From 07dac13fe9fe6fd54d7c2f6fa143cb38b03af5cb Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 03:11:49 +0000 Subject: [PATCH 1/3] routeros: translate initial-setup.rsc to Russian, add ROS6 package disable - Add usage note (item 4) clarifying that the "drop all other" filter rules intentionally use action=passthrough and must be switched to action=drop after verification. - Translate all documentation and config comments to Russian. - Disable unused RouterOS 6 packages (hotspot, ipv6, mpls); this replaces the ROS7-only /ipv6 settings disable-ipv6 block for IPv6. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UXAWR3BJ7yjfpE7STGCtvT --- routeros/initial-setup.rsc | 133 ++++++++++++++++++++----------------- 1 file changed, 72 insertions(+), 61 deletions(-) diff --git a/routeros/initial-setup.rsc b/routeros/initial-setup.rsc index 796fa81..3cf0000 100644 --- a/routeros/initial-setup.rsc +++ b/routeros/initial-setup.rsc @@ -1,40 +1,45 @@ -# RouterOS initial setup script -# Based on routeros/autorun.scr, extended with interface lists and firewall rules. +# Скрипт первичной настройки RouterOS +# На основе routeros/autorun.scr, расширен списками интерфейсов и правилами firewall. # -# Usage: -# 1. Review and adjust the placeholders marked CHANGE_ME / <...> below. -# 2. Assign real interfaces to the LAN / WAN / StS / VPN lists in the -# "/interface list member" section. -# 3. Upload to the router and run: /import file-name=initial-setup.rsc +# Использование: +# 1. Просмотрите и поправьте плейсхолдеры CHANGE_ME / <...> ниже. +# 2. Назначьте реальные интерфейсы спискам LAN / WAN / StS / VPN в +# секции "/interface list member". +# 3. Загрузите на роутер и выполните: /import file-name=initial-setup.rsc +# 4. Правила firewall "отбрасывать всё остальное" намеренно используют +# action=passthrough: на этапе первичной настройки трафик НЕ отбрасывается, +# а только логируется — чтобы не потерять доступ к роутеру. После проверки +# логов и уверенности, что вы себя не заблокируете, смените эти правила +# (в цепочках input и forward) на action=drop. # -# Notes: -# StS = Site-to-Site tunnels, VPN = remote-access VPN clients. -# Port knocking sequence: 1234 -> 2345 -> 3456, then connect to 12345. +# Примечания: +# StS = туннели site-to-site, VPN = удалённые VPN-клиенты. +# Последовательность port knocking: 1234 -> 2345 -> 3456, затем подключение к 12345. -# Per-provider settings (addresses, routes, dhcp-client, user passwords) -# are intentionally NOT included here — configure them separately for each -# uplink / deployment. +# Настройки, зависящие от провайдера (адреса, маршруты, dhcp-клиент, пароли +# пользователей) намеренно НЕ включены — настраивайте их отдельно для каждого +# аплинка / развёртывания. # --------------------------------------------------------------------------- -# Bridge +# Мост (bridge) # --------------------------------------------------------------------------- /interface bridge -add name=bridge comment="Local bridge" -# Ports are intentionally not bound here — add them per deployment, e.g.: +add name=bridge comment="Локальный мост" +# Порты намеренно не привязаны здесь — добавляйте их под каждое развёртывание, напр.: # /interface bridge port # add bridge=bridge interface=ether2 # --------------------------------------------------------------------------- -# Interface lists +# Списки интерфейсов # --------------------------------------------------------------------------- /interface list -add name=WAN comment="Uplinks / Internet-facing interfaces" -add name=LAN comment="Local trusted networks" -add name=StS comment="Site-to-Site tunnels" -add name=VPN comment="Remote-access VPN clients" +add name=WAN comment="Аплинки / интерфейсы, смотрящие в интернет" +add name=LAN comment="Локальные доверенные сети" +add name=StS comment="Туннели site-to-site" +add name=VPN comment="Удалённые VPN-клиенты" /interface list member -# Assign your real interfaces here, examples below: +# Назначьте здесь свои реальные интерфейсы, примеры ниже: add list=WAN interface=ether1 add list=LAN interface=bridge # add list=StS interface= @@ -44,22 +49,22 @@ add list=LAN interface=bridge # Firewall filter # --------------------------------------------------------------------------- /ip firewall filter -add action=accept chain=input comment="accept established, related connections" connection-state=established,related -add action=drop chain=input comment="drop invalid connections" connection-state=invalid log-prefix="DROP INPUT INVALID:" -add action=jump chain=input comment="jump for icmp input flow" jump-target=icmp protocol=icmp -add action=jump chain=input comment="detect intrusion" connection-state=new jump-target=detect-intrusion src-address-list=!management +add action=accept chain=input comment="принимать established/related соединения" connection-state=established,related +add action=drop chain=input comment="отбрасывать invalid соединения" connection-state=invalid log-prefix="DROP INPUT INVALID:" +add action=jump chain=input comment="переход в цепочку icmp для входящих" jump-target=icmp protocol=icmp +add action=jump chain=input comment="обнаружение вторжений" connection-state=new jump-target=detect-intrusion src-address-list=!management add action=jump chain=input comment="port knocking" connection-state=new dst-port=1234,2345,3456 in-interface-list=WAN jump-target=pk log=yes protocol=tcp add action=drop chain=input dst-port=12345 in-interface-list=WAN protocol=tcp src-address-list=!pk-1 add action=drop chain=input dst-port=12345 in-interface-list=WAN protocol=tcp src-address-list=!pk-2 add action=add-src-to-address-list address-list=management address-list-timeout=1d chain=input connection-state=new dst-port=12345 in-interface-list=WAN log=yes log-prefix=ACCESS! protocol=tcp src-address-list=pk-3 -add action=accept chain=input comment="accept management" connection-state=new dst-port=22,8291,8729 log=yes log-prefix=ACCESS! protocol=tcp src-address-list=management -add action=accept chain=input comment="accept LAN" in-interface-list=LAN -add action=accept chain=input comment="accept StS" in-interface-list=StS -add action=accept chain=input comment="accept VPN" in-interface-list=VPN -add action=passthrough chain=input comment="drop all other" log-prefix="IN DROP" -add action=accept chain=forward comment="accept established, related connections" connection-state=established,related -add action=drop chain=forward comment="drop invalid connections" connection-state=invalid log-prefix="INV FWD" -add action=accept chain=forward comment="accept DST-NAT" connection-nat-state=dstnat +add action=accept chain=input comment="принимать управляющий доступ" connection-state=new dst-port=22,8291,8729 log=yes log-prefix=ACCESS! protocol=tcp src-address-list=management +add action=accept chain=input comment="принимать LAN" in-interface-list=LAN +add action=accept chain=input comment="принимать StS" in-interface-list=StS +add action=accept chain=input comment="принимать VPN" in-interface-list=VPN +add action=passthrough chain=input comment="отбрасывать всё остальное (см. п.4 шапки: passthrough)" log-prefix="IN DROP" +add action=accept chain=forward comment="принимать established/related соединения" connection-state=established,related +add action=drop chain=forward comment="отбрасывать invalid соединения" connection-state=invalid log-prefix="INV FWD" +add action=accept chain=forward comment="принимать DST-NAT" connection-nat-state=dstnat add action=drop chain=forward comment="WAN -X" in-interface-list=WAN log-prefix=FWD add action=jump chain=forward comment=ICMP jump-target=icmp protocol=icmp add action=accept chain=forward comment="LAN -> WAN" in-interface-list=LAN out-interface-list=WAN @@ -67,17 +72,17 @@ add action=accept chain=forward comment="LAN -> StS" in-interface-list=LAN out-i add action=accept chain=forward comment="LAN -> VPN" in-interface-list=LAN out-interface-list=VPN add action=accept chain=forward comment="StS -> LAN" in-interface-list=StS out-interface-list=LAN add action=accept chain=forward comment="VPN -> LAN" in-interface-list=VPN out-interface-list=LAN -add action=passthrough chain=forward comment="drop all other" log-prefix=FWD -add action=accept chain=icmp comment="echo request" icmp-options=8:0 protocol=icmp -add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp -add action=accept chain=icmp comment="net unreachable" icmp-options=3:3 protocol=icmp -add action=accept chain=icmp comment="host unreachable fragmentation required" icmp-options=3:4 protocol=icmp -add action=accept chain=icmp comment="time exceed" icmp-options=11:0 protocol=icmp -add action=drop chain=icmp comment="drop all other types" +add action=passthrough chain=forward comment="отбрасывать всё остальное (см. п.4 шапки: passthrough)" log-prefix=FWD +add action=accept chain=icmp comment="эхо-запрос" icmp-options=8:0 protocol=icmp +add action=accept chain=icmp comment="эхо-ответ" icmp-options=0:0 protocol=icmp +add action=accept chain=icmp comment="сеть недоступна" icmp-options=3:3 protocol=icmp +add action=accept chain=icmp comment="хост недоступен / требуется фрагментация" icmp-options=3:4 protocol=icmp +add action=accept chain=icmp comment="превышение времени (time exceeded)" icmp-options=11:0 protocol=icmp +add action=drop chain=icmp comment="отбрасывать все прочие типы" add action=add-src-to-address-list address-list=pk-1 address-list-timeout=1m chain=pk comment=port-knocking dst-port=1234 protocol=tcp add action=add-src-to-address-list address-list=pk-2 address-list-timeout=1m chain=pk connection-state="" dst-port=2345 protocol=tcp add action=add-src-to-address-list address-list=pk-3 address-list-timeout=1m chain=pk connection-state="" dst-port=3456 protocol=tcp -add action=return chain=detect-intrusion comment="detect intrusion" dst-limit=30,256,src-and-dst-addresses/1s +add action=return chain=detect-intrusion comment="обнаружение вторжений" dst-limit=30,256,src-and-dst-addresses/1s add action=add-src-to-address-list address-list="black-list attackers" address-list-timeout=1d chain=detect-intrusion add action=drop chain=detect-intrusion src-address-list="black-list attackers" @@ -88,15 +93,15 @@ add action=drop chain=detect-intrusion src-address-list="black-list attackers" add action=masquerade chain=srcnat comment="LAN -> Internet" out-interface-list=WAN # --------------------------------------------------------------------------- -# DNS — resolver for LAN / VPN / StS clients +# DNS — резолвер для клиентов LAN / VPN / StS # --------------------------------------------------------------------------- /ip dns set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8 -# DNS queries are accepted from LAN / VPN / StS by the input chain rules above -# and dropped from WAN by default. +# DNS-запросы принимаются от LAN / VPN / StS правилами цепочки input выше +# и по умолчанию отбрасываются со стороны WAN. # --------------------------------------------------------------------------- -# Service / management hardening +# Сервисы / усиление безопасности управления # --------------------------------------------------------------------------- /ip service set telnet disabled=yes @@ -106,24 +111,30 @@ set api disabled=yes set api-ssl disabled=yes /ip neighbor discovery-settings set discover-interface-list=LAN -# MAC-server is left enabled on all interfaces so the router stays reachable -# via MAC-telnet / MAC-winbox during initial setup from any port, before it has -# an IP address. NOTE: this also exposes MAC access on WAN — restrict to a -# management interface list once setup is complete. +# MAC-server оставлен включённым на всех интерфейсах, чтобы роутер оставался +# доступен по MAC-telnet / MAC-winbox во время первичной настройки с любого +# порта, пока у него ещё нет IP-адреса. ВНИМАНИЕ: это также открывает MAC-доступ +# на WAN — после завершения настройки ограничьте его управляющим списком интерфейсов. /tool mac-server set allowed-interface-list=all /tool mac-server mac-winbox set allowed-interface-list=all /tool mac-server ping set enabled=yes -# Disable the bandwidth-test server (open by default, common attack vector). +# Отключаем сервер bandwidth-test (по умолчанию открыт, частый вектор атаки). /tool bandwidth-server set enabled=no -/ipv6 settings -set disable-ipv6=yes # --------------------------------------------------------------------------- -# Time / NTP +# Отключение неиспользуемых пакетов (только RouterOS 6) +# Отключает пакеты hotspot, ipv6 и mpls. Изменения применяются после +# перезагрузки роутера. Отключение пакета ipv6 — это способ полностью +# выключить IPv6 в RouterOS 6 (заменяет "/ipv6 settings set disable-ipv6=yes"). +# --------------------------------------------------------------------------- +/system package disable hotspot,ipv6,mpls + +# --------------------------------------------------------------------------- +# Время / NTP # --------------------------------------------------------------------------- /system clock set time-zone-name=Asia/Yekaterinburg @@ -132,26 +143,26 @@ set enabled=yes /system ntp client servers add address=pool.ntp.org -# Act as an NTP server for downstream clients. +# Работать как NTP-сервер для нижестоящих клиентов. /system ntp server set enabled=yes # --------------------------------------------------------------------------- -# Logging — suppress info-level messages for DHCP and Wireless +# Логирование — подавить info-сообщения для DHCP и беспроводной сети # --------------------------------------------------------------------------- /system logging set [find where topics="info"] topics=info,!dhcp,!wireless,!wifi # --------------------------------------------------------------------------- -# RouterOS package update channel — use the long-term (stable) release branch +# Канал обновления пакетов RouterOS — использовать ветку long-term (стабильную) # --------------------------------------------------------------------------- /system package update set channel=long-term # --------------------------------------------------------------------------- -# RouterBOARD firmware auto-upgrade -# Upgrades the RouterBOARD firmware on startup when a newer one is available, -# then reboots to apply it. +# Авто-обновление прошивки RouterBOARD +# Обновляет прошивку RouterBOARD при старте, если доступна более новая, +# затем перезагружается для её применения. # --------------------------------------------------------------------------- /system scheduler add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=startup \ @@ -162,7 +173,7 @@ add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=sta \n}" # --------------------------------------------------------------------------- -# OSPF routing filters — accept only local (RFC1918) prefixes in/out +# Фильтры маршрутизации OSPF — принимать только локальные (RFC1918) префиксы вх/исх # --------------------------------------------------------------------------- /routing filter rule add chain=ospf-in disabled=no rule="if (dst in 192.168.0.0/16 && dst-len in 16-32) {accept;}" From 1655cdd785b786a5edbb08b8ae242366fd2ec907 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 03:16:19 +0000 Subject: [PATCH 2/3] routeros: split initial-setup into ROS6 and ROS7 variants (English comments) - Replace initial-setup.rsc with initial-setup-ros6.rsc and initial-setup-ros7.rsc; restore English comments. - ROS7 variant: NTP servers as a client property, /ipv6 settings disable, routing-filter rule="if(...)" syntax, wifi logging topic. - ROS6 variant: NTP server-dns-names, IPv6 off via /system package disable (hotspot, ipv6, mpls), /routing filter prefix syntax, wireless logging topic. - Both keep the action=passthrough "drop all other" rules with usage note 4 explaining they must be switched to action=drop after verification. - Update README table for the two variants. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UXAWR3BJ7yjfpE7STGCtvT --- routeros/README.md | 3 +- routeros/initial-setup-ros6.rsc | 191 ++++++++++++++++++++++++++++++++ routeros/initial-setup-ros7.rsc | 184 ++++++++++++++++++++++++++++++ routeros/initial-setup.rsc | 184 ------------------------------ 4 files changed, 377 insertions(+), 185 deletions(-) create mode 100644 routeros/initial-setup-ros6.rsc create mode 100644 routeros/initial-setup-ros7.rsc delete mode 100644 routeros/initial-setup.rsc diff --git a/routeros/README.md b/routeros/README.md index 2f0e5b5..cc33cb4 100644 --- a/routeros/README.md +++ b/routeros/README.md @@ -5,7 +5,8 @@ | Файл | Назначение | |---|---| | `autorun.rsc` | Шаблон первичной настройки роутера: адресация, отключение небезопасных сервисов (telnet, ftp, api и т.д.), NTP, часовой пояс. Замените `CHANGE_ME` на свои значения. | -| `initial-setup.rsc` | Расширенный шаблон настройки: bridge, interface-lists (WAN/LAN/StS/VPN), полный firewall (port knocking, anti-bruteforce, ICMP), NAT, DNS, харднинг сервисов, OSPF-фильтры, автообновление прошивки. | +| `initial-setup-ros7.rsc` | Расширенный шаблон настройки для **RouterOS 7**: bridge, interface-lists (WAN/LAN/StS/VPN), полный firewall (port knocking, anti-bruteforce, ICMP), NAT, DNS, харднинг сервисов, OSPF-фильтры, автообновление прошивки. | +| `initial-setup-ros6.rsc` | То же для **RouterOS 6** (6.41+): отличается синтаксисом NTP-клиента, отключением IPv6 через `/system package disable`, ROS6-фильтрами маршрутов и топиками логирования. | | `check-isp.rsc` | Проверка доступности двух провайдеров пингом и сброс соединений упавшего канала (для dual-WAN). | | `rdp-bruteforce.rsc` | Защита от перебора RDP (TCP/3389): ступенчатое (`rdp_stage1`…`rdp_stage5`) добавление источников в `black-list attackers` с баном на 4w2d и правилом `drop` в filter. Списки `RDP` (доверенные клиенты) и `management` заполняются вручную; `192.168.0.0/16` не банится. | | `cloudflare-ip-updater.rsc` | Обновление address-list `CF` актуальными IPv4-подсетями Cloudflare (по расписанию). | diff --git a/routeros/initial-setup-ros6.rsc b/routeros/initial-setup-ros6.rsc new file mode 100644 index 0000000..625f00d --- /dev/null +++ b/routeros/initial-setup-ros6.rsc @@ -0,0 +1,191 @@ +# RouterOS 6 initial setup script +# Based on routeros/autorun.scr, extended with interface lists and firewall rules. +# For RouterOS 7 use initial-setup-ros7.rsc instead (different NTP / IPv6 / +# routing-filter / logging syntax). +# +# Usage: +# 1. Review and adjust the placeholders marked CHANGE_ME / <...> below. +# 2. Assign real interfaces to the LAN / WAN / StS / VPN lists in the +# "/interface list member" section. +# 3. Upload to the router and run: /import file-name=initial-setup-ros6.rsc +# 4. The "drop all other" filter rules intentionally use action=passthrough: +# during initial setup nothing is actually dropped, only logged, so you +# cannot lock yourself out. After reviewing the logs and confirming you +# will not be locked out, switch these rules (in the input and forward +# chains) to action=drop. +# +# Notes: +# StS = Site-to-Site tunnels, VPN = remote-access VPN clients. +# Port knocking sequence: 1234 -> 2345 -> 3456, then connect to 12345. +# Requires RouterOS 6.41+ (interface lists / in-interface-list). + +# Per-provider settings (addresses, routes, dhcp-client, user passwords) +# are intentionally NOT included here — configure them separately for each +# uplink / deployment. + +# --------------------------------------------------------------------------- +# Bridge +# --------------------------------------------------------------------------- +/interface bridge +add name=bridge comment="Local bridge" +# Ports are intentionally not bound here — add them per deployment, e.g.: +# /interface bridge port +# add bridge=bridge interface=ether2 + +# --------------------------------------------------------------------------- +# Interface lists +# --------------------------------------------------------------------------- +/interface list +add name=WAN comment="Uplinks / Internet-facing interfaces" +add name=LAN comment="Local trusted networks" +add name=StS comment="Site-to-Site tunnels" +add name=VPN comment="Remote-access VPN clients" + +/interface list member +# Assign your real interfaces here, examples below: +add list=WAN interface=ether1 +add list=LAN interface=bridge +# add list=StS interface= +# add list=VPN interface= + +# --------------------------------------------------------------------------- +# Firewall filter +# --------------------------------------------------------------------------- +/ip firewall filter +add action=accept chain=input comment="accept established, related connections" connection-state=established,related +add action=drop chain=input comment="drop invalid connections" connection-state=invalid log-prefix="DROP INPUT INVALID:" +add action=jump chain=input comment="jump for icmp input flow" jump-target=icmp protocol=icmp +add action=jump chain=input comment="detect intrusion" connection-state=new jump-target=detect-intrusion src-address-list=!management +add action=jump chain=input comment="port knocking" connection-state=new dst-port=1234,2345,3456 in-interface-list=WAN jump-target=pk log=yes protocol=tcp +add action=drop chain=input dst-port=12345 in-interface-list=WAN protocol=tcp src-address-list=!pk-1 +add action=drop chain=input dst-port=12345 in-interface-list=WAN protocol=tcp src-address-list=!pk-2 +add action=add-src-to-address-list address-list=management address-list-timeout=1d chain=input connection-state=new dst-port=12345 in-interface-list=WAN log=yes log-prefix=ACCESS! protocol=tcp src-address-list=pk-3 +add action=accept chain=input comment="accept management" connection-state=new dst-port=22,8291,8729 log=yes log-prefix=ACCESS! protocol=tcp src-address-list=management +add action=accept chain=input comment="accept LAN" in-interface-list=LAN +add action=accept chain=input comment="accept StS" in-interface-list=StS +add action=accept chain=input comment="accept VPN" in-interface-list=VPN +add action=passthrough chain=input comment="drop all other (see usage note 4: passthrough)" log-prefix="IN DROP" +add action=accept chain=forward comment="accept established, related connections" connection-state=established,related +add action=drop chain=forward comment="drop invalid connections" connection-state=invalid log-prefix="INV FWD" +add action=accept chain=forward comment="accept DST-NAT" connection-nat-state=dstnat +add action=drop chain=forward comment="WAN -X" in-interface-list=WAN log-prefix=FWD +add action=jump chain=forward comment=ICMP jump-target=icmp protocol=icmp +add action=accept chain=forward comment="LAN -> WAN" in-interface-list=LAN out-interface-list=WAN +add action=accept chain=forward comment="LAN -> StS" in-interface-list=LAN out-interface-list=StS +add action=accept chain=forward comment="LAN -> VPN" in-interface-list=LAN out-interface-list=VPN +add action=accept chain=forward comment="StS -> LAN" in-interface-list=StS out-interface-list=LAN +add action=accept chain=forward comment="VPN -> LAN" in-interface-list=VPN out-interface-list=LAN +add action=passthrough chain=forward comment="drop all other (see usage note 4: passthrough)" log-prefix=FWD +add action=accept chain=icmp comment="echo request" icmp-options=8:0 protocol=icmp +add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp +add action=accept chain=icmp comment="net unreachable" icmp-options=3:3 protocol=icmp +add action=accept chain=icmp comment="host unreachable fragmentation required" icmp-options=3:4 protocol=icmp +add action=accept chain=icmp comment="time exceed" icmp-options=11:0 protocol=icmp +add action=drop chain=icmp comment="drop all other types" +add action=add-src-to-address-list address-list=pk-1 address-list-timeout=1m chain=pk comment=port-knocking dst-port=1234 protocol=tcp +add action=add-src-to-address-list address-list=pk-2 address-list-timeout=1m chain=pk connection-state="" dst-port=2345 protocol=tcp +add action=add-src-to-address-list address-list=pk-3 address-list-timeout=1m chain=pk connection-state="" dst-port=3456 protocol=tcp +add action=return chain=detect-intrusion comment="detect intrusion" dst-limit=30,256,src-and-dst-addresses/1s +add action=add-src-to-address-list address-list="black-list attackers" address-list-timeout=1d chain=detect-intrusion +add action=drop chain=detect-intrusion src-address-list="black-list attackers" + +# --------------------------------------------------------------------------- +# Firewall NAT +# --------------------------------------------------------------------------- +/ip firewall nat +add action=masquerade chain=srcnat comment="LAN -> Internet" out-interface-list=WAN + +# --------------------------------------------------------------------------- +# DNS — resolver for LAN / VPN / StS clients +# --------------------------------------------------------------------------- +/ip dns +set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8 +# DNS queries are accepted from LAN / VPN / StS by the input chain rules above +# and dropped from WAN by default. + +# --------------------------------------------------------------------------- +# Service / management hardening +# --------------------------------------------------------------------------- +/ip service +set telnet disabled=yes +set ftp disabled=yes +set www disabled=yes +set api disabled=yes +set api-ssl disabled=yes +/ip neighbor discovery-settings +set discover-interface-list=LAN +# MAC-server is left enabled on all interfaces so the router stays reachable +# via MAC-telnet / MAC-winbox during initial setup from any port, before it has +# an IP address. NOTE: this also exposes MAC access on WAN — restrict to a +# management interface list once setup is complete. +/tool mac-server +set allowed-interface-list=all +/tool mac-server mac-winbox +set allowed-interface-list=all +/tool mac-server ping +set enabled=yes +# Disable the bandwidth-test server (open by default, common attack vector). +/tool bandwidth-server +set enabled=no + +# --------------------------------------------------------------------------- +# Disable unused packages (RouterOS 6 only) +# Turns off the hotspot, ipv6 and mpls packages. Takes effect after a reboot. +# Disabling the ipv6 package is how IPv6 is fully turned off on RouterOS 6 +# (there is no monolithic-package "/ipv6 settings set disable-ipv6" toggle). +# --------------------------------------------------------------------------- +/system package disable hotspot,ipv6,mpls + +# --------------------------------------------------------------------------- +# Time / NTP +# --------------------------------------------------------------------------- +/system clock +set time-zone-name=Asia/Yekaterinburg +# RouterOS 6: NTP client uses server-dns-names / primary-ntp (no "servers"). +/system ntp client +set enabled=yes server-dns-names=pool.ntp.org + +# Act as an NTP server for downstream clients. +# NOTE: on RouterOS 6 the NTP server lives in the separate "ntp" package — +# this block only works if that package is installed. +/system ntp server +set enabled=yes + +# --------------------------------------------------------------------------- +# Logging — suppress info-level messages for DHCP and Wireless +# --------------------------------------------------------------------------- +# RouterOS 6 has no "wifi" topic; use "wireless". If this device has no +# wireless package at all, drop !wireless and keep only info,!dhcp. +/system logging +set [find where topics="info"] topics=info,!dhcp,!wireless + +# --------------------------------------------------------------------------- +# RouterOS package update channel — use the long-term (stable) release branch +# --------------------------------------------------------------------------- +/system package update +set channel=long-term + +# --------------------------------------------------------------------------- +# RouterBOARD firmware auto-upgrade +# Upgrades the RouterBOARD firmware on startup when a newer one is available, +# then reboots to apply it. +# --------------------------------------------------------------------------- +/system scheduler +add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=startup \ + on-event="if ([/system routerboard get current-firmware] != [/system routerboard get upgrade-firmware]) do={\r\ + \n/system routerboard upgrade\r\ + \n:delay 15s\r\ + \n/system reboot\r\ + \n}" + +# --------------------------------------------------------------------------- +# OSPF routing filters — accept only local (RFC1918) prefixes in/out +# RouterOS 6 routing-filter syntax (prefix / prefix-length / action). +# --------------------------------------------------------------------------- +/routing filter +add chain=ospf-in prefix=192.168.0.0/16 prefix-length=16-32 action=accept +add chain=ospf-in prefix=10.0.0.0/8 prefix-length=8-32 action=accept +add chain=ospf-in prefix=172.16.0.0/12 prefix-length=12-32 action=accept +add chain=ospf-out prefix=192.168.0.0/16 prefix-length=16-32 action=accept +add chain=ospf-out prefix=10.0.0.0/8 prefix-length=8-32 action=accept +add chain=ospf-out prefix=172.16.0.0/12 prefix-length=12-32 action=accept diff --git a/routeros/initial-setup-ros7.rsc b/routeros/initial-setup-ros7.rsc new file mode 100644 index 0000000..bf0cb65 --- /dev/null +++ b/routeros/initial-setup-ros7.rsc @@ -0,0 +1,184 @@ +# RouterOS 7 initial setup script +# Based on routeros/autorun.scr, extended with interface lists and firewall rules. +# For RouterOS 6 use initial-setup-ros6.rsc instead (different NTP / IPv6 / +# routing-filter / logging syntax). +# +# Usage: +# 1. Review and adjust the placeholders marked CHANGE_ME / <...> below. +# 2. Assign real interfaces to the LAN / WAN / StS / VPN lists in the +# "/interface list member" section. +# 3. Upload to the router and run: /import file-name=initial-setup-ros7.rsc +# 4. The "drop all other" filter rules intentionally use action=passthrough: +# during initial setup nothing is actually dropped, only logged, so you +# cannot lock yourself out. After reviewing the logs and confirming you +# will not be locked out, switch these rules (in the input and forward +# chains) to action=drop. +# +# Notes: +# StS = Site-to-Site tunnels, VPN = remote-access VPN clients. +# Port knocking sequence: 1234 -> 2345 -> 3456, then connect to 12345. + +# Per-provider settings (addresses, routes, dhcp-client, user passwords) +# are intentionally NOT included here — configure them separately for each +# uplink / deployment. + +# --------------------------------------------------------------------------- +# Bridge +# --------------------------------------------------------------------------- +/interface bridge +add name=bridge comment="Local bridge" +# Ports are intentionally not bound here — add them per deployment, e.g.: +# /interface bridge port +# add bridge=bridge interface=ether2 + +# --------------------------------------------------------------------------- +# Interface lists +# --------------------------------------------------------------------------- +/interface list +add name=WAN comment="Uplinks / Internet-facing interfaces" +add name=LAN comment="Local trusted networks" +add name=StS comment="Site-to-Site tunnels" +add name=VPN comment="Remote-access VPN clients" + +/interface list member +# Assign your real interfaces here, examples below: +add list=WAN interface=ether1 +add list=LAN interface=bridge +# add list=StS interface= +# add list=VPN interface= + +# --------------------------------------------------------------------------- +# Firewall filter +# --------------------------------------------------------------------------- +/ip firewall filter +add action=accept chain=input comment="accept established, related connections" connection-state=established,related +add action=drop chain=input comment="drop invalid connections" connection-state=invalid log-prefix="DROP INPUT INVALID:" +add action=jump chain=input comment="jump for icmp input flow" jump-target=icmp protocol=icmp +add action=jump chain=input comment="detect intrusion" connection-state=new jump-target=detect-intrusion src-address-list=!management +add action=jump chain=input comment="port knocking" connection-state=new dst-port=1234,2345,3456 in-interface-list=WAN jump-target=pk log=yes protocol=tcp +add action=drop chain=input dst-port=12345 in-interface-list=WAN protocol=tcp src-address-list=!pk-1 +add action=drop chain=input dst-port=12345 in-interface-list=WAN protocol=tcp src-address-list=!pk-2 +add action=add-src-to-address-list address-list=management address-list-timeout=1d chain=input connection-state=new dst-port=12345 in-interface-list=WAN log=yes log-prefix=ACCESS! protocol=tcp src-address-list=pk-3 +add action=accept chain=input comment="accept management" connection-state=new dst-port=22,8291,8729 log=yes log-prefix=ACCESS! protocol=tcp src-address-list=management +add action=accept chain=input comment="accept LAN" in-interface-list=LAN +add action=accept chain=input comment="accept StS" in-interface-list=StS +add action=accept chain=input comment="accept VPN" in-interface-list=VPN +add action=passthrough chain=input comment="drop all other (see usage note 4: passthrough)" log-prefix="IN DROP" +add action=accept chain=forward comment="accept established, related connections" connection-state=established,related +add action=drop chain=forward comment="drop invalid connections" connection-state=invalid log-prefix="INV FWD" +add action=accept chain=forward comment="accept DST-NAT" connection-nat-state=dstnat +add action=drop chain=forward comment="WAN -X" in-interface-list=WAN log-prefix=FWD +add action=jump chain=forward comment=ICMP jump-target=icmp protocol=icmp +add action=accept chain=forward comment="LAN -> WAN" in-interface-list=LAN out-interface-list=WAN +add action=accept chain=forward comment="LAN -> StS" in-interface-list=LAN out-interface-list=StS +add action=accept chain=forward comment="LAN -> VPN" in-interface-list=LAN out-interface-list=VPN +add action=accept chain=forward comment="StS -> LAN" in-interface-list=StS out-interface-list=LAN +add action=accept chain=forward comment="VPN -> LAN" in-interface-list=VPN out-interface-list=LAN +add action=passthrough chain=forward comment="drop all other (see usage note 4: passthrough)" log-prefix=FWD +add action=accept chain=icmp comment="echo request" icmp-options=8:0 protocol=icmp +add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp +add action=accept chain=icmp comment="net unreachable" icmp-options=3:3 protocol=icmp +add action=accept chain=icmp comment="host unreachable fragmentation required" icmp-options=3:4 protocol=icmp +add action=accept chain=icmp comment="time exceed" icmp-options=11:0 protocol=icmp +add action=drop chain=icmp comment="drop all other types" +add action=add-src-to-address-list address-list=pk-1 address-list-timeout=1m chain=pk comment=port-knocking dst-port=1234 protocol=tcp +add action=add-src-to-address-list address-list=pk-2 address-list-timeout=1m chain=pk connection-state="" dst-port=2345 protocol=tcp +add action=add-src-to-address-list address-list=pk-3 address-list-timeout=1m chain=pk connection-state="" dst-port=3456 protocol=tcp +add action=return chain=detect-intrusion comment="detect intrusion" dst-limit=30,256,src-and-dst-addresses/1s +add action=add-src-to-address-list address-list="black-list attackers" address-list-timeout=1d chain=detect-intrusion +add action=drop chain=detect-intrusion src-address-list="black-list attackers" + +# --------------------------------------------------------------------------- +# Firewall NAT +# --------------------------------------------------------------------------- +/ip firewall nat +add action=masquerade chain=srcnat comment="LAN -> Internet" out-interface-list=WAN + +# --------------------------------------------------------------------------- +# DNS — resolver for LAN / VPN / StS clients +# --------------------------------------------------------------------------- +/ip dns +set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8 +# DNS queries are accepted from LAN / VPN / StS by the input chain rules above +# and dropped from WAN by default. + +# --------------------------------------------------------------------------- +# Service / management hardening +# --------------------------------------------------------------------------- +/ip service +set telnet disabled=yes +set ftp disabled=yes +set www disabled=yes +set api disabled=yes +set api-ssl disabled=yes +/ip neighbor discovery-settings +set discover-interface-list=LAN +# MAC-server is left enabled on all interfaces so the router stays reachable +# via MAC-telnet / MAC-winbox during initial setup from any port, before it has +# an IP address. NOTE: this also exposes MAC access on WAN — restrict to a +# management interface list once setup is complete. +/tool mac-server +set allowed-interface-list=all +/tool mac-server mac-winbox +set allowed-interface-list=all +/tool mac-server ping +set enabled=yes +# Disable the bandwidth-test server (open by default, common attack vector). +/tool bandwidth-server +set enabled=no +# Disable IPv6 entirely (RouterOS 7 keeps IPv6 in the monolithic package, +# so it is turned off via a setting rather than by removing a package). +/ipv6 settings +set disable-ipv6=yes + +# --------------------------------------------------------------------------- +# Time / NTP +# --------------------------------------------------------------------------- +/system clock +set time-zone-name=Asia/Yekaterinburg +# RouterOS 7: NTP servers are a property of the client (no "servers" submenu). +/system ntp client +set enabled=yes servers=pool.ntp.org + +# Act as an NTP server for downstream clients. +/system ntp server +set enabled=yes + +# --------------------------------------------------------------------------- +# Logging — suppress info-level messages for DHCP and Wireless +# --------------------------------------------------------------------------- +# RouterOS 7 with the wifi (wifiwave2) driver uses the "wifi" topic. If this +# device runs the legacy wireless package instead, replace !wifi with !wireless. +/system logging +set [find where topics="info"] topics=info,!dhcp,!wifi + +# --------------------------------------------------------------------------- +# RouterOS package update channel — use the long-term (stable) release branch +# --------------------------------------------------------------------------- +/system package update +set channel=long-term + +# --------------------------------------------------------------------------- +# RouterBOARD firmware auto-upgrade +# Upgrades the RouterBOARD firmware on startup when a newer one is available, +# then reboots to apply it. +# --------------------------------------------------------------------------- +/system scheduler +add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=startup \ + on-event="if ([/system routerboard get current-firmware] != [/system routerboard get upgrade-firmware]) do={\r\ + \n/system routerboard upgrade\r\ + \n:delay 15s\r\ + \n/system reboot\r\ + \n}" + +# --------------------------------------------------------------------------- +# OSPF routing filters — accept only local (RFC1918) prefixes in/out +# RouterOS 7 routing-filter syntax (rule="if (...) {accept;}"). +# --------------------------------------------------------------------------- +/routing filter rule +add chain=ospf-in disabled=no rule="if (dst in 192.168.0.0/16 && dst-len in 16-32) {accept;}" +add chain=ospf-in disabled=no rule="if (dst in 10.0.0.0/8 && dst-len in 8-32) {accept;}" +add chain=ospf-in disabled=no rule="if (dst in 172.16.0.0/12 && dst-len in 12-32) {accept;}" +add chain=ospf-out disabled=no rule="if (dst in 192.168.0.0/16 && dst-len in 16-32) {accept;}" +add chain=ospf-out disabled=no rule="if (dst in 10.0.0.0/8 && dst-len in 8-32) {accept;}" +add chain=ospf-out disabled=no rule="if (dst in 172.16.0.0/12 && dst-len in 12-32) {accept;}" diff --git a/routeros/initial-setup.rsc b/routeros/initial-setup.rsc deleted file mode 100644 index 3cf0000..0000000 --- a/routeros/initial-setup.rsc +++ /dev/null @@ -1,184 +0,0 @@ -# Скрипт первичной настройки RouterOS -# На основе routeros/autorun.scr, расширен списками интерфейсов и правилами firewall. -# -# Использование: -# 1. Просмотрите и поправьте плейсхолдеры CHANGE_ME / <...> ниже. -# 2. Назначьте реальные интерфейсы спискам LAN / WAN / StS / VPN в -# секции "/interface list member". -# 3. Загрузите на роутер и выполните: /import file-name=initial-setup.rsc -# 4. Правила firewall "отбрасывать всё остальное" намеренно используют -# action=passthrough: на этапе первичной настройки трафик НЕ отбрасывается, -# а только логируется — чтобы не потерять доступ к роутеру. После проверки -# логов и уверенности, что вы себя не заблокируете, смените эти правила -# (в цепочках input и forward) на action=drop. -# -# Примечания: -# StS = туннели site-to-site, VPN = удалённые VPN-клиенты. -# Последовательность port knocking: 1234 -> 2345 -> 3456, затем подключение к 12345. - -# Настройки, зависящие от провайдера (адреса, маршруты, dhcp-клиент, пароли -# пользователей) намеренно НЕ включены — настраивайте их отдельно для каждого -# аплинка / развёртывания. - -# --------------------------------------------------------------------------- -# Мост (bridge) -# --------------------------------------------------------------------------- -/interface bridge -add name=bridge comment="Локальный мост" -# Порты намеренно не привязаны здесь — добавляйте их под каждое развёртывание, напр.: -# /interface bridge port -# add bridge=bridge interface=ether2 - -# --------------------------------------------------------------------------- -# Списки интерфейсов -# --------------------------------------------------------------------------- -/interface list -add name=WAN comment="Аплинки / интерфейсы, смотрящие в интернет" -add name=LAN comment="Локальные доверенные сети" -add name=StS comment="Туннели site-to-site" -add name=VPN comment="Удалённые VPN-клиенты" - -/interface list member -# Назначьте здесь свои реальные интерфейсы, примеры ниже: -add list=WAN interface=ether1 -add list=LAN interface=bridge -# add list=StS interface= -# add list=VPN interface= - -# --------------------------------------------------------------------------- -# Firewall filter -# --------------------------------------------------------------------------- -/ip firewall filter -add action=accept chain=input comment="принимать established/related соединения" connection-state=established,related -add action=drop chain=input comment="отбрасывать invalid соединения" connection-state=invalid log-prefix="DROP INPUT INVALID:" -add action=jump chain=input comment="переход в цепочку icmp для входящих" jump-target=icmp protocol=icmp -add action=jump chain=input comment="обнаружение вторжений" connection-state=new jump-target=detect-intrusion src-address-list=!management -add action=jump chain=input comment="port knocking" connection-state=new dst-port=1234,2345,3456 in-interface-list=WAN jump-target=pk log=yes protocol=tcp -add action=drop chain=input dst-port=12345 in-interface-list=WAN protocol=tcp src-address-list=!pk-1 -add action=drop chain=input dst-port=12345 in-interface-list=WAN protocol=tcp src-address-list=!pk-2 -add action=add-src-to-address-list address-list=management address-list-timeout=1d chain=input connection-state=new dst-port=12345 in-interface-list=WAN log=yes log-prefix=ACCESS! protocol=tcp src-address-list=pk-3 -add action=accept chain=input comment="принимать управляющий доступ" connection-state=new dst-port=22,8291,8729 log=yes log-prefix=ACCESS! protocol=tcp src-address-list=management -add action=accept chain=input comment="принимать LAN" in-interface-list=LAN -add action=accept chain=input comment="принимать StS" in-interface-list=StS -add action=accept chain=input comment="принимать VPN" in-interface-list=VPN -add action=passthrough chain=input comment="отбрасывать всё остальное (см. п.4 шапки: passthrough)" log-prefix="IN DROP" -add action=accept chain=forward comment="принимать established/related соединения" connection-state=established,related -add action=drop chain=forward comment="отбрасывать invalid соединения" connection-state=invalid log-prefix="INV FWD" -add action=accept chain=forward comment="принимать DST-NAT" connection-nat-state=dstnat -add action=drop chain=forward comment="WAN -X" in-interface-list=WAN log-prefix=FWD -add action=jump chain=forward comment=ICMP jump-target=icmp protocol=icmp -add action=accept chain=forward comment="LAN -> WAN" in-interface-list=LAN out-interface-list=WAN -add action=accept chain=forward comment="LAN -> StS" in-interface-list=LAN out-interface-list=StS -add action=accept chain=forward comment="LAN -> VPN" in-interface-list=LAN out-interface-list=VPN -add action=accept chain=forward comment="StS -> LAN" in-interface-list=StS out-interface-list=LAN -add action=accept chain=forward comment="VPN -> LAN" in-interface-list=VPN out-interface-list=LAN -add action=passthrough chain=forward comment="отбрасывать всё остальное (см. п.4 шапки: passthrough)" log-prefix=FWD -add action=accept chain=icmp comment="эхо-запрос" icmp-options=8:0 protocol=icmp -add action=accept chain=icmp comment="эхо-ответ" icmp-options=0:0 protocol=icmp -add action=accept chain=icmp comment="сеть недоступна" icmp-options=3:3 protocol=icmp -add action=accept chain=icmp comment="хост недоступен / требуется фрагментация" icmp-options=3:4 protocol=icmp -add action=accept chain=icmp comment="превышение времени (time exceeded)" icmp-options=11:0 protocol=icmp -add action=drop chain=icmp comment="отбрасывать все прочие типы" -add action=add-src-to-address-list address-list=pk-1 address-list-timeout=1m chain=pk comment=port-knocking dst-port=1234 protocol=tcp -add action=add-src-to-address-list address-list=pk-2 address-list-timeout=1m chain=pk connection-state="" dst-port=2345 protocol=tcp -add action=add-src-to-address-list address-list=pk-3 address-list-timeout=1m chain=pk connection-state="" dst-port=3456 protocol=tcp -add action=return chain=detect-intrusion comment="обнаружение вторжений" dst-limit=30,256,src-and-dst-addresses/1s -add action=add-src-to-address-list address-list="black-list attackers" address-list-timeout=1d chain=detect-intrusion -add action=drop chain=detect-intrusion src-address-list="black-list attackers" - -# --------------------------------------------------------------------------- -# Firewall NAT -# --------------------------------------------------------------------------- -/ip firewall nat -add action=masquerade chain=srcnat comment="LAN -> Internet" out-interface-list=WAN - -# --------------------------------------------------------------------------- -# DNS — резолвер для клиентов LAN / VPN / StS -# --------------------------------------------------------------------------- -/ip dns -set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8 -# DNS-запросы принимаются от LAN / VPN / StS правилами цепочки input выше -# и по умолчанию отбрасываются со стороны WAN. - -# --------------------------------------------------------------------------- -# Сервисы / усиление безопасности управления -# --------------------------------------------------------------------------- -/ip service -set telnet disabled=yes -set ftp disabled=yes -set www disabled=yes -set api disabled=yes -set api-ssl disabled=yes -/ip neighbor discovery-settings -set discover-interface-list=LAN -# MAC-server оставлен включённым на всех интерфейсах, чтобы роутер оставался -# доступен по MAC-telnet / MAC-winbox во время первичной настройки с любого -# порта, пока у него ещё нет IP-адреса. ВНИМАНИЕ: это также открывает MAC-доступ -# на WAN — после завершения настройки ограничьте его управляющим списком интерфейсов. -/tool mac-server -set allowed-interface-list=all -/tool mac-server mac-winbox -set allowed-interface-list=all -/tool mac-server ping -set enabled=yes -# Отключаем сервер bandwidth-test (по умолчанию открыт, частый вектор атаки). -/tool bandwidth-server -set enabled=no - -# --------------------------------------------------------------------------- -# Отключение неиспользуемых пакетов (только RouterOS 6) -# Отключает пакеты hotspot, ipv6 и mpls. Изменения применяются после -# перезагрузки роутера. Отключение пакета ipv6 — это способ полностью -# выключить IPv6 в RouterOS 6 (заменяет "/ipv6 settings set disable-ipv6=yes"). -# --------------------------------------------------------------------------- -/system package disable hotspot,ipv6,mpls - -# --------------------------------------------------------------------------- -# Время / NTP -# --------------------------------------------------------------------------- -/system clock -set time-zone-name=Asia/Yekaterinburg -/system ntp client -set enabled=yes -/system ntp client servers -add address=pool.ntp.org - -# Работать как NTP-сервер для нижестоящих клиентов. -/system ntp server -set enabled=yes - -# --------------------------------------------------------------------------- -# Логирование — подавить info-сообщения для DHCP и беспроводной сети -# --------------------------------------------------------------------------- -/system logging -set [find where topics="info"] topics=info,!dhcp,!wireless,!wifi - -# --------------------------------------------------------------------------- -# Канал обновления пакетов RouterOS — использовать ветку long-term (стабильную) -# --------------------------------------------------------------------------- -/system package update -set channel=long-term - -# --------------------------------------------------------------------------- -# Авто-обновление прошивки RouterBOARD -# Обновляет прошивку RouterBOARD при старте, если доступна более новая, -# затем перезагружается для её применения. -# --------------------------------------------------------------------------- -/system scheduler -add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=startup \ - on-event="if ([/system routerboard get current-firmware] != [/system routerboard get upgrade-firmware]) do={\r\ - \n/system routerboard upgrade\r\ - \n:delay 15s\r\ - \n/system reboot\r\ - \n}" - -# --------------------------------------------------------------------------- -# Фильтры маршрутизации OSPF — принимать только локальные (RFC1918) префиксы вх/исх -# --------------------------------------------------------------------------- -/routing filter rule -add chain=ospf-in disabled=no rule="if (dst in 192.168.0.0/16 && dst-len in 16-32) {accept;}" -add chain=ospf-in disabled=no rule="if (dst in 10.0.0.0/8 && dst-len in 8-32) {accept;}" -add chain=ospf-in disabled=no rule="if (dst in 172.16.0.0/12 && dst-len in 12-32) {accept;}" -add chain=ospf-out disabled=no rule="if (dst in 192.168.0.0/16 && dst-len in 16-32) {accept;}" -add chain=ospf-out disabled=no rule="if (dst in 10.0.0.0/8 && dst-len in 8-32) {accept;}" -add chain=ospf-out disabled=no rule="if (dst in 172.16.0.0/12 && dst-len in 12-32) {accept;}" From e5e57456db72ab19f7d8998fae74f905c5ebec83 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 03:23:51 +0000 Subject: [PATCH 3/3] routeros: Russian doc comments + management/tunnel adjustments - Descriptions (# comments) in Russian; config comment= fields kept English. - Enable api-ssl (disabled=no). - Restrict mac-server / mac-winbox to the LAN interface list and disable mac-server ping. - Comment out the example WAN interface-list member (add per deployment). - Add disabled input rules to accept GRE / L2TP / IPsec (IKE 500/4500, ESP, AH) so tunnel termination can be enabled when needed. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UXAWR3BJ7yjfpE7STGCtvT --- routeros/initial-setup-ros6.rsc | 120 +++++++++++++++++--------------- routeros/initial-setup-ros7.rsc | 109 +++++++++++++++-------------- 2 files changed, 120 insertions(+), 109 deletions(-) diff --git a/routeros/initial-setup-ros6.rsc b/routeros/initial-setup-ros6.rsc index 625f00d..5df9041 100644 --- a/routeros/initial-setup-ros6.rsc +++ b/routeros/initial-setup-ros6.rsc @@ -1,39 +1,39 @@ -# RouterOS 6 initial setup script -# Based on routeros/autorun.scr, extended with interface lists and firewall rules. -# For RouterOS 7 use initial-setup-ros7.rsc instead (different NTP / IPv6 / -# routing-filter / logging syntax). +# Скрипт первичной настройки RouterOS 6 +# На основе routeros/autorun.scr, расширен списками интерфейсов и правилами firewall. +# Для RouterOS 7 используйте initial-setup-ros7.rsc (отличается синтаксис NTP / +# IPv6 / фильтров маршрутов / топиков логирования). # -# Usage: -# 1. Review and adjust the placeholders marked CHANGE_ME / <...> below. -# 2. Assign real interfaces to the LAN / WAN / StS / VPN lists in the -# "/interface list member" section. -# 3. Upload to the router and run: /import file-name=initial-setup-ros6.rsc -# 4. The "drop all other" filter rules intentionally use action=passthrough: -# during initial setup nothing is actually dropped, only logged, so you -# cannot lock yourself out. After reviewing the logs and confirming you -# will not be locked out, switch these rules (in the input and forward -# chains) to action=drop. +# Использование: +# 1. Просмотрите и поправьте плейсхолдеры CHANGE_ME / <...> ниже. +# 2. Назначьте реальные интерфейсы спискам LAN / WAN / StS / VPN в +# секции "/interface list member". +# 3. Загрузите на роутер и выполните: /import file-name=initial-setup-ros6.rsc +# 4. Правила firewall "drop all other" намеренно используют action=passthrough: +# на этапе первичной настройки трафик НЕ отбрасывается, а только логируется, +# чтобы не потерять доступ к роутеру. После проверки логов и уверенности, +# что вы себя не заблокируете, смените эти правила (в цепочках input и +# forward) на action=drop. # -# Notes: -# StS = Site-to-Site tunnels, VPN = remote-access VPN clients. -# Port knocking sequence: 1234 -> 2345 -> 3456, then connect to 12345. -# Requires RouterOS 6.41+ (interface lists / in-interface-list). +# Примечания: +# StS = туннели site-to-site, VPN = удалённые VPN-клиенты. +# Последовательность port knocking: 1234 -> 2345 -> 3456, затем подключение к 12345. +# Требуется RouterOS 6.41+ (списки интерфейсов / in-interface-list). -# Per-provider settings (addresses, routes, dhcp-client, user passwords) -# are intentionally NOT included here — configure them separately for each -# uplink / deployment. +# Настройки, зависящие от провайдера (адреса, маршруты, dhcp-клиент, пароли +# пользователей) намеренно НЕ включены — настраивайте их отдельно для каждого +# аплинка / развёртывания. # --------------------------------------------------------------------------- -# Bridge +# Мост (bridge) # --------------------------------------------------------------------------- /interface bridge add name=bridge comment="Local bridge" -# Ports are intentionally not bound here — add them per deployment, e.g.: +# Порты намеренно не привязаны здесь — добавляйте их под каждое развёртывание, напр.: # /interface bridge port # add bridge=bridge interface=ether2 # --------------------------------------------------------------------------- -# Interface lists +# Списки интерфейсов # --------------------------------------------------------------------------- /interface list add name=WAN comment="Uplinks / Internet-facing interfaces" @@ -42,8 +42,8 @@ add name=StS comment="Site-to-Site tunnels" add name=VPN comment="Remote-access VPN clients" /interface list member -# Assign your real interfaces here, examples below: -add list=WAN interface=ether1 +# Назначьте здесь свои реальные интерфейсы, примеры ниже: +# add list=WAN interface=ether1 add list=LAN interface=bridge # add list=StS interface= # add list=VPN interface= @@ -64,6 +64,13 @@ add action=accept chain=input comment="accept management" connection-state=new d add action=accept chain=input comment="accept LAN" in-interface-list=LAN add action=accept chain=input comment="accept StS" in-interface-list=StS add action=accept chain=input comment="accept VPN" in-interface-list=VPN +# VPN / туннельные протоколы (GRE / L2TP / IPsec): правила выключены (disabled=yes), +# включите нужные (disabled=no) при терминировании туннелей на роутере. +add action=accept chain=input comment="accept IPsec IKE (500,4500)" disabled=yes dst-port=500,4500 in-interface-list=WAN protocol=udp +add action=accept chain=input comment="accept IPsec ESP" disabled=yes in-interface-list=WAN protocol=ipsec-esp +add action=accept chain=input comment="accept IPsec AH" disabled=yes in-interface-list=WAN protocol=ipsec-ah +add action=accept chain=input comment="accept L2TP (1701)" disabled=yes dst-port=1701 in-interface-list=WAN protocol=udp +add action=accept chain=input comment="accept GRE" disabled=yes in-interface-list=WAN protocol=gre add action=passthrough chain=input comment="drop all other (see usage note 4: passthrough)" log-prefix="IN DROP" add action=accept chain=forward comment="accept established, related connections" connection-state=established,related add action=drop chain=forward comment="drop invalid connections" connection-state=invalid log-prefix="INV FWD" @@ -96,79 +103,78 @@ add action=drop chain=detect-intrusion src-address-list="black-list attackers" add action=masquerade chain=srcnat comment="LAN -> Internet" out-interface-list=WAN # --------------------------------------------------------------------------- -# DNS — resolver for LAN / VPN / StS clients +# DNS — резолвер для клиентов LAN / VPN / StS # --------------------------------------------------------------------------- /ip dns set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8 -# DNS queries are accepted from LAN / VPN / StS by the input chain rules above -# and dropped from WAN by default. +# DNS-запросы принимаются от LAN / VPN / StS правилами цепочки input выше +# и по умолчанию отбрасываются со стороны WAN. # --------------------------------------------------------------------------- -# Service / management hardening +# Сервисы / усиление безопасности управления # --------------------------------------------------------------------------- /ip service set telnet disabled=yes set ftp disabled=yes set www disabled=yes set api disabled=yes -set api-ssl disabled=yes +set api-ssl disabled=no /ip neighbor discovery-settings set discover-interface-list=LAN -# MAC-server is left enabled on all interfaces so the router stays reachable -# via MAC-telnet / MAC-winbox during initial setup from any port, before it has -# an IP address. NOTE: this also exposes MAC access on WAN — restrict to a -# management interface list once setup is complete. +# MAC-сервер ограничен списком LAN: MAC-telnet / MAC-winbox доступны только +# из локальной сети и недоступны со стороны WAN. /tool mac-server -set allowed-interface-list=all +set allowed-interface-list=LAN /tool mac-server mac-winbox -set allowed-interface-list=all +set allowed-interface-list=LAN /tool mac-server ping -set enabled=yes -# Disable the bandwidth-test server (open by default, common attack vector). +set enabled=no +# Отключаем сервер bandwidth-test (по умолчанию открыт, частый вектор атаки). /tool bandwidth-server set enabled=no # --------------------------------------------------------------------------- -# Disable unused packages (RouterOS 6 only) -# Turns off the hotspot, ipv6 and mpls packages. Takes effect after a reboot. -# Disabling the ipv6 package is how IPv6 is fully turned off on RouterOS 6 -# (there is no monolithic-package "/ipv6 settings set disable-ipv6" toggle). +# Отключение неиспользуемых пакетов (только RouterOS 6) +# Отключает пакеты hotspot, ipv6 и mpls. Изменения применяются после +# перезагрузки роутера. Отключение пакета ipv6 — это способ полностью +# выключить IPv6 в RouterOS 6 (в ней нет настройки "/ipv6 settings +# set disable-ipv6" монолитного пакета). # --------------------------------------------------------------------------- /system package disable hotspot,ipv6,mpls # --------------------------------------------------------------------------- -# Time / NTP +# Время / NTP # --------------------------------------------------------------------------- /system clock set time-zone-name=Asia/Yekaterinburg -# RouterOS 6: NTP client uses server-dns-names / primary-ntp (no "servers"). +# RouterOS 6: NTP-клиент использует server-dns-names / primary-ntp (без "servers"). /system ntp client set enabled=yes server-dns-names=pool.ntp.org -# Act as an NTP server for downstream clients. -# NOTE: on RouterOS 6 the NTP server lives in the separate "ntp" package — -# this block only works if that package is installed. +# Работать как NTP-сервер для нижестоящих клиентов. +# ПРИМЕЧАНИЕ: в RouterOS 6 NTP-сервер входит в отдельный пакет "ntp" — +# этот блок работает только если пакет установлен. /system ntp server set enabled=yes # --------------------------------------------------------------------------- -# Logging — suppress info-level messages for DHCP and Wireless +# Логирование — подавить info-сообщения для DHCP и беспроводной сети # --------------------------------------------------------------------------- -# RouterOS 6 has no "wifi" topic; use "wireless". If this device has no -# wireless package at all, drop !wireless and keep only info,!dhcp. +# В RouterOS 6 нет топика "wifi"; используйте "wireless". Если на устройстве +# вообще нет беспроводного пакета — уберите !wireless, оставив только info,!dhcp. /system logging set [find where topics="info"] topics=info,!dhcp,!wireless # --------------------------------------------------------------------------- -# RouterOS package update channel — use the long-term (stable) release branch +# Канал обновления пакетов RouterOS — использовать ветку long-term (стабильную) # --------------------------------------------------------------------------- /system package update set channel=long-term # --------------------------------------------------------------------------- -# RouterBOARD firmware auto-upgrade -# Upgrades the RouterBOARD firmware on startup when a newer one is available, -# then reboots to apply it. +# Авто-обновление прошивки RouterBOARD +# Обновляет прошивку RouterBOARD при старте, если доступна более новая, +# затем перезагружается для её применения. # --------------------------------------------------------------------------- /system scheduler add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=startup \ @@ -179,8 +185,8 @@ add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=sta \n}" # --------------------------------------------------------------------------- -# OSPF routing filters — accept only local (RFC1918) prefixes in/out -# RouterOS 6 routing-filter syntax (prefix / prefix-length / action). +# Фильтры маршрутизации OSPF — принимать только локальные (RFC1918) префиксы вх/исх +# Синтаксис фильтров маршрутов RouterOS 6 (prefix / prefix-length / action). # --------------------------------------------------------------------------- /routing filter add chain=ospf-in prefix=192.168.0.0/16 prefix-length=16-32 action=accept diff --git a/routeros/initial-setup-ros7.rsc b/routeros/initial-setup-ros7.rsc index bf0cb65..1d16fa2 100644 --- a/routeros/initial-setup-ros7.rsc +++ b/routeros/initial-setup-ros7.rsc @@ -1,38 +1,38 @@ -# RouterOS 7 initial setup script -# Based on routeros/autorun.scr, extended with interface lists and firewall rules. -# For RouterOS 6 use initial-setup-ros6.rsc instead (different NTP / IPv6 / -# routing-filter / logging syntax). +# Скрипт первичной настройки RouterOS 7 +# На основе routeros/autorun.scr, расширен списками интерфейсов и правилами firewall. +# Для RouterOS 6 используйте initial-setup-ros6.rsc (отличается синтаксис NTP / +# IPv6 / фильтров маршрутов / топиков логирования). # -# Usage: -# 1. Review and adjust the placeholders marked CHANGE_ME / <...> below. -# 2. Assign real interfaces to the LAN / WAN / StS / VPN lists in the -# "/interface list member" section. -# 3. Upload to the router and run: /import file-name=initial-setup-ros7.rsc -# 4. The "drop all other" filter rules intentionally use action=passthrough: -# during initial setup nothing is actually dropped, only logged, so you -# cannot lock yourself out. After reviewing the logs and confirming you -# will not be locked out, switch these rules (in the input and forward -# chains) to action=drop. +# Использование: +# 1. Просмотрите и поправьте плейсхолдеры CHANGE_ME / <...> ниже. +# 2. Назначьте реальные интерфейсы спискам LAN / WAN / StS / VPN в +# секции "/interface list member". +# 3. Загрузите на роутер и выполните: /import file-name=initial-setup-ros7.rsc +# 4. Правила firewall "drop all other" намеренно используют action=passthrough: +# на этапе первичной настройки трафик НЕ отбрасывается, а только логируется, +# чтобы не потерять доступ к роутеру. После проверки логов и уверенности, +# что вы себя не заблокируете, смените эти правила (в цепочках input и +# forward) на action=drop. # -# Notes: -# StS = Site-to-Site tunnels, VPN = remote-access VPN clients. -# Port knocking sequence: 1234 -> 2345 -> 3456, then connect to 12345. +# Примечания: +# StS = туннели site-to-site, VPN = удалённые VPN-клиенты. +# Последовательность port knocking: 1234 -> 2345 -> 3456, затем подключение к 12345. -# Per-provider settings (addresses, routes, dhcp-client, user passwords) -# are intentionally NOT included here — configure them separately for each -# uplink / deployment. +# Настройки, зависящие от провайдера (адреса, маршруты, dhcp-клиент, пароли +# пользователей) намеренно НЕ включены — настраивайте их отдельно для каждого +# аплинка / развёртывания. # --------------------------------------------------------------------------- -# Bridge +# Мост (bridge) # --------------------------------------------------------------------------- /interface bridge add name=bridge comment="Local bridge" -# Ports are intentionally not bound here — add them per deployment, e.g.: +# Порты намеренно не привязаны здесь — добавляйте их под каждое развёртывание, напр.: # /interface bridge port # add bridge=bridge interface=ether2 # --------------------------------------------------------------------------- -# Interface lists +# Списки интерфейсов # --------------------------------------------------------------------------- /interface list add name=WAN comment="Uplinks / Internet-facing interfaces" @@ -41,8 +41,8 @@ add name=StS comment="Site-to-Site tunnels" add name=VPN comment="Remote-access VPN clients" /interface list member -# Assign your real interfaces here, examples below: -add list=WAN interface=ether1 +# Назначьте здесь свои реальные интерфейсы, примеры ниже: +# add list=WAN interface=ether1 add list=LAN interface=bridge # add list=StS interface= # add list=VPN interface= @@ -63,6 +63,13 @@ add action=accept chain=input comment="accept management" connection-state=new d add action=accept chain=input comment="accept LAN" in-interface-list=LAN add action=accept chain=input comment="accept StS" in-interface-list=StS add action=accept chain=input comment="accept VPN" in-interface-list=VPN +# VPN / туннельные протоколы (GRE / L2TP / IPsec): правила выключены (disabled=yes), +# включите нужные (disabled=no) при терминировании туннелей на роутере. +add action=accept chain=input comment="accept IPsec IKE (500,4500)" disabled=yes dst-port=500,4500 in-interface-list=WAN protocol=udp +add action=accept chain=input comment="accept IPsec ESP" disabled=yes in-interface-list=WAN protocol=ipsec-esp +add action=accept chain=input comment="accept IPsec AH" disabled=yes in-interface-list=WAN protocol=ipsec-ah +add action=accept chain=input comment="accept L2TP (1701)" disabled=yes dst-port=1701 in-interface-list=WAN protocol=udp +add action=accept chain=input comment="accept GRE" disabled=yes in-interface-list=WAN protocol=gre add action=passthrough chain=input comment="drop all other (see usage note 4: passthrough)" log-prefix="IN DROP" add action=accept chain=forward comment="accept established, related connections" connection-state=established,related add action=drop chain=forward comment="drop invalid connections" connection-state=invalid log-prefix="INV FWD" @@ -95,73 +102,71 @@ add action=drop chain=detect-intrusion src-address-list="black-list attackers" add action=masquerade chain=srcnat comment="LAN -> Internet" out-interface-list=WAN # --------------------------------------------------------------------------- -# DNS — resolver for LAN / VPN / StS clients +# DNS — резолвер для клиентов LAN / VPN / StS # --------------------------------------------------------------------------- /ip dns set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8 -# DNS queries are accepted from LAN / VPN / StS by the input chain rules above -# and dropped from WAN by default. +# DNS-запросы принимаются от LAN / VPN / StS правилами цепочки input выше +# и по умолчанию отбрасываются со стороны WAN. # --------------------------------------------------------------------------- -# Service / management hardening +# Сервисы / усиление безопасности управления # --------------------------------------------------------------------------- /ip service set telnet disabled=yes set ftp disabled=yes set www disabled=yes set api disabled=yes -set api-ssl disabled=yes +set api-ssl disabled=no /ip neighbor discovery-settings set discover-interface-list=LAN -# MAC-server is left enabled on all interfaces so the router stays reachable -# via MAC-telnet / MAC-winbox during initial setup from any port, before it has -# an IP address. NOTE: this also exposes MAC access on WAN — restrict to a -# management interface list once setup is complete. +# MAC-сервер ограничен списком LAN: MAC-telnet / MAC-winbox доступны только +# из локальной сети и недоступны со стороны WAN. /tool mac-server -set allowed-interface-list=all +set allowed-interface-list=LAN /tool mac-server mac-winbox -set allowed-interface-list=all +set allowed-interface-list=LAN /tool mac-server ping -set enabled=yes -# Disable the bandwidth-test server (open by default, common attack vector). +set enabled=no +# Отключаем сервер bandwidth-test (по умолчанию открыт, частый вектор атаки). /tool bandwidth-server set enabled=no -# Disable IPv6 entirely (RouterOS 7 keeps IPv6 in the monolithic package, -# so it is turned off via a setting rather than by removing a package). +# Полностью отключаем IPv6 (в RouterOS 7 IPv6 входит в монолитный пакет, +# поэтому выключается настройкой, а не удалением пакета). /ipv6 settings set disable-ipv6=yes # --------------------------------------------------------------------------- -# Time / NTP +# Время / NTP # --------------------------------------------------------------------------- /system clock set time-zone-name=Asia/Yekaterinburg -# RouterOS 7: NTP servers are a property of the client (no "servers" submenu). +# RouterOS 7: серверы NTP задаются свойством клиента (подменю "servers" нет). /system ntp client set enabled=yes servers=pool.ntp.org -# Act as an NTP server for downstream clients. +# Работать как NTP-сервер для нижестоящих клиентов. /system ntp server set enabled=yes # --------------------------------------------------------------------------- -# Logging — suppress info-level messages for DHCP and Wireless +# Логирование — подавить info-сообщения для DHCP и беспроводной сети # --------------------------------------------------------------------------- -# RouterOS 7 with the wifi (wifiwave2) driver uses the "wifi" topic. If this -# device runs the legacy wireless package instead, replace !wifi with !wireless. +# RouterOS 7 с драйвером wifi (wifiwave2) использует топик "wifi". Если на +# устройстве legacy-пакет wireless — замените !wifi на !wireless. /system logging set [find where topics="info"] topics=info,!dhcp,!wifi # --------------------------------------------------------------------------- -# RouterOS package update channel — use the long-term (stable) release branch +# Канал обновления пакетов RouterOS — использовать ветку long-term (стабильную) # --------------------------------------------------------------------------- /system package update set channel=long-term # --------------------------------------------------------------------------- -# RouterBOARD firmware auto-upgrade -# Upgrades the RouterBOARD firmware on startup when a newer one is available, -# then reboots to apply it. +# Авто-обновление прошивки RouterBOARD +# Обновляет прошивку RouterBOARD при старте, если доступна более новая, +# затем перезагружается для её применения. # --------------------------------------------------------------------------- /system scheduler add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=startup \ @@ -172,8 +177,8 @@ add name=routerboard_fwupgrade policy=reboot,read,write,sensitive start-time=sta \n}" # --------------------------------------------------------------------------- -# OSPF routing filters — accept only local (RFC1918) prefixes in/out -# RouterOS 7 routing-filter syntax (rule="if (...) {accept;}"). +# Фильтры маршрутизации OSPF — принимать только локальные (RFC1918) префиксы вх/исх +# Синтаксис фильтров маршрутов RouterOS 7 (rule="if (...) {accept;}"). # --------------------------------------------------------------------------- /routing filter rule add chain=ospf-in disabled=no rule="if (dst in 192.168.0.0/16 && dst-len in 16-32) {accept;}"