Base config feedback

• mikrotik-scripts

  3 17 3.6 HTML

  MikroTik RouterOS scripts

/interface bridge add admin-mac=48:8F:5A:2D:66:01 auto-mac=no name=bridge-rb4011 /interface ethernet set [ find default-name=ether1 ] name=ether1-wan set [ find default-name=ether10 ] name=ether10-wifi set [ find default-name=sfp-sfpplus1 ] disabled=yes name=sfpplus1 /interface wireguard add listen-port=51820 mtu=1420 name=wireguard1 private-key="xxx" /interface pppoe-client add add-default-route=yes disabled=no interface=bridge-rb4011 max-mtu=1480 name=pppoe-ais password=xxx user=xxx /interface list add name=WAN add name=LAN add name=INET /ip pool add name=main-pool ranges=10.66.11.2-10.66.11.222 /ip dhcp-server add address-pool=main-pool interface=bridge-rb4011 lease-script="[removed script, see https://github.com/arktronic/mikrotik-scripts/blob/main/dhcp-dns.rsc]" name=dhcp-main /interface bridge port add bridge=bridge-rb4011 ingress-filtering=no interface=ether2 add bridge=bridge-rb4011 ingress-filtering=no interface=ether3 add bridge=bridge-rb4011 ingress-filtering=no interface=ether4 add bridge=bridge-rb4011 ingress-filtering=no interface=ether5 add bridge=bridge-rb4011 ingress-filtering=no interface=ether6 multicast-router=disabled add bridge=bridge-rb4011 ingress-filtering=no interface=ether7 multicast-router=disabled add bridge=bridge-rb4011 ingress-filtering=no interface=ether8 add bridge=bridge-rb4011 ingress-filtering=no interface=ether9 add bridge=bridge-rb4011 ingress-filtering=no interface=ether10-wifi add bridge=bridge-rb4011 ingress-filtering=no interface=sfpplus1 add bridge=bridge-rb4011 ingress-filtering=no interface=ether1-wan multicast-router=disabled /interface list member add interface=pppoe-ais list=WAN add interface=ether1-wan list=WAN add interface=bridge-rb4011 list=LAN add interface=bridge-rb4011 list=INET add interface=wireguard1 list=INET add interface=wireguard1 list=LAN /interface wireguard peers add allowed-address=10.66.2.2/32 endpoint-address=10.66.2.1 interface=wireguard1 public-key="xxx" add allowed-address=10.66.2.3/32 endpoint-address=10.66.2.1 interface=wireguard1 public-key="xxx" add allowed-address=10.66.2.4/32 endpoint-address=10.66.2.1 interface=wireguard1 public-key="xxx" /ip address add address=10.66.2.1/24 interface=wireguard1 network=10.66.2.0 add address=10.66.11.1/24 interface=bridge-rb4011 network=10.66.11.0 /ip dhcp-server network add address=10.66.11.0/24 comment=main-dhcp-network dns-server=10.66.11.1 gateway=10.66.11.1 /ip dns set allow-remote-requests=yes use-doh-server=https://dns.nextdns.io/xxx verify-doh-cert=yes /ip dns static add address=45.90.1.0 name=dns.nextdns.io add address=45.90.2.0 name=dns.nextdns.io add address=10.66.11.1 name=router.lan [removed dns entries for brevity] /ip firewall filter add action=drop chain=forward comment="Drop invalid connections" connection-state=invalid add action=accept chain=forward comment="Allow established/related/untracked connections" connection-state=established,related,untracked add action=accept chain=forward comment="Allow internet access" in-interface-list=INET out-interface-list=WAN add action=accept chain=forward comment="Allow LAN access from Wireguard" in-interface=wireguard1 out-interface-list=LAN add action=accept chain=forward comment="Allow service A from internet" dst-port=443 in-interface-list=WAN protocol=tcp add action=accept chain=forward comment="Allow service B from internet" dst-port=8080 in-interface-list=WAN protocol=tcp add action=drop chain=forward comment="Drop everything else" log-prefix=drop add action=drop chain=input comment="Drop invalid connections" connection-state=invalid add action=accept chain=input comment="Allow established/related/untracked connections" connection-state=established,related,untracked add action=accept chain=input comment="Allow LAN to access the router" in-interface-list=LAN add action=accept chain=input comment="Allow WireGuard from internet" dst-port=51820 log=yes log-prefix=wg protocol=udp add action=accept chain=input comment="Allow ICMP for everyone" protocol=icmp add action=drop chain=input comment="Drop everything else" log-prefix=dropped /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN add action=dst-nat chain=dstnat comment="Public access to service A" dst-port=443 in-interface-list=WAN protocol=tcp to-addresses=10.66.11.2 to-ports=443 add action=dst-nat chain=dstnat comment="Public access to service B" dst-port=8080 in-interface-list=WAN protocol=tcp to-addresses=10.66.11.2 to-ports=8080

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project