Plantilla 20 Nov Mikrotik Editar Ler

/ip pool
add name=vpn ranges=192.168.89.2-192.168.89.255
add name=Desconectados ranges=10.10.0.2-10.10.0.200
add name=PPPOE ranges=172.14.2.1-172.15.100.254
add name=dhcp_pool19 ranges=192.168.0.1-192.168.0.9,192.168.0.11-192.168.1.254
add name=PPPOEREHUSO1-5M ranges=172.16.2.1-172.16.100.254
/ppp profile
add local-address=10.10.0.1 name=Desconectado rate-limit=0k/0k remote-

address=Desconectados
add address-list=PLAN4M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1 name=PLAN4M

remote-address=PPPOE





add address-list=PLAN100M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1

name=PLAN100M remote-address=PPPOE
add address-list=PLAN500M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1

name=PLAN500M remote-address=PPPOE
add address-list=PLAN5MREHUSO1-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.16.0.1

name=PLAN5MREHUSO1-5M remote-address=PPPOEREHUSO1-5M







set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/ip firewall filter
add action=accept chain=input comment="*************Accept established connection packets"

connection-state=established disabled=yes
add action=accept chain=input comment="Accept related connection packets" connection-

state=related disabled=yes
add action=drop chain=input comment="Drop invalid packets" connection-state=invalid

disabled=yes
add action=accept chain=forward comment="*************Accept established connection

packets" connection-state=established disabled=yes
add action=accept chain=forward comment="Accept related connection packets" connection-
state=related disabled=yes
add action=drop chain=forward comment="Drop invalid packets" connection-state=invalid

disabled=yes
add action=drop chain=forward comment="Bloqueo DNS cache externo" disabled=yes dst-port=53

in-interface=WAN protocol=udp
add action=drop chain=input comment="Bloqueo DNS cache input" disabled=yes dst-port=53 in-
interface=WAN protocol=udp
add action=accept chain=input comment="allow IPsec NAT" disabled=yes dst-port=4500

protocol=udp
add action=accept chain=input comment="allow IKE" disabled=yes dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" disabled=yes dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" disabled=yes dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" disabled=yes dst-port=443 protocol=tcp
add action=drop chain=input comment="BLOQUEO DURANTE 24 horas despues 5 intents

seguidos de login winbox!" dst-port=8291 protocol=tcp
add action=add-src-to-address-list address-list=black_list_winbox address-list-timeout=1h

chain=input connection-state=new dst-port=8291 protocol=tcp
add action=add-src-to-address-list address-list=winbox_stage4 address-list-timeout=3m




add action=drop chain=input comment="BLOQUEA DURANTE 24 horas despues de 5 intents

seguidos de login SSH!" dst-port=22 protocol=tcp src-address-list=black_list_ssh
add action=add-src-to-address-list address-list=black_list_ssh address-list-timeout=1d chain=input

connection-state=new dst-port=22 protocol=tcp
add action=add-src-to-address-list address-list=ssh_stage4 address-list-timeout=1m chain=input



/ip firewall nat
add action=masquerade chain=srcnat comment="NAT PLAN 2M" src-address-list=PLAN2M
add action=masquerade chain=srcnat comment="NAT PLAN 5MREHUSO1-5M" src-address-

list=PLAN5MREHUSO1-5M








add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=192.168.89.0/24
add action=dst-nat chain=dstnat comment="ASIGNACION DE PUERTOS" disabled=yes dst-

address=45.7.133.204 dst-port=8085 protocol=tcp to-addresses=192.168.8.100 to-ports=80



/ip firewall mangle
add action=add-dst-to-address-list address-list=speedtest address-list-timeout=none-dynamic

chain=forward layer7-protocol=speedtest
add action=add-dst-to-address-list address-list=speedtest address-list-timeout=none-dynamic

chain=forward layer7-protocol=speedtest2
add action=mark-packet chain=forward comment="MARCACION PLAN 2M SPEEDTEST" dst-

address-list=PLAN2M new-packet-mark=DWPK2MSPEED passthrough=no src-address-
list=speedtest
add action=mark-packet chain=forward dst-address-list=speedtest new-packet-

mark=UPPK2MSPEED passthrough=no src-address-list=PLAN2M

list=speedtest


list=speedtest


list=speedtest
add action=mark-packet chain=forward comment="MARCACION PLAN 5M SPEEDTESTREHUSO1-

5M" dst-address-list=PLAN5MREHUSO1-5M new-packet-mark=DWPK5MSPEEDREHUSO1-5M \
passthrough=no src-address-list=speedtest

mark=UPPK5MSPEEDREHUSO1-5M passthrough=no src-address-list=PLAN5MREHUSO1-5M















list=speedtest


list=speedtest


address-list=PLAN10M new-packet-mark=DWPK10MSPEED passthrough=no src-address-list=\
speedtest


address-list=PLAN100M new-packet-mark=DWPK100MSPEED passthrough=no src-address-list=\
speedtest

add action=mark-packet chain=forward comment="MARCACION PLAN 2M" dst-address-

list=PLAN2M new-packet-mark=DWPK2M passthrough=no
add action=mark-packet chain=forward new-packet-mark=UPPK2M passthrough=no src-address-

list=PLAN2M

list=PLAN3M


list=PLAN4M


list=PLAN5M
add action=mark-packet chain=forward comment="MARCACION PLAN 5MREHUSO1-5M" dst-

address-list=PLAN5MREHUSO1-5M new-packet-mark=DWPK5MREHUSO1-5M passthrough=no
add action=mark-packet chain=forward new-packet-mark=UPPK5MREHUSO1-5M passthrough=no

src-address-list=PLAN5MREHUSO1-5M















list=PLAN6M


list=PLAN8M


list=PLAN10M

add action=mark-packet chain=forward new-packet-mark=UPPK100M passthrough=no src-

address-list=PLAN100M
add action=change-mss chain=forward new-mss=1440 out-interface=all-ppp passthrough=yes

protocol=tcp tcp-flags=syn tcp-mss=1440-65535
add action=change-mss chain=forward in-interface=all-ppp new-mss=1440 passthrough=yes

protocol=tcp tcp-flags=syn tcp-mss=1440-65535
/ip firewall address-list
add address=186.179.96.84 list=speedtest
add address=151.101.0.0/22 list=speedtest

add address=190.184.202.0/24 list=speedtest

















add address=52.2.59.77 comment=imp.heasyspeedtest.co list=speedtest
add address=52.2.60.17 comment=imp.heasyspeedtest.co list=speedtest
add address=52.1.139.208 comment=search.heasyspeedtest.co list=speedtest
add address=52.44.146.13 comment=search.heasyspeedtest.co list=speedtest
/ip firewall layer7-protocol
add name=speedtest regexp="^.*(get|GET).+speedtest.*\\\$"
add name=speedtest2 regexp="^.+(speedtest).*\\\\\\\$"

/queue tree
add max-limit=20M name=DOWNLOAD parent=global
add name=DW4MSPEED packet-mark=DWPK4MSPEED parent=DOWNLOAD priority=2

queue=DW4M
add max-limit=20M name=DWPLAN4M packet-mark=DWPK4M parent=DOWNLOAD priority=6

queue=DW4M

queue=DW6M

queue=DW8M

queue=DW10M
add max-limit=65M name=UPLOAD parent=WAN
add max-limit=60M name=UPPLAN4M packet-mark=UPPK4M parent=UPLOAD priority=6

queue=UP4M

queue=UP6M

queue=UP8M

queue=UP10M

queue=DW2M

queue=DW3M
add max-limit=20M name=DWPLAN100M packet-mark=DWPK100M parent=DOWNLOAD

priority=4 queue=DW100M

queue=UP2M

queue=UP3M

queue=UP100M
add name=UP4MSPEED packet-mark=UPPK4MSPEED parent=UPLOAD priority=2 queue=UP4M

queue=DW2M

queue=DW5M

queue=UP5M

queue=DW3M

queue=DW5M

queue=DW6M

queue=DW8M

queue=DW10M

queue=DW100M
add name=UP100MSPEED packet-mark=UPPK100MSPEED parent=UPLOAD priority=2

queue=UP100M
add max-limit=7M name=DOWNLOADREHUSO1-5M parent=global
add name=DW5MSPEEDREHUSO1-5M packet-mark=DWPK5MSPEEDREHUSO1-5M

parent=DOWNLOADREHUSO1-5M priority=2 queue=DW5MREHUSO1-5M

add max-limit=65M name=UPLOADREHUSO1-5M parent=WAN







add max-limit=7M name=DWPLAN5MREHUSO1-5M packet-mark=DWPK5MREHUSO1-5M







add name=UP5MSPEEDREHUSO1-5M packet-mark=UPPK5MSPEEDREHUSO1-5M

parent=UPLOADREHUSO1-5M priority=2 queue=UP5MREHUSO1-5M







add max-limit=60M name=UPPLAN5MREHUSO1-5M packet-mark=UPPK5MREHUSO1-5M







/queue type
add kind=pcq name=DW4M pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-rate=4M

pcq-src-address6-mask=64



add kind=pcq name=TESTDOWN pcq-burst-time=5s pcq-classifier=dst-address pcq-dst-address6-

mask=64 pcq-rate=20M pcq-src-address6-mask=64
add kind=pcq name=UP4M pcq-burst-rate=8M pcq-burst-threshold=3M pcq-burst-time=5s pcq-

classifier=src-address pcq-dst-address6-mask=64 pcq-rate=4M pcq-src-address6-mask=\
64

classifier=src-address pcq-dst-address6-mask=64 pcq-rate=6M \


add kind=pcq name=UP2M pcq-burst-rate=4M pcq-burst-threshold=1536k pcq-burst-time=5s pcq-


add kind=pcq name=DW100M pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-

rate=100M pcq-src-address6-mask=64

classifier=src-address pcq-dst-address6-mask=64 pcq-rate=3M pcq-src-address6-mask=\
64
add kind=pcq name=UP100M pcq-burst-rate=200M pcq-burst-threshold=75M pcq-burst-time=5s

pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=100M \


add kind=pcq name=TESTUP pcq-burst-time=5s pcq-classifier=src-address pcq-dst-address6-

mask=64 pcq-rate=20M pcq-src-address6-mask=64
add kind=pcq name=DW500M pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-

rate=500M pcq-src-address6-mask=64
add kind=pcq name=DW5MREHUSO1-5M pcq-classifier=dst-address pcq-dst-address6-mask=64

pcq-rate=5M pcq-src-address6-mask=64






add kind=pcq name=UP5MREHUSO1-5M pcq-burst-rate=10M pcq-burst-threshold=4M pcq-burst-

time=5s pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=5M \







/system scheduler
add disabled=yes interval=1d name="QUEUE REMOVE" on-event="/queue simple remove [find

dynamic=yes invalid=no ];" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=jan/27/2018 start-

time=23:00:00
add interval=1d name=BACKUP on-event="/system backup save name=([/system identity get

name] . \"-\" . \\\
\n[:pick [/system clock get date] 7 11] . [:pick [/system clock get date] 0 3] . [:pick [/system clock
get date] 4 6]); :delay 10; \\\
\n/tool e-mail send start-tls=yes to=\"bernardo.fabio.bermudez@gmail.com\"

subject=([/system identity get name] . \" Backup \" . \\\
\n[/system clock get date]) file=([/system identity get name] . \"-\" . [:pick [/system clock get
date] 7 11] . \\\
\n[:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4 6] . \".backup\"); :delay
10; \\\
\n/file rem [/file find name=([/system identity get name] . \"-\" . [:pick [/system clock get date] 7
11] . \\\
\n[:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4 6] . \".backup\")]; \\\
\n:log info (\"System Backup emailed at \" . [/sys cl get time] . \" \" . [/sys cl get date])"
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \
start-date=jul/28/2017 start-time=14:16:45
add interval=1w name=reboot on-event="/system reboot"

policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=jul/28/2017 start-
time=04:00:00
add disabled=yes interval=1d name="Remove ppp connections" on-event="/ppp active remove

[find]" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=aug/26/2018 start-time=04:00:00
add interval=1m name=Speedtest on-event=":foreach i in=[/ip dns cache all find where
(name~\"speedtest\") && (type=\"A\") ] do={\r\
\n :local tmpAddress [/ip dns cache get \$i address];\r\
\ndelay delay-time=10ms\r\
\n# prevent script from using all cpu time #\r\
\n :if ( [/ip firewall address-list find where address=\$tmpAddress] = \"\") do={ \r\
\n :local cacheName [/ip dns cache get \$i name] ;\r\
\n :log info (\"added entry: \$cacheName \$tmpAddress\");\r\
\n /ip firewall address-list add address=\$tmpAddress list=speedtest

comment=\$cacheName;\r\
\n}" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup

Plantilla 20 Nov Mikrotik Editar Ler

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Plantilla 20 Nov Mikrotik Editar Ler

Caricato da

Copyright:

Formati disponibili

/ip pool

add name=vpn ranges=192.168.89.2-192.168.89.255

add name=Desconectados ranges=10.10.0.2-10.10.0.200

add name=PPPOE ranges=172.14.2.1-172.15.100.254

add name=dhcp_pool19 ranges=192.168.0.1-192.168.0.9,192.168.0.11-192.168.1.254

add name=PPPOEREHUSO1-5M ranges=172.16.2.1-172.16.100.254

add name=PPPOEREHUSO2-5M ranges=172.17.2.1-172.17.100.254

add name=PPPOEREHUSO3-5M ranges=172.18.2.1-172.18.100.254

add name=PPPOEREHUSO4-5M ranges=172.19.2.1-172.19.100.254

add name=PPPOEREHUSO5-5M ranges=172.20.2.1-172.20.100.254

add name=PPPOEREHUSO6-5M ranges=172.21.2.1-172.21.100.254

add name=PPPOEREHUSO7-5M ranges=172.22.2.1-172.22.100.254

add name=PPPOEREHUSO8-5M ranges=172.23.2.1-172.23.100.254

add local-address=10.10.0.1 name=Desconectado rate-limit=0k/0k remote-

add address-list=PLAN4M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1 name=PLAN4M

add address-list=PLAN6M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1 name=PLAN6M

add address-list=PLAN8M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1 name=PLAN8M

add address-list=PLAN10M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1 name=PLAN10M

add address-list=PLAN2M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1 name=PLAN2M

add address-list=PLAN3M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1 name=PLAN3M

add address-list=PLAN100M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1

add address-list=PLAN500M dns-server=8.8.8.8,8.8.4.4 local-address=172.14.0.1

add address-list=PLAN5MREHUSO1-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.16.0.1

add address-list=PLAN5MREHUSO2-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.17.0.1

add address-list=PLAN5MREHUSO3-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.18.0.1

add address-list=PLAN5MREHUSO4-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.19.0.1

add address-list=PLAN5MREHUSO5-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.20.0.1

add address-list=PLAN5MREHUSO6-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.21.0.1

add address-list=PLAN5MREHUSO7-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.22.0.1

add address-list=PLAN5MREHUSO8-5M dns-server=8.8.8.8,8.8.4.4 local-address=172.23.0.1

set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn

/ip firewall filter

add action=accept chain=input comment="*************Accept established connection packets"

add action=accept chain=input comment="Accept related connection packets" connection-

add action=drop chain=input comment="Drop invalid packets" connection-state=invalid

add action=accept chain=forward comment="*************Accept established connection

add action=drop chain=forward comment="Drop invalid packets" connection-state=invalid

add action=drop chain=forward comment="Bloqueo DNS cache externo" disabled=yes dst-port=53

add action=accept chain=input comment="allow IPsec NAT" disabled=yes dst-port=4500

add action=accept chain=input comment="allow IKE" disabled=yes dst-port=500 protocol=udp

add action=accept chain=input comment="allow l2tp" disabled=yes dst-port=1701 protocol=udp

add action=accept chain=input comment="allow pptp" disabled=yes dst-port=1723 protocol=tcp

add action=accept chain=input comment="allow sstp" disabled=yes dst-port=443 protocol=tcp

add action=drop chain=input comment="BLOQUEO DURANTE 24 horas despues 5 intents

add action=add-src-to-address-list address-list=black_list_winbox address-list-timeout=1h

add action=add-src-to-address-list address-list=winbox_stage4 address-list-timeout=3m

add action=add-src-to-address-list address-list=winbox_stage3 address-list-timeout=3m

add action=add-src-to-address-list address-list=winbox_stage2 address-list-timeout=3m

add action=add-src-to-address-list address-list=winbox_stage1 address-list-timeout=3m

add action=drop chain=input comment="BLOQUEA DURANTE 24 horas despues de 5 intents

add action=add-src-to-address-list address-list=black_list_ssh address-list-timeout=1d chain=input

add action=add-src-to-address-list address-list=ssh_stage4 address-list-timeout=1m chain=input

add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input

add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input

/ip firewall nat

add action=masquerade chain=srcnat comment="NAT PLAN 2M" src-address-list=PLAN2M

add action=masquerade chain=srcnat comment="NAT PLAN 3M" src-address-list=PLAN3M

add action=masquerade chain=srcnat comment="NAT PLAN 4M" src-address-list=PLAN4M

add action=masquerade chain=srcnat comment="NAT PLAN 5M" src-address-list=PLAN5M

add action=masquerade chain=srcnat comment="NAT PLAN 5MREHUSO1-5M" src-address-

add action=masquerade chain=srcnat comment="NAT PLAN 5MREHUSO2-5M" src-address-

add action=masquerade chain=srcnat comment="NAT PLAN 5MREHUSO3-5M" src-address-

add action=masquerade chain=srcnat comment="NAT PLAN 5MREHUSO4-5M" src-address-

add action=masquerade chain=srcnat comment="NAT PLAN 5MREHUSO5-5M" src-address-