Jump to content

This is the support site for Andrews & Arnold Ltd, a UK Internet provider. Information on these pages is generally for our customers but may be useful to others, enjoy!

Router - RouterOS and Routerboard: Difference between revisions

m
Change interface names to aliases so that it's easier to apply to different hardware setups.
No edit summary
m (Change interface names to aliases so that it's easier to apply to different hardware setups.)
*Also see: [[Router - RouterOS and Routerboard bonding]]
*[irc://irc.z.je/routerboard irc://irc.z.je/routerboard] - which is hosted on the sameZ.JE ircIRC server that AAISP use and contains (among others) lots of AAISP customers using Mikrotik.
 
= Overview =
= Default Configuration =
 
This example assumes that the router is at its default configuration with any example/demo/supplied settings removed. Furthermore, it is assumed that your WAN (ADSL/VDSL/whatever modem) is plugged into interface 'ether1' and LAN into 'ether2'. The following snippet changes the default interface names so that the examples below won't depend as closely on your hardware setup.
 
<pre>
/interface ethernet
set [ find default-name=ether1 ] name=uplink-wan
set [ find default-name=ether2 ] name=lan
</pre>
 
= Configuring Initial Basic Settings =
broadcast=192.0.2.15 \
disabled=no \
interface=ether2lan \
network=192.0.2.0
/ipv6 address add \
disabled=no \
eui-64=no \
interface=ether2</pre> lan
</pre>
 
Set basic firewalling (all out, none in!)
<pre>/ip firewall filter
add action=accept chain=forward comment="LAN traffic can go anywhere" disabled=no in-interface=ether2lan
add action=accept chain=forward comment="Established traffic" connection-state=established disabled=no
add action=accept chain=forward comment="Related traffic" connection-state=related disabled=no
add action=drop chain=forward comment="Drop the rest" disabled=no
add action=accept chain=output disabled=no
add action=accept chain=input comment="LAN traffic can go anywhere" disabled=no in-interface=ether2lan
add action=accept chain=input comment="Established traffic" connection-state=established disabled=no
add action=accept chain=input comment="Related traffic" connection-state=related disabled=no
 
/ipv6 firewall filter
add action=accept chain=forward comment="LAN traffic can go anywhere" disabled=no in-interface=ether2lan
add action=accept chain=forward comment="Established traffic" connection-state=established disabled=no
add action=accept chain=forward comment="Related traffic" connection-state=related disabled=no
add action=drop chain=forward comment="Drop the rest" disabled=no
add action=accept chain=output disabled=no
add action=accept chain=input comment="LAN traffic can go anywhere" disabled=no in-interface=ether2lan
add action=accept chain=input comment="Established traffic" connection-state=established disabled=no
add action=accept chain=input comment="Related traffic" connection-state=related disabled=no
dial-on-demand=no \
disabled=no \
interface=ether1uplink-wan \
max-mru=1492 \
max-mtu=1492 \
disabled=no \
hop-limit=64 \
interface=ether2lan \
managed-address-configuration=no \
mtu=1492 \
<pre>/ipv6 address
add address=2001:8b0:XXX::1/64 advertise=yes comment="advertise on lan" disabled=no eui-64=no \
interface=ether2lan
</pre>
 
3

edits