Image Image Image Image Image Image Image Image Image Image

Ubuntu Server | October 17, 2018

Scroll to top

Top

No Comments

Mikrotik CRS1xx/2xx Trunk+Access Hybrid/Routed R.O. 6.41 Esempio2

Mikrotik CRS1xx/2xx Trunk+Access Hybrid/Routed R.O. 6.41 Esempio2

Anche in questa configurazione le porte sono ibride, con l’aggiunta del layer3 quindi il CRS fa da Router e gestisce Nat,Dhcp,Firewall. Nell’export della config ho lasciato le porte 1 e 2 libere per gestire la parte pubblica.

/interface bridge
add fast-forward=no name=bridge_switch

/interface ethernet
set [ find default-name=ether1 ] comment=Wan1
set [ find default-name=ether2 ] comment=Wan2
set [ find default-name=sfp-sfpplus1 ] name=sfp1
set [ find default-name=sfpplus2 ] name=sfp2

/interface pppoe-client
add add-default-route=yes allow=pap,chap comment="Wan1-PPPoe" disabled=no interface=ether1 name=pppoe-wan1 password=pluto user=pippo

/interface vlan
add interface=bridge_switch name=vlan10 vlan-id=10
add interface=bridge_switch name=vlan20 vlan-id=20
add interface=bridge_switch name=vlan30 vlan-id=30

/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports="switch1-cpu,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ethe\
    r14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,sfp1,sfp2"

/ip pool
add name=pool_vlan10 ranges=192.168.10.10-192.168.10.100
add name=pool_vlan20 ranges=192.168.20.20-192.168.20.100
add name=pool_vlan30 ranges=192.168.30.20-192.168.30.100

/ip dhcp-server
add address-pool=pool_vlan10 disabled=no interface=vlan10 name=dhcp_vlan10
add address-pool=pool_vlan20 disabled=no interface=vlan20 name=dhcp_vlan20
add address-pool=pool_vlan30 disabled=no interface=vlan30 name=dhcp_vlan30

/interface bridge port
add bridge=bridge_switch interface=ether3
add bridge=bridge_switch interface=ether4
add bridge=bridge_switch interface=ether5
add bridge=bridge_switch interface=ether6
add bridge=bridge_switch interface=ether7
add bridge=bridge_switch interface=ether8
add bridge=bridge_switch interface=ether9
add bridge=bridge_switch interface=ether10
add bridge=bridge_switch interface=ether11
add bridge=bridge_switch interface=ether12
add bridge=bridge_switch interface=ether13
add bridge=bridge_switch interface=ether14
add bridge=bridge_switch interface=ether15
add bridge=bridge_switch interface=ether16
add bridge=bridge_switch interface=ether17
add bridge=bridge_switch interface=ether18
add bridge=bridge_switch interface=ether19
add bridge=bridge_switch interface=ether20
add bridge=bridge_switch interface=ether21
add bridge=bridge_switch interface=ether22
add bridge=bridge_switch interface=ether23
add bridge=bridge_switch interface=ether24
add bridge=bridge_switch interface=sfp1
add bridge=bridge_switch interface=sfp2

/interface ethernet switch egress-vlan-tag
add tagged-ports=switch1-cpu vlan-id=10
add tagged-ports="ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,eth\
    er21,ether22,ether23,ether24,sfp1,sfp2,switch1-cpu" vlan-id=20
add tagged-ports="ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,eth\
    er21,ether22,ether23,ether24,sfp1,sfp2,switch1-cpu" vlan-id=30

/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=10 ports=ether3
add customer-vid=0 new-customer-vid=10 ports=ether4
add customer-vid=0 new-customer-vid=10 ports=ether5
add customer-vid=0 new-customer-vid=10 ports=ether6
add customer-vid=0 new-customer-vid=10 ports=ether7
add customer-vid=0 new-customer-vid=10 ports=ether8
add customer-vid=0 new-customer-vid=10 ports=ether9
add customer-vid=0 new-customer-vid=10 ports=ether10
add customer-vid=0 new-customer-vid=10 ports=ether11
add customer-vid=0 new-customer-vid=10 ports=ether12
add customer-vid=0 new-customer-vid=10 ports=ether13
add customer-vid=0 new-customer-vid=10 ports=ether14
add customer-vid=0 new-customer-vid=10 ports=ether15
add customer-vid=0 new-customer-vid=10 ports=ether16
add customer-vid=0 new-customer-vid=10 ports=ether17
add customer-vid=0 new-customer-vid=10 ports=ether18
add customer-vid=0 new-customer-vid=10 ports=ether19
add customer-vid=0 new-customer-vid=10 ports=ether20
add customer-vid=0 new-customer-vid=10 ports=ether21
add customer-vid=0 new-customer-vid=10 ports=ether22
add customer-vid=0 new-customer-vid=10 ports=ether23
add customer-vid=0 new-customer-vid=10 ports=ether24
add customer-vid=0 new-customer-vid=10 ports=sfp1
add customer-vid=0 new-customer-vid=10 ports=sfp2

/interface ethernet switch vlan
add ports="ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,et\
    her22,ether23,ether24,sfp1,sfp2,switch1-cpu" vlan-id=10
add ports="ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,et\
    her22,ether23,ether24,sfp1,sfp2,switch1-cpu" vlan-id=20
add ports="ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,et\
    her22,ether23,ether24,sfp1,sfp2,switch1-cpu" vlan-id=30

/ip address
add address=192.168.10.1/24 interface=vlan10 network=192.168.10.0
add address=192.168.20.1/24 interface=vlan20 network=192.168.20.0
add address=192.168.30.1/24 interface=vlan30 network=192.168.30.0

/ip dhcp-server network
add address=192.168.10.0/24 dns-server=192.168.10.1 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=192.168.20.1 gateway=192.168.20.1
add address=192.168.30.0/24 dns-server=192.168.30.1 gateway=192.168.30.1

/ip dns
set allow-remote-requests=yes cache-size=10000KiB servers=8.8.4.4,208.67.220.220

/ip firewall filter
add action=drop chain=forward comment="drop invalid connections" connection-state=invalid
add action=accept chain=forward comment="allow already established connections" connection-state=established
add action=accept chain=forward comment="allow related connections" connection-state=related
add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp
add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 protocol=icmp
add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 protocol=icmp
add action=accept chain=icmp comment="allow source quench" icmp-options=4:0 protocol=icmp
add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 protocol=icmp
add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 protocol=icmp
add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 protocol=icmp
add action=drop chain=icmp comment="deny all other types"
add action=drop chain=input dst-port=53 in-interface=pppoe-wan1 protocol=udp

/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-wan1

/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes

/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=222
set api disabled=yes
set api-ssl disabled=yes

/lcd
set default-screen=informative-slideshow read-only-mode=yes

/system clock
set time-zone-name=Europe/Rome

/system ntp client
set enabled=yes primary-ntp=91.189.89.198 secondary-ntp=188.40.67.131

Spero ti sia stato utile e se vuoi offrimi una birra 😉

Submit a Comment

*

adidas yeezy 650 boost adidas yeezy boost 650 adidas yeezy 650 boost colorways adidas yeezy 650 350 2 0 boost yeezy boost 650 adidas yeezy boost 650 supreme x nike air uptempo release info adidas yeezy boost 650 v1 sample detailed look adidas yeezy boost 650 v1 sample adidas yeezy boost 650 v1 sample adidas yeezy boost 650 v1 adidas yeezy 650 boost adidas yeezy boost 650 adidas yeezy 650 boost colorways adidas yeezy 650 350 2 0 boost yeezy boost 650 adidas yeezy boost 650 supreme x nike air uptempo release info adidas yeezy boost 650 v1 sample detailed look adidas yeezy boost 650 v1 sample