Hello Everyone,
I have been toying with my hEX POE for a while trying to understand and create a configuration that would suite my needs:
- dualwan with failover with 2 ISP delivering dynamic addresses. I am not looking for lodd balancing as the second ISP is a 4G LTE router.
- secured
Can I submit this config to your expert eyes and get your opinion?
For now, there is no WiFi configuration as my sandbox router has no wifi chip but it will come later with some CAPsMAN config.
I am a total beginner, with no IT training so be comprehensive for any obvious big mistakes…
Thank you!
Here is the config file:
/interface bridge
add name=bridge-lan
/interface list
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=lan-pool ranges=192.168.0.5-192.168.0.254
/ip dhcp-server
add address-pool=lan-pool interface=bridge-lan name=dhcp-lan
/interface bridge port
add bridge=bridge-lan interface=ether3
add bridge=bridge-lan interface=ether4
/interface list member
add interface=ether1 list=WAN
add interface=ether2 list=WAN
/ip address
add address=192.168.0.XXX/24 interface=bridge-lan network=192.168.0.0
/ip dhcp-client
# Interface not active
add add-default-route=no interface=ether1 script=":local rname \"ISP1_check\"\
\n:local gwt [/ip route find where comment=\$rname]\
\n:if (\$bound=1) do={\
\n /ip route set \$gwt gateway=\$\"gateway-address\"\
\n} else={\
\n /ip route set \$gwt gateway=127.0.0.1\
\n}" use-peer-ntp=no
add add-default-route=no interface=ether2 script=":local rname \"ISP2_check\"\
\n:local gwt [/ip route find where comment=\$rname]\
\n:if (\$bound=1) do={\
\n /ip route set \$gwt gateway=\$\"gateway-address\"\
\n} else={\
\n /ip route set \$gwt gateway=127.0.0.1\
\n}" use-peer-ntp=no
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.101 gateway=192.168.0.XXX
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=drop chain=input comment="Drop known bad IPs" dst-port=22,23,8291 \
protocol=tcp src-address-list=blocked-ips
add action=add-src-to-address-list address-list=blocked-ips \
address-list-timeout=1d chain=input connection-state=new dst-port=22 \
protocol=tcp src-address-list=ssh_stage1
add action=accept chain=input comment="Allow established/related" \
connection-state=established,related
add action=drop chain=input comment="Drop invalid connections" \
connection-state=invalid
add action=accept chain=input comment="Allow LAN access to router" \
in-interface=bridge-lan
add action=drop chain=input comment="Drop everything else (WAN to router)"
add action=accept chain=forward comment="Allow established/related forward" \
connection-state=established,related
add action=drop chain=forward comment="Drop invalid forward" \
connection-state=invalid
add action=accept chain=forward comment="Allow LAN to WAN" in-interface=\
bridge-lan out-interface-list=WAN
add action=drop chain=forward comment="Drop all other forward traffic"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add comment=ISP1_check dst-address=8.8.8.8/32 gateway=127.0.0.1 scope=10
add comment=ISP2_check dst-address=1.1.1.1/32 gateway=10.0.0.1 scope=10
add check-gateway=ping distance=1 gateway=8.8.8.8 target-scope=11
add check-gateway=ping distance=2 gateway=1.1.1.1 target-scope=11
/system clock
set time-zone-name=Europe/Paris
/system note
set show-at-login=no
]