I was a bit confused about the last updated script. Some parts from the initial script you first sent me was missing so I wasn’t sure if I should incude the missing parts or not. I tried both, but nothing worked. I’ve played around with it quite a bit, but can’t seem to get it working. Several error messages (see comments in script below) and no internet. Since DHCP server isn’t running, my office computer also can’t get a valid IP. I tried static (192.168.1.10 and gateway 192.168.1.1, DNS 193.75.75.193 (from my ISP)). I can ping the routerboard, but no internet.
We actually don’t need DHCP. The guest router (UniFi Amplifi HD on eth3) can be put in router mode (is now in bridge mode), the two office computers can have static IP, and POS system has it’s own UniFi Security Gateway with a running DHCP. That might make it much simpler and more secure. Same IPs as before, but office computers 1 and 2 can have 192.168.1.10 and 192.168.1.11.
I have included the complete script (what I believe is the complete(?) script).
If you have the possibility to help me more, please include the complete script (to setup a reset routerboard with no default configuration)
/interface bridge
add admin-mac=E4:8D:8C:2D:27:5A auto-mac=no comment=“TrustedBridge” name=WorkBridge
/interface ethernet
set [ find default-name=ether1 ] name=eth1_WAN
set [ find default-name=ether2 ] name=eth2_kontor
set [ find default-name=ether3 ] name=eth3_gjest
set [ find default-name=ether4 ] name=eth4_gastrofix
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface bridge port
add bridge=WorkBridge comment=“TrustedInterface” interface=eth2_kontor hw=yes
add bridge=WorkBridge comment=“TrustedInterface” interface=eth4_gastrofix hw=yes
#here it kills winbox connection, all ok after manual re-connect.
/ip neighbor discovery-settings
set discover-interface-list=none
/interface list member
add interface=eth1_WAN list=WAN
add interface=WorkBridge list=LAN
add interface=eth3_gjest list=LAN
/ip pool
add name=WorkLAN_pool ranges=192.168.1.10-192.168.1.254
add name=GuestLAN_pool ranges=192.168.2.2-192.168.2.254
add name=POSLAN_pool ranges=192.168.7.20-192.168.7.254
/ip address
add address=192.168.1.1/24 interface=eth2_kontor network=192.168.1.0
add address=192.168.2.1/24 interface=eth3_gjest network=192.168.2.0
add address=192.168.7.1/24 interface=eth4_gastrofix network=192.168.7.0
/ip dhcp-server
#failure: can not run on slave interface (works if I put for example ether7, 8 or something, but not 2 and 4. Also works on eth3_gjest but that is already running for name=Guest_Server):
add address-pool=WorkLAN_pool disabled=no interface=eth2_kontor name=Office_Server
add address-pool=GuestLAN_pool disabled=no interface=eth3_gjest name=Guest_Server
#failure: can not run on slave interface:
add address-pool=POSLAN_pool disabled=no interface=eth4_gastrofix name=POS_Server
/ip dhcp-client
add add-default-route=no comment=defconf dhcp-options=hostname,clientid interface=eth1_WAN
/ip dns
set allow-remote-requests=yes
/ip firewall filter
#{INPUT}
add action=accept chain=input comment=“defconf: accept established,related” connection-state=established,related
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“Admin Access to Router” src-address-list=AdminAccess
add action=accept chain=input comment=“allow LAN to DNS-TCP” protocol=tcp dst-port=53 in-interface-list=LAN
add action=accept chain=input comment=“allow LAN to DNS-UDP” protocol=udp dst-port=53 in-interface-list=LAN
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=drop chain=input comment=“Drop All Else”
#{FORWARD}
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related” connection-state=established,related
add action=drop chain=forward comment=“drop invalid” connection-state=invalid
add action=accept chain=forward comment=“Allow Office and POS Traffic to Internet” in-interface=WorkBridge out-interface=WAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=log chain=forward comment=“Show ALL Else Dropped” log=yes log-prefix=“FORWARD DROP-All Else”
add action=drop chain=forward comment=“DROP ALL Else”
#input does not match any value of interface:
add action=accept chain=forward comment=“Allow Traffic to Internet (GuestWIFI)” in-interface=eth3_gjest out-interface=WAN src-address=192.168.2.2-192.168.2.254
add action=accept chain=forward comment=“Allow Port Fowarding if required” connection-nat-state=dstnat
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
#expected end of command (line 1 column 24):
add action=log log=yes prefix=“SHOW ALL ELSE DROPPED” comment=“Help adjust blocked traffic log”
add action=drop chain=forward comment=“DROP All Else”
/ip firewall address-list
#admin PC on work network (and add more PCs you use as required)
add address=192.168.1.10 list=AdminAccess
add address=192.168.1.11 list=AdminAccess
#OR all PCs on work network can access router:
#add address=192.168.1.0/24 list=AdminAccess
/ip firewall nat
#input does not match any value of interface:
add action=masquerade chain=srcnat comment=“Source_NAT for All Users” ipsec-policy=out,none out-interface=WAN
add action=redirect chain=dstnat comment=“Force Users to Router DNS -TCP” protocol=tcp dst-port=53
add action=redirect chain=dstnat comment=“Force Users to Router DNS -UDP” protocol=udp dst-port=53
/ip route
add dst-address=0.0.0.0/0 gateway=193.90.223.117 distance=1
/ip firewall address-list
add address=0.0.0.0/8 list=bogons
add address=172.16.0.0/12 list=bogons
#add address=192.168.0.0/16 list=bogons ****************************** REMOVE THIS ONE AS ITS BEING USED ON YOUR NETWORK>
add address=10.0.0.0/8 list=bogons
add address=169.254.0.0/16 list=bogons
add address=127.0.0.0/8 list=bogons
add address=224.0.0.0/4 list=bogons
add address=198.18.0.0/15 list=bogons
add address=192.0.0.0/24 list=bogons
add address=192.0.2.0/24 list=bogons
add address=198.51.100.0/24 list=bogons
add address=203.0.113.0/24 list=bogons
add address=100.64.0.0/10 list=bogons
add address=240.0.0.0/4 list=bogons
add address=192.88.99.0/24 list=bogons
/ip firewall raw
add chain=prerouting action=drop src-address-list=bogons comment=“Drop all non-internet networks”
