any advice is appreciated.
Code: Select all
# apr/20/2023 09:10:44 by RouterOS 7.8
# software id = NVZC-831S
#
# model = RB5009UPr+S+
# serial number = HDA08CJZJ94
/interface bridge
add admin-mac=18:FD:74:CF:67:FC auto-mac=no comment=defconf name=bridge
/interface veth
add address=172.17.0.2/16 gateway=172.17.0.1 name=veth1
/disk
add parent=usb1 partition-number=1 partition-offset=512 partition-size=\
"31 004 294 656" type=partition
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk group-key-update=8h mode=dynamic-keys name=\
DevoRoxy supplicant-identity=""
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=8h name=defconf
/container config
set ram-high=512 registry-url=https://registry-1.docker.io tmpdir=\
usb1-part1/pull
/container envs
add key=MEM_LIMIT name=unifi value=512
add key=MEM_STARTUP name=unifi value=256
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=172.17.0.1/16 interface=*B network=172.17.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=30m
/ip cloud advanced
set use-local-address=yes
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.225 comment=AdGuardHome mac-address=44:07:0B:84:81:D2 \
server=defconf
add address=192.168.88.107 client-id=1:dc:a6:32:3c:d0:bf mac-address=\
DC:A6:32:3C:D0:BF server=defconf
add address=192.168.88.133 client-id=1:60:22:32:2d:2e:e9 mac-address=\
60:22:32:2D:2E:E9 server=defconf
add address=192.168.88.135 client-id=1:f0:9f:c2:70:ae:11 mac-address=\
F0:9F:C2:70:AE:11 server=defconf
add address=192.168.88.137 client-id=1:78:45:58:87:a7:93 mac-address=\
78:45:58:87:A7:93 server=defconf
add address=192.168.88.73 client-id=\
ff:ca:53:9:5a:0:2:0:0:ab:11:95:be:bd:77:e0:89:97:6c mac-address=\
0E:9F:CA:CE:7D:91 server=defconf
add address=192.168.88.72 client-id=\
ff:ca:53:9:5a:0:2:0:0:ab:11:f1:c3:5b:7a:86:5:c9:81 mac-address=\
F6:E0:99:75:4C:F5 server=defconf
add address=192.168.88.71 client-id=1:6:f:21:98:21:7e comment=\
"Turnkey Fileserver (Samba)" mac-address=06:0F:21:98:21:7E server=defconf
add address=192.168.88.30 client-id=\
ff:ca:53:9:5a:0:2:0:0:ab:11:44:68:85:44:bd:d9:e5:18 mac-address=\
E2:9E:BA:61:5B:E1 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.88.225
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=hda08cjzj94.sn.mynetname.net list=mycloud
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=Hairpin dst-address=\
192.168.88.0/24 src-address=192.168.88.0/24
add action=dst-nat chain=dstnat comment="Port forwarding with cloud" \
dst-address-list=mycloud dst-port=443 protocol=tcp to-addresses=\
192.168.88.107 to-ports=443
add action=dst-nat chain=dstnat dst-address-list=mycloud dst-port=80 \
protocol=tcp to-addresses=192.168.88.107 to-ports=80
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.88.107 \
dst-port=53 protocol=udp src-address=!192.168.88.107 to-addresses=\
192.168.88.107
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.88.107 \
dst-port=53 protocol=tcp src-address=!192.168.88.107 to-addresses=\
192.168.88.107
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.88.107 \
dst-port=53 protocol=udp src-address=192.168.88.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.88.107 \
dst-port=53 protocol=tcp src-address=192.168.88.0/24
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system clock
set time-zone-autodetect=no time-zone-name=America/Los_Angeles
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Code: Select all
chad@raspberrypi:~/docker $ docker exec -it c5a201e0ce33 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
26: eth0@if27: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0
valid_lft forever preferred_lft forever