:global GlobalFuncReady false;
# Git commit id & info, expected configuration version
-:global CommitId "main/400/bdb022f2";
+:global CommitId "main/401/b55e8919";
:global CommitTAG "unknown";
-:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 02:40:03 02.05.2026.";
+:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 03:05:02 02.05.2026.";
# The variables are received right here.
:global GlobalConfVersion 138;
--- /dev/null
+# adguard home to container | by @xdenb43
+# tested on hap ax3/RoS 7.17.2+
+
+# enable containers, follow https://help.mikrotik.com/docs/spaces/ROS/pages/84901929/Container
+/system/device-mode/update container=yes
+
+# MAIN PART STARTS HERE
+/interface veth
+add address=192.168.254.5/24 gateway=192.168.254.1 name=ADGUARD-HOME
+
+/interface bridge
+add name=Bridge-Docker port-cost-mode=short
+/interface bridge port
+add bridge=Bridge-Docker interface=ADGUARD-HOME
+/ip address
+add address=192.168.254.1/24 interface=Bridge-Docker network=192.168.254.0
+
+/ip firewall nat
+add action=masquerade chain=srcnat comment=AdGuardHome src-address=192.168.254.5
+
+# USB flash drive, FS ext4
+/container config
+set ram-high=200.0MiB registry-url=https://registry-1.docker.io tmpdir=/usb1/docker/pull
+
+/container mounts
+add dst=/opt/adguardhome/conf name=adguard_home_conf src=/usb1/docker_configs/adguard_home
+
+/container
+add cmd="-c /opt/adguardhome/conf/AdGuardHome.yaml -h 0.0.0.0 -w /opt/adguardhome/work" entrypoint=/opt/adguardhome/AdGuardHome interface=ADGUARD-HOME logging=yes mounts=\
+ adguard_home_conf root-dir=/usb1/docker/adguard_home workdir=/opt/adguardhome/work remote-image=adguard/adguardhome:latest
+
+/container/start [find where interface=ADGUARD-HOME]
+
+# ADH available on http://192.168.254.5:300 , configure before use
+# Choose one of the options below
+# uncomment lines before copying to terminal
+
+# OPTION 1
+# Just set AGH ip as DNS server.
+# /!\ DNS FWD will work.
+# /!\ No device-related stats will be gathered (all dns requests are coming from mikrotik)
+#/ip dns
+#set allow-remote-requests=yes servers=192.168.254.5
+#/ip firewall nat
+#add action=redirect chain=dstnat comment="Incoming DNS redirect" dst-address-type=!local dst-port=53 in-interface-list=LAN protocol=udp
+#add action=redirect chain=dstnat comment="Incoming DNS redirect" dst-address-type=!local dst-port=53 in-interface-list=LAN protocol=tcp
+
+
+# OPTION 2
+# Forward all DNS requests to ADH
+# /!\ DNS FWD will NOT work
+# /!\ WILL SHOW stats for every LAN device
+#/ip firewall nat
+#add action=dst-nat chain=dstnat comment="local AdGuard udp - NO NAT Loopback / local addresses only!" dst-port=53 in-interface-list=LAN protocol=udp src-address=\
+# 192.168.88.0/24 to-addresses=192.168.254.5 to-ports=53
+#add action=dst-nat chain=dstnat comment="local AdGuard tcp" dst-port=53 in-interface-list=LAN protocol=tcp src-address=192.168.88.0/24 to-addresses=192.168.254.5 to-ports=53
--- /dev/null
+# DNS Forwarders | by @xmrdenb43
+# tested on hap ac lite tc/hap ax3, RoS 7.18.2+
+
+/ip dns static
+add address=8.8.8.8 comment="DNS Google" name=dns.google type=A
+add address=8.8.4.4 comment="DNS Google" name=dns.google type=A
+add address=9.9.9.9 comment="DNS Quad9" name=dns.quad9.net type=A
+add address=149.112.112.112 comment="DNS Quad9" name=dns.quad9.net type=A
+add address=195.133.25.16 comment="DNS Comss" name=dns.comss.one type=A
+
+/ip dns forwarders
+add doh-servers=https://cloudflare-dns.com/dns-query name="CloudFlare DoH"
+add doh-servers=https://secure.cloudflare-dns.com/dns-query name="CloudFlare Secure DoH"
+add disabled=yes doh-servers=https://dns.quad9.net/dns-query name="Quad9 Default" verify-doh-cert=no
+add doh-servers=https://dns.google/dns-query name="Google DoH"
+add dns-servers=dns.comss.one doh-servers=https://dns.comss.one/mikrotik name="Comss DoH" verify-doh-cert=no
+add doh-servers=https://cloudflare-dns.com/dns-query,https://dns.google/dns-query name="CF & Google DoH"
+add dns-servers=1.0.0.1,8.8.4.4,1.1.1.1,8.8.8.8,77.88.8.1,77.88.8.8 name="CF & G & Ya IPv4" verify-doh-cert=no
--- /dev/null
+# Import minimum cerificates to have several DOHs servers working
+# by xdenb43 | tested on hap ac lite tc/hap ax3, RoS 7.17+
+
+#CloudFlare
+/tool fetch https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem
+/certificate import file-name=DigiCertGlobalRootG2.crt.pem passphrase=""
+#/ip dns set allow-remote-requests=yes use-doh-server=https://cloudflare-dns.com/dns-query verify-doh-cert=yes
+#secure https://secure.cloudflare-dns.com/dns-query
+
+#Quad9
+/tool/fetch url=https://cacerts.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crt.pem
+/certificate/import file-name=DigiCertGlobalG3TLSECCSHA3842020CA1-2.crt.pem
+#/ip dns set allow-remote-requests=yes use-doh-server=https://dns.quad9.net/dns-query verify-doh-cert=yes
+
+#Google
+/tool fetch url=https://i.pki.goog/r1.pem
+/tool fetch url=https://i.pki.goog/r2.pem
+/tool fetch url=https://i.pki.goog/r3.pem
+/tool fetch url=https://i.pki.goog/r4.pem
+/tool fetch url=https://i.pki.goog/gsr4.pem
+/certificate/import file-name=r1.pem
+/certificate/import file-name=r2.pem
+/certificate/import file-name=r3.pem
+/certificate/import file-name=r4.pem
+/certificate/import file-name=gsr4.pem
+#/ip dns set allow-remote-requests=yes use-doh-server=https://dns.google/dns-query verify-doh-cert=yes
+
+#COMSS - rename .crt to .pem!!!
+#/tool/fetch url=https://www.tbs-x509.com/USERTrustRSACertificationAuthority.crt dst-path=USERTrustRSACertificationAuthority.crt.pem
+/tool/fetch url=https://www.tbs-x509.com/USERTrustRSACertificationAuthority.crt
+/certificate/import file-name=USERTrustRSACertificationAuthority.crt
+#/ip dns set allow-remote-requests=yes use-doh-server=https://dns.comss.one/mikrotik verify-doh-cert=yes
+
+
+#big list ~ 2Mb
+#/tool fetch url=https://curl.se/ca/cacert.pem
+#/certificate import file-name=cacert.pem passphrase=""
--- /dev/null
+# VPN Clients connection failover resolution | by @xdenb43
+# tested on hap ac lite tc, RoS 7.18.2+
+# based on recursive routing and DNS FWD + mangle
+#
+# VPNs clients configured:
+# wg-proton - Wireguard Proton
+# wg-bth - Mikrotik Back-To-Home via relay
+# wg-warp - CloudFlare Warp
+#
+# External servers used to check internet availability:
+# 77.88.8.2 - Yandex secure DNS
+# 1.1.1.3 - CF Family DNS
+#
+# Cheat by @wiktorbgu MUST be used to have WG working
+# https://gist.github.com/wiktorbgu/1f2dfe99837d8f2803483be95814d2e5
+
+# Addresses
+/ip address
+add address=10.2.0.2/24 interface=wg-proton network=10.2.0.0
+add address=172.16.0.2/24 interface=wg-warp network=172.16.0.0
+add address=192.168.216.4/24 interface=wg-bth network=192.168.216.0
+
+# Routing tables
+# any_vpn_out - used for ANY vpn connection
+# geo_vpn_out - used to bypass GEO check
+/routing table
+add disabled=no fib name=any_vpn_out
+add disabled=no fib name=geo_vpn_out
+
+# Routes with priorities
+# Target Scope for recursive route MUST be greater than next hope route targetr scope value
+/ip route
+add comment="proton recursive routing" disabled=no distance=21 dst-address=0.0.0.0/0 gateway=77.88.8.2 routing-table=any_vpn_out scope=30 suppress-hw-offload=no \
+ target-scope=11
+add comment="proton recursive routing" disabled=no distance=20 dst-address=0.0.0.0/0 gateway=77.88.8.2 routing-table=geo_vpn_out scope=30 suppress-hw-offload=no \
+ target-scope=11
+add comment="warp recursive routing" disabled=no distance=20 dst-address=0.0.0.0/0 gateway=1.1.1.3 routing-table=any_vpn_out scope=30 suppress-hw-offload=no \
+ target-scope=11
+add comment=bth disabled=no distance=21 dst-address=0.0.0.0/0 gateway=192.168.216.1 routing-table=geo_vpn_out scope=30 suppress-hw-offload=no target-scope=10
+add comment=bth disabled=no distance=22 dst-address=0.0.0.0/0 gateway=192.168.216.1 routing-table=any_vpn_out scope=30 suppress-hw-offload=no target-scope=10
+add check-gateway=ping comment="proton monitor external ip" disabled=no distance=20 dst-address=77.88.8.2/32 gateway=10.2.0.1 routing-table=main scope=10 \
+ suppress-hw-offload=no target-scope=10
+add check-gateway=ping comment="warp monitor external ip" disabled=no distance=20 dst-address=1.1.1.3/32 gateway=172.16.0.1 routing-table=main scope=10 \
+ suppress-hw-offload=no target-scope=10
git.vados.ru / Mikrotiks / ros.vados.ru.git / commitdiff
