--- /dev/null
+# 2026-04-30 14:40:01 by RouterOS 7.22\r
+# software id = 2961-C4ZZ\r
+#\r
+# model = RBD52G-5HacD2HnD\r
+# serial number = HCX084RAVFA\r
+/interface bridge\r
+add admin-mac=48:8F:5A:60:A1:0B auto-mac=no name=Bridge-LAN port-cost-mode=\\r
+ short\r
+/interface ethernet\r
+set [ find default-name=ether1 ] comment="WAN - Unet" mac-address=\\r
+ F6:BE:9D:85:53:F5 name="ether1 - Unet"\r
+set [ find default-name=ether3 ] comment=LEN\r
+set [ find default-name=ether4 ] comment=NUC\r
+/interface l2tp-server\r
+add comment=Server disabled=yes name=l2tp-in1 user=vados\r
+/interface l2tp-client\r
+add comment="Starless 2 MikroSPb" connect-to=176.53.203.171 name=l2tp-EoIP \\r
+ user=vados\r
+add allow=mschap2 allow-fast-path=yes comment=Starless connect-to=\\r
+ vpn.starless.ru max-mru=1280 name=l2tp-vpn use-ipsec=yes use-peer-dns=yes \\r
+ user=vados\r
+/interface wireless\r
+# managed by CAPsMAN\r
+# channel: 2422/20-Ce/gn(17dBm), SSID: vados, local forwarding\r
+set [ find default-name=wlan1 ] ampdu-priorities=0,1,2,3,4,5,6,7 band=\\r
+ 2ghz-b/g/n basic-rates-a/g=\\r
+ 6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps basic-rates-b=\\r
+ 1Mbps,2Mbps,5.5Mbps,11Mbps channel-width=20/40mhz-XX country=belarus \\r
+ disabled=no frequency=auto hw-protection-mode=rts-cts mode=ap-bridge \\r
+ rate-set=configured skip-dfs-channels=10min-cac ssid=vados \\r
+ station-roaming=enabled wds-default-bridge=Bridge-LAN wds-mode=\\r
+ dynamic-mesh wireless-protocol=802.11 wmm-support=enabled wps-mode=\\r
+ disabled\r
+# managed by CAPsMAN\r
+# channel: 5260/20-Ceee/ac/DP(17dBm), SSID: vados5g, local forwarding\r
+set [ find default-name=wlan2 ] ampdu-priorities=0,1,2,3,4,5,6,7 band=\\r
+ 5ghz-a/n/ac basic-rates-a/g=\\r
+ 6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps channel-width=\\r
+ 20/40/80mhz-XXXX country=belarus disabled=no frequency=auto \\r
+ hw-protection-mode=rts-cts mode=ap-bridge rate-set=configured \\r
+ skip-dfs-channels=10min-cac ssid=vados5g station-roaming=enabled \\r
+ wds-default-bridge=Bridge-LAN wds-mode=dynamic-mesh wireless-protocol=\\r
+ 802.11 wmm-support=enabled wps-mode=disabled\r
+/interface wireguard\r
+add listen-port=13231 mtu=1280 name=WG\r
+/interface wireless nstreme\r
+# managed by CAPsMAN\r
+# channel: 2422/20-Ce/gn(17dBm), SSID: vados, local forwarding\r
+set wlan1 enable-nstreme=yes\r
+# managed by CAPsMAN\r
+# channel: 5260/20-Ceee/ac/DP(17dBm), SSID: vados5g, local forwarding\r
+set wlan2 enable-nstreme=yes\r
+/caps-man security\r
+add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm \\r
+ group-encryption=aes-ccm name=security\r
+/caps-man configuration\r
+add channel.band=2ghz-b/g/n .control-channel-width=20mhz .extension-channel=\\r
+ XX country=belarus datapath.client-to-client-forwarding=yes \\r
+ .local-forwarding=yes name=cfg-2ghz security=security ssid=vados\r
+add channel.band=5ghz-a/n/ac .control-channel-width=20mhz .extension-channel=\\r
+ XXXX country=belarus datapath.client-to-client-forwarding=yes \\r
+ .local-forwarding=yes name=cfg-5ghz-ac security=security ssid=vados5g\r
+add channel.band=5ghz-a/n .control-channel-width=20mhz .extension-channel=XX \\r
+ country=belarus datapath.client-to-client-forwarding=yes \\r
+ .local-forwarding=yes name=cfg-5ghz-an security=security ssid=vados5g\r
+/disk\r
+add media-interface=lo slot=tmpfs tmpfs-max-size=44739242 type=tmpfs\r
+/interface list\r
+add comment=defconf name=WAN\r
+add comment=defconf name=LAN\r
+/interface lte apn\r
+set [ find default=yes ] ip-type=ipv4 use-network-apn=no\r
+/interface wifi channel\r
+add band=5ghz-ax disabled=no frequency=5180,5200,5220,5240 name=5G-AX\r
+add band=5ghz-ac disabled=no frequency=5180,5200,5220,5240 name=5G-AC\r
+add band=2ghz-n disabled=no frequency=2422,2442,2462 name=2G-N\r
+add band=2ghz-ax disabled=no frequency=2422,2442,2462 name=2G-AX\r
+add band=2ghz-g disabled=no frequency=2422,2442,2462 name=2G-G\r
+add band=5ghz-n disabled=no frequency=5180,5200,5220,5240 name=5G-AN\r
+/interface wifi datapath\r
+add bridge=Bridge-LAN disabled=no interface-list=all name=xs-DataPath\r
+/interface wifi security\r
+add authentication-types=wpa2-psk,wpa3-psk disabled=no group-encryption=ccmp \\r
+ group-key-update=1h management-protection=allowed name=sec2g\r
+add authentication-types=wpa3-psk disable-pmkid=yes disabled=no \\r
+ group-encryption=ccmp group-key-update=5m management-encryption=cmac \\r
+ management-protection=required name=sec5G\r
+/interface wifi configuration\r
+add channel=2G-AX datapath=xs-DataPath disabled=no mode=ap name=2G-AX \\r
+ security=sec2g security.ft=yes .ft-over-ds=yes ssid=vados\r
+add channel=2G-N datapath=xs-DataPath disabled=no mode=ap name=2G-N security=\\r
+ sec2g security.ft=yes .ft-over-ds=yes ssid=vados\r
+add channel=5G-AX disabled=no mode=ap name=5G-AX security=sec5G security.ft=\\r
+ yes .ft-over-ds=yes ssid=vados\r
+add channel=5G-AC datapath=xs-DataPath disabled=no mode=ap name=5G-AC \\r
+ security=sec5G security.authentication-types="" .ft=yes .ft-over-ds=yes \\r
+ ssid=vados\r
+add channel=2G-G datapath=xs-DataPath disabled=no mode=ap name=2G-G security=\\r
+ sec2g security.authentication-types="" .ft=yes .ft-over-ds=yes ssid=vados\r
+add channel=5G-AN disabled=no mode=ap name=5G-AN security=sec5G ssid=vados\r
+/interface wireless security-profiles\r
+set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\\r
+ dynamic-keys supplicant-identity=MikroTik\r
+/ip dhcp-server option\r
+add code=12 name=HostName\r
+add code=119 force=yes name=domain-search-list value="0x03'WORKGROUP'0x00"\r
+/ip dhcp-server option sets\r
+add name=HP1505n options=HostName\r
+add name=StartLife1 options=HostName\r
+add name=amsterDev options=HostName\r
+add name=MiTV options=HostName\r
+add name=miller options=HostName\r
+add name=amster options=HostName\r
+add name=garage options=HostName\r
+add name=domain-search-set options=domain-search-list\r
+add name=VADOS-LEN options=HostName\r
+add name=VADOS-NUC options=HostName\r
+add name=MikroNUC options=HostName\r
+add name=master options=HostName\r
+add name=MikroYellow options=HostName\r
+add name="=\"Client ID\"" options=HostName\r
+add name=mVados options=HostName\r
+/ip dns forwarders\r
+add dns-servers=1.1.1.1,1.0.0.1 name=blsp.at verify-doh-cert=no\r
+add comment=Kra dns-servers=1.0.0.1,1.1.1.1 name=slon2.to verify-doh-cert=no\r
+add dns-servers=1.1.1.1,1.0.0.1 name=slon3.at verify-doh-cert=no\r
+add dns-servers=1.0.0.1,1.1.1.1 name=slon3.cc verify-doh-cert=no\r
+add dns-servers=1.1.1.1,1.0.0.1 name=bs2web.at verify-doh-cert=no\r
+add dns-servers=1.1.1.1,1.0.0.1 name=bs2best.at verify-doh-cert=no\r
+add dns-servers=1.0.0.1,1.1.1.1 name=psrms.is verify-doh-cert=no\r
+add dns-servers=1.0.0.1,1.1.1.1 name=m.blsp.at verify-doh-cert=no\r
+/ip ipsec proposal\r
+set [ find default=yes ] disabled=yes\r
+/ip pool\r
+add name=dhcp ranges=10.30.30.150-10.30.30.200\r
+/ip dhcp-server\r
+add add-arp=yes address-pool=dhcp dhcp-option-set=domain-search-set \\r
+ dynamic-lease-identifiers=client-mac,client-id,opt-82 interface=\\r
+ Bridge-LAN lease-time=10m name=masterDHCP server-address=10.30.30.81 \\r
+ use-reconfigure=yes\r
+/ip hotspot user profile\r
+set [ find default=yes ] address-pool=dhcp\r
+/ip smb users\r
+set [ find default=yes ] disabled=yes\r
+add disabled=yes name=vados\r
+/ppp profile\r
+set *FFFFFFFE use-upnp=no\r
+/routing bgp template\r
+set default disabled=no output.network=bgp-networks\r
+/routing table\r
+add disabled=no fib name=To-VPN\r
+/snmp community\r
+set [ find default=yes ] addresses=10.30.30.0/24 read-access=no security=\\r
+ private\r
+/system logging action\r
+add email-start-tls=yes email-to=vados@vados.ru name=email target=email\r
+/system script\r
+add comment="Example add WU servers to AddrList" dont-require-permissions=no \\r
+ name=WU-add-to-list owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ \_Script to add target web sites DNS IP addresses into address list\r\\r
+ \n# Tested with Mikrotik 6.4x\r\\r
+ \n# Syed Jahanzaib / aacable@hotmail.com\r\\r
+ \n# List name\r\\r
+ \n:local LISTNAME \"windowsupdateslist\"\r\\r
+ \n# Web site names which will be added in address list\r\\r
+ \n:local TARGET1 \"update.microsoft.com\"\r\\r
+ \n:local TARGET2 \"download.windowsupdate.com\"\r\\r
+ \n:local TARGET3 \"download.microsoft.com\"\r\\r
+ \n:local TARGET4 \"windowsupdate.com\"\r\\r
+ \n:local TARGET5 \"ntservicepack.microsoft.com\"\r\\r
+ \n:local TARGET6 \"wustat.windows.com\"\r\\r
+ \n:local TARGET7 \"stats.microsoft.com\"\r\\r
+ \n:local TARGET8 \"mp.microsoft.com\"\r\\r
+ \n:local TARGET9 \"ws.microsoft.com\"\r\\r
+ \n:local TARGET10 \"sls.update.microsoft.com.akadns.net\"\r\\r
+ \n:local TARGET11 \"vortex.data.microsoft.com\"\r\\r
+ \n:local TARGET12 \"vortex-win.data.microsoft.com\"\r\\r
+ \n:local TARGET13 \"fe2.update.microsoft.com.akadns.net\"\r\\r
+ \n:local TARGET14 \"statsfe2.update.microsoft.com.akadns.net\"\r\\r
+ \n \r\\r
+ \n# 1st time runner, check if address list is not created previously and a\\r
+ dd entries in it for 1st time usage\r\\r
+ \n:if ( [/ip firewall address-list find where list=\$LISTNAME] = \"\") do=\\r
+ {\r\\r
+ \n:log warning \"No address list for \$TARGET1 found ! creating and adding\\r
+ \_resolved entry for 1st time usage ... zaib\"\r\\r
+ \n \r\\r
+ \n:local FirstAddr [resolve \$TARGET1];\r\\r
+ \n\r\\r
+ \n/ip firewall address-list add address=\$FirstAddr list=\$LISTNAME commen\\r
+ t=\$TARGET1;\r\\r
+ \n} else={\r\\r
+ \n:log warning \"Previous List for \$LISTNAME found ! moving forward and c\\r
+ hecking if DNS entries can be added in it ...\"\r\\r
+ \n}\r\\r
+ \n \r\\r
+ \n# Check DNS entries and collect matching names\r\\r
+ \n:foreach i in=[/ip dns cache find name~\"(\$TARGET1|\$TARGET2|\$TARGET3|\\r
+ \$TARGET4|\$TARGET5|\$TARGET6|\$TARGET7|\$TARGET8|\$TARGET9|\$TARGET10|\$T\\r
+ ARGET11|\$TARGET12|\$TARGET13|\$TARGET14)\" && \$type ~ \"^(A|CNAME)\\\$\"\\r
+ \_] do={\r\\r
+ \n \r\\r
+ \n# Get IP Address from the names and hold it in temporary buffer\r\\r
+ \n:local Buffer [/ip dns cache get \$i data];\r\\r
+ \ndelay delay-time=10ms\r\\r
+ \n \r\\r
+ \n# Check if entry is already not exists, then OK, otherwise ignore duplic\\r
+ ation\r\\r
+ \n:if ( [/ip firewall address-list find where address=\$Buffer] = \"\") do\\r
+ ={\r\\r
+ \n \r\\r
+ \n# Fetch DNS names for the entries\r\\r
+ \n:local sitednsname [/ip dns cache get \$i name] ;\r\\r
+ \n \r\\r
+ \n# Print name in LOG window\r\\r
+ \n:log info (\"added entry: \$sitednsname \$Buffer\");\r\\r
+ \n \r\\r
+ \n# Add IP addresses and there names to the address list\r\\r
+ \n/ip firewall address-list add address=\$Buffer list=\$LISTNAME comment=\\r
+ \$sitednsname;\r\\r
+ \n}\r\\r
+ \n}"\r
+add comment="Add Hosts DNS names to NoWG addres list" \\r
+ dont-require-permissions=no name=Add2vdsina owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ \_Script to add target web sites DNS IP addresses into address list\r\\r
+ \n# Tested with Mikrotik 6.4x\r\\r
+ \n# \r\\r
+ \n# List name\r\\r
+ \n:local LISTNAME \"NoWG\"\r\\r
+ \n#\r\\r
+ \n# Web site names which will be added in address list\r\\r
+ \n:local TARGET1 \"comp-lenta.ru\"\r\\r
+ \n:local TARGET2 \"ok.ru\"\r\\r
+ \n:local TARGET3 \"vk.com\"\r\\r
+ \n#:local TARGET4 \"smtp.mail.me.com\"\r\\r
+ \n#:local TARGET4 \"windowsupdate.com\"\r\\r
+ \n#:local TARGET5 \"ntservicepack.microsoft.com\"\r\\r
+ \n#:local TARGET6 \"wustat.windows.com\"\r\\r
+ \n#:local TARGET7 \"stats.microsoft.com\"\r\\r
+ \n#:local TARGET8 \"mp.microsoft.com\"\r\\r
+ \n#:local TARGET9 \"ws.microsoft.com\"\r\\r
+ \n#:local TARGET10 \"sls.update.microsoft.com.akadns.net\"\r\\r
+ \n#:local TARGET11 \"vortex.data.microsoft.com\"\r\\r
+ \n#:local TARGET12 \"vortex-win.data.microsoft.com\"\r\\r
+ \n#:local TARGET13 \"fe2.update.microsoft.com.akadns.net\"\r\\r
+ \n#:local TARGET14 \"statsfe2.update.microsoft.com.akadns.net\"\r\\r
+ \n \r\\r
+ \n# 1st time runner, check if address list is not created previously and a\\r
+ dd entries in it for 1st time usage\r\\r
+ \n:if ( [/ip firewall address-list find where list=\$LISTNAME] = \"\") do=\\r
+ {\r\\r
+ \n:log warning \"No address list for \$TARGET1 found ! creating and adding\\r
+ \_resolved entry for 1st time usage ... zaib\"\r\\r
+ \n\r\\r
+ \n:local FirstAddr [resolve \$TARGET1];\r\\r
+ \n\r\\r
+ \n/ip firewall address-list add address=\$FirstAddr list=\$LISTNAME commen\\r
+ t=\$TARGET1;\r\\r
+ \n\r\\r
+ \n} else={\r\\r
+ \n:log warning \"Previous List for \$LISTNAME found ! moving forward and c\\r
+ hecking if DNS entries can be added in it ...\"\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n# Check DNS entries and collect matching names\r\\r
+ \n:foreach i in=[/ip dns cache find name~\"(\$TARGET1|\$TARGET2|\$TARGET3|\\r
+ \$TARGET4)\" && \$type ~ \"^(A|CNAME)\\\$\" ] do={\r\\r
+ \n\r\\r
+ \n:log info (\"start entry: \$c \$sitednsname \$Buffer\");\r\\r
+ \n\r\\r
+ \n# Get IP Address from the names and hold it in temporary buffer\r\\r
+ \n:local Buffer [/ip dns cache get \$i data];\r\\r
+ \ndelay delay-time=10ms\r\\r
+ \n:log info (\"1: \$Buffer\"); \r\\r
+ \n\r\\r
+ \n# Check if entry is already not exists, then OK, otherwise ignore duplic\\r
+ ation\r\\r
+ \n:if ( [/ip firewall address-list find where address=\$Buffer] = \"\") do\\r
+ ={\r\\r
+ \n\r\\r
+ \n:log info (\"2: \$Buffer\"); \r\\r
+ \n \r\\r
+ \n# Fetch DNS names for the entries\r\\r
+ \n:local sitednsname [/ip dns cache get \$i name] ;\r\\r
+ \n \r\\r
+ \n# Print name in LOG window\r\\r
+ \n:log info (\"added entry: \$i \$sitednsname \$Buffer\");\r\\r
+ \n \r\\r
+ \n# Add IP addresses and there names to the address list\r\\r
+ \n/ip firewall address-list add address=\$Buffer list=\$LISTNAME comment=\\r
+ \$sitednsname;\r\\r
+ \n}\r\\r
+ \n}"\r
+add comment="Flush DNS Cache" dont-require-permissions=no name=\\r
+ DNS_Flush_Cache owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\\r
+ "/ip dns cache flush"\r
+add dont-require-permissions=no name=create_mkdir_function owner=vados \\r
+ policy=read,write source="# Written by Phillip Stromberg in 2019\r\\r
+ \n# Distributed under the MIT license\r\\r
+ \n# \r\\r
+ \n# \r\\r
+ \n# this creates a function called \$mkdir\r\\r
+ \n# from the command line you will be able to just type \"\$mkdir some/new\\r
+ /folder\"\r\\r
+ \n# and all the folders that need to be created will be\r\\r
+ \n# if the folder already existed, it is ignored\r\\r
+ \n\r\\r
+ \n:log info \"Creating \\\$mkdir function...\"\r\\r
+ \n\r\\r
+ \n:global mkdir do={\r\\r
+ \n # \$1 refers to the input variable the user passed in to us\r\\r
+ \n :local newFolder \$1;\r\\r
+ \n\r\\r
+ \n # we'll use this variable to report error messages that may arise\r\\r
+ \n :local errorMsg;\r\\r
+ \n\r\\r
+ \n # if the user put a slash on the end of the new folder name, remove \\r
+ it\r\\r
+ \n # i.e. \"some/test/\" becomes \"some/test\"\r\\r
+ \n :while (([:pick \$newFolder ([:len \$newFolder] - 1)]) = \"/\") do={\\r
+ \r\\r
+ \n :set newFolder [:pick \$newFolder 0 ([:len \$newFolder] - 1)]\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n # if the user put a slash at the beginning of the new folder name, r\\r
+ emove it\r\\r
+ \n # i.e. \"/some/test\" becomes \"some/test\"\r\\r
+ \n :while ([:pick \$newFolder 0] = \"/\") do={\r\\r
+ \n :set newFolder [:pick \$newFolder 1 [:len \$newFolder]]\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ([/file find name=\$newFolder] != \"\") do={\r\\r
+ \n :set errorMsg \"'\$newFolder' already exists.\";\r\\r
+ \n :log debug \"mkdir: \$errorMsg\";\r\\r
+ \n :return \$newFolder;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n # the name of the temp file to create\r\\r
+ \n :local tempfile \"mkdir_temp_file.txt\";\r\\r
+ \n\r\\r
+ \n # port 0 is unlikely to be open to HTTP requests...\r\\r
+ \n :local fakeURL \"http://127.0.0.1:0/should-not-exist.txt\";\r\\r
+ \n\r\\r
+ \n :local fullTempPath (\$newFolder . \"/\" . \$tempfile);\r\\r
+ \n\r\\r
+ \n # this is where the folder creation happens\r\\r
+ \n # `as-value` prevents status messages from printing\r\\r
+ \n # wrapping in a `:do {...} on-error` prevents error messages from pr\\r
+ inting.\r\\r
+ \n :do {\r\\r
+ \n /tool fetch dst-path=\"\$fullTempPath\" url=\"\$fakeURL\" durati\\r
+ on=0.001s as-value;\r\\r
+ \n } on-error={}\r\\r
+ \n\r\\r
+ \n # this waits for the temporary dir to show up so there isn't a race \\r
+ \r\\r
+ \n # condition where you call mkdir and then try to do something before\\r
+ \_the \r\\r
+ \n # folder is actually created\r\\r
+ \n :local count 0;\r\\r
+ \n :while ([/file find name=\"\$newFolder\"] = \"\") do={\r\\r
+ \n :if (\$count >= 50) do={\r\\r
+ \n # after 50 * 0.1s delays, it's been 5 seconds, which should \\r
+ be long enough\r\\r
+ \n :set errorMsg \"New folder could not be created at \$newFold\\r
+ er\";\r\\r
+ \n :log error \"mkdir: \$errorMsg\"\r\\r
+ \n :error \$errorMsg\r\\r
+ \n }\r\\r
+ \n :delay 0.1s;\r\\r
+ \n :set count (\$count + 1);\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :return \$newFolder;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:log info \"Created function \\\$mkdir\"\r\\r
+ \n"\r
+add comment="Certificates CloudFlare, Quad9 " dont-require-permissions=no \\r
+ name=CustomUpdate-Certificates owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ \_CloudFlare\r\\r
+ \n/tool/fetch mode=https url=https://developers.cloudflare.com/ssl/static/\\r
+ origin_ca_ecc_root.pem;\r\\r
+ \n/tool/fetch mode=https url=https://cacerts.digicert.com/DigiCertGlobalRo\\r
+ otCA.crt.pem;\r\\r
+ \n/certificate/import file-name=DigiCertGlobalRootCA.crt.pem passphrase=\"\\r
+ \";\r\\r
+ \n/tool/ fetch mode=https url=https://cacerts.digicert.com/DigiCertGlobalG\\r
+ 2TLSRSASHA2562020CA1-1.crt.pem;\r\\r
+ \n/certificate/import file-name=DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt.\\r
+ pem passphrase=\"\";\r\\r
+ \n# Quad9\r\\r
+ \n/tool/fetch mode=https url=\"https://cacerts.digicert.com/DigiCertGlobal\\r
+ G3TLSECCSHA3842020CA1-1.crt.pem\"\r\\r
+ \n/certificate/import file-name=DigiCertGlobalG3TLSECCSHA3842020CA1-1.crt.\\r
+ pem passphrase=\"\";\r\\r
+ \n\r\\r
+ \n#:global AmScriptsUrl;\r\\r
+ \n#google\r\\r
+ \n#:local CertName \"GTS-Root-R1.pem\";\r\\r
+ \n#/tool/fetch mode=https url=(\$AmScriptsUrl . \"certs/\" . \$CertName);\\r
+ \r\\r
+ \n#/certificate/import file-name=\$CertName passphrase=\"\";\r\\r
+ \n#:set CertName \"GTS-Root-R4.pem\";\r\\r
+ \n#/tool/fetch mode=https url=(\$AmScriptsUrl . \"certs/\" . \$CertName);\\r
+ \r\\r
+ \n#/certificate/import file-name=\$CertName passphrase=\"\";\r\\r
+ \n#:set CertName \"GTS-Root-RX.pem\";\r\\r
+ \n#/tool/fetch mode=https url=(\$AmScriptsUrl . \"certs/\" . \$CertName);\\r
+ \r\\r
+ \n#/certificate/import file-name=\$CertName passphrase=\"\";\r\\r
+ \n#internet\r\\r
+ \n#:set CertName \"ISRG-Root-X1.pem\";\r\\r
+ \n#/tool/fetch mode=https url=(\$AmScriptsUrl . \"certs/\" . \$CertName);\\r
+ \r\\r
+ \n#/certificate/import file-name=\$CertName passphrase=\"\";\r\\r
+ \n#:set CertName \"ISRG-Root-X2.pem\";\r\\r
+ \n#/tool/fetch mode=https url=(\$AmScriptsUrl . \"certs/\" . \$CertName);\\r
+ \r\\r
+ \n#/certificate/import file-name=\$CertName passphrase=\"\";\r\\r
+ \n#:set CertName \"Starfield-Root-Certificate-Authority-G2.pem\";\r\\r
+ \n#/tool/fetch mode=https url=(\$AmScriptsUrl . \"certs/\" . \$CertName);\\r
+ \r\\r
+ \n#/certificate/import file-name=\$CertName passphrase=\"\";\r\\r
+ \n\r\\r
+ \n#/ip/dns/set allow-remote-requests=yes doh-max-concurrent-queries=100 do\\r
+ h-max-server-connections=20 use-doh-server=https://security.cloudflare-dns\\r
+ .com/dns-query verify-doh-cert=yes;\r\\r
+ \n#/ip/dns/static remove [find where address=1.1.1.1];\r\\r
+ \n#/ip/dns/static add address=1.1.1.1 name=security.cloudflare-dns.com com\\r
+ ment=\"cloudflare-dns IPv4 1\";\r\\r
+ \n#/ip/dns/static remove [find where address=1.0.0.1];\r\\r
+ \n#/ip/dns/static add address=1.0.0.1 name=security.cloudflare-dns.com com\\r
+ ment=\"cloudflare-dns IPv4 2\"\r\\r
+ \n#/ip dns static add address=2606:4700:4700::1111 name=security.cloudflar\\r
+ e-dns.com type=AAAA\r\\r
+ \n#/ip dns static add address=2606:4700:4700::1001 name=security.cloudflar\\r
+ e-dns.com type=AAAA\r\\r
+ \n#/ip/dns set servers=\"1.0.0.1, 8.8.4.4\";\r\\r
+ \n#/ip/dns set servers=\"\";"\r
+add dont-require-permissions=no name=script1 owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/\\r
+ tool/netwatch/add comment=\"doh-fallback, doh-url=https://security.cloudfl\\r
+ are-dns.com/dns-query, doh-cert=DigiCert Global Root CA, notify, name=Clou\\r
+ dFlare-doh IPv4 1\" host=1.1.1.1;\r\\r
+ \n/tool/netwatch/add comment=\"doh, doh-url=https://security.cloudflare-dn\\r
+ s.com/dns-query, doh-cert=DigiCert Global Root CA, notify, name=CloudFlare\\r
+ -doh IPv4 2\" host=1.0.0.1;\r\\r
+ \n/tool/netwatch/add comment=\"doh-fallback, dns-fallback, doh-url=https:/\\r
+ /dns.google/dns-query, doh-cert=DigiCert Global Root G2, notify, name=Goog\\r
+ le-doh IPv4 1\" host=8.8.8.8;\r\\r
+ \n/tool/netwatch/add comment=\"doh-fallback, dns-fallback, doh-url=https:/\\r
+ /dns.google/dns-query, doh-cert=DigiCert Global Root G2, notify, name=Goog\\r
+ le-doh IPv4 2\" host=8.8.4.4;\r\\r
+ \n/tool/netwatch/add comment=\"doh-fallback, dns-fallback, doh-url=https:/\\r
+ /dns.quad9.net/dns-query, doh-cert=DigiCert Global Root G3, notify, name=C\\r
+ uad9-doh IPv4 1\" host=9.9.9.9;\r\\r
+ \n/tool/netwatch/add comment=\"doh-fallback, dns-fallback, doh-url=https:/\\r
+ /dns.quad9.net/dns-query, doh-cert=DigiCert Global Root G3, notify, name=C\\r
+ uad9-doh IPv4 2\" host=149.112.112.112;\r\\r
+ \n\r\\r
+ \n/tool/netwatch/add comment=\"dns, notify, name=ns1.unet.ws\" host=91.192\\r
+ .189.2;"\r
+add dont-require-permissions=no name=script2 owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ \r\\r
+ \n\r\\r
+ \n:global InspectVar;\r\\r
+ \n#:global RouterBoard;\r\\r
+ \n#:do {:set RouterBoard [[ :parse \"/system/routerboard/get\" ]]} on-erro\\r
+ r={}\r\\r
+ \n#:global Resources;\r\\r
+ \n#:do {:set Resources [[ :parse \"/system/resource/get\" ]]} on-error={}\\r
+ \r\\r
+ \n\r\\r
+ \n#:global Updates;\r\\r
+ \n#:do {:set Updates [[ :parse \"/system/package/update/get\" ]]} on-error\\r
+ ={}\r\\r
+ \n\r\\r
+ \n#:global PkgUpdStatus \"undefined\";\r\\r
+ \n#:local Update [/system/package/update/get];\r\\r
+ \n#:retry command={:set PkgUpdStatus (\$Update->\"status\")} delay=200ms m\\r
+ ax=5 on-error={};\r\\r
+ \n\r\\r
+ \n#:log warning [\$InspectVar \$RouterBoard];\r\\r
+ \n#:put [\$InspectVar \$RouterBoard];\r\\r
+ \n\r\\r
+ \n#:retry command={/system/package/update check-for-updates without-paging\\r
+ \_as-value} delay=300ms max=5 on-error={};\r\\r
+ \n\r\\r
+ \n#:global arrDeviceInfo ({});\r\\r
+ \n#:local arrDeviceInfo ({\"section\":{\"key\":\"\"; \"value\":\"\";};});\\r
+ \r\\r
+ \n#:set (\$arrDeviceInfo->\"RouterBoard\") [[ :parse \"/system/routerboard\\r
+ /get\" ]];\r\\r
+ \n#:retry command={:set (\$arrDeviceInfo->\"Updates\") [[ :parse \"/system\\r
+ /package/update/get\" ]]} delay=500ms max=5 on-error={:log error (\"Error\\r
+ \")};\r\\r
+ \n# [:toarray {\"section\"={\"key\"=\"\"; \"value\"=\"\";} }];\r\\r
+ \n# [:toarray \"\"];\r\\r
+ \n:local arrDeviceInfo ({});\r\\r
+ \n\r\\r
+ \n:set (\$arrDeviceInfo->\"devUpdates\") {\"channel\"; \"stable\";};\r\\r
+ \n#:do {:set (arrDeviceInfo->\"Updates\") [[ :parse \"/system/package/upda\\r
+ te/get\" ]]} on-error={:log error (\$error)}\r\\r
+ \n\$InspectVar \$arrDeviceInfo;\r\\r
+ \n"\r
+add comment="Script for setup routeros script system" \\r
+ dont-require-permissions=no name=AM-setup owner=AM-setup policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\r\\r
+ \n# RouterOS script: AM-setup\r\\r
+ \n# Script comment: Script for setup routeros script system\r\\r
+ \n# Copyright (c) 2005-2026 Vados <vados@vados.ru>\r\\r
+ \n#\r\\r
+ \n#\r\\r
+ \n# requires RouterOS, version=7.19\r\\r
+ \n# requires device-mode, fetch\r\\r
+ \n#\r\\r
+ \n# :local ScriptName [ :jobname ];\r\\r
+ \n# Additional commands:\r\\r
+ \n#\r\\r
+ \n# For scripts:\r\\r
+ \n#:global NewScript \"script_name\"; \r\\r
+ \n#:global GlobalScriptsUrl \"https://ros.vados.ru/\";\r\\r
+ \n#/system/script/add name=\$NewScript owner=\$NewScript source=([/tool/fe\\r
+ tch check-certificate=yes-without-crl (\$GlobalScriptsUrl . \$ScriptAdd . \\r
+ \".rsc\") output=user as-value ]->\"data\");\r\\r
+ \n#:global NewScript (a);\r\\r
+ \n#:global ScriptInstallUpdate; \$ScriptInstallUpdate;\r\\r
+ \n#\r\\r
+ \n# For run from terminal:\r\\r
+ \n#/system/script/add name=AM-setup owner=AM-Setup source=([/tool/fetch ch\\r
+ eck-certificate=yes-without-crl \"https://ros.vados.ru/AM-setup.rsc\" outp\\r
+ ut=user as-value ]->\"data\");\r\\r
+ \n#\r\\r
+ \n\r\\r
+ \n:global ScriptUpdatesCRLF \"LF\";\r\\r
+ \n#:if (\$ScriptUpdatesCRLF != false) do={\r\\r
+ \n# :foreach Script in=[ /system/script/find where source~\"^#!rsc by Vad\\r
+ os\" ] do={\r\\r
+ \n# if (\$ScriptUpdatesCRLF = true) do={\r\\r
+ \n# /system/script/set source=[ :tocrlf [ get \$Script source ] ] \$S\\r
+ cript;\r\\r
+ \n# } else={\r\\r
+ \n# /system/script/set source=[ :tolf [ get \$Script source ] ] \$Scr\\r
+ ipt;\r\\r
+ \n# }\r\\r
+ \n# }\r\\r
+ \n#}\r\\r
+ \n\r\\r
+ \n# /import verbose=no \$ScriptName\r\\r
+ \n:global SetupScript [ :jobname ];\r\\r
+ \n:global RemoveMe;\r\\r
+ \n:global RunOnce;\r\\r
+ \n:global InitSetup true;\r\\r
+ \n:global tmpfs true;\r\\r
+ \n\r\\r
+ \n{\r\\r
+ \n :local RmMe [:tobool \$1];\r\\r
+ \n\r\\r
+ \n :global GlobalScriptsUrl;\r\\r
+ \n :global SetupScript;\r\\r
+ \n :global RemoveMe;\r\\r
+ \n :global InitSetup;\r\\r
+ \n :global tmpfs;\r\\r
+ \n \r\\r
+ \n :local CertCommonName \"Root YE\";\r\\r
+ \n :local CertFileName \"Root-YE.pem\";\r\\r
+ \n :local CertFingerprint \"e14ffcad5b0025731006caa43a121a22d8e9700f4fb9c\\r
+ f852f02a708aa5d5666\";\r\\r
+ \n\r\\r
+ \n :if (\$SetupScript = false) do={\r\\r
+ \n :global SetupScript \"AM-setup\";\r\\r
+ \n }\r\\r
+ \n :if (\$RemoveMe != false) do={\r\\r
+ \n :set RemoveMe true;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :log warning (\"\\n\\\$GlobalScriptsUrl = \" . \$GlobalScriptsUrl);\r\\r
+ \n \r\\r
+ \n :local CertSettings [ /certificate/settings/get ];\r\\r
+ \n :if (!(((\$CertSettings->\"builtin-trust-anchors\") = \"trusted\" || \\r
+ \\\r\\r
+ \n (\$CertSettings->\"builtin-trust-store\") ~ \"fetch\" || \\\r\\r
+ \n (\$CertSettings->\"builtin-trust-store\") = \"all\") && \\\r\\r
+ \n [ :len [ /certificate/builtin/find where common-name=\$CertComm\\r
+ onName ] ] > 0)) do={\r\\r
+ \n :put \"Importing certificate...\";\r\\r
+ \n \r\\r
+ \n /tool/fetch (\$GlobalScriptsUrl . \"certs/\" . \$CertFileName) dst-p\\r
+ ath=\$CertFileName as-value;\r\\r
+ \n :delay 1s;\r\\r
+ \n /certificate/import file-name=\$CertFileName passphrase=\"\";\r\\r
+ \n :if ([ :len [ /certificate/find where fingerprint=\$CertFingerprint \\r
+ ] ] != 1) do={\r\\r
+ \n :error \"Something is wrong with your certificates!\";\r\\r
+ \n };\r\\r
+ \n :delay 1s;\r\\r
+ \n };\r\\r
+ \n\r\\r
+ \n:local MkTmpfs do={\r\\r
+ \n :local TmpFs [ /disk/find where slot=tmpfs type=tmpfs ];\r\\r
+ \n :if ([ :len \$TmpFs ] = 1) do={\r\\r
+ \n :if ([ /disk/get \$TmpFs disabled ] = true) do={\r\\r
+ \n :log info (\"The tmpfs is disabled, enabling.\");\r\\r
+ \n /disk/enable \$TmpFs;\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n :log info (\"Try to removing directory 'tmpfs'.\");\r\\r
+ \n :do {\r\\r
+ \n :retry {\r\\r
+ \n /file/remove tmpfs;\r\\r
+ \n :return true;\r\\r
+ \n } delay=100ms max=10;\r\\r
+ \n } on-error={ }\r\\r
+ \n# \$RmDir \"tmpfs\";\r\\r
+ \n :onerror Err {\r\\r
+ \n /disk/add slot=tmpfs type=tmpfs tmpfs-max-size=([ /system/resource/g\\r
+ et total-memory ] / 3);\r\\r
+ \n :do {\r\\r
+ \n :retry {\r\\r
+ \n /file/get tmpfs;\r\\r
+ \n :return true;\r\\r
+ \n } delay=222ms max=10;\r\\r
+ \n } on-error={ }\r\\r
+ \n } do={\r\\r
+ \n :log warning (\"Creating disk of type tmpfs failed: \" . \$Err);\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n# :return true;\r\\r
+ \n}\r\\r
+ \n:if (\$tmpfs = true) do={\r\\r
+ \n :put \"Tmpfs variable is true. Checking for tmpfs/scripts directory...\\r
+ \";\r\\r
+ \n :if ([/file find name=\"tmpfs/scripts\"] != \"\") do={\r\\r
+ \n :log info (\$0 . \"Directory tmpfs/scripts exsist.\");\r\\r
+ \n :return \$true;\r\\r
+ \n } else={\r\\r
+ \n :log warning (\$0 . \"Directory tmpfs/scripts does't exsist.\");\r\\r
+ \n :if ([ \$MkTmpfs ] = false) do={\r\\r
+ \n :log error (\$0 . \"Directory tmpfs is not created!\");\r\\r
+ \n :return false;\r\\r
+ \n } else={\r\\r
+ \n :onerror Err {\r\\r
+ \n /file/add type=\"directory\" name=/tmpfs/scripts;\r\\r
+ \n :do {\r\\r
+ \n :retry {\r\\r
+ \n /file/get /tmpfs/scripts;\r\\r
+ \n :return true;\r\\r
+ \n } delay=100ms max=10;\r\\r
+ \n } on-error={ }\r\\r
+ \n } do={\r\\r
+ \n :log warning (\$0 . \"Making directory 'scripts' failed: \" . \$\\r
+ Err);\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n# :return true;\r\\r
+ \n# [ /file/get \$FileName ]\r\\r
+ \n }\r\\r
+ \n# :log error (\$0 . \"Directory tmpfs/scripts does not exsist. Remove\\r
+ \_global variable tmpfs!\");\r\\r
+ \n# :global tmpfs (a);\r\\r
+ \n# return false;\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n :put \"Renaming AM-GlobalConfig, if exists...\";\r\\r
+ \n :local ConfOldName (\"AM-GlobalConfig-\" . [ /system/clock/get date ] \\r
+ . [ /system/clock/get time ] . \".rsc\");\r\\r
+ \n /system/script/set name=\$ConfOldName [ find where name=\"AM-GlobalCon\\r
+ fig\" ];\r\\r
+ \n :foreach Script in={ \"AM-GlobalConfig\"; \"AM-GlobalFunc\" } do={\r\\r
+ \n :put \"Installing \$Script...\";\r\\r
+ \n /system/script/remove [ find where name=\$Script ];\r\\r
+ \n /system/script/add name=\$Script owner=\$Script source=([ /tool/fetc\\r
+ h check-certificate=yes-without-crl url=(\$GlobalScriptsUrl . \$Script . \\r
+ \".rsc\") output=user as-value ]->\"data\");\r\\r
+ \n \r\\r
+ \n /system/script run \$Script;\r\\r
+ \n :delay 2s;\r\\r
+ \n };\r\\r
+ \n\r\\r
+ \n :if ([ :len [ /certificate/find where fingerprint=\$CertFingerprint ] \\r
+ ] > 0) do={\r\\r
+ \n :put \"Renaming certificate by its common-name...\";\r\\r
+ \n :global CertificateNameByCN;\r\\r
+ \n \$CertificateNameByCN \$CertFingerprint;\r\\r
+ \n };\r\\r
+ \n\r\\r
+ \n :if (\$RemoveMe = true) do={\r\\r
+ \n :put \"Add Scheduler for remove this script...\";\r\\r
+ \n :local OnEvent (\":delay 30s;\\n\" . \"/system/script/remove [ find \\r
+ where name=\\\"\$SetupScript\\\" ];\\n\" . \\\r\\r
+ \n \":delay 2s;\\n\" . \"/system/scheduler/remove [ find where name=\\\\r
+ \"_RemoveSetup\\\" ];\\n\" . \\\r\\r
+ \n \":delay 2s;\\n\" . \":global RemoveMe (a);\\n\");\r\\r
+ \n :local Comment \"_RemoveSetup tmp scheduler for remove setup script.\\r
+ \";\r\\r
+ \n /system/scheduler/add name=\"_RemoveSetup\" comment=\$Comment start-\\r
+ time=startup interval=30s on-event=\$OnEvent;\r\\r
+ \n :log warning (\$0 . \"\\nI've done everything, and now I'm tired..\\r
+ . I'm leaving.\\nThere will be an error below, this is normal.\");\r\\r
+ \n }\r\\r
+ \n :delay 1;\r\\r
+ \n :put \"Loading configuration and functions...\";\r\\r
+ \n :do { \r\\r
+ \n :global ScriptInstallUpdate; \$ScriptInstallUpdate;\r\\r
+ \n :put \"Normal removing temporary global environment variables.\";\\r
+ \r\\r
+ \n :global SetupScript (a);\r\\r
+ \n :global InitSetup (a);\r\\r
+ \n :global RemoveMe (a);\r\\r
+ \n } on-error={\r\\r
+ \n :local ErrorMsg \"Loading configuration and functions error!\";\r\\r
+ \n :log error (\$0 . \$ErrorMsg . :error);\r\\r
+ \n :error \$ErrorMsg;\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n"\r
+add dont-require-permissions=no name=fetchCustom owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ \r\\r
+ \n#root.mnuc.backuper\r\\r
+ \n:global GlobalScriptsUrl \"https://ros.vados.ru/\";\r\\r
+ \n#/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@1\\r
+ 0.30.30.81.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.81.pub\";\r\\r
+ \n#:local Script AM-GlobalConfig;\r\\r
+ \n#/system/script/add name=\$Script owner=\$Script source=([ /tool/fetch c\\r
+ heck-certificate=yes-without-crl url=(\$GlobalScriptsUrl . \$Script . \".r\\r
+ sc\") output=user as-value ]->\"data\");\r\\r
+ \n#/usb1/mikro_bak_rsa.pub\r\\r
+ \n:local FetchFile AM-DOHCert.rsc\r\\r
+ \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \$FetchFile) dst-path=(\\r
+ \"[usb1]/scripts/\" . \$FetchFile);\r\\r
+ \n"\r
+add comment="Global functions" dont-require-permissions=no name=AM-GlobalFunc \\r
+ owner=AM-GlobalFunc policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\r\\r
+ \n# RouterOS script: AM-GglobalFunc\r\\r
+ \n# Script comment: Global functions\r\\r
+ \n# Copyright (c) 2005-2026 Vados <vados@vados.ru>\r\\r
+ \n#\r\\r
+ \n#\r\\r
+ \n# requires RouterOS, version=7.19\r\\r
+ \n# requires device-mode, fetch, scheduler\r\\r
+ \n:local ExitOK false;\r\\r
+ \n:local ScriptName [ :jobname ];\r\\r
+ \n#:global checkRunJob \$SriptName;\r\\r
+ \n#:global fixCRLF;\r\\r
+ \n#:if (\$fixCRLF != false) do={\r\\r
+ \n#:foreach fixScript in=([ /system/script/find where name~\"*\" ]) do={/s\\r
+ ystem/script/set source=[ :tocrlf [ get \$fixScript source ] ] \$fixScript\\r
+ }\r\\r
+ \n#:if (\$fixCRLF != \"LF\") do={ /system/script/set source=[ :tocrlf [ g\\r
+ et \$fixScript source ] ] \$fixScript};};\r\\r
+ \n#}\r\\r
+ \n:global GlobalFuncReady false;\r\\r
+ \n\r\\r
+ \n# Git commit id & info, expected configuration version\r\\r
+ \n:global CommitId \"main/285/12e1c210\";\r\\r
+ \n:global CommitTAG \"unknown\";\r\\r
+ \n:global CommitInfo \"Autocommit in repo: ros.vados.ru, generated by owne\\r
+ r: root, in 14:20:03 30.04.2026.\";\r\\r
+ \n\r\\r
+ \n# The variables are received right here.\r\\r
+ \n:global GlobalConfVersion 138;\r\\r
+ \n\r\\r
+ \n:global SumsDirAndFileName \"tmp/checksums.json\";\r\\r
+ \n\r\\r
+ \n:global Identity [/system/identity/get name];\r\\r
+ \n:global IdentityShort [:pick \$Identity 0 18];\r\\r
+ \n\r\\r
+ \n:global devBoardName [/system/resource/get board-name];\r\\r
+ \n:global devMode [/system/device-mode/get mode];\r\\r
+ \n:global devCurArch [/system/resource/get architecture-name];\r\\r
+ \n:global devCurVersion [/system/resource/get version];\r\\r
+ \n\r\\r
+ \n# Variables defined in AM-GlobalConfig.rsc\r\\r
+ \n:global TerminalColorOutput;\r\\r
+ \n:global CommentsInScripts;\r\\r
+ \n:global DetectIpAddrDefault;\r\\r
+ \n:global DetectIpAddrFallback;\r\\r
+ \n:global updateChannel;\r\\r
+ \n:global Domain;\r\\r
+ \n:global EmailGeneralTo;\r\\r
+ \n:global BackupAndUpdateMode;\r\\r
+ \n\r\\r
+ \n# Single functions, without nested functions.\r\\r
+ \n:global GlobalEnvRemove;\r\\r
+ \n:global MiniDateTimeStamp;\r\\r
+ \n\r\\r
+ \n# Include globals \$PrintDebug and \$PrintDebugOverride\r\\r
+ \n:global LogPrint;\r\\r
+ \n\r\\r
+ \n# DeviceInfo and Updates\r\\r
+ \n:global IsCheckUpdates;\r\\r
+ \n:global WaitCheckUpdates;\r\\r
+ \n:global GetPubIp;\r\\r
+ \n\r\\r
+ \n:global GetArrDeviceInfo;\r\\r
+ \n:global WaitArrDeviceInfo;\r\\r
+ \n\r\\r
+ \n:global devModel;\r\\r
+ \n:global devRunningMode;\r\\r
+ \n\r\\r
+ \n:global devRbRevision;\r\\r
+ \n:global devRbSerialNumber;\r\\r
+ \n:global devRbVerAvail;\r\\r
+ \n\r\\r
+ \n:global runningChannelVersion;\r\\r
+ \n:global runningChannel;\r\\r
+ \n:global runningVersion;\r\\r
+ \n\r\\r
+ \n:global devBuildTime;\r\\r
+ \n:global ROsVerAvail;\r\\r
+ \n:global PkgUpdStatus;\r\\r
+ \n:global currentUpdateChannel;\r\\r
+ \n\r\\r
+ \n:global ScriptInstallUpdate;\r\\r
+ \n\r\\r
+ \n:global DeviceInfo;\r\\r
+ \n\r\\r
+ \n:global OldMode;\r\\r
+ \n\r\\r
+ \n:global ParseKeyValueStore;\r\\r
+ \n:global RandomDelay;\r\\r
+ \n:global GetRandomNumber;\r\\r
+ \n:global EscapeForRegEx;\r\\r
+ \n:global ExitError;\r\\r
+ \n:global CharacterMultiply;\r\\r
+ \n:global CharacterReplace;\r\\r
+ \n:global CleanFilePath;\r\\r
+ \n:global CleanName;\r\\r
+ \n\r\\r
+ \n:global CommitBrief;\r\\r
+ \n\r\\r
+ \n:global EitherOr;\r\\r
+ \n:global FormatLine;\r\\r
+ \n:global GetRandom20CharAlNum;\r\\r
+ \n:global Grep;\r\\r
+ \n:global IfThenElse;\r\\r
+ \n:global MAX;\r\\r
+ \n:global MIN;\r\\r
+ \n:global HumanReadableNum;\r\\r
+ \n\r\\r
+ \n:global IsFullyConnected;\r\\r
+ \n:global IsDNSResolving;\r\\r
+ \n:global IsTimeSync;\r\\r
+ \n:global IsTimeSyncCached;\r\\r
+ \n:global IsTimeSyncResetNtp;\r\\r
+ \n\r\\r
+ \n:global WaitDNSResolving;\r\\r
+ \n:global WaitFullyConnected;\r\\r
+ \n:global WaitTimeSync;\r\\r
+ \n:global MkDir;\r\\r
+ \n:global RmDir;\r\\r
+ \n:global RmFile;\r\\r
+ \n:global FileGet;\r\\r
+ \n:global Unix2Dos;\r\\r
+ \n:global UrlEncode;\r\\r
+ \n:global WaitForFile;\r\\r
+ \n:global ScriptLock;\r\\r
+ \n:global SendTelegram;\r\\r
+ \n:global NotificationFunctions;\r\\r
+ \n:global SendNotification;\r\\r
+ \n:global SendNotification2;\r\\r
+ \n:global SymbolForNotification;\r\\r
+ \n:global SymbolByUnicodeName;\r\\r
+ \n:global ValidateSyntax;\r\\r
+ \n:global CheckSumsVerify;\r\\r
+ \n:global GlobalConfChanges;\r\\r
+ \n:global GlobalConfMigration;\r\\r
+ \n:global VersionToNum;\r\\r
+ \n:global RequiredRouterOS;\r\\r
+ \n:global FetchLargeFiles;\r\\r
+ \n:global FetchUserAgentStr;\r\\r
+ \n:global CertificateAvailable;\r\\r
+ \n:global CertificateDownload;\r\\r
+ \n:global CertificateNameByCN;\r\\r
+ \n:global CharacterMultiply;\r\\r
+ \n\r\\r
+ \n:global InspectVar;\r\\r
+ \n:global InspectVarRet;\r\\r
+ \n:global ParseCustom;\r\\r
+ \n\r\\r
+ \n:set IsCheckUpdates do={\r\\r
+ \n :local isInfo [:tobool \$1];\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global updateChannel;\r\\r
+ \n :global PkgUpdStatus;\r\\r
+ \n :global currentUpdateChannel;\r\\r
+ \n :global ROsVerAvail;\r\\r
+ \n :global arrDeviceInfo;\r\\r
+ \n \$LogPrint debug \$0 (\"\\\$isInfo = \" . \$isInfo); \r\\r
+ \n :local CurrentChannel [ /system/package/update/get channel ];\r\\r
+ \n :if ([ :len \$updateChannel ] > 0 && \$CurrentChannel != \$updateChann\\r
+ el) do={\r\\r
+ \n :retry command={/system/package/update set channel=\$updateChannel} \\r
+ \_delay=300ms max=5 on-error={};\r\\r
+ \n \$LogPrint debug \$0 (\"Set updates channel to: \$updateChannel\");\\r
+ \r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local Update [ /system/package/update/get ];\r\\r
+ \n :local Channel [ :tostr (\$Update->\"channel\") ];\r\\r
+ \n :set currentUpdateChannel \$Channel;\r\\r
+ \n \$LogPrint debug \$0 (\"Update Channel: \" . \$Channel . \".\");\r\\r
+ \n\r\\r
+ \n\r\\r
+ \n :local StatusPkg \"undefined\";\r\\r
+ \n \$LogPrint debug \$0 (\"Checking for updates...\");\r\\r
+ \n :retry command={:set \$StatusPkg ([/system/package/update/check-for-up\\r
+ dates without-paging as-value]->\"status\")} \\\r\\r
+ \n delay=300ms max=5 on-error={};\r\\r
+ \n \$LogPrint debug \$0 (\"\\\$StatusPkg = \" . \$StatusPkg);\r\\r
+ \n :if (\$StatusPkg = \"New version is available\") do={ :set PkgUpdStatu\\r
+ s true; } else={ :set PkgUpdStatus false; }\r\\r
+ \n :set ROsVerAvail [ :tostr [ /system/package/update/get latest-version \\r
+ ] ];\r\\r
+ \n \$LogPrint debug \$0 (\"\\\$PkgUpdStatus = \" . \$PkgUpdStatus);\r\\r
+ \n :if (\$isInfo != false || \$PkgUpdStatus = true) do={\r\\r
+ \n \$LogPrint debug \$0 (\"\\\$PkgUpdStatus = \" . \$PkgUpdStatus);\r\\r
+ \n :if ([ :typeof \$arrDeviceInfo ] != \"array\") do={\r\\r
+ \n :set arrDeviceInfo [:toarray \$arrDeviceInfo];\r\\r
+ \n }\r\\r
+ \n :retry command={:set (\$arrDeviceInfo->\"devUpdates\") [ /system/pac\\r
+ kage/update/get ]} delay=500ms max=5 on-error={:log error (\"Error\")};\r\\r
+ \n :return true;\r\\r
+ \n } else={\r\\r
+ \n :return \$PkgUpdStatus;\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set WaitCheckUpdates do={\r\\r
+ \n :global IsCheckUpdates;\r\\r
+ \n :global PkgUpdStatus;\r\\r
+ \n :global currentUpdateChannel;\r\\r
+ \n :global ROsVerAvail;\r\\r
+ \n :global arrDeviceInfo;\r\\r
+ \n\r\\r
+ \n :local Status \"\";\r\\r
+ \n :local Update;\r\\r
+ \n :local WaitCount 0;\r\\r
+ \n\r\\r
+ \n :if ([ \$IsCheckUpdates true ] = false) do={\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :set Status [ :tostr [ /system/package/update/get status ] ];\r\\r
+ \n :while ((\$Status = \"\" || \$Status = \"finding out latest version...\\r
+ \") && \$WaitCount < 60) do={\r\\r
+ \n :delay 1s;\r\\r
+ \n :set WaitCount (\$WaitCount + 1);\r\\r
+ \n :set Status [ :tostr [ /system/package/update/get status ] ];\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :set Update [ /system/package/update/get ];\r\\r
+ \n :set currentUpdateChannel [ :tostr (\$Update->\"channel\") ];\r\\r
+ \n :set ROsVerAvail [ :tostr (\$Update->\"latest-version\") ];\r\\r
+ \n :if ((\$Update->\"status\") = \"New version is available\") do={\r\\r
+ \n :set PkgUpdStatus true;\r\\r
+ \n } else={\r\\r
+ \n :set PkgUpdStatus false;\r\\r
+ \n }\r\\r
+ \n :if ([ :typeof \$arrDeviceInfo ] != \"array\") do={\r\\r
+ \n :set arrDeviceInfo [:toarray \$arrDeviceInfo];\r\\r
+ \n }\r\\r
+ \n :set (\$arrDeviceInfo->\"devUpdates\") \$Update;\r\\r
+ \n\r\\r
+ \n :if (\$Status = \"\" || \$Status = \"finding out latest version...\") \\r
+ do={\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set WaitArrDeviceInfo do={\r\\r
+ \n :global GetArrDeviceInfo;\r\\r
+ \n :while ([ \$GetArrDeviceInfo ] = false) do={\r\\r
+ \n :delay 1s;\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set GetArrDeviceInfo do={\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global arrDeviceInfo;\r\\r
+ \n\r\\r
+ \n :global devBoardName;\r\\r
+ \n :global devModel;\r\\r
+ \n :global devRunning;\r\\r
+ \n :global devCurArch;\r\\r
+ \n :global devRbRevision;\r\\r
+ \n :global devRbSerialNumber;\r\\r
+ \n :global devBuildTime;\r\\r
+ \n :global runningChannelVersion;\r\\r
+ \n :global runningChannel;\r\\r
+ \n :global runningVersion;\r\\r
+ \n :global currentUpdateChannel;\r\\r
+ \n :global ROsVerAvail;\r\\r
+ \n\r\\r
+ \n :local DeviceInfo;\r\\r
+ \n :local Resource [/system/resource/get];\r\\r
+ \n :local Update [ /system/package/update/get ];\r\\r
+ \n :local VersionString [ :tostr (\$Resource->\"version\") ];\r\\r
+ \n :local ChannelStart [ :find \$VersionString \" (\" ];\r\\r
+ \n :local RouterBoard;\r\\r
+ \n :local IsRouterBoard false;\r\\r
+ \n :local RunningMode \"\";\r\\r
+ \n\r\\r
+ \n :set devCurArch [ :tostr (\$Resource->\"architecture-name\") ];\r\\r
+ \n :set devBuildTime [ :tostr (\$Resource->\"build-time\") ];\r\\r
+ \n :set runningChannelVersion \$VersionString;\r\\r
+ \n :set runningVersion \$VersionString;\r\\r
+ \n :set runningChannel \"\";\r\\r
+ \n\r\\r
+ \n :if ([ :typeof \$ChannelStart ] = \"num\" && \$ChannelStart >= 0) do=\\r
+ {\r\\r
+ \n :set runningVersion [ :pick \$VersionString 0 \$ChannelStart ];\r\\r
+ \n :local ChannelRest [ :pick \$VersionString (\$ChannelStart + 2) [ :\\r
+ len \$VersionString ] ];\r\\r
+ \n :local ChannelEnd [ :find \$ChannelRest \")\" ];\r\\r
+ \n :if ([ :typeof \$ChannelEnd ] = \"num\" && \$ChannelEnd >= 0) do={\\r
+ \r\\r
+ \n :set runningChannel [ :pick \$ChannelRest 0 \$ChannelEnd ];\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ([:pick \$devBoardName 0 3] != \"CHR\" or [:pick \$devBoardName 0\\r
+ \_3] != \"x86\") do={\r\\r
+ \n :do {\r\\r
+ \n :set RouterBoard [[ :parse \"/system/routerboard/get\" ]];\r\\r
+ \n# :set RouterBoard [ /system/routerboard/get ];\r\\r
+ \n :if ((\$RouterBoard->\"routerboard\") = true) do={\r\\r
+ \n :set IsRouterBoard true;\r\\r
+ \n }\r\\r
+ \n } on-error={}\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :do {\r\\r
+ \n :set RunningMode [ /system/device-mode/get mode ];\r\\r
+ \n } on-error={\r\\r
+ \n :do {\r\\r
+ \n :set RunningMode [ /system/device-mode/get running ];\r\\r
+ \n } on-error={\r\\r
+ \n :set RunningMode \"\";\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :set devRunning \$RunningMode;\r\\r
+ \n\r\\r
+ \n :if (\$IsRouterBoard = true) do={\r\\r
+ \n :set devModel [ :tostr (\$RouterBoard->\"model\") ];\r\\r
+ \n :set devRbRevision [ :tostr (\$RouterBoard->\"revision\") ];\r\\r
+ \n :set devRbSerialNumber [ :tostr (\$RouterBoard->\"serial-number\") \\r
+ ];\r\\r
+ \n } else={\r\\r
+ \n :set devModel \$devBoardName;\r\\r
+ \n :set devRbRevision \"\";\r\\r
+ \n :set devRbSerialNumber \"\";\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :set currentUpdateChannel [ :tostr (\$Update->\"channel\") ];\r\\r
+ \n :set ROsVerAvail [ :tostr (\$Update->\"latest-version\") ];\r\\r
+ \n\r\\r
+ \n :set (\$DeviceInfo->\"board-name\") \$devBoardName;\r\\r
+ \n :set (\$DeviceInfo->\"architecture-name\") \$devCurArch;\r\\r
+ \n :set (\$DeviceInfo->\"model\") \$devModel;\r\\r
+ \n :set (\$DeviceInfo->\"revision\") \$devRbRevision;\r\\r
+ \n :set (\$DeviceInfo->\"serial-number\") \$devRbSerialNumber;\r\\r
+ \n :set (\$DeviceInfo->\"running-mode\") \$devRunning;\r\\r
+ \n :set (\$DeviceInfo->\"build-time\") \$devBuildTime;\r\\r
+ \n :set (\$DeviceInfo->\"running-channel-version\") \$runningChannelVers\\r
+ ion;\r\\r
+ \n :set (\$DeviceInfo->\"running-version\") \$runningVersion;\r\\r
+ \n :set (\$DeviceInfo->\"running-channel\") \$runningChannel;\r\\r
+ \n :set (\$DeviceInfo->\"routerboard\") \$IsRouterBoard;\r\\r
+ \n :set (\$DeviceInfo->\"current-firmware\") [ :tostr (\$RouterBoard->\"\\r
+ current-firmware\") ];\r\\r
+ \n :set (\$DeviceInfo->\"upgrade-firmware\") [ :tostr (\$RouterBoard->\"\\r
+ upgrade-firmware\") ];\r\\r
+ \n :set (\$DeviceInfo->\"package-channel\") \$currentUpdateChannel;\r\\r
+ \n :set (\$DeviceInfo->\"installed-version\") [ :tostr (\$Update->\"inst\\r
+ alled-version\") ];\r\\r
+ \n :set (\$DeviceInfo->\"latest-version\") \$ROsVerAvail;\r\\r
+ \n :set (\$DeviceInfo->\"update-status\") [ :tostr (\$Update->\"status\"\\r
+ ) ];\r\\r
+ \n\r\\r
+ \n :set arrDeviceInfo \$DeviceInfo;\r\\r
+ \n :return \$DeviceInfo;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set DeviceInfo do={\r\\r
+ \n :global GetArrDeviceInfo;\r\\r
+ \n :global GlobalConfVersion;\r\\r
+ \n :global Identity;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :global FormatLine;\r\\r
+ \n :global CommitBrief;\r\\r
+ \n\r\\r
+ \n :local License [/system/license/get];\r\\r
+ \n :local Snmp [ /snmp/get ];\r\\r
+ \n :local Info [ \$GetArrDeviceInfo ];\r\\r
+ \n\r\\r
+ \n :if ([ :typeof \$Info ] != \"array\") do={\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :return ( \\\r\\r
+ \n [ \$FormatLine \"Hostname\" \$Identity ] . \"\\n\" . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$Snmp->\"location\") ] > 0) \\\r\\r
+ \n ([ \$FormatLine \"Location\" (\$Snmp->\"location\") ] . \"\\n\") ]\\r
+ \_. \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$Snmp->\"contact\") ] > 0) \\\r\\r
+ \n ([ \$FormatLine \"Contact\" (\$Snmp->\"contact\") ] . \"\\n\") ] .\\r
+ \_\\\r\\r
+ \n \"Hardware:\\n\" . \\\r\\r
+ \n [ \$FormatLine \" Board\" (\$Info->\"board-name\") ] . \"\\n\" . \\r
+ \\\r\\r
+ \n [ \$FormatLine \" Arch\" (\$Info->\"architecture-name\") ] . \"\\\\r
+ n\" . \\\r\\r
+ \n [ \$FormatLine \" Model\" (\$Info->\"model\") ] . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$Info->\"revision\") ] > 0) \\\r\\r
+ \n (\" \" . (\$Info->\"revision\")) ] . \"\\n\" . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$Info->\"serial-number\") ] > 0) \\\r\\r
+ \n ([ \$FormatLine \" Serial\" (\$Info->\"serial-number\") ] . \"\\r
+ \\n\") ] . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$License->\"nlevel\") ] > 0) \\\r\\r
+ \n ([ \$FormatLine \" License\" (\"level \" . (\$License->\"nlevel\\r
+ \")) ] . \"\\n\") ] . \\\r\\r
+ \n \"RouterOS:\\n\" . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$License->\"level\") ] > 0) \\\r\\r
+ \n ([ \$FormatLine \" License\" (\"level \" . (\$License->\"level\\r
+ \")) ] . \"\\n\") ] . \\\r\\r
+ \n [ \$FormatLine \" Channel\" (\$Info->\"package-channel\") ] . \"\\r
+ \\n\" . \\\r\\r
+ \n [ \$FormatLine \" Installed\" (\$Info->\"installed-version\") ] .\\r
+ \_\"\\n\" . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$Info->\"running-channel\") ] > 0) \\\r\\r
+ \n ([ \$FormatLine \" Running\" ((\$Info->\"running-version\") . \\r
+ \" (\" . (\$Info->\"running-channel\") . \")\") ] . \"\\n\") \\\r\\r
+ \n ([ \$FormatLine \" Running\" (\$Info->\"running-version\") ] . \\r
+ \"\\n\") ] . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$Info->\"latest-version\") ] > 0 && \\\r\\r
+ \n (\$Info->\"installed-version\") != (\$Info->\"latest-version\"))\\r
+ \_\\\r\\r
+ \n ([ \$FormatLine \" Available\" (\$Info->\"latest-version\") ] .\\r
+ \_\"\\n\") ] . \\\r\\r
+ \n [ \$IfThenElse ((\$Info->\"routerboard\") = true && \\\r\\r
+ \n (\$Info->\"current-firmware\") != (\$Info->\"upgrade-firmware\")\\r
+ ) \\\r\\r
+ \n ([ \$FormatLine \" Firmware\" ((\$Info->\"current-firmware\") .\\r
+ \_\" -> \" . (\$Info->\"upgrade-firmware\")) ] . \"\\n\") ] . \\\r\\r
+ \n \"RouterOS-Scripts:\\n\" . \\\r\\r
+ \n [ \$FormatLine \" Commit\" [ \$CommitBrief ] ] . \"\\n\" . \\\r\\r
+ \n [ \$FormatLine \" Version\" \$GlobalConfVersion ]);\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:if ([ :typeof \$NotificationFunctions ] != \"array\") do={:set Notifica\\r
+ tionFunctions ({})}\r\\r
+ \n:set GetRandom20CharAlNum do={\r\\r
+ \n :global EitherOr;\r\\r
+ \n :return [ :rndstr length=[ \$EitherOr [ :tonum \$1 ] 20 ] from=\"ABCDE\\r
+ FGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\" ];\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:global checkRunJob;\r\\r
+ \n:set checkRunJob do={\r\\r
+ \n :local Script [ :tostr \$1 ];\r\\r
+ \n :global ScriptLock; \r\\r
+ \n :if ([ \$ScriptLock \$Script ] = false) do={:return false}\r\\r
+ \n :foreach Job in=[ /system/script/job/find where script=\$Script ] do={\\r
+ :set Job [ /system/script/job/get \$Job ];\r\\r
+ \n :while ([ :typeof (\$Job->\"parent\") ] = \"id\") do={:set Job [ /sy\\r
+ stem/script/job/get [ find where .id=(\$Job->\"parent\") ] ]}\r\\r
+ \n :if ((\$Job->\"type\") = \"login\") do={:return true};}; :return fa\\r
+ lse; \r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set InspectVar do={\r\\r
+ \n :global InspectVarRet;\r\\r
+ \n :put [ :tocrlf [ \$InspectVarRet \$1 ] ];\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CommitBrief do={\r\\r
+ \n :global CommitId;\r\\r
+ \n :global CommitInfo;\r\\r
+ \n :if (\$CommitId = \"unknown\") do={\r\\r
+ \n :return \"unknown\";\r\\r
+ \n }\r\\r
+ \n :return (\$CommitInfo . \"/\" . [ :pick \$CommitId 0 8 ]);\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set InspectVarRet do={\r\\r
+ \n :local Input \$1;\r\\r
+ \n :local Level (0 + [ :tonum \$2 ]);\r\\r
+ \n :global CharacterReplace;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :global InspectVarRet;\r\\r
+ \n :local IndentReturn do={\r\\r
+ \n :local Prefix [ :tostr \$1 ];\r\\r
+ \n :local Value [ :tostr \$2 ];\r\\r
+ \n :local Level [ :tonum \$3 ];\r\\r
+ \n :global CharacterMultiply;\r\\r
+ \n :return ([ \$CharacterMultiply \" \" (\$Level * 2) ] . \"-\" . \$Pre\\r
+ fix . \"-> \" . \$Value);\r\\r
+ \n }\r\\r
+ \n :local TypeOf [ :typeof \$Input ];\r\\r
+ \n :local Len [ :len \$Input ];\r\\r
+ \n :local Return [ \$IndentReturn \"type\" \$TypeOf \$Level ];\r\\r
+ \n :if (\$TypeOf = \"array\") do={\r\\r
+ \n :foreach Key,Value in=\$Input do={\r\\r
+ \n :set \$Return (\$Return . \"\\n\" . \\\r\\r
+ \n [ \$IndentReturn \"key\" \$Key (\$Level + 1) ] . \"\\n\" . \\\r\\r
+ \n [ \$InspectVarRet \$Value (\$Level + 2) ]);\r\\r
+ \n }\r\\r
+ \n } else={\r\\r
+ \n :if (\$TypeOf = \"str\") do={\r\\r
+ \n :set \$Return (\$Return . \"\\n\" . \\\r\\r
+ \n [ \$IndentReturn \"len\" \$Len \$Level ]);\r\\r
+ \n :if ([ :typeof [ :find \$Input (\"\\r\") ] ] = \"num\") do={\r\\r
+ \n :set Input [ \$CharacterReplace \$Input (\"\\r\") \"\" ];\r\\r
+ \n }\r\\r
+ \n :if ([ :typeof [ :find \$Input (\"\\n\") ] ] = \"num\") do={\r\\r
+ \n :set Input [ \$CharacterReplace \$Input (\"\\n\") \" \" ];\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :if (\$TypeOf != \"nothing\") do={\r\\r
+ \n :set \$Return (\$Return . \"\\n\" . \\\r\\r
+ \n [ \$IndentReturn \"value\" [ \$IfThenElse ([ :len \$Input ] > 80)\\r
+ \_\\\r\\r
+ \n ([ :pick \$Input 0 77 ] . \"...\") \$Input ] \$Level ]);\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n# !!! The function is not ready !!!\r\\r
+ \n:global FetchHttpInfo do={\r\\r
+ \n :local Mac [ :tostr \$1 ];\r\\r
+ \n :global CertificateAvailable;\r\\r
+ \n :global IsMacLocallyAdministered;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :local Url \"https://api.macvendors.com/\";\r\\r
+ \n :if ([ \$IsMacLocallyAdministered \$Mac ] = true) do={:return \"locall\\r
+ y administered\";}\r\\r
+ \n :do {\r\\r
+ \n :if ([ \$CertificateAvailable \"GTS Root R4\" \"fetch\" ] = false) d\\r
+ o={\r\\r
+ \n \$LogPrint warning \$0 (\"Downloading required certificate failed.\\r
+ \");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n :local Vendor ([ /tool/fetch \r\\r
+ \n (\$Url . [ :pick \$Mac 0 8 ]) output=user as-value ]->\"data\");\r\\r
+ \n :return \$Vendor;\r\\r
+ \n } on-error={\r\\r
+ \n :onerror Err {\r\\r
+ \n /tool/fetch check-certificate=yes-without-crl (\$Url) output=none \\r
+ as-value;\r\\r
+ \n \$LogPrint debug \$0 (\"The mac vendor is not known in database.\"\\r
+ );\r\\r
+ \n } do={ \$LogPrint warning \$0 (\"Failed getting mac vendor: \" . \$E\\r
+ rr); }\r\\r
+ \n :return \"unknown vendor\";\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set GetPubIp do={\r\\r
+ \n :global DetectIpAddrDefault;\r\\r
+ \n :global DetectIpAddrFallback;\r\\r
+ \n :global LogPrint;\r\\r
+ \n \r\\r
+ \n :local PubIpAddr false;\r\\r
+ \n :local Url \$DetectIpAddrDefault;\r\\r
+ \n\r\\r
+ \n# :retry command={abc} delay=1 max=2 on-error={:put \"got error\"} \r\\r
+ \n :do {\r\\r
+ \n \$LogPrint debug \$0 (\"Trying to detect public IP using default s\\r
+ ervice: \" . \$Url . \"...\");\r\\r
+ \n :retry command={:set PubIpAddr ([ /tool/fetch http-method=\"get\"\\r
+ \_check-certificate=yes-without-crl \$Url output=user as-value ]->\"data\"\\r
+ )} \\\r\\r
+ \n delay=50ms max=5 on-error={\$LogPrint error [ :jobname ] (\"Fail\\r
+ ed to detect public IP using default service: \" . \$Url . \".\")}\r\\r
+ \n #:error \"Failed to detect public IP using default service: \$Url\\r
+ .\"};\r\\r
+ \n } on-error={\r\\r
+ \n \$LogPrint error \$0 (\"Failed to detect public IP using default s\\r
+ ervice: \" . \$Url . \".\");\r\\r
+ \n :set Url \$DetectIpAddrFallBack;\r\\r
+ \n \$LogPrint debug \$0 (\"Trying to detect public IP using fallback \\r
+ service: \" . \$Url . \"...\");\r\\r
+ \n :retry command={:set PubIpAddr ([ /tool/fetch http-method=\"get\"\\r
+ \_check-certificate=yes-without-crl \$Url output=user as-value ]->\"data\"\\r
+ )} \\\r\\r
+ \n delay=200ms max=5 on-error={\$LogPrint error [ :jobname ] (\"Fai\\r
+ led to detect public IP using fallback service: \" . \$Url . \".\")}\r\\r
+ \n };\r\\r
+ \n :if (\$PubIpAddr = false) do={\r\\r
+ \n :set PubIpAddr \"not-detected\";\r\\r
+ \n } else={\r\\r
+ \n :set PubIpAddr [ :pick \$PubIpAddr 0 15];\r\\r
+ \n }\r\\r
+ \n :return \$PubIpAddr;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set FormatLine do={\r\\r
+ \n :local Key [ :tostr \$1 ];\r\\r
+ \n :local Value [ :tostr \$2 ];\r\\r
+ \n :local Indent [ :tonum \$3 ];\r\\r
+ \n :local Spaces;\r\\r
+ \n :local Return \"\";\r\\r
+ \n :global CharacterMultiply;\r\\r
+ \n :global EitherOr;\r\\r
+ \n :set Indent [ \$EitherOr \$Indent 16 ];\r\\r
+ \n :local Spaces [ \$CharacterMultiply \" \" \$Indent ];\r\\r
+ \n :if ([ :len \$Key ] > 0) do={ :set Return (\$Key . \":\")}\r\\r
+ \n :if ([ :len \$Key ] > (\$Indent - 2)) do={:set Return (\$Return . \"\\\\r
+ n\" . [ :pick \$Spaces 0 \$Indent ] . \$Value);\r\\r
+ \n } else={:set Return (\$Return . [ :pick \$Spaces 0 (\$Indent - [ :len \\r
+ \$Return ]) ] . \$Value)}\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set ParseCustom do={\r\\r
+ \n :local Str [ :tostr \$1 ];\r\\r
+ \n :local Start [:find [ \$Str ] [:tostr \$2]];\r\\r
+ \n :local End [ :tostr \$3 ];\r\\r
+ \n :local Num [ :tonum \$4 ];\r\\r
+ \n :local Return;\r\\r
+ \n :if ([:len \$Num] = 0) do={:set Num \"0\"}\r\\r
+ \n :local rest [:pick \$Str (\$Start+\$Num) [:len \$Str]]; \r\\r
+ \n :if ([:len \$End ] = 0) do={:set Return [:pick \$Str \$Num \$Start]} e\\r
+ lse={\r\\r
+ \n :set End [:find \$rest \$End];\r\\r
+ \n :set Return [:pick \$rest 0 \$End];\r\\r
+ \n }\r\\r
+ \n:return \$Return;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set LogPrint do={\r\\r
+ \n :local Severity [ :tostr \$1 ];\r\\r
+ \n :local Name [ :tostr \$2 ];\r\\r
+ \n :local Message [ :tostr \$3 ];\r\\r
+ \n :global PrintDebug;\r\\r
+ \n :global PrintDebugOverride;\r\\r
+ \n :global EitherOr;\r\\r
+ \n :local Debug [ \$EitherOr (\$PrintDebugOverride->\$Name) \$PrintDebug \\r
+ ];\r\\r
+ \n :local PrintSeverity do={\r\\r
+ \n :global TerminalColorOutput;\r\\r
+ \n :if (\$TerminalColorOutput != true) do={:return \$1}\r\\r
+ \n :local Color { debug=96; info=97; warning=93; error=91 };\r\\r
+ \n :return (\"\\1B[\" . \$Color->\$1 . \"m\" . \$1 . \"\\1B[0m\");\r\\r
+ \n}\r\\r
+ \n :local Log ([ \$EitherOr \$Name \"<unknown>\" ] . \": \" . \$Message);\\r
+ \r\\r
+ \n :if (\$Severity ~ (\"^(custom|debug|error|info)\\\$\")) do={\r\\r
+ \n :if (\$Severity = \"debug\") do={:log debug \$Log}\r\\r
+ \n :if (\$Severity = \"error\") do={:log error \$Log}\r\\r
+ \n :if (\$Severity = \"info\" ) do={:log info \$Log}\r\\r
+ \n } else={:log warning \$Log; :set Severity \"warning\"}\r\\r
+ \n :if (\$Severity != \"debug\" || \$Debug = true) do={:put ([ \$PrintSev\\r
+ erity \$Severity ] . \": \" . \$Message)}\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CertificateAvailable do={\r\\r
+ \n :local CommonName [ :tostr \$1 ];\r\\r
+ \n :local UseFor [ :tostr \$2 ];\r\\r
+ \n :global CertificateDownload;\r\\r
+ \n :global EitherOr;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global ParseKeyValueStore;\r\\r
+ \n :set UseFor [ \$EitherOr \$UseFor \"undefined\" ];\r\\r
+ \n :if ([ /system/resource/get free-hdd-space ] < 8388608 && \\\r\\r
+ \n [ /certificate/settings/get crl-download ] = true && \\\r\\r
+ \n [ /certificate/settings/get crl-store ] = \"system\") do={\r\\r
+ \n \$LogPrint warning \$0 (\"This system has low free flash space but \\r
+ \" . \\\r\\r
+ \n \"is configured to download certificate CRLs to system!\");\r\\r
+ \n }\r\\r
+ \n :if ([ :len \$CommonName ] = 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"No CommonName given!\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local CertSettings [ /certificate/settings/get ];\r\\r
+ \n :if (((\$CertSettings->\"builtin-trust-anchors\") = \"trusted\" || \\\\r
+ \r\\r
+ \n (\$CertSettings->\"builtin-trust-store\") ~ \$UseFor || \\\r\\r
+ \n (\$CertSettings->\"builtin-trust-store\") = \"all\") && \\\r\\r
+ \n [ :len [ /certificate/builtin/find where common-name=\$CommonName\\r
+ \_] ] > 0) do={\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n :if ([ :len [ /certificate/find where common-name=\$CommonName ] ] = 0\\r
+ ) do={\r\\r
+ \n \$LogPrint info \$0 (\"Certificate with CommonName '\" . \$CommonNam\\r
+ e . \"' not available.\");\r\\r
+ \n :if ([ \$CertificateDownload \$CommonName ] = false) do={:return fal\\r
+ se}\r\\r
+ \n }\r\\r
+ \n :if ([ :len [ /certificate/find where common-name=\$CommonName ] ] > 1\\r
+ ) do={\r\\r
+ \n \$LogPrint info \$0 (\"There are \" . \$CertCount . \" Certificates \\r
+ with CommonName '\" . \$CommonName . \"'. Should be ok.\");\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n :local CertVal [ /certificate/get [ find where common-name=\$CommonNam\\r
+ e ] ];\r\\r
+ \n :while ((\$CertVal->\"akid\") != \"\" && (\$CertVal->\"akid\") != (\$C\\r
+ ertVal->\"skid\")) do={\r\\r
+ \n :if ([ :len [ /certificate/find where skid=(\$CertVal->\"akid\") ] ]\\r
+ \_= 0) do={\r\\r
+ \n :local IssuerCN ([ \$ParseKeyValueStore (\$CertVal->\"issuer\") ]-\\r
+ >\"CN\");\r\\r
+ \n \$LogPrint info \$0 (\"Certificate chain for '\" . \$CommonName . \\r
+ \"' is incomplete, missing '\" . \$IssuerCN . \"'.\");\r\\r
+ \n :if ([ \$CertificateDownload \$IssuerCN ] = false) do={:return fal\\r
+ se}\r\\r
+ \n }\r\\r
+ \n :set CertVal [ /certificate/get [ find where skid=(\$CertVal->\"akid\\r
+ \") ] ];\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CertificateDownload do={\r\\r
+ \n :local CommonName [ :tostr \$1 ];\r\\r
+ \n :global GlobalScriptsUrl;\r\\r
+ \n :global GlobalScriptsUrlSuffix;\r\\r
+ \n :global CertificateNameByCN;\r\\r
+ \n :global CleanName;\r\\r
+ \n :global FetchUserAgentStr;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global RmFile;\r\\r
+ \n :global WaitForFile;\r\\r
+ \n \r\\r
+ \n \$LogPrint info \$0 (\"Downloading and importing certificate with Comm\\r
+ onName '\" . \$CommonName . \"'.\");\r\\r
+ \n \r\\r
+ \n :local FileName ([ \$CleanName \$CommonName ] . \".pem\");\r\\r
+ \n :do {\r\\r
+ \n /tool/fetch check-certificate=yes-without-crl http-header-field=({ [\\r
+ \_\$FetchUserAgentStr \$0 ] }) \\\r\\r
+ \n (\$GlobalScriptsUrl . \"certs/\" . \$FileName . \$GlobalScriptsUrl\\r
+ Suffix) dst-path=\$FileName as-value;\r\\r
+ \n \$WaitForFile \$FileName;\r\\r
+ \n } on-error={\r\\r
+ \n \$LogPrint warning \$0 (\"Failed downloading certificate with Common\\r
+ Name '\" . \$CommonName . \\\r\\r
+ \n \"' from repository! Trying fallback to mkcert.org...\");\r\\r
+ \n :do {\r\\r
+ \n :if ([ :len [ /certificate/find where common-name=\"ISRG Root X1\"\\r
+ \_] ] = 0) do={\r\\r
+ \n \$LogPrint error \$0 (\"Required certificate is not available.\"\\r
+ );\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n /tool/fetch check-certificate=yes-without-crl http-header-field=({\\r
+ \_[ \$FetchUserAgentStr \$0 ] }) \\\r\\r
+ \n \"https://mkcert.org/generate/\" http-data=[ :serialize to=json \\r
+ ({ \$CommonName }) ] \\\r\\r
+ \n dst-path=\$FileName as-value;\r\\r
+ \n \$WaitForFile \$FileName;\r\\r
+ \n :if ([ /file/get \$FileName size ] = 0) do={\r\\r
+ \n \$RmFile \$FileName;\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n } on-error={\r\\r
+ \n \$LogPrint warning \$0 (\"Failed downloading certificate with Comm\\r
+ onName '\" . \$CommonName . \"'!\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n /certificate/import file-name=\$FileName passphrase=\"\" as-value;\r\\r
+ \n :delay 1s;\r\\r
+ \n \$RmFile \$FileName;\r\\r
+ \n\r\\r
+ \n :if ([ :len [ /certificate/find where common-name=\$CommonName ] ] = 0\\r
+ ) do={\r\\r
+ \n /certificate/remove [ find where name~(\"^\" . \$FileName . \"_[0-9]\\r
+ +\\\$\") ];\r\\r
+ \n \$LogPrint warning \$0 (\"Certificate with CommonName '\" . \$Common\\r
+ Name . \"' still unavailable!\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :foreach Cert in=[ /certificate/find where name~(\"^\" . \$FileName . \\r
+ \"_[0-9]+\\\$\") ] do={\r\\r
+ \n \$CertificateNameByCN [ /certificate/get \$Cert common-name ];\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CertificateNameByCN do={\r\\r
+ \n :local Match [ :tostr \$1 ];\r\\r
+ \n :global CleanName;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :local Cert ([ /certificate/find where (common-name=\$Match or fingerp\\r
+ rint=\$Match or name=\$Match) ]->0);\r\\r
+ \n :if ([ :len \$Cert ] = 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"No matching certificate found.\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local CommonName [ /certificate/get \$Cert common-name ];\r\\r
+ \n /certificate/set \$Cert name=[ \$CleanName \$CommonName ];\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CharacterMultiply do={\r\\r
+ \n :local Str [ :tostr \$1 ];\r\\r
+ \n :local Num [ :tonum \$2 ];\r\\r
+ \n :if (\$Num = 0) do={:return \"\"}\r\\r
+ \n :local Return \"\";\r\\r
+ \n :for I from=1 to=\$Num do={:set Return (\$Return . \$Str)}\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set FetchUserAgentStr do={\r\\r
+ \n :local Caller [ :tostr \$1 ];\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :local Resource [ /system/resource/get ];\r\\r
+ \n :return (\"User-Agent: Mikrotik/\" . \$Resource->\"version\" . \" \" .\\r
+ \_\$Resource->\"architecture-name\" . \\\r\\r
+ \n \" \" . \$Caller . \"/Fetch (https://amster.vados.ru/; main/3419/3ee\\r
+ 19780)\");\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set Grep do={\r\\r
+ \n :local Input ([ :tostr \$1 ] . \"\\n\");\r\\r
+ \n :local Pattern [ :tostr \$2 ];\r\\r
+ \n :if ([ :typeof [ :find \$Input \$Pattern ] ] = \"nil\") do={:return []\\r
+ }\r\\r
+ \n :do {\r\\r
+ \n :local Line [ :pick \$Input 0 [ :find \$Input \"\\n\" ] ];\r\\r
+ \n :if ([ :typeof [ :find \$Line \$Pattern ] ] = \"num\") do={:return \\r
+ \$Line}\r\\r
+ \n :set Input [ :pick \$Input ([ :find \$Input \"\\n\" ] + 1) [ :len \$\\r
+ Input ] ];\r\\r
+ \n } while=([ :len \$Input ] > 0);\r\\r
+ \n :return [];\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set HumanReadableNum do={\r\\r
+ \n :local Input [ :tonum \$1 ];\r\\r
+ \n :local Base [ :tonum \$2 ];\r\\r
+ \n :global EitherOr;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :local Prefix \"kMGTPE\";\r\\r
+ \n :local Pow 1;\r\\r
+ \n :set Base [ \$EitherOr \$Base 1024 ];\r\\r
+ \n :local Bin [ \$IfThenElse (\$Base = 1024) \"i\" \"\" ];\r\\r
+ \n :if (\$Input < \$Base) do={:return \$Input}\r\\r
+ \n :for I from=0 to=[ :len \$Prefix ] do={\r\\r
+ \n :set Pow (\$Pow * \$Base);\r\\r
+ \n :if (\$Input / \$Base < \$Pow) do={\r\\r
+ \n :set Prefix [ :pick \$Prefix \$I ];\r\\r
+ \n :local Tmp1 (\$Input * 100 / \$Pow);\r\\r
+ \n :local Tmp2 (\$Tmp1 / 100);\r\\r
+ \n :if (\$Tmp2 >= 100) do={:return (\$Tmp2 . \$Prefix . \$Bin)}\r\\r
+ \n :return (\$Tmp2 . \".\" . \\\r\\r
+ \n [ :pick \$Tmp1 [ :len \$Tmp2 ] ([ :len \$Tmp1 ] - [ :len \$Tmp\\r
+ 2 ] + 1) ] . \\\r\\r
+ \n \$Prefix . \$Bin);\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CleanName do={\r\\r
+ \n :local Input [ :tostr \$1 ];\r\\r
+ \n :local Return \"\";\r\\r
+ \n :for I from=0 to=([ :len \$Input ] - 1) do={\r\\r
+ \n :local Char [ :pick \$Input \$I ];\r\\r
+ \n :if ([ :typeof [ find \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqr\\r
+ stuvwxyz0123456789\" \$Char ] ] = \"nil\") do={\r\\r
+ \n :do {:if ([ :len \$Return ] = 0) do={:error true};\r\\r
+ \n :if ([ :pick \$Return ([ :len \$Return ] - 1) ] = \"-\") do={:er\\r
+ ror true}; :set Char \"-\"} on-error={:set Char \"\"}; \r\\r
+ \n };\r\\r
+ \n :set Return (\$Return . \$Char)};\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set GetRandomNumber do={\r\\r
+ \n :global EitherOr;\r\\r
+ \n :return [ :rndnum from=0 to=[ \$EitherOr [ :tonum \$1 ] 4294967295 ] ]\\r
+ \r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set RandomDelay do={\r\\r
+ \n :local Time [ :tonum \$1 ];\r\\r
+ \n :local Unit [ :tostr \$2 ];\r\\r
+ \n :global EitherOr;\r\\r
+ \n :global GetRandomNumber;\r\\r
+ \n :global MAX;\r\\r
+ \n :if (\$Time = 0) do={:return false}\r\\r
+ \n :delay ([ \$MAX 10 [ \$GetRandomNumber ([ :tonsec [ :totime (\$Time . \\r
+ [ \$EitherOr \$Unit \"s\" ]) ] ] / 1000000) ] ] . \"ms\");\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set EscapeForRegEx do={\r\\r
+ \n :local Input [ :tostr \$1 ];\r\\r
+ \n :if ([ :len \$Input ] = 0) do={:return \"\"}\r\\r
+ \n :local Return \"\";\r\\r
+ \n :local Chars (\"^.[]\\\$()|*+\?{}\\\\\");\r\\r
+ \n :for I from=0 to=([ :len \$Input ] - 1) do={\r\\r
+ \n :local Char [ :pick \$Input \$I ];\r\\r
+ \n :if ([ :find \$Chars \$Char ]) do={:set Char (\"\\\\\" . \$Char)}\r\\r
+ \n :set Return (\$Return . \$Char);\r\\r
+ \n }\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n:set ExitError do={\r\\r
+ \n :local ExitOK [ :tostr \$1 ];\r\\r
+ \n :local Name [ :tostr \$2 ];\r\\r
+ \n :local Error [ :tostr \$3 ];\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :if (\$ExitOK = \"false\") do={\r\\r
+ \n \$LogPrint error \$Name ([ \$IfThenElse ([ :pick \$Name 0 1 ] = \"\\\\r
+ \$\") \\\r\\r
+ \n \"Function\" \"Script\" ] . \" '\" . \$Name . \"' exited with er\\r
+ ror\" . \\\r\\r
+ \n [ \$IfThenElse (!(\$Error ~ \"^(|true|false)\\\$\")) (\": \" . \\r
+ \$Error) \".\" ]);\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set MiniDateTimeStamp do={\r\\r
+ \n /system/clock;\r\\r
+ \n :local vdate [get date];\r\\r
+ \n :local vtime [get time];\r\\r
+ \n :local vdoff [:toarray \"0,4,5,7,8,10\"];\r\\r
+ \n :local MM [:pick \$vdate (\$vdoff->2) (\$vdoff->3)];\r\\r
+ \n :local M [:tonum \$MM];\r\\r
+ \n :if (\$vdate ~ \".../../....\") do={\r\\r
+ \n :set vdoff [:toarray \"7,11,1,3,4,6\"];\r\\r
+ \n :set M ([:find \"xxanebarprayunulugepctovecANEBARPRAYUNULUGE\\r
+ PCTOVEC\" [:pick \$vdate (\$vdoff->2) (\$vdoff->3)] -1] / 2);\r\\r
+ \n :if (\$M>12) do={:set M (\$M - 12)}\r\\r
+ \n :set MM [:pick (100 + \$M) 1 3];\r\\r
+ \n }\r\\r
+ \n :local yyyy [:pick \$vdate (\$vdoff->0) (\$vdoff->1)];\r\\r
+ \n :local dd [:pick \$vdate (\$vdoff->4) (\$vdoff->5)];\r\\r
+ \n :local HH [:pick \$vtime 0 2];\r\\r
+ \n :local mm [:pick \$vtime 3 5];\r\\r
+ \n :local ss [:pick \$vtime 6 8];\r\\r
+ \n :return ([\$yyyy] . [\$MM] . [\$dd] . [\$HH] . [\$mm] . [\$ss]);\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set WaitForFile do={\r\\r
+ \n :local FileName [ :tostr \$1 ];\r\\r
+ \n :local WaitTime [ :totime \$2 ];\r\\r
+ \n :global CleanFilePath;\r\\r
+ \n :global EitherOr;\r\\r
+ \n :global MAX;\r\\r
+ \n :set FileName [ \$CleanFilePath \$FileName ];\r\\r
+ \n :local Delay ([ \$MAX [ \$EitherOr \$WaitTime 2s ] 100ms ] / 9);\r\\r
+ \n :do {\r\\r
+ \n :retry {\r\\r
+ \n /file/get \$FileName;\r\\r
+ \n :return true;\r\\r
+ \n } delay=\$Delay max=10;\r\\r
+ \n } on-error={ }\r\\r
+ \n :while ([ :len [ /file/find where name=\$FileName ] ] > 0) do={\r\\r
+ \n :do {\r\\r
+ \n /file/get \$FileName;\r\\r
+ \n :return true;\r\\r
+ \n } on-error={ }\r\\r
+ \n :delay \$Delay;\r\\r
+ \n :set Delay (\$Delay * 3 / 2);\r\\r
+ \n }\r\\r
+ \n :return false;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set FileGet do={\r\\r
+ \n :local FileName [ :tostr \$1 ];\r\\r
+ \n :global WaitForFile;\r\\r
+ \n :if ([ \$WaitForFile \$FileName 0s ] = false) do={:return false}\r\\r
+ \n :local FileVal false;\r\\r
+ \n :do {:set FileVal [ /file/get \$FileName ];\r\\r
+ \n } on-error={ }\r\\r
+ \n :return \$FileVal;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set RmDir do={\r\\r
+ \n :local DirName [ :tostr \$1 ];\r\\r
+ \n :global FileGet;\r\\r
+ \n :global LogPrint;\r\\r
+ \n \$LogPrint debug \$0 (\"Removing directory: \". \$DirName);\r\\r
+ \n :local DirVal [ \$FileGet \$DirName ];\r\\r
+ \n :if (\$DirVal = false) do={\$LogPrint debug \$0 (\"... which does not \\r
+ exist.\"); :return true};\r\\r
+ \n :if (\$DirVal->\"type\" != \"directory\") do={\$LogPrint error \$0 (\"\\r
+ Directory '\" . \$DirName . \"' is not a directory.\"); :return false};\r\\r
+ \n :onerror Err {/file/remove \$DirName} do={\$LogPrint error \$0 (\"Remo\\r
+ ving directory '\" . \$DirName . \"' failed: \" . \$Err); :return false};\\r
+ \r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set RmFile do={\r\\r
+ \n :local FileName [ :tostr \$1 ];\r\\r
+ \n :global FileGet;\r\\r
+ \n :global LogPrint;\r\\r
+ \n \$LogPrint debug \$0 (\"Removing file: \". \$FileName);\r\\r
+ \n :local FileVal [ \$FileGet \$FileName ];\r\\r
+ \n :if (\$FileVal = false) do={\$LogPrint debug \$0 (\"... which does not\\r
+ \_exist.\"); :return true}\r\\r
+ \n :if (\$FileVal->\"type\" = \"directory\" || \$FileVal->\"type\" = \"di\\r
+ sk\") do={\r\\r
+ \n \$LogPrint error \$0 (\"File '\" . \$FileName . \"' is not a file.\"\\r
+ ); :return false}\r\\r
+ \n :onerror Err {\r\\r
+ \n /file/remove \$FileName;\r\\r
+ \n } do={\$LogPrint error \$0 (\"Removing file '\" . \$FileName . \"' fai\\r
+ led: \" . \$Err); :return false}\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set MkDir do={\r\\r
+ \n :local Path [ :tostr \$1 ];\r\\r
+ \n :global CleanFilePath;\r\\r
+ \n :global FileGet;\r\\r
+ \n :global RmDir;\r\\r
+ \n :global WaitForFile;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :local MkTmpfs do={\r\\r
+ \n :global WaitForFile;\r\\r
+ \n :local TmpFs [ /disk/find where slot=tmpfs type=tmpfs ];\r\\r
+ \n :if ([ :len \$TmpFs ] = 1) do={\r\\r
+ \n :if ([ /disk/get \$TmpFs disabled ] = true) do={\r\\r
+ \n \$LogPrint info \$0 (\"The tmpfs is disabled, enabling.\");\r\\r
+ \n /disk/enable \$TmpFs;\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n \$LogPrint info \$0 (\"Creating disk of type tmpfs.\");\r\\r
+ \n \$RmDir \"tmpfs\";\r\\r
+ \n :onerror Err {\r\\r
+ \n /disk/add slot=tmpfs type=tmpfs tmpfs-max-size=([ /system/resource\\r
+ /get total-memory ] / 3);\r\\r
+ \n \$WaitForFile \"tmpfs\";\r\\r
+ \n } do={\r\\r
+ \n \$LogPrint warning \$0 (\"Creating disk of type tmpfs failed: \" .\\r
+ \_\$Err);\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n :set Path [ \$CleanFilePath \$Path ];\r\\r
+ \n :if (\$Path = \"\") do={\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n \$LogPrint debug \$0 (\"Making directory: \" . \$Path);\r\\r
+ \n :local PathVal [ \$FileGet \$Path ];\r\\r
+ \n :if (\$PathVal->\"type\" = \"directory\") do={\r\\r
+ \n \$LogPrint debug \$0 (\"... which already exists.\");\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n :if ([ :pick \$Path 0 5 ] = \"tmpfs\") do={\r\\r
+ \n :if ([ \$MkTmpfs ] = false) do={\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :onerror Err {\r\\r
+ \n /file/add type=\"directory\" name=\$Path;\r\\r
+ \n \$WaitForFile \$Path;\r\\r
+ \n } do={\r\\r
+ \n \$LogPrint warning \$0 (\"Making directory '\" . \$Path . \"' failed\\r
+ : \" . \$Err);\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set MAX do={:if (\$1 > \$2) do={:return \$1}\r\\r
+ \n :return \$2;\r\\r
+ \n}\r\\r
+ \n:set MIN do={:if (\$1 < \$2) do={:return \$1}\r\\r
+ \n :return \$2;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CharacterMultiply do={\r\\r
+ \n :local Str [ :tostr \$1 ];\r\\r
+ \n :local Num [ :tonum \$2 ];\r\\r
+ \n :if (\$Num = 0) do={:return \"\"}\r\\r
+ \n :local Return \"\";\r\\r
+ \n :for I from=1 to=\$Num do={:set Return (\$Return . \$Str)}\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CharacterReplace do={\r\\r
+ \n :local String [ :tostr \$1 ];\r\\r
+ \n :local ReplaceFrom [ :tostr \$2 ];\r\\r
+ \n :local ReplaceWith [ :tostr \$3 ];\r\\r
+ \n :local Return \"\";\r\\r
+ \n :if (\$ReplaceFrom = \"\") do={:return \$String}\r\\r
+ \n :while ([ :typeof [ :find \$String \$ReplaceFrom ] ] != \"nil\") do={\\r
+ \r\\r
+ \n :local Pos [ :find \$String \$ReplaceFrom ];\r\\r
+ \n :set Return (\$Return . [ :pick \$String 0 \$Pos ] . \$ReplaceWith);\\r
+ \r\\r
+ \n :set String [ :pick \$String (\$Pos + [ :len \$ReplaceFrom ]) [ :len\\r
+ \_\$String ] ];\r\\r
+ \n }\r\\r
+ \n :return (\$Return . \$String);\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set CleanFilePath do={\r\\r
+ \n :local Path [ :tostr \$1 ];\r\\r
+ \n :global CharacterReplace;\r\\r
+ \n :while (\$Path ~ \"//\") do={:set \$Path [ \$CharacterReplace \$Path \\r
+ \"//\" \"/\" ]};\r\\r
+ \n :if ([ :pick \$Path 0 ] = \"/\") do={:set Path [ :pick \$Path 1 [ :len\\r
+ \_\$Path ] ]};\r\\r
+ \n :if ([ :pick \$Path ([ :len \$Path ] - 1) ] = \"/\") do={:set Path [ :\\r
+ pick \$Path 0 ([ :len \$Path ] - 1) ]};\r\\r
+ \n :return \$Path;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set IfThenElse do={\r\\r
+ \n :if ([ :tostr \$1 ] = \"true\" || [ :tobool \$1 ] = true) do={:return \\r
+ \$2};\r\\r
+ \n :return \$3;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set EitherOr do={\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :if ([ :typeof \$1 ] = \"num\") do={:return [ \$IfThenElse (\$1 != 0) \\r
+ \$1 \$2 ]}\r\\r
+ \n :if ([ :typeof \$1 ] = \"time\") do={:return [ \$IfThenElse (\$1 > 0s)\\r
+ \_\$1 \$2 ]}\r\\r
+ \n# this works for boolean values, literal ones with parentheses\r\\r
+ \n :return [ \$IfThenElse ([ :len [ :tostr \$1 ] ] > 0) \$1 \$2 ];\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set ParseKeyValueStore do={\r\\r
+ \n :local Source \$1;\r\\r
+ \n :if ([ :pick \$Source 0 1 ] = \"{\") do={\r\\r
+ \n :do {\r\\r
+ \n :return [ :deserialize from=json \$Source ];\r\\r
+ \n } on-error={ }\r\\r
+ \n } \r\\r
+ \n :if ([ :typeof \$Source ] != \"array\") do={:set Source [ :tostr \$1 ]\\r
+ }\r\\r
+ \n :local Result ({});\r\\r
+ \n :foreach KeyValue in=[ :toarray \$Source ] do={\r\\r
+ \n :if ([ :find \$KeyValue \"=\" ]) do={\r\\r
+ \n :local Key [ :pick \$KeyValue 0 [ :find \$KeyValue \"=\" ] ];\r\\r
+ \n :local Value [ :pick \$KeyValue ([ :find \$KeyValue \"=\" ] + 1) [\\r
+ \_:len \$KeyValue ] ];\r\\r
+ \n :if (\$Value=\"true\") do={:set Value true}\r\\r
+ \n :if (\$Value=\"false\") do={:set Value false}\r\\r
+ \n :set (\$Result->\$Key) \$Value;\r\\r
+ \n } else={:set (\$Result->\$KeyValue) true}\r\\r
+ \n }\r\\r
+ \n :return \$Result;\r\\r
+ \n}\r\\r
+ \n:set RequiredRouterOS do={\r\\r
+ \n :local Caller [ :tostr \$1 ];\r\\r
+ \n :local Required [ :tostr \$2 ];\r\\r
+ \n :local Warn [ :tostr \$3 ];\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global VersionToNum;\r\\r
+ \n :if (!(\$Required ~ \"^\\\\d+\\\\.\\\\d+((alpha|beta|rc|\\\\.)\\\\d+|)\\r
+ \\\$\")) do={\r\\r
+ \n \$LogPrint error \$0 (\"No valid RouterOS version: \" . \$Required);\\r
+ \r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :if ([ \$VersionToNum \$Required ] > [ \$VersionToNum [ /system/packag\\r
+ e/update/get installed-version ] ]) do={\r\\r
+ \n :if (\$Warn = \"true\") do={\r\\r
+ \n \$LogPrint warning \$0 (\"This \" . [ \$IfThenElse ([ :pick \$Call\\r
+ er 0 ] = (\"\\\$\")) \"function\" \"script\" ] . \\\r\\r
+ \n \" '\" . \$Caller . \"' (at least specific functionality) requir\\r
+ es RouterOS \" . \$Required . \". Please update!\");\r\\r
+ \n }\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n:set VersionToNum do={\r\\r
+ \n :local Input [ :tostr \$1 ];\r\\r
+ \n :local Multi 0x1000000;\r\\r
+ \n :local Return 0;\r\\r
+ \n :global CharacterReplace;\r\\r
+ \n :set Input [ \$CharacterReplace \$Input \".\" \",\" ];\r\\r
+ \n :foreach I in={ \"zero\"; \"alpha\"; \"beta\"; \"rc\" } do={\r\\r
+ \n :set Input [ \$CharacterReplace \$Input \$I (\",\" . \$I . \",\") ];\\r
+ \r\\r
+ \n }\r\\r
+ \n :foreach Value in=([ :toarray \$Input ], 0) do={\r\\r
+ \n :local Num [ :tonum \$Value ];\r\\r
+ \n :if (\$Multi = 0x100) do={\r\\r
+ \n :if ([ :typeof \$Num ] = \"num\") do={\r\\r
+ \n :set Return (\$Return + 0xff00);\r\\r
+ \n :set Multi (\$Multi / 0x100);\r\\r
+ \n } else={\r\\r
+ \n :if (\$Value = \"zero\") do={ }\r\\r
+ \n :if (\$Value = \"alpha\") do={ :set Return (\$Return + 0x3f00); \\r
+ }\r\\r
+ \n :if (\$Value = \"beta\") do={ :set Return (\$Return + 0x5f00); }\\r
+ \r\\r
+ \n :if (\$Value = \"rc\") do={ :set Return (\$Return + 0x7f00); }\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :if ([ :typeof \$Num ] = \"num\") do={ :set Return (\$Return + (\$Va\\r
+ lue * \$Multi)); }\r\\r
+ \n :set Multi (\$Multi / 0x100);\r\\r
+ \n }\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n:set ScriptLock do={\r\\r
+ \n :local Script [ :tostr \$1 ];\r\\r
+ \n :local WaitMax [ :totime \$2 ];\r\\r
+ \n :global GetRandom20CharAlNum;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global ScriptLockOrder;\r\\r
+ \n :if ([ :typeof \$ScriptLockOrder ] = \"nothing\") do={\r\\r
+ \n :set ScriptLockOrder ({});\r\\r
+ \n }\r\\r
+ \n :if ([ :typeof (\$ScriptLockOrder->\$Script) ] = \"nothing\") do={\r\\r
+ \n :set (\$ScriptLockOrder->\$Script) ({});\r\\r
+ \n }\r\\r
+ \n :local JobCount do={\r\\r
+ \n :local Script [ :tostr \$1 ];\r\\r
+ \n :return [ :len [ /system/script/job/find where script=\$Script ] ];\\r
+ \r\\r
+ \n }\r\\r
+ \n :local TicketCount do={\r\\r
+ \n :local Script [ :tostr \$1 ];\r\\r
+ \n :global ScriptLockOrder;\r\\r
+ \n :local Count 0;\r\\r
+ \n :foreach Ticket in=(\$ScriptLockOrder->\$Script) do={\r\\r
+ \n :if ([ :typeof \$Ticket ] != \"nothing\") do={:set Count (\$Count \\r
+ + 1)}\r\\r
+ \n }\r\\r
+ \n :return \$Count;\r\\r
+ \n }\r\\r
+ \n :local IsFirstTicket do={\r\\r
+ \n :local Script [ :tostr \$1 ];\r\\r
+ \n :local Check [ :tostr \$2 ];\r\\r
+ \n :global ScriptLockOrder;\r\\r
+ \n :foreach Ticket in=(\$ScriptLockOrder->\$Script) do={\r\\r
+ \n :if (\$Ticket = \$Check) do={:return true}\r\\r
+ \n :if ([ :typeof \$Ticket ] != \"nothing\" && \$Ticket != \$Check) d\\r
+ o={:return false}\r\\r
+ \n }\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local AddTicket do={\r\\r
+ \n :local Script [ :tostr \$1 ];\r\\r
+ \n :local Add [ :tostr \$2 ];\r\\r
+ \n :global ScriptLockOrder;\r\\r
+ \n :while (true) do={\r\\r
+ \n :local Pos [ :len (\$ScriptLockOrder->\$Script) ];\r\\r
+ \n :set (\$ScriptLockOrder->\$Script->\$Pos) \$Add;\r\\r
+ \n :delay 10ms;\r\\r
+ \n :if ((\$ScriptLockOrder->\$Script->\$Pos) = \$Add) do={:return tru\\r
+ e}\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :local RemoveTicket do={\r\\r
+ \n :local Script [ :tostr \$1 ];\r\\r
+ \n :local Remove [ :tostr \$2 ];\r\\r
+ \n :global ScriptLockOrder;\r\\r
+ \n :foreach Id,Ticket in=(\$ScriptLockOrder->\$Script) do={\r\\r
+ \n :while ((\$ScriptLockOrder->\$Script->\$Id) = \$Remove) do={\r\\r
+ \n :set (\$ScriptLockOrder->\$Script->\$Id);\r\\r
+ \n :delay 10ms;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :local CleanupTickets do={\r\\r
+ \n :local Script [ :tostr \$1 ];\r\\r
+ \n :global ScriptLockOrder;\r\\r
+ \n :foreach Ticket in=(\$ScriptLockOrder->\$Script) do={\r\\r
+ \n :if ([ :typeof \$Ticket ] != \"nothing\") do={:return false}\r\\r
+ \n }\r\\r
+ \n :set (\$ScriptLockOrder->\$Script) ({});\r\\r
+ \n }\r\\r
+ \n :if ([ :typeof \$WaitMax ] = \"nil\" ) do={:set WaitMax 0s}\r\\r
+ \n :if ([ :len [ /system/script/find where name=\$Script ] ] = 0) do={\r\\r
+ \n \$LogPrint error \$0 (\"A script named '\" . \$Script . \"' does not\\r
+ \_exist!\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n :if ([ \$JobCount \$Script ] = 0) do={\r\\r
+ \n \$LogPrint error \$0 (\"No script '\" . \$Script . \"' is running!\"\\r
+ );\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n :if ([ \$TicketCount \$Script ] >= [ \$JobCount \$Script ]) do={\r\\r
+ \n \$LogPrint error \$0 (\"More tickets than running scripts '\" . \$Sc\\r
+ ript . \"', resetting!\");\r\\r
+ \n :set (\$ScriptLockOrder->\$Script) ({});\r\\r
+ \n /system/script/job/remove [ find where script=\$Script ];\r\\r
+ \n }\r\\r
+ \n :local MyTicket [ \$GetRandom20CharAlNum 6 ];\r\\r
+ \n \$AddTicket \$Script \$MyTicket;\r\\r
+ \n :local WaitInterval (\$WaitMax / 20);\r\\r
+ \n :local WaitTime \$WaitMax;\r\\r
+ \n :while (\$WaitTime > 0 && \\\r\\r
+ \n ([ \$IsFirstTicket \$Script \$MyTicket ] = false || \\\r\\r
+ \n [ \$TicketCount \$Script ] < [ \$JobCount \$Script ])) do={\r\\r
+ \n :set WaitTime (\$WaitTime - \$WaitInterval);\r\\r
+ \n :delay \$WaitInterval;\r\\r
+ \n }\r\\r
+ \n :if ([ \$IsFirstTicket \$Script \$MyTicket ] = true && \\\r\\r
+ \n [ \$TicketCount \$Script ] = [ \$JobCount \$Script ]) do={\r\\r
+ \n \$RemoveTicket \$Script \$MyTicket;\r\\r
+ \n \$CleanupTickets \$Script;\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n \$RemoveTicket \$Script \$MyTicket;\r\\r
+ \n \$LogPrint debug \$0 (\"Script '\" . \$Script . \"' started more than \\r
+ once\" . \\\r\\r
+ \n [ \$IfThenElse (\$WaitTime < \$WaitMax) \" and timed out waiting for\\r
+ \_lock\" \"\" ] . \"...\");\r\\r
+ \n :return false;\r\\r
+ \n}\r\\r
+ \n:set SendNotification do={ :onerror Err {\r\\r
+ \n :global SendNotification2;\r\\r
+ \n \$SendNotification2 ({ origin=\$0; subject=\$1; message=\$2; link=\$3;\\r
+ \_silent=\$4 });\r\\r
+ \n} do={:global ExitOnError; \$ExitOnError \$0 \$Err}\r\\r
+ \n}\r\\r
+ \n:set SendNotification2 do={\r\\r
+ \n :local Notification \$1;\r\\r
+ \n :global NotificationFunctions;\r\\r
+ \n :foreach FunctionName,Discard in=\$NotificationFunctions do={\r\\r
+ \n (\$NotificationFunctions->\$FunctionName) (\"\\\$NotificationFunctio\\r
+ ns->\\\"\" . \$FunctionName . \"\\\"\") \$Notification;\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n:set SymbolByUnicodeName do={\r\\r
+ \n :local Name [ :tostr \$1 ];\r\\r
+ \n :global EitherOr;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global SymbolsExtra;\r\\r
+ \n :local Symbols ({\r\\r
+ \n \"abacus\"=\"\\F0\\9F\\A7\\AE\";\r\\r
+ \n \"alarm-clock\"=\"\\E2\\8F\\B0\";\r\\r
+ \n \"arrow-down\"=\"\\E2\\AC\\87\";\r\\r
+ \n \"arrow-up\"=\"\\E2\\AC\\86\";\r\\r
+ \n \"calendar\"=\"\\F0\\9F\\93\\85\";\r\\r
+ \n \"card-file-box\"=\"\\F0\\9F\\97\\83\";\r\\r
+ \n \"chart-decreasing\"=\"\\F0\\9F\\93\\89\";\r\\r
+ \n \"chart-increasing\"=\"\\F0\\9F\\93\\88\";\r\\r
+ \n \"cloud\"=\"\\E2\\98\\81\";\r\\r
+ \n \"cross-mark\"=\"\\E2\\9D\\8C\";\r\\r
+ \n \"earth\"=\"\\F0\\9F\\8C\\8D\";\r\\r
+ \n \"fire\"=\"\\F0\\9F\\94\\A5\";\r\\r
+ \n \"floppy-disk\"=\"\\F0\\9F\\92\\BE\";\r\\r
+ \n \"gear\"=\"\\E2\\9A\\99\";\r\\r
+ \n \"heart\"=\"\\E2\\99\\A5\";\r\\r
+ \n \"high-voltage-sign\"=\"\\E2\\9A\\A1\";\r\\r
+ \n \"incoming-envelope\"=\"\\F0\\9F\\93\\A8\";\r\\r
+ \n \"information\"=\"\\E2\\84\\B9\";\r\\r
+ \n \"large-orange-circle\"=\"\\F0\\9F\\9F\\A0\";\r\\r
+ \n \"large-red-circle\"=\"\\F0\\9F\\94\\B4\";\r\\r
+ \n \"link\"=\"\\F0\\9F\\94\\97\";\r\\r
+ \n \"lock-with-ink-pen\"=\"\\F0\\9F\\94\\8F\";\r\\r
+ \n \"memo\"=\"\\F0\\9F\\93\\9D\";\r\\r
+ \n \"mobile-phone\"=\"\\F0\\9F\\93\\B1\";\r\\r
+ \n \"pushpin\"=\"\\F0\\9F\\93\\8C\";\r\\r
+ \n \"scissors\"=\"\\E2\\9C\\82\";\r\\r
+ \n \"scroll\"=\"\\F0\\9F\\93\\9C\";\r\\r
+ \n \"smiley-partying-face\"=\"\\F0\\9F\\A5\\B3\";\r\\r
+ \n \"smiley-smiling-face\"=\"\\E2\\98\\BA\";\r\\r
+ \n \"smiley-winking-face-with-tongue\"=\"\\F0\\9F\\98\\9C\";\r\\r
+ \n \"sparkles\"=\"\\E2\\9C\\A8\";\r\\r
+ \n \"speech-balloon\"=\"\\F0\\9F\\92\\AC\";\r\\r
+ \n \"star\"=\"\\E2\\AD\\90\";\r\\r
+ \n \"warning-sign\"=\"\\E2\\9A\\A0\";\r\\r
+ \n \"white-heavy-check-mark\"=\"\\E2\\9C\\85\"\r\\r
+ \n }, \$SymbolsExtra);\r\\r
+ \n :local Magic [ :pick [ /system/clock/get date ] 4 10 ];\r\\r
+ \n :local Special {\r\\r
+ \n \"information-04-01\"=\"\\F0\\9F\\9A\\BB\";\r\\r
+ \n \"large-orange-circle-04-01\"=\"\\F0\\9F\\8D\\8A\";\r\\r
+ \n \"large-orange-circle-10-31\"=\"\\F0\\9F\\8E\\83\";\r\\r
+ \n \"large-red-circle-04-01\"=\"\\F0\\9F\\8D\\92\" };\r\\r
+ \n :if ([ :len (\$Symbols->\$Name) ] = 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"No symbol available for name '\" . \$Name \\r
+ . \"'!\");\r\\r
+ \n :return \"\";\r\\r
+ \n }\r\\r
+ \n :return ([ \$EitherOr (\$Special->(\$Name . \$Magic)) (\$Symbols->\$Na\\r
+ me) ] . \"\\EF\\B8\\8F\");\r\\r
+ \n}\r\\r
+ \n:set SymbolForNotification do={\r\\r
+ \n :global NotificationsWithSymbols;\r\\r
+ \n :global SymbolByUnicodeName;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :if (\$NotificationsWithSymbols != true) do={:return [ \$IfThenElse ([\\r
+ \_:len \$2 ] > 0) ([ :tostr \$2 ] . \" \") \"\" ]}\r\\r
+ \n :local Return \"\";\r\\r
+ \n :foreach Symbol in=[ :toarray \$1 ] do={:set Return (\$Return . [ \$Sy\\r
+ mbolByUnicodeName \$Symbol ])}\r\\r
+ \n :return (\$Return . \" \");\r\\r
+ \n}\r\\r
+ \n:set Unix2Dos do={:return [ :tocrlf [ :tostr \$1 ] ]}\r\\r
+ \n:set UrlEncode do={\r\\r
+ \n :local Input [ :tostr \$1 ];\r\\r
+ \n :if ([ :len \$Input ] = 0) do={:return \"\"}\r\\r
+ \n :local Return \"\";\r\\r
+ \n :local Chars (\"\\n\\r !\\\"#\\\$%&'()*+,:;<=>\?@[\\\\]^`{|}~\");\r\\r
+ \n :local Subs { \"%0A\"; \"%0D\"; \"%20\"; \"%21\"; \"%22\"; \"%23\"; \"\\r
+ %24\"; \"%25\"; \"%26\"; \"%27\";\r\\r
+ \n \"%28\"; \"%29\"; \"%2A\"; \"%2B\"; \"%2C\"; \"%3A\"; \"%3B\"; \\r
+ \"%3C\"; \"%3D\"; \"%3E\"; \"%3F\";\r\\r
+ \n \"%40\"; \"%5B\"; \"%5C\"; \"%5D\"; \"%5E\"; \"%60\"; \"%7B\"; \\r
+ \"%7C\"; \"%7D\"; \"%7E\" };\r\\r
+ \n :for I from=0 to=([ :len \$Input ] - 1) do={\r\\r
+ \n :local Char [ :pick \$Input \$I ];\r\\r
+ \n :local Replace [ :find \$Chars \$Char ];\r\\r
+ \n :if ([ :typeof \$Replace ] = \"num\") do={:set Char (\$Subs->\$Repla\\r
+ ce)}\r\\r
+ \n :set Return (\$Return . \$Char);\r\\r
+ \n }\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n:set ValidateSyntax do={\r\\r
+ \n :local Code [ :tostr \$1 ];\r\\r
+ \n :global LogPrint;\r\\r
+ \n :onerror Err {\r\\r
+ \n [ :parse (\":local Validate do={\\n\" . \$Code . \"\\n}\") ];\r\\r
+ \n } do={\r\\r
+ \n \$LogPrint debug \$0 (\"Valdation failed: \" . \$Err);\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n:set IsDNSResolving do={\r\\r
+ \n :do {:resolve \"api.telegram.org\"} on-error={:return false}\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n:set IsFullyConnected do={\r\\r
+ \n :global IsDNSResolving;\r\\r
+ \n :global IsTimeSync;\r\\r
+ \n :if ([ \$IsDNSResolving ] = false) do={:return false};\r\\r
+ \n :if ([ \$IsTimeSync ] = false) do={:return false};\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n:set IsTimeSync do={\r\\r
+ \n :global IsTimeSyncCached;\r\\r
+ \n :global IsTimeSyncResetNtp;\r\\r
+ \n :if (\$IsTimeSyncCached = true) do={:return true}\r\\r
+ \n :if ([ /system/ntp/client/get enabled ] = true) do={\r\\r
+ \n :if ([ /system/ntp/client/get status ] = \"synchronized\") do={\r\\r
+ \n :set IsTimeSyncCached true;\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n :local Uptime [ /system/resource/get uptime ];\r\\r
+ \n :if ([ :typeof \$IsTimeSyncResetNtp ] = \"nothing\") do={\r\\r
+ \n :set IsTimeSyncResetNtp \$Uptime;\r\\r
+ \n }\r\\r
+ \n :if (\$Uptime - \$IsTimeSyncResetNtp < 3m) do={:return false}\r\\r
+ \n :log warning \"\$0 The ntp client is configured, but did not sync.\"\\r
+ ;\r\\r
+ \n :set IsTimeSyncResetNtp \$Uptime;\r\\r
+ \n /system/ntp/client/set enabled=no;\r\\r
+ \n :delay 20ms;\r\\r
+ \n /system/ntp/client/set enabled=yes;\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :if ([ /system/license/get ]->\"level\" = \"free\" || \\\r\\r
+ \n [ /system/resource/get ]->\"board-name\" = \"x86\") do={\r\\r
+ \n :log debug \"\$0 No ntp client configured, relying on RTC for CHR fr\\r
+ ee license and x86.\";\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n :if ([ /ip/cloud/get update-time ] = true) do={\r\\r
+ \n :if ([ :typeof [ /ip/cloud/get public-address ] ] = \"ip\") do={\r\\r
+ \n :set IsTimeSyncCached true;\r\\r
+ \n :return true;\r\\r
+ \n }\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :log debug \"\$0 No time source configured! Returning gracefully...\";\\r
+ \r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n# read parts of a large file\r\\r
+ \n:set FetchLargeFiles do={\r\\r
+ \n :local ScriptName [:tostr \$1];\r\\r
+ \n :local fetchUrl [:tostr \$2];\r\\r
+ \n :local CheckCert [:tostr \$3];\r\\r
+ \n :local fetchMode [:tostr \$4];\r\\r
+ \n :local fetchMethod [:tostr \$5];\r\\r
+ \n :local FetchString \"undefined\";\r\\r
+ \n \r\\r
+ \n :global CleanName;\r\\r
+ \n :global FetchUserAgentStr;\r\\r
+ \n :global GetRandom20CharAlNum;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global MkDir;\r\\r
+ \n :global RmDir;\r\\r
+ \n :global RmFile;\r\\r
+ \n :global WaitForFile;\r\\r
+ \n\r\\r
+ \n :set CheckCert [ \$IfThenElse (\$CheckCert = \"false\") \"no\" \"yes-w\\r
+ ithout-crl\" ];\r\\r
+ \n #:set fetchMode [ \$IfThenElse (\$fetchMode != \"false\") [:tostr (\"m\\r
+ ode=\" . \$fetchMode)] ];\r\\r
+ \n #:set fetchMethod [\$IfThenElse (\$fetchMethod != \"false\") [:tostr (\\r
+ \"http-method=\\\"\" . \$fetchMethod . \"\\\"\") ]];\r\\r
+ \n \r\\r
+ \n :local DirName (\"tmpfs/\" . [ \$CleanName \$ScriptName ]);\r\\r
+ \n :if ([ \$MkDir \$DirName ] = false) do={\r\\r
+ \n \$LogPrint error \$0 (\"Failed creating directory!\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local FileName (\$DirName . \"/\" . [ \$CleanName \$0 ] . \"-\" . [ \\r
+ \$GetRandom20CharAlNum ]);\r\\r
+ \n #/tool/fetch check-certificate=\$CheckCert \$Url dst-path=\$FileName h\\r
+ ttp-header-field=({ [ \$FetchUserAgentStr \$ScriptName ] }) as-value;\r\\r
+ \n #:log warning (\"\\\$fUrl =\" . \$2 . ({[ \$fMode ]}));\r\\r
+ \n :onerror Err {\r\\r
+ \n :set FetchString (\"/tool/fetch \" . \\\r\\r
+ \n [\$IfThenElse ([\$fetchMethod] != \"false\") (\"http-method=\\\"\"\\r
+ \_. \$fetchMethod . \"\\\" \")] . \\\r\\r
+ \n \"check-certificate=\" . \$CheckCert . \" url=(\\\"\" . \$fetchUrl\\r
+ \_. \"\\\") \" . \\\r\\r
+ \n [\$IfThenElse ([\$fetchMode] != \"false\") (\"mode=\" . \$fetchMod\\r
+ e . \" \")] . \\\r\\r
+ \n http-header-field=({ [ \$FetchUserAgentStr \$ScriptName ] }) as-va\\r
+ lue);\r\\r
+ \n :log warning (\"\\\$FetchSring = \" . \$FetchString);\r\\r
+ \n :put [\$FetchString];\r\\r
+ \n #:put [/tool/fetch \$fetchMode check-certificate=\$CheckCert url=(\$\\r
+ fetchUrl) dst-path=(\$FileName) http-header-field=({ [ \$FetchUserAgentStr\\r
+ \_\$ScriptName ] }) as-value];\r\\r
+ \n } do={\r\\r
+ \n :if ([ \$WaitForFile \$FileName 500ms ] = true) do={\r\\r
+ \n \$RmFile \$FileName;\r\\r
+ \n }\r\\r
+ \n \$LogPrint debug \$0 (\"Failed downloading from \" . \$fetchUrl . \"\\r
+ \_- \" . \$Err);\r\\r
+ \n \$RmDir \$DirName;\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :if ([ \$WaitForFile \$FileName 5s ] = false) do={\r\\r
+ \n \$LogPrint debug \$0 (\"The file downloaded from \" . \$fetchUrl . \\r
+ \" did not show up.\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local FileSize [ /file/get \$FileName size ];\r\\r
+ \n :local Return \"\";\r\\r
+ \n :local VarSize 0;\r\\r
+ \n :while (\$VarSize != \$FileSize) do={\r\\r
+ \n :set Return (\$Return . ([ /file/read offset=\$VarSize chunk-size=32\\r
+ 768 file=\$FileName as-value ]->\"data\"));\r\\r
+ \n :set FileSize [ /file/get \$FileName size ];\r\\r
+ \n :set VarSize [ :len \$Return ];\r\\r
+ \n :if (\$VarSize > \$FileSize) do={\r\\r
+ \n :delay 100ms;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n \$RmDir \$DirName;\r\\r
+ \n :return \$Return;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:set ScriptInstallUpdate do={ :onerror Err {\r\\r
+ \n :local Scripts [ :toarray \$1 ];\r\\r
+ \n :local NewComment [ :tostr \$2 ];\r\\r
+ \n :global InitSetup;\r\\r
+ \n\r\\r
+ \n :global CommitId;\r\\r
+ \n :global ScriptUpdatesCRLF;\r\\r
+ \n :global GlobalConfVersion;\r\\r
+ \n :global Identity;\r\\r
+ \n :global CertificateAvailable;\r\\r
+ \n :global CheckSumsVerify;\r\\r
+ \n :global GlobalScriptsUrl;\r\\r
+ \n :global SumsDirAndFileName;\r\\r
+ \n :global GlobalScriptsUrlSuffix;\r\\r
+ \n :global EitherOr;\r\\r
+ \n :global FetchUserAgentStr;\r\\r
+ \n :global Grep;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global ParseKeyValueStore;\r\\r
+ \n :global RequiredRouterOS;\r\\r
+ \n :global SendNotification2;\r\\r
+ \n :global SymbolForNotification;\r\\r
+ \n :global ValidateSyntax;\r\\r
+ \n :global CommentsInScripts;\r\\r
+ \n\r\\r
+ \n :if ([ \$CertificateAvailable \"Root YE\" \"fetch\" ] = false) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Downloading certificate failed, trying wit\\r
+ hout.\");\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :foreach Script in=\$Scripts do={\r\\r
+ \n :if ([ :len [ /system/script/find where name=\$Script ] ] = 0) do={\\r
+ \r\\r
+ \n \$LogPrint info \$0 (\"Adding new script: \" . \$Script);\r\\r
+ \n /system/script/add name=\$Script owner=\$Script source=\"#!rsc by \\r
+ Vados\\n\" comment=\$NewComment;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local CommitIdBefore \$CommitId;\r\\r
+ \n :local GlobalConfVersionBefore \$GlobalConfVersion;\r\\r
+ \n :local ReloadGlobal false;\r\\r
+ \n :local DeviceMode [ /system/device-mode/get ];\r\\r
+ \n\r\\r
+ \n :if (\$CheckSumsVerify = true) do={\r\\r
+ \n :local CheckSums ({});\r\\r
+ \n :do {\r\\r
+ \n :local Url (\$GlobalScriptsUrl . \$SumsDirAndFileName . \$GlobalScr\\r
+ iptsUrlSuffix);\r\\r
+ \n \$LogPrint debug \$0 (\"Fetching checksums from url: \" . \$Url);\\r
+ \r\\r
+ \n :set CheckSums [ :deserialize from=json ([ /tool/fetch check-certi\\r
+ ficate=yes-without-crl \\\r\\r
+ \n http-header-field=({ [ \$FetchUserAgentStr \$0 ] }) \$Url output\\r
+ =user as-value ]->\"data\") ];\r\\r
+ \n } on-error={ \$LogPrint warning \$0 (\"Err = \" . \$Err); }\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :foreach Script in=[ /system/script/find where source~\"^#!rsc by Vado\\r
+ s\" ] do={\r\\r
+ \n :local ScriptVal [ /system/script/get \$Script ];\r\\r
+ \n :local ScriptInfo [ \$ParseKeyValueStore (\$ScriptVal->\"comment\") \\r
+ ];\r\\r
+ \n :local SourceNew;\r\\r
+ \n\r\\r
+ \n :foreach Scheduler in=[ /system/scheduler/find where on-event~(\"\\\\r
+ \\b\" . \$ScriptVal->\"name\" . \"\\\\b\") ] do={\r\\r
+ \n :local SchedulerVal [ /system/scheduler/get \$Scheduler ];\r\\r
+ \n :if (\$ScriptVal->\"policy\" != \$SchedulerVal->\"policy\") do={\r\\r
+ \n \$LogPrint warning \$0 (\"Policies differ for script '\" . \$Scr\\r
+ iptVal->\"name\" . \"' and its scheduler '\" . \$SchedulerVal->\"name\" . \\r
+ \"'!\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :do {\r\\r
+ \n :if (\$ScriptInfo->\"ignore\" = true) do={\r\\r
+ \n \$LogPrint debug \$0 (\"Ignoring script '\" . \$ScriptVal->\"nam\\r
+ e\" . \"', as requested.\");\r\\r
+ \n :error true;\r\\r
+ \n }\r\\r
+ \n :if (\$CheckSumsVerify = true) do={\r\\r
+ \n :local CheckSum (\$CheckSums->(\$ScriptVal->\"name\"));\r\\r
+ \n :if ([ :len (\$ScriptInfo->\"base-url\") ] = 0 && [ :len (\$Scri\\r
+ ptInfo->\"url-suffix\") ] = 0 && \\\r\\r
+ \n [ :convert transform=md5 to=hex [ :tolf (\$ScriptVal->\"sou\\r
+ rce\") ] ] = \$CheckSum) do={\r\\r
+ \n \$LogPrint debug \$0 (\"Checksum for script '\" . \$ScriptVal-\\r
+ >\"name\" . \"' matches, ignoring.\");\r\\r
+ \n :error true;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :if ([ :len (\$ScriptInfo->\"certificate\") ] > 0) do={\r\\r
+ \n :if ([ \$CertificateAvailable (\$ScriptInfo->\"certificate\") \"\\r
+ fetch\" ] = false) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Downloading certificate failed, tryi\\r
+ ng without.\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :onerror Err {\r\\r
+ \n :local BaseUrl [ \$EitherOr (\$ScriptInfo->\"base-url\") \$Globa\\r
+ lScriptsUrl ];\r\\r
+ \n :local UrlSuffix [ \$EitherOr (\$ScriptInfo->\"url-suffix\") \$G\\r
+ lobalScriptsUrlSuffix ];\r\\r
+ \n :local Url (\$BaseUrl . \$ScriptVal->\"name\" . \".rsc\" . \$Url\\r
+ Suffix);\r\\r
+ \n \$LogPrint warning \$0 (\"Fetching script '\" . (\$ScriptVal->\"\\r
+ name\") . \"' from url: \" . \$Url);\r\\r
+ \n :local Result [ /tool/fetch check-certificate=yes-without-crl \\\\r
+ \r\\r
+ \n http-header-field=({ [ \$FetchUserAgentStr \$0 ] }) \$Url outp\\r
+ ut=user as-value ];\r\\r
+ \n :if (\$Result->\"status\" = \"finished\") do={\r\\r
+ \n :set SourceNew [ :tolf (\$Result->\"data\") ];\r\\r
+ \n } \r\\r
+ \n } do={\r\\r
+ \n \$LogPrint warning \$0 (\"Failed fetching script '\" . \$ScriptV\\r
+ al->\"name\" . \"': \" . \$Err);\r\\r
+ \n :if (\$Err != \"Fetch failed with status 404\") do={\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n :if (\$ScriptVal->\"source\" = \"#!rsc by Vados\") do={\r\\r
+ \n \$LogPrint warning \$0 (\"Removing dummy. Typo on installation\\r
+ \?\");\r\\r
+ \n /system/script/remove \$Script;\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n :if (\$CheckSumsVerify = true) do={\r\\r
+ \n :if ([ :len (\$ScriptInfo->\"base-url\") ] = 0 && [ :len (\$Sc\\r
+ riptInfo->\"url-suffix\") ] = 0 && \\\r\\r
+ \n [ :len \$CheckSum ] = 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Added the script manually\? Skip u\\r
+ pdates with 'ignore=true' in comment.\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ([ :len \$SourceNew ] = 0) do={\r\\r
+ \n \$LogPrint debug \$0 (\"No update for script '\" . (\$ScriptVal-\\r
+ >\"name\") . \"'.\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local SourceCRLF [ :tocrlf \$SourceNew ];\r\\r
+ \n :if (\$InitSetup != true && ((\$ScriptVal->\"name\") != \"AM-Globa\\r
+ lConfig\" || (\$ScriptVal->\"name\") != \"AM-GlobalFunc\")) do={\r\\r
+ \n :if (\$SourceNew = (\$ScriptVal->\"source\") || \$SourceCRLF = (\\r
+ \$ScriptVal->\"source\")) do={\r\\r
+ \n \$LogPrint debug \$0 (\"Script '\" . (\$ScriptVal->\"name\") \\r
+ . \"' source did not change. End of lines set to CRLF.\");\r\\r
+ \n if (\$ScriptUpdatesCRLF = false) do={\r\\r
+ \n :put [ :tolf \$SourceNew ];\r\\r
+ \n \$LogPrint debug \$0 (\"Script '\" . (\$ScriptVal->\"name\"\\r
+ ) . \"' source update end of lines to LF.\");\r\\r
+ \n }\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ([ :pick \$SourceNew 0 14 ] != \"#!rsc by Vados\") do={\r\\r
+ \n \$LogPrint warning \$0 (\"Looks like new script '\" . \$ScriptVa\\r
+ l->\"name\" . \"' is not valid (missing shebang = '\$shebang') Ignoring!\"\\r
+ );\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if (\$CommentsInScripts = true) do={\r\\r
+ \n :local CommentLine [ \$Grep \$SourceNew (\"\\23 Script comment:\\r
+ \_\") ];\r\\r
+ \n :if ([ :len \$CommentLine ] = 0) do={\r\\r
+ \n \$LogPrint debug \$0 (\"The search in new script '\" . (\$Scr\\r
+ iptVal->\"name\") . \"' for comment in script body, is not found result Ig\\r
+ noring!\");\r\\r
+ \n :error false;\r\\r
+ \n } else={\r\\r
+ \n :if ([ :len (\$ScriptVal->\"comment\")] = 0 || [ :len (\$Scri\\r
+ ptVal->\"comment\")] != [ :pick \$CommentLine ([ :find \$CommentLine \":\"\\r
+ ] + 2) [ :len \$CommentLine] ]) do={\r\\r
+ \n \$LogPrint debug \$0 (\"Exsiting comment for script '\" . (\\r
+ \$ScriptVal->\"name\") . \"' is '\" . (\$ScriptVal->\"comment\") . \"'.\")\\r
+ ;\r\\r
+ \n :set (\$ScriptVal->\"comment\") [ :pick \$CommentLine ([ :f\\r
+ ind \$CommentLine \":\"] + 2) [ :len \$CommentLine] ];\r\\r
+ \n \$LogPrint debug \$0 (\"New comment (\" . (\$ScriptVal->\"c\\r
+ omment\") . \") for script '\" . (\$ScriptVal->\"name\") . \"' has been ad\\r
+ ded!\");\r\\r
+ \n } else={\r\\r
+ \n \$LogPrint debug \$0 (\"Comment for script '\" . (\$ScriptV\\r
+ al->\"name\") . \"' did not change.\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n } \r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local RequiredROS ([ \$ParseKeyValueStore [ \$Grep \$SourceNew (\\r
+ \"\\23 requires RouterOS, \") ] ]->version);\r\\r
+ \n :if ([ \$RequiredRouterOS \$0 [ \$EitherOr \$RequiredROS \"0.0\" ]\\r
+ \_false ] = false) do={\r\\r
+ \n \$LogPrint warning \$0 (\"The script '\" . (\$ScriptVal->\"name\\r
+ \") . \"' requires RouterOS \" . \\\r\\r
+ \n \$RequiredROS . \", which is not met by your installation. I\\r
+ gnoring!\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n :local RequiredDM [ \$ParseKeyValueStore [ \$Grep \$SourceNew (\"\\r
+ \\23 requires device-mode, \") ] ];\r\\r
+ \n :local MissingDM ({});\r\\r
+ \n :foreach Feature,Value in=\$RequiredDM do={\r\\r
+ \n :if ([ :typeof (\$DeviceMode->\$Feature) ] = \"bool\" && (\$Devi\\r
+ ceMode->\$Feature) = false) do={\r\\r
+ \n :set MissingDM (\$MissingDM, \$Feature);\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :if ([ :len \$MissingDM ] > 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"The script '\" . (\$ScriptVal->\"name\\r
+ \") . \"' requires disabled \" . \\\r\\r
+ \n \"device-mode features (\" . [ :tostr \$MissingDM ] . \"). I\\r
+ gnoring!\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ([ \$ValidateSyntax \$SourceNew ] = false) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Syntax validation for script '\" . (\$\\r
+ ScriptVal->\"name\") . \"' failed! Ignoring!\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n \r\\r
+ \n :log info (\"Updating script: \" . (\$ScriptVal->\"name\") . \" Sc\\r
+ ript comment: \" . (\$ScriptVal->\"comment\"));\r\\r
+ \n\r\\r
+ \n /system/script/set owner=(\$ScriptVal->\"name\") comment=(\$Script\\r
+ Val->\"comment\") \\\r\\r
+ \n source=[ \$IfThenElse (\$ScriptUpdatesCRLF = true) \$SourceCRL\\r
+ F \$SourceNew ] \$Script;\r\\r
+ \n :if (\$ScriptVal->\"name\" = \"AM-GlobalConfig\" || \\\r\\r
+ \n \$ScriptVal->\"name\" = \"AM-GlobalFunc\" || \\\r\\r
+ \n \$ScriptVal->\"name\" ~ (\"^(AM-GlobalFunc\\\\.d|mod)/.\")) d\\r
+ o={\r\\r
+ \n :set ReloadGlobal true;\r\\r
+ \n }\r\\r
+ \n } on-error={ }\r\\r
+ \n }\r\\r
+ \n :if (\$ReloadGlobal = true) do={\r\\r
+ \n \$LogPrint info \$0 (\"Reloading global configuration and functions.\\r
+ \");\r\\r
+ \n :onerror Err {\r\\r
+ \n :global InitSetup (a);\r\\r
+ \n /system/script {run AM-GlobalConfig; run AM-GlobalFunc;};\r\\r
+ \n } do={\$LogPrint error \$0 (\"Reloading global configuration and fun\\r
+ ctions failed! \" . \$Err)}\r\\r
+ \n }\r\\r
+ \n :if (\$GlobalConfVersionBefore > \$GlobalConfVersion) do={\r\\r
+ \n \$LogPrint warning \$0 (\"The configuration version decreased from \\r
+ \" . \\\r\\r
+ \n \$GlobalConfVersionBefore . \" to \" . \$GlobalConfVersion . \\\r\\r
+ \n \". Installed an older version\?\");\r\\r
+ \n }\r\\r
+ \n :if (\$GlobalConfVersionBefore < \$GlobalConfVersion) do={\r\\r
+ \n :global GlobalConfChanges;\r\\r
+ \n :global GlobalConfMigration;\r\\r
+ \n :local ChangeLogCode;\r\\r
+ \n :if ([ :len \$ChangeLogCode ] > 0) do={\r\\r
+ \n :if ([ \$ValidateSyntax \$ChangeLogCode ] = true) do={\r\\r
+ \n :onerror Err {\r\\r
+ \n [ :parse \$ChangeLogCode ];\r\\r
+ \n } do={\$LogPrint warning \$0 (\"The changelog failed to run: \" \\r
+ . \$Err)}\r\\r
+ \n } else={\$LogPrint warning \$0 (\"The changelog failed syntax vali\\r
+ dation!\")}\r\\r
+ \n }\r\\r
+ \n :if ([ :len \$GlobalConfMigration ] > 0) do={\r\\r
+ \n :for I from=(\$GlobalConfVersionBefore + 1) to=\$GlobalConfVersion\\r
+ \_do={\r\\r
+ \n :local Migration (\$GlobalConfMigration->[ :tostr \$I ]);\r\\r
+ \n :do {\r\\r
+ \n :if ([ :typeof \$Migration ] != \"str\") do={\r\\r
+ \n \$LogPrint debug \$0 (\"Migration code for change \" . \$I .\\r
+ \_\" is not available.\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n :if ([ \$ValidateSyntax \$Migration ] = false) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Migration code for change \" . \$I\\r
+ \_. \" failed syntax validation!\");\r\\r
+ \n :error false}\r\\r
+ \n \$LogPrint info \$0 (\"Applying migration for change \" . \$I \\r
+ . \": \" . \$Migration);\r\\r
+ \n :onerror Err {\r\\r
+ \n [ :parse \$Migration ];\r\\r
+ \n } do={\$LogPrint warning \$0 (\"Migration code for change \" .\\r
+ \_\$I . \" failed to run: \" . \$Err)}\r\\r
+ \n } on-error={ }\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :local NotificationMessage (\"The configuration version on \" . \$Id\\r
+ entity . \" increased \" . \\\r\\r
+ \n \"to \" . \$GlobalConfVersion . \", current configuration may nee\\r
+ d modification. \" . \\\r\\r
+ \n \"Please review and update global-config-overlay, then re-run glo\\r
+ bal-config.\");\r\\r
+ \n \$LogPrint info \$0 (\$NotificationMessage);\r\\r
+ \n :if ([ :len \$GlobalConfChanges ] > 0) do={\r\\r
+ \n :set NotificationMessage (\$NotificationMessage . \"\\n\\nChanges:\\r
+ \");\r\\r
+ \n :for I from=(\$GlobalConfVersionBefore + 1) to=\$GlobalConfVersion\\r
+ \_do={\r\\r
+ \n :local Change (\$GlobalConfChanges->[ :tostr \$I ]);\r\\r
+ \n :set NotificationMessage (\$NotificationMessage . \"\\n \" . \\\\r
+ \r\\r
+ \n [ \$SymbolForNotification \"pushpin\" \"*\" ] . \$Change);\r\\r
+ \n \$LogPrint info \$0 (\"Change \" . \$I . \": \" . \$Change);\r\\r
+ \n }\r\\r
+ \n } else={:set NotificationMessage (\$NotificationMessage . \"\\n\\nNe\\r
+ ws and changes are not available.\")}\r\\r
+ \n\r\\r
+ \n :set GlobalConfChanges;\r\\r
+ \n :set GlobalConfMigration;\r\\r
+ \n }\r\\r
+ \n} do={:global ExitOnError; \$ExitOnError \$0 \$Err}\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n# Global Environment clear. Use: \"\$GlobalEnvRemove True;\".\r\\r
+ \n:set GlobalEnvRemove do={\r\\r
+ \n :local doRmEnv [ :tostr \$1 ];\r\\r
+ \n :global GlobalScriptsUrl;\r\\r
+ \n :local ScriptsUrl;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :if (\$doRmEnv != \"True\") do={\r\\r
+ \n \$LogPrint error \"GlobalEnvRemove\" (\"This script is needed \\\"T\\r
+ rue\\\" for confirm to remove global environment variables!\");\r\\r
+ \n :return [];\r\\r
+ \n :error true; \r\\r
+ \n } else={\r\\r
+ \n :set ScriptsUrl \$GlobalScriptsUrl;\r\\r
+ \n :delay 5;\r\\r
+ \n :foreach var in=[/system/script/environment print as-value] do={/sy\\r
+ stem/script/environment remove (\$var->\".id\")}\r\\r
+ \n :delay 5;\r\\r
+ \n :global GlobalScriptsUrl \$ScriptsUrl;\r\\r
+ \n \$LogPrint warning \"GlobalEnvRemove\" (\"Done!\");\r\\r
+ \n :return [];\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n# Add and fix global scheduler\r\\r
+ \n:put \"Add or/and fix Global scheduler...\";\r\\r
+ \n:local OnEvent \"/system/script { run AM-GlobalConfig; run AM-GlobalFunc\\r
+ ; }\";\r\\r
+ \n:local Comment \"Setup Global Environment for scripts\";\r\\r
+ \n:if ([ :len [ /system/scheduler/find where name=\"AM-SetGlobalEnv\" ] ] \\r
+ = 0) do={\r\\r
+ \n /system/scheduler/add name=\"AM-SetGlobalEnv\" comment=\$Comment on-ev\\r
+ ent=\$OnEvent start-time=startup;\r\\r
+ \n}\r\\r
+ \n:if ([ /system/scheduler/get \"AM-SetGlobalEnv\" comment ] != \$Comment)\\r
+ \_do={\r\\r
+ \n /system/scheduler/set \"AM-SetGlobalEnv\" comment=\$Comment;\r\\r
+ \n}\r\\r
+ \n:if ([ /system/scheduler/get \"AM-SetGlobalEnv\" on-event ] != \$OnEvent\\r
+ ) do={\r\\r
+ \n /system/scheduler/set \"AM-SetGlobalEnv\" on-event=\$OnEvent;\r\\r
+ \n}\r\\r
+ \n# Add Update Script scheduler\r\\r
+ \n:put \"Add or/and fix Update Script scheduler\";\r\\r
+ \n:set OnEvent \":global ScriptInstallUpdate; \\\$ScriptInstallUpdate;\";\\r
+ \r\\r
+ \n:set Comment \"Every Day Check For Update Scripts\";\r\\r
+ \n:if ([ :len [ /system/scheduler/find where name=\"AM-ScriptInstallUpdate\\r
+ \" ] ] = 0) do={\r\\r
+ \n/system/scheduler/add name=\"AM-ScriptInstallUpdate\" comment=\$Comment \\r
+ start-time=startup interval=1d on-event=\$OnEvent;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n#:local Resource [ /system/resource/get ];\r\\r
+ \n#:log info (\$ScriptName . \" Loaded on \" . \$Resource->\"board-name\" \\r
+ . \" with RouterOS \" . \$Resource->\"version\" . \" and Architecture \" .\\r
+ \".\");\r\\r
+ \n\r\\r
+ \n:onerror Err {\r\\r
+ \n :global GlobalConfReady;\r\\r
+ \n :retry { :if (\$GlobalConfReady != true) do={ :error (\"Global configs\\r
+ \_not ready.\"); }; } delay=100ms max=5;\r\\r
+ \n\r\\r
+ \n# signal we are ready\r\\r
+ \n:set GlobalFuncReady true;\r\\r
+ \n:set ExitOK true;\r\\r
+ \n:log warning (\"This script \$ScriptName Loaded \" . \\\r\\r
+ \n [ \$IfThenElse (\$CommitId != \"unknown\") ([ \$CommitBrief ] . \" \\r
+ \") ] . \\\r\\r
+ \n \"on \" . \$devBoardName . \"\\nRouterOS: \" . \$devCurVersion . \"\\r
+ \\nArchitecture: \" . \$devCurArch . \"\\nIdentity: \" . \$Identity);\r\\r
+ \n} do={:global ExitOnError; \$ExitOnError \$0 \$Err;}\r\\r
+ \n\r\\r
+ \n#} do={:global ExitError; \$ExitError \$ExitOK [ :jobname ] \$Err}\r\\r
+ \n# log the successful load of the script, or an error if it failed\r\\r
+ \n#:if ([\$GlobalFuncReady] = true && [\$GlobalConfReady] = true) do={\r\\r
+ \n"\r
+add comment="Import ssh keys for public key authentication" \\r
+ dont-require-permissions=no name=AM-SshKeysImport owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\r\\r
+ \n# RouterOS script: AM-SshKeysImport\r\\r
+ \n# Script comment: Import ssh keys for public key authentication\r\\r
+ \n# Copyright (c) 2005-2026 Vados <vados@vados.ru>\r\\r
+ \n#\r\\r
+ \n# requires RouterOS, version=7.19\r\\r
+ \n#\r\\r
+ \n:local ExitOK false;\r\\r
+ \n:onerror Err {\r\\r
+ \n :global GlobalConfReady; :global GlobalFuncReady;\r\\r
+ \n :retry { :if (\$GlobalConfReady != true || \$GlobalFuncReady != true) \\r
+ \\\r\\r
+ \n do={ :error (\"Global configs or functions not ready.\"); }; } del\\r
+ ay=500ms max=50;\r\\r
+ \n :local ScriptName [ :jobname ];\r\\r
+ \n\r\\r
+ \n:global SSHKeysImport;\r\\r
+ \n:global SSHKeysImportFile;\r\\r
+ \n\r\\r
+ \n# import single key passed as string\r\\r
+ \n:set SSHKeysImport do={ :onerror Err {\r\\r
+ \n :local Key [ :tostr \$1 ];\r\\r
+ \n :local User [ :tostr \$2 ];\r\\r
+ \n :global GetRandom20CharAlNum;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global MkDir;\r\\r
+ \n :global RmDir;\r\\r
+ \n :global WaitForFile;\r\\r
+ \n :if ([ :len \$Key ] = 0 || [ :len \$User ] = 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Missing argument(s), please pass key and u\\r
+ ser!\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :if ([ :len [ /user/find where name=\$User ] ] = 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"User '\" . \$User . \"' does not exist.\")\\r
+ ;\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local KeyVal ([ :deserialize \$Key delimiter=\" \" from=dsv options=d\\r
+ sv.plain ]->0);\r\\r
+ \n :if (!(\$KeyVal->0 = \"ssh-ed25519\" || \$KeyVal->0 = \"ssh-rsa\")) do\\r
+ ={\r\\r
+ \n \$LogPrint warning \$0 (\"SSH key of type '\" . \$KeyVal->0 . \"' is\\r
+ \_not supported.\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local FingerPrintMD5 [ :convert from=base64 transform=md5 to=hex (\$K\\r
+ eyVal->1) ];\r\\r
+ \n :local RegEx (\"\\\\bmd5=\" . \$FingerPrintMD5 . \"\\\\b\");\r\\r
+ \n :if ([ :len [ /user/ssh-keys/find where user=\$User \\\r\\r
+ \n (key-owner~\$RegEx or info~\$RegEx) ] ] > 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"The ssh public key (MD5:\" . \$FingerPrint\\r
+ MD5 . \\\r\\r
+ \n \") is already available for user '\" . \$User . \"'.\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :if ([ \$MkDir \"tmpfs/ssh-keys-import\" ] = false) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Creating directory 'tmpfs/ssh-keys-import'\\r
+ \_failed!\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local FileName (\"tmpfs/ssh-keys-import/key-\" . [ \$GetRandom20CharA\\r
+ lNum 6 ] . \".pub\");\r\\r
+ \n /file/add name=\$FileName contents=(\$Key . \", md5=\" . \$FingerPrint\\r
+ MD5);\r\\r
+ \n \$WaitForFile \$FileName;\r\\r
+ \n :onerror Err {\r\\r
+ \n /user/ssh-keys/import public-key-file=\$FileName user=\$User;\r\\r
+ \n \$LogPrint info \$0 (\"Imported ssh public key (\" . \$KeyVal->2 . \\r
+ \", \" . \$KeyVal->0 . \", \" . \\\r\\r
+ \n \"MD5:\" . \$FingerPrintMD5 . \") for user '\" . \$User . \"'.\");\\r
+ \r\\r
+ \n \$RmDir \"tmpfs/ssh-keys-import\";\r\\r
+ \n } do={\r\\r
+ \n \$LogPrint warning \$0 (\"Failed importing key: \" . \$Err);\r\\r
+ \n \$RmDir \"tmpfs/ssh-keys-import\";\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n} do={\r\\r
+ \n :global ExitOnError; \$ExitOnError \$0 \$Err;\r\\r
+ \n} }\r\\r
+ \n\r\\r
+ \n# import keys from a file\r\\r
+ \n:set SSHKeysImportFile do={ :onerror Err {\r\\r
+ \n :local FileName [ :tostr \$1 ];\r\\r
+ \n :local User [ :tostr \$2 ];\r\\r
+ \n :global EitherOr;\r\\r
+ \n :global FileExists;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global ParseKeyValueStore;\r\\r
+ \n :global SSHKeysImport;\r\\r
+ \n :if ([ :len \$FileName ] = 0 || [ :len \$User ] = 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Missing argument(s), please pass file name\\r
+ \_and user!\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :if ([ \$FileExists \$FileName ] = false) do={\r\\r
+ \n \$LogPrint warning \$0 (\"File '\" . \$FileName . \"' does not exist\\r
+ .\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :local Keys [ :tolf [ /file/get \$FileName contents ] ];\r\\r
+ \n :foreach KeyVal in=[ :deserialize \$Keys delimiter=\" \" from=dsv opti\\r
+ ons=dsv.plain ] do={\r\\r
+ \n :local Continue false;\r\\r
+ \n :if (\$KeyVal->0 = \"ssh-ed25519\" || \$KeyVal->0 = \"ssh-rsa\") do=\\r
+ {\r\\r
+ \n :if ([ \$SSHKeysImport (\$KeyVal->0 . \" \" . \$KeyVal->1 . \" \" \\r
+ . \$KeyVal->2) \$User ] = false) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Failed importing key for user '\" . \$\\r
+ User . \"'.\");\r\\r
+ \n }\r\\r
+ \n :set Continue true;\r\\r
+ \n }\r\\r
+ \n :if (\$Continue = false && \$KeyVal->0 = \"#\") do={\r\\r
+ \n :set User [ \$EitherOr ([ \$ParseKeyValueStore (\$KeyVal->1) ]->\"\\r
+ user\") \$User ];\r\\r
+ \n :set Continue true;\r\\r
+ \n }\r\\r
+ \n :if (\$Continue = false && [ :len (\$KeyVal->0) ] > 0) do={\r\\r
+ \n \$LogPrint warning \$0 (\"SSH key of type '\" . \$KeyVal->0 . \"' \\r
+ is not supported.\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n} do={\r\\r
+ \n :global ExitOnError; \$ExitOnError \$0 \$Err;\r\\r
+ \n} }\r\\r
+ \n} do={:global ExitError; \$ExitError \$ExitOK [ :jobname ] \$Err}\r\\r
+ \n"\r
+add comment="Enable or disable ip addresses based on bridge port state" \\r
+ dont-require-permissions=no name=mod/AM-IPbridge owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\r\\r
+ \n# RouterOS script: mod/AM-IPbridge\r\\r
+ \n# Script comment: Enable or disable ip addresses based on bridge port st\\r
+ ate\r\\r
+ \n# Copyright (c) 2005-2026 Vados <vados@vados.ru>\r\\r
+ \n#\r\\r
+ \n#\r\\r
+ \n# requires RouterOS, version=7.19\r\\r
+ \n# requires device-mode, fetch\r\\r
+ \n#\r\\r
+ \n:local ScriptName [ :jobname ];\r\\r
+ \n\r\\r
+ \n# Add this Script scheduler\r\\r
+ \n:if ([ :len [ /system/scheduler/find where name=\$ScriptName ] ] = 0) do\\r
+ ={\r\\r
+ \n:log warning (\"SystemScheduler for script: \" . \$ScriptName . \" is NO\\r
+ T SET! Fix It Now!\");\r\\r
+ \n:local OnEvent \"/system/script/run \$ScriptName;\";\r\\r
+ \n:local Comment \"Every Day Check For Fake Bridges\";\r\\r
+ \n/system/scheduler/add name=\$ScriptName comment=\$Comment start-time=sta\\r
+ rtup interval=1d on-event=\$OnEvent;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:foreach Bridge in=[ /interface/bridge/find ] do={\r\\r
+ \n :local BrName [ /interface/bridge/get \$Bridge name ];\r\\r
+ \n :if ([ :len [ /interface/bridge/port/find where bridge=\$BrName ] ] > \\r
+ 0) do={\r\\r
+ \n :if ([ :len [ /interface/bridge/port/find where bridge=\$BrName and \\r
+ inactive=no ] ] = 0) do={\r\\r
+ \n /ip/address/disable [ find where !dynamic interface=\$BrName ];\r\\r
+ \n } else={\r\\r
+ \n /ip/address/enable [ find where !dynamic interface=\$BrName ];\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n"\r
+add comment="Check for certificates validity" dont-require-permissions=no \\r
+ name=AM-CheckCerts owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\r\\r
+ \n# RouterOS script: AM-CheckCerts\r\\r
+ \n# Script comment: Check for certificates validity\r\\r
+ \n# Copyright (c) 2005-2026 Vados <vados@vados.ru>\r\\r
+ \n#\r\\r
+ \n#\r\\r
+ \n# requires RouterOS, version=7.19\r\\r
+ \n# requires device-mode, fetch\r\\r
+ \n\r\\r
+ \n:local ExitOK false;\r\\r
+ \n:onerror Err {\r\\r
+ \n :global GlobalConfReady; :global GlobalFuncReady;\r\\r
+ \n :retry { :if (\$GlobalConfReady != true || \$GlobalFuncReady != true) \\r
+ \\\r\\r
+ \n do={ :error (\"Global config and/or functions not ready.\"); }; } \\r
+ delay=500ms max=50;\r\\r
+ \n :local ScriptName [ :jobname ];\r\\r
+ \n\r\\r
+ \n :global CertRenewTime;\r\\r
+ \n :global CertRenewUrl;\r\\r
+ \n :global CertWarnTime;\r\\r
+ \n :global Identity;\r\\r
+ \n\r\\r
+ \n :global CertificateAvailable;\r\\r
+ \n :global EscapeForRegEx;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global ParseKeyValueStore;\r\\r
+ \n :global ScriptLock;\r\\r
+ \n :global SendNotification2;\r\\r
+ \n :global SymbolForNotification;\r\\r
+ \n :global UrlEncode;\r\\r
+ \n# :global WaitFullyConnected;\r\\r
+ \n\r\\r
+ \n# Add this Script scheduler\r\\r
+ \n:if ([ :len [ /system/scheduler/find where name=\$ScriptName ] ] = 0) do\\r
+ ={\r\\r
+ \n:log warning (\"System Scheduler for script: \" . \$ScriptName . \" is N\\r
+ OT SET! Fix It Now!\");\r\\r
+ \n:local OnEvent \"/system/script/run \$ScriptName;\";\r\\r
+ \n:local Comment \"Every Day Check For Renew Certificates\";\r\\r
+ \n/system/scheduler/add name=\$ScriptName comment=\$Comment start-time=sta\\r
+ rtup interval=1d on-event=\$OnEvent;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n\r\\r
+ \n :local CheckCertificatesDownloadImport do={\r\\r
+ \n :local ScriptName [ :tostr \$1 ];\r\\r
+ \n :local CertName [ :tostr \$2 ];\r\\r
+ \n :local FetchName [ :tostr \$3 ];\r\\r
+ \n\r\\r
+ \n :global CertRenewUrl;\r\\r
+ \n :global CertRenewPass;\r\\r
+ \n\r\\r
+ \n :global CertificateNameByCN;\r\\r
+ \n :global EscapeForRegEx;\r\\r
+ \n :global FetchUserAgentStr;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global RmFile;\r\\r
+ \n :global UrlEncode;\r\\r
+ \n :global WaitForFile;\r\\r
+ \n\r\\r
+ \n :foreach Type in={ \"p12\"; \"pem\" } do={\r\\r
+ \n :local CertFileName ([ \$UrlEncode \$FetchName ] . \".\" . \$Type)\\r
+ ;\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Trying type '\" . \$Type . \"' fo\\r
+ r '\" . \$CertName . \\\r\\r
+ \n \"' (file '\" . \$CertFileName . \"')...\");\r\\r
+ \n\r\\r
+ \n :do {\r\\r
+ \n :onerror Err {\r\\r
+ \n /tool/fetch check-certificate=yes-without-crl \\\r\\r
+ \n http-header-field=({ [ \$FetchUserAgentStr \$ScriptName ] \\r
+ }) \\\r\\r
+ \n (\$CertRenewUrl . \$CertFileName) dst-path=\$CertFileName \\r
+ as-value;\r\\r
+ \n } do={\r\\r
+ \n :if (!(\$Err ~ \"[Ss]tatus 404\")) do={\r\\r
+ \n \$LogPrint warning \$0 (\"Failed fetching certificate: \" . \\r
+ \$Err);\r\\r
+ \n }\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n \$WaitForFile \$CertFileName; \r\\r
+ \n\r\\r
+ \n :local DecryptionFailed true;\r\\r
+ \n :foreach I,PassPhrase in=\$CertRenewPass do={\r\\r
+ \n :do {\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Trying \" . \$I . \". passp\\r
+ hrase... \");\r\\r
+ \n :local Result [ /certificate/import file-name=\$CertFileName\\r
+ \_passphrase=\$PassPhrase as-value ];\r\\r
+ \n :if (\$Result->\"decryption-failures\" = 0) do={\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Success!\");\r\\r
+ \n :set DecryptionFailed false;\r\\r
+ \n }\r\\r
+ \n } on-error={ }\r\\r
+ \n }\r\\r
+ \n \$RmFile \$CertFileName;\r\\r
+ \n\r\\r
+ \n :if (\$DecryptionFailed = true) do={\r\\r
+ \n \$LogPrint warning \$ScriptName (\"Decryption failed for certi\\r
+ ficate file '\" . \$CertFileName . \"'.\");\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :foreach CertInChain in=[ /certificate/find where common-name!=\\r
+ \$CertName !private-key \\\r\\r
+ \n name~(\"^\" . [ \$EscapeForRegEx \$CertFileName ] . \"_[0-9]\\r
+ +\\\$\") \\\r\\r
+ \n !(subject-alt-name~(\"(^|\\\\W)(DNS|IP):\" . [ \$EscapeForRe\\r
+ gEx \$CertName ] . \"(\\\\W|\\\$)\")) \\\r\\r
+ \n !(common-name=[]) ] do={\r\\r
+ \n \$CertificateNameByCN [ /certificate/get \$CertInChain common-\\r
+ name ];\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :return true;\r\\r
+ \n } on-error={\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Could not download certificate \\r
+ file '\" . \$CertFileName . \"'.\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local FormatInfo do={\r\\r
+ \n :local Cert \$1;\r\\r
+ \n\r\\r
+ \n :global FormatLine;\r\\r
+ \n :global FormatMultiLines;\r\\r
+ \n :global IfThenElse;\r\\r
+ \n\r\\r
+ \n :local FormatExpire do={\r\\r
+ \n :global CharacterReplace;\r\\r
+ \n :return [ \$CharacterReplace [ \$CharacterReplace [ :tostr \$1 ] \\r
+ \"w\" \"w \" ] \"d\" \"d \" ];\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local FormatCertChain do={\r\\r
+ \n :local Cert \$1;\r\\r
+ \n\r\\r
+ \n :global ParseKeyValueStore;\r\\r
+ \n\r\\r
+ \n :local CertVal [ /certificate/get \$Cert ];\r\\r
+ \n\r\\r
+ \n :if ([ :typeof (\$CertVal->\"issuer\") ] = \"nothing\") do={\r\\r
+ \n :return \"self-signed\";\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local Return \"\";\r\\r
+ \n :for I from=0 to=5 do={\r\\r
+ \n :set Return (\$Return . [ \$ParseKeyValueStore (\$CertVal->\"iss\\r
+ uer\") ]->\"CN\");\r\\r
+ \n :if ([ :len [ /certificate/builtin/find where skid=(\$CertVal->\\r
+ \"akid\") ] ] > 0) do={\r\\r
+ \n :return \$Return;\r\\r
+ \n }\r\\r
+ \n :do {\r\\r
+ \n :set CertVal [ /certificate/get [ find where skid=(\$CertVal->\\r
+ \"akid\") ] ];\r\\r
+ \n } on-error={\r\\r
+ \n :return (\$Return . \" (possibly incomplete!)\");\r\\r
+ \n }\r\\r
+ \n :if ((\$CertVal->\"akid\") = \"\" || (\$CertVal->\"akid\") = (\$\\r
+ CertVal->\"skid\")) do={\r\\r
+ \n :return \$Return;\r\\r
+ \n }\r\\r
+ \n :set Return (\$Return . \" -> \");\r\\r
+ \n }\r\\r
+ \n :return (\$Return . \"...\");\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local CertVal [ /certificate/get \$Cert ];\r\\r
+ \n\r\\r
+ \n :return ( \\\r\\r
+ \n [ \$FormatLine \"Name\" (\$CertVal->\"name\") ] . \"\\n\" . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$CertVal->\"common-name\") ] > 0) ([ \$Fo\\r
+ rmatLine \"CommonName\" (\$CertVal->\"common-name\") ] . \"\\n\") ] . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$CertVal->\"subject-alt-name\") ] > 0) ([\\r
+ \_\$FormatMultiLines \"SubjectAltNames\" (\$CertVal->\"subject-alt-name\")\\r
+ \_] . \"\\n\") ] . \\\r\\r
+ \n [ \$FormatLine \"Private key\" [ \$IfThenElse ((\$CertVal->\"priva\\r
+ te-key\") = true) \"available\" \"missing\" ] ] . \"\\n\" . \\\r\\r
+ \n [ \$FormatLine \"Fingerprint\" (\$CertVal->\"fingerprint\") ] . \"\\r
+ \\n\" . \\\r\\r
+ \n [ \$IfThenElse ([ :len (\$CertVal->\"ca\") ] > 0) [ \$FormatLine \\r
+ \"Issuer\" (\$CertVal->\"ca\") ] [ \$FormatLine \"Issuer chain\" [ \$Forma\\r
+ tCertChain \$Cert ] ] ] . \"\\n\" . \\\r\\r
+ \n \"Validity:\\n\" . \\\r\\r
+ \n [ \$FormatLine \" days\" (\$CertVal->\"days-valid\") ] . \"\\n\\r
+ \" . \\\r\\r
+ \n [ \$FormatLine \" from\" (\$CertVal->\"invalid-before\") ] . \"\\r
+ \\n\" . \\\r\\r
+ \n [ \$FormatLine \" to\" (\$CertVal->\"invalid-after\") ] . \"\\n\\r
+ \" . \\\r\\r
+ \n [ \$FormatLine \" time left\" [ \$IfThenElse ((\$CertVal->\"exp\\r
+ ired\") = true) \"expired\" [ \$FormatExpire (\$CertVal->\"expires-after\"\\r
+ ) ] ] ]);\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ([ \$ScriptLock \$ScriptName ] = false) do={\r\\r
+ \n :set ExitOK true;\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n# \$WaitFullyConnected;\r\\r
+ \n\r\\r
+ \n :foreach Cert in=[ /certificate/find where !revoked !ca !scep-url expi\\r
+ res-after<\$CertRenewTime ] do={\r\\r
+ \n :local CertVal [ /certificate/get \$Cert ];\r\\r
+ \n :local LastName;\r\\r
+ \n :local FetchName;\r\\r
+ \n\r\\r
+ \n :do {\r\\r
+ \n :if ([ :len \$CertRenewUrl ] = 0) do={\r\\r
+ \n \$LogPrint info \$ScriptName (\"No CertRenewUrl given.\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n \$LogPrint info \$ScriptName (\"Attempting to renew certificate '\\r
+ \" . (\$CertVal->\"name\") . \"'.\");\r\\r
+ \n\r\\r
+ \n :local ImportSuccess false;\r\\r
+ \n :if ([ :len (\$CertVal->\"common-name\") ] > 0) do={\r\\r
+ \n :set LastName (\$CertVal->\"common-name\");\r\\r
+ \n :set FetchName \$LastName;\r\\r
+ \n :set ImportSuccess [ \$CheckCertificatesDownloadImport \$ScriptN\\r
+ ame \$LastName \$FetchName ];\r\\r
+ \n }\r\\r
+ \n :foreach SAN in=(\$CertVal->\"subject-alt-name\") do={\r\\r
+ \n :if (\$ImportSuccess = false) do={\r\\r
+ \n :set LastName [ :pick \$SAN ([ :find \$SAN \":\" ] + 1) [ :len\\r
+ \_\$SAN ] ];\r\\r
+ \n :set FetchName \$LastName;\r\\r
+ \n :set ImportSuccess [ \$CheckCertificatesDownloadImport \$Scrip\\r
+ tName \$LastName \$FetchName ];\r\\r
+ \n :if (\$ImportSuccess = false && [ :pick \$LastName 0 2 ] = \"*\\r
+ .\") do={\r\\r
+ \n :set FetchName (\"star.\" . [ :pick \$LastName 2 [ :len \$La\\r
+ stName ] ]);\r\\r
+ \n :set ImportSuccess [ \$CheckCertificatesDownloadImport \$Scr\\r
+ iptName \$LastName \$FetchName ];\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :if (\$ImportSuccess = false) do={ :error false; }\r\\r
+ \n\r\\r
+ \n :if ([ :len (\$CertVal->\"fingerprint\") ] > 0 && \$CertVal->\"fin\\r
+ gerprint\" != [ /certificate/get \$Cert fingerprint ]) do={\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Certificate '\" . \$CertVal->\"\\r
+ name\" . \"' was updated in place.\");\r\\r
+ \n :set CertVal [ /certificate/get \$Cert ];\r\\r
+ \n } else={\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Certificate '\" . \$CertVal->\"\\r
+ name\" . \"' was not updated, but replaced.\");\r\\r
+ \n\r\\r
+ \n :local CertNew [ /certificate/find where name~(\"^\" . [ \$Escap\\r
+ eForRegEx [ \$UrlEncode \$FetchName ] ] . \"\\\\.(p12|pem)_[0-9]+\\\$\") \\r
+ \\\r\\r
+ \n (common-name=(\$CertVal->\"common-name\") or subject-alt-name~\\r
+ (\"(^|\\\\W)(DNS|IP):\" . [ \$EscapeForRegEx \$LastName ] . \"(\\\\W|\\\$)\\r
+ \")) \\\r\\r
+ \n fingerprint!=[ :tostr (\$CertVal->\"fingerprint\") ] ];\r\\r
+ \n :local CertNewVal [ /certificate/get \$CertNew ];\r\\r
+ \n\r\\r
+ \n :if ((\$CertVal->\"expires-after\") > (\$CertNewVal->\"expires-a\\r
+ fter\")) do={\r\\r
+ \n /certificate/remove \$CertNew;\r\\r
+ \n \$LogPrint warning \$ScriptName (\"Old certificate is newer th\\r
+ an the new one. Aborting renew.\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ((\$CertVal->\"private-key\") = true && (\$CertVal->\"privat\\r
+ e-key\") != (\$CertNewVal->\"private-key\")) do={\r\\r
+ \n /certificate/remove \$CertNew;\r\\r
+ \n \$LogPrint warning \$ScriptName (\"Old certificate '\" . (\$Ce\\r
+ rtVal->\"name\") . \"' has a private key, new certificate does not. Aborti\\r
+ ng renew.\");\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ([ \$CertificateAvailable ([ \$ParseKeyValueStore (\$CertNew\\r
+ Val->\"issuer\") ]->\"CN\") \"fetch\" ] = false) do={\r\\r
+ \n \$LogPrint warning \$ScriptName (\"The certificate chain is no\\r
+ t available!\");\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n /ip/service/set certificate=(\$CertNewVal->\"name\") [ find wher\\r
+ e certificate=(\$CertVal->\"name\") ];\r\\r
+ \n\r\\r
+ \n /ip/ipsec/identity/set certificate=(\$CertNewVal->\"name\") [ fi\\r
+ nd where certificate=(\$CertVal->\"name\") ];\r\\r
+ \n /ip/ipsec/identity/set remote-certificate=(\$CertNewVal->\"name\\r
+ \") [ find where remote-certificate=(\$CertVal->\"name\") ];\r\\r
+ \n\r\\r
+ \n /ip/hotspot/profile/set ssl-certificate=(\$CertNewVal->\"name\")\\r
+ \_[ find where ssl-certificate=(\$CertVal->\"name\") ];\r\\r
+ \n\r\\r
+ \n /certificate/remove \$Cert;\r\\r
+ \n /certificate/set \$CertNew name=(\$CertVal->\"name\");\r\\r
+ \n :set Cert \$CertNew;\r\\r
+ \n :set CertVal [ /certificate/get \$CertNew ];\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n \$SendNotification2 ({ origin=\$ScriptName; silent=true; \\\r\\r
+ \n subject=([ \$SymbolForNotification \"lock-with-ink-pen\" ] . \"C\\r
+ ertificate renewed: \" . (\$CertVal->\"name\")); \\\r\\r
+ \n message=(\"A certificate on \" . \$Identity . \" has been renewe\\r
+ d.\\n\\n\" . [ \$FormatInfo \$Cert ]) });\r\\r
+ \n \$LogPrint info \$ScriptName (\"The certificate '\" . (\$CertVal->\\r
+ \"name\") . \"' has been renewed.\");\r\\r
+ \n } on-error={\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Could not renew certificate '\" .\\r
+ \_(\$CertVal->\"name\") . \"'.\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :foreach Cert in=[ /certificate/find where !revoked !scep-url !(expire\\r
+ s-after=[]) \\\r\\r
+ \n expires-after<\$CertWarnTime !(fingerprint=[]) ] do\\r
+ ={\r\\r
+ \n :local CertVal [ /certificate/get \$Cert ];\r\\r
+ \n\r\\r
+ \n :if ([ :len [ /certificate/scep-server/find where ca-cert=(\$CertVal\\r
+ ->\"ca\") ] ] > 0) do={\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Certificate '\" . (\$CertVal->\"n\\r
+ ame\") . \"' is handled by SCEP, skipping.\");\r\\r
+ \n } else={\r\\r
+ \n :local State [ \$IfThenElse ((\$CertVal->\"expired\") = true) \"ex\\r
+ pired\" \"is about to expire\" ];\r\\r
+ \n\r\\r
+ \n \$SendNotification2 ({ origin=\$ScriptName; \\\r\\r
+ \n subject=([ \$SymbolForNotification \"lock-with-ink-pen,warning-s\\r
+ ign\" ] . \"Certificate warning: \" . (\$CertVal->\"name\")); \\\r\\r
+ \n message=(\"A certificate on \" . \$Identity . \" \" . \$State . \\r
+ \".\\n\\n\" . [ \$FormatInfo \$Cert ]) });\r\\r
+ \n \$LogPrint info \$ScriptName (\"The certificate '\" . (\$CertVal->\\r
+ \"name\") . \"' \" . \$State . \\\r\\r
+ \n \", it is invalid after \" . (\$CertVal->\"invalid-after\") . \\r
+ \".\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n} do={\r\\r
+ \n :global ExitError; \$ExitError \$ExitOK [ :jobname ] \$Err;\r\\r
+ \n}\r\\r
+ \n"\r
+add comment="Global Config Script" dont-require-permissions=no name=\\r
+ AM-GlobalConfig owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\\r
+ \n# RouterOS script: AM-GlobalConfig\\r
+ \n# Script comment: Global Config Script\\r
+ \n# Copyright (c) 2007-2026 Vados <vados@vados.ru>\\r
+ \n#\\r
+ \n#\\r
+ \n# Warning: Dont touch this line!\\r
+ \n:global GlobalConfReady false;\\r
+ \n#\\r
+ \n#\\r
+ \n# Global Url For Amster scripts to fetch\\r
+ \n# most be defined in AM-Init-Script or AM-setup scripts\\r
+ \n:global GlobalScriptsUrl \"https://ros.vados.ru/\";\\r
+ \n:global ScriptsUrlSuffix \"\";\\r
+ \n:global CheckSumsVerify true;\\r
+ \n\\r
+ \n:global ScriptUpdatesCRLF true;\\r
+ \n:global CommentsInScripts true;\\r
+ \n\\r
+ \n# Debug output:\\r
+ \n:global PrintDebug true; #false;\\r
+ \n\\r
+ \n# Debug output for specific script:\\r
+ \n:set (\$PrintDebugOverride->\"AM-GlobalFunc\") true;\\r
+ \n\\r
+ \n# Debug logs\\r
+ \n# Other actions (disk, email, remote or support) can be used as well.\\r
+ \n# I do not recommend using echo - use debug output instead (https://rsc.\\r
+ eworm.de/main/DEBUG.html#debug-output).\\r
+ \n#/system/logging/add topics=script,debug action=memory;\\r
+ \n\\r
+ \n:global MikrotikUpgradeUrl \"https://upgrade.mikrotik.com/routeros\";\\r
+ \n:global Domain \"WORKGROUP\";\\r
+ \n\\r
+ \n:global EmailGeneralTo \"vados@vados.ru\";\\r
+ \n#:global EmailGeneralCc \"\";\\r
+ \n\\r
+ \n# \$ScriptInstallUpdate mod/notification-telegram\\r
+ \n:global TelegramTokenId \"8390868324:AAG3_d1hfVR2M6pGAgDK6ZvhOe4J97nyopw\\r
+ \";\\r
+ \n:global TelegramChatId \"-1003631309063\"; #\"454403445\";\\r
+ \n# Use this to send notifications to a specific topic in group.\\r
+ \n#:global TelegramThreadId \"30\";\\r
+ \n# Using telegram-chat you have to define trusted chat ids (not group ids\\r
+ !)\\r
+ \n# or user names. Groups allow to chat with devices simultaneously.\\r
+ \n:global TelegramChatIdsTrusted {\\r
+ \n \"454403445\"\\r
+ \n \"-1003631309063\"\\r
+ \n \"-5124482807\"\\r
+ \n \"1087968824\";\\r
+ \n};\\r
+ \n# \"-5294757340\";\\r
+ \n\\r
+ \n:global TelegramChatGroups \"(all)\";\\r
+ \n#:global TelegramChatGroups \"(all|home|office)\";\\r
+ \n\\r
+ \n:global NotificationFunctions {\\r
+ \n \"email\"\\r
+ \n \"telegram\";\\r
+ \n};\\r
+ \n# Toggle this to disable symbols in notifications.\\r
+ \n:global NotificationsWithSymbols true;\\r
+ \n:global TerminalColorOutput true;\\r
+ \n\\r
+ \n:global DetectIpAddrDefault \"https://ipv4.mikrotik.ovh/\";\\r
+ \n:global DetectIpAddrFallback \"https://api.ipify.org/\";\\r
+ \n\\r
+ \n## Update channel. Possible values: stable, long-term, testing, developm\\r
+ ent\\r
+ \n:global updateChannel \"stable\";\\r
+ \n\\r
+ \n:global CertRenewUrl (\$GlobalScriptsUrl . \"certs/\");\\r
+ \n:global CertRenewTime 2w;\\r
+ \n:global CertRenewPass {\\r
+ \n \"\";\\r
+ \n# \"v3ry-s3cr3t\";\\r
+ \n# \"4n0th3r-s3cr3t\";\\r
+ \n};\\r
+ \n:global CertWarnTime 1w;\\r
+ \n:global CertIssuedExportPass {\\r
+ \n \"\";\\r
+ \n# \"cert1-cn\"=\"v3ry-s3cr3t\";\\r
+ \n# \"cert2-cn\"=\"4n0th3r-s3cr3t\";\\r
+ \n};\\r
+ \n\\r
+ \n# Script BackupAndUpdate mode, possible values: backup,\\r
+ \n# updateOnce - Update once as \"osnotify\" and back \"osnotify\" mode (i\\r
+ n terminal run :set OSUpdateMode updateOnce; \$OSUpdateMode;). \\r
+ \n# osupdate - Update if available and creates backups before/after update\\r
+ \_(ignores `forceBackup`)\\r
+ \n# Set `forceBackup` to true to always create backups, even\\r
+ \_without updates\\r
+ \n# osnotify - Set `forceBackup` to always create backups on every run\\r
+ \n:global DevInfoIncludeIP true;\\r
+ \n:global BackupAndUpdateMode \"osnotify\"\\r
+ \n\\r
+ \n:global forceBackup true;\\r
+ \n:global BackupPassword \"Peskar55\";\\r
+ \n\\r
+ \n# SFTP Backup Variables\\r
+ \n:global BackupRandomDelay 0;\\r
+ \n:global BackupUploadUrl \"sftp://amster.vados.ru/upload/\";\\r
+ \n:global BackupUploadUser \$Identity;\\r
+ \n:global BackupUploadPass \"root.mnuc.backuper\";\\r
+ \n\\r
+ \n:global BackupSendBinary true;\\r
+ \n:global BackupSendExport true;\\r
+ \n:global BackupSendGlobalConfig true;\\r
+ \n:global BackupSendScripts true;\\r
+ \n\\r
+ \n# Remove local file after uploading if no errors\\r
+ \n:global BackupRmLocal true;\\r
+ \n\\r
+ \n# Local Backups Root Directory \\r
+ \n:global BackupLocalRoot \"tmpfs\";\\r
+ \n\\r
+ \n# Encrypt Backup\\r
+ \n:global BackupEncrypt true;\\r
+ \n\\r
+ \n# Sensitive information in Backups\\r
+ \n:global BackupSens true;\\r
+ \n\\r
+ \n# User Export\\r
+ \n:global BackupUser true;\\r
+ \n\\r
+ \n# License Export (not for CHR, will silently skip)\\r
+ \n:global BackupLicense false;\\r
+ \n\\r
+ \n# SSH Keys\\r
+ \n:global BackupSshKeys true;\\r
+ \n\\r
+ \n# Certificate Export\\r
+ \n:global BackupCerts true;\\r
+ \n\\r
+ \n# Certificate Password\\r
+ \n:global BackupCertsPasswd \"\";\\r
+ \n\\r
+ \n# User-Manager Export\\r
+ \n:global BackupUserMan false;\\r
+ \n\\r
+ \n# The Dude Export\\r
+ \n:global BackupDude false;\\r
+ \n\\r
+ \n# User Files to export, comma-separated string or array of strings\\r
+ \n# User Files are not removed on backup\\r
+ \n# Any directory paths will be removed (/ -> _) on remote file\\r
+ \n# Nonpresent files are silently skipped\\r
+ \n:global BackupUserList \"autosupout.rif,autosupout.old.rif\";\\r
+ \n\\r
+ \n# load functions and any custom scripts\\r
+ \n# [ /system/script/find where name=\"global-config-ov\\r
+ erlay\" ], \\\\r
+ \n# [ /system/script/find where name~\"^global-config-o\\r
+ verlay\\\\.d/.\" ]\\r
+ \n#\\r
+ \n#:foreach Script in=([ /system/script/find where name=\"Amster-TGglobalV\\r
+ ars\" ], [ /system/script/find where name=\"Amster-TGglobalFunc\" ]) do={\\r
+ \n# :onerror Err {\\r
+ \n# /system/script/run \$Script;\\r
+ \n# } do={\\r
+ \n# :log error (\"Loading configuration from configs and functions\"\\r
+ \_. [ /system/script/get \$Script name ] . \" failed: \" . \$Err);\\r
+ \n# }\\r
+ \n#}\\r
+ \n#:log info \"\\ndevMode = \$devMode\";\\r
+ \n#:log info \"\\ndevRunning = \$devRunning\";\\r
+ \n:foreach Script in=[ /system/script/find where source~\"^#!rsc by Vados \\r
+ GlobalRUN\\r\?\\n\" ] do={\\r
+ \n :onerror Err {\\r
+ \n /system/script/run \$Script;\\r
+ \n } do={\\r
+ \n :log error (\"Run script \" . [ /system/script/get \$Script name \\r
+ ] . \" width marker \\\" GlobalRUN\\\" failed: \" . \$Err);\\r
+ \n }\\r
+ \n}\\r
+ \n\\r
+ \n# signal we are ready\\r
+ \n:set GlobalConfReady true;\\r
+ \n:while (\$GlobalConfReady != true) do={:delay 500ms};\\r
+ \n"\r
+add comment="Renew locally issued certificates" dont-require-permissions=no \\r
+ name=AM-CertsRenew owner=AM-CertsRenew policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\r\\r
+ \n# RouterOS script: AM-CertsRenew\r\\r
+ \n# Script comment: Renew locally issued certificates\r\\r
+ \n# Copyright (c) 2005-2026 Vados <vados@vados.ru>\r\\r
+ \n#\r\\r
+ \n#\r\\r
+ \n# requires RouterOS, version=7.19\r\\r
+ \n#\r\\r
+ \n:local ExitOK false;\r\\r
+ \n:onerror Err {\r\\r
+ \n :global GlobalConfReady; :global GlobalFuncReady;\r\\r
+ \n :retry { :if (\$GlobalConfReady != true || \$GlobalFuncReady != true) \\r
+ \\\r\\r
+ \n do={ :error (\"Global config and/or functions not ready.\"); }; } \\r
+ delay=500ms max=50;\r\\r
+ \n :local ScriptName [ :jobname ];\r\\r
+ \n\r\\r
+ \n :global CertIssuedExportPass;\r\\r
+ \n\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global MkDir;\r\\r
+ \n :global ScriptLock;\r\\r
+ \n\r\\r
+ \n# Add this Script scheduler\r\\r
+ \n:if ([ :len [ /system/scheduler/find where name=\$ScriptName ] ] = 0) do\\r
+ ={\r\\r
+ \n:log warning (\"System Scheduler for script: \" . \$ScriptName . \" is N\\r
+ OT SET! Fix It Now!\");\r\\r
+ \n:local OnEvent \"/system/script/run \$ScriptName;\";\r\\r
+ \n:local Comment \"Every Day Check For Update Local Issued Certificates.\"\\r
+ ;\r\\r
+ \n#/system/scheduler/add name=\$ScriptName comment=\$Comment start-time=st\\r
+ artup interval=1d on-event=\$OnEvent;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n :if ([ \$ScriptLock \$ScriptName ] = false) do={\r\\r
+ \n :set ExitOK true;\r\\r
+ \n :error false;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :foreach Cert in=[ /certificate/find where issued expires-after<3w ] d\\r
+ o={\r\\r
+ \n :local CertVal [ /certificate/get \$Cert ];\r\\r
+ \n /certificate/issued-revoke \$Cert;\r\\r
+ \n /certificate/set name=(\$CertVal->\"name\" . \"-revoked-\" . [ /syst\\r
+ em/clock/get date ]) \$Cert;\r\\r
+ \n /certificate/add name=(\$CertVal->\"name\") common-name=(\$CertVal->\\r
+ \"common-name\") \\\r\\r
+ \n key-usage=(\$CertVal->\"key-usage\") subject-alt-name=(\$CertVal\\r
+ ->\"subject-alt-name\");\r\\r
+ \n /certificate/sign (\$CertVal->\"name\") ca=(\$CertVal->\"ca\");\r\\r
+ \n :if ([ :typeof (\$CertIssuedExportPass->(\$CertVal->\"common-name\")\\r
+ ) ] = \"str\") do={\r\\r
+ \n :if ([ \$MkDir \"cert-issued\" ] = true) do={\r\\r
+ \n /certificate/export-certificate (\$CertVal->\"name\") type=pkcs1\\r
+ 2 \\\r\\r
+ \n file-name=(\"cert-issued/\" . \$CertVal->\"common-name\") \\\\r
+ \r\\r
+ \n export-passphrase=(\$CertIssuedExportPass->(\$CertVal->\"com\\r
+ mon-name\"));\r\\r
+ \n \$LogPrint info \$ScriptName (\"Issued a new certificate for '\"\\r
+ \_. \$CertVal->\"common-name\" . \\\r\\r
+ \n \"', exported to 'cert-issued/\" . \$CertVal->\"common-name\" \\r
+ . \".p12'.\");\r\\r
+ \n } else={\r\\r
+ \n \$LogPrint warning \$ScriptName (\"Failed creating directory, no\\r
+ t exporting certificate.\");\r\\r
+ \n }\r\\r
+ \n } else={\r\\r
+ \n \$LogPrint info \$ScriptName (\"Issued a new certificate for '\" .\\r
+ \_\$CertVal->\"common-name\" . \"'.\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n} do={\r\\r
+ \n :global ExitError; \$ExitError \$ExitOK [ :jobname ] \$Err;\r\\r
+ \n}\r\\r
+ \n"\r
+add comment="Update and Backup send notification to EMail" \\r
+ dont-require-permissions=no name=AM-Backup-UpdateEmail owner=\\r
+ AM-Backup-UpdateEmail policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\r\\r
+ \n# RouterOS script: AM-Backup-UpdateEmail\r\\r
+ \n# Script comment: Update and Backup send notification to EMail\r\\r
+ \n# Copyright (c) 2007-2026 Vados <vados@vados.ru>\r\\r
+ \n#\r\\r
+ \n# requires RouterOS, version>=6.43.7\r\\r
+ \n# requires device-mode, fetch\r\\r
+ \n#\r\\r
+ \n# Updated: 15/04/2025\r\\r
+ \n# Website: https://github.com/beeyev\r\\r
+ \n# Notification e-mail (Make sure you have configured Email settings in T\\r
+ ools -> Email)\r\\r
+ \n:local ExitOK false;\r\\r
+ \n:onerror Err {\r\\r
+ \n :global GlobalConfReady; :global GlobalFuncReady;\r\\r
+ \n :retry { :if (\$GlobalConfReady != true || \$GlobalFuncReady != true) \\r
+ \\\r\\r
+ \n do={ :error (\"Global config and/or functions not ready.\"); }; } \\r
+ delay=500ms max=50;\r\\r
+ \n :local ScriptName [ :jobname ];\r\\r
+ \n\r\\r
+ \n:global LogPrint;\r\\r
+ \n:global EditSchedulers;\r\\r
+ \n:global OSUpdateMode;\r\\r
+ \n\r\\r
+ \n:local SchedInterval \"7d\";\r\\r
+ \n:local SchedStartTime \"03:41:27\";\r\\r
+ \n:local SchedComment \"Every 7 Day Check For Update and Backup send notif\\r
+ ication to EMail.\";\r\\r
+ \n\r\\r
+ \n# Function to add or edit schedulers for scripts, to ensure they are set\\r
+ \_up correctly\r\\r
+ \n# How to use:\r\\r
+ \n# Call this function with the following parameters:\r\\r
+ \n# 1. \$1 - Scheduler name (usually same as script name) [*]\r\\r
+ \n# 2. \$2 - Interval (e.g. \"1d\" (default is \"1d\")) [**]\r\\r
+ \n# 3. \$3 - Start Time (e.g. \"00:00:00\", default is current time) [**]\\r
+ \r\\r
+ \n# 4. \$4 - Comment (optional, default: \"Scheduler for script: <name>\")\\r
+ \_[**]\r\\r
+ \n# 5. \$5 - On Event command (e.g. \"/system/script { run <name>; }\" (de\\r
+ fault is \"/system/script { run \$SchedName; }\")) [**]\r\\r
+ \n# 6. \$6 - Policy (e.g. \"ftp,reboot,read,write,policy,test,password,sni\\r
+ ff,sensitive,romon\" (default is the same)) [**]\r\\r
+ \n# 7. \$7 - Start Date (e.g. \"jan/01/1970\", default is current date) [*\\r
+ *]\r\\r
+ \n# Notes:\r\\r
+ \n# * - Scheduler name is required, and is used to identify the scheduler\\r
+ \_to create or edit. It is usually the same as the script name (\$ScriptNa\\r
+ me).\r\\r
+ \n# ** - If optional parameters are not provided, default values will be u\\r
+ sed.\r\\r
+ \n# This allows for quick setup with minimal parameters, while still \\r
+ providing flexibility for customization.\r\\r
+ \n# Example usage:\r\\r
+ \n# :if ([ \$EditSchedulers \"my-script\" ] = false) do={:set ExitOK false\\r
+ ; :error true;}\r\\r
+ \n# :if ([ \$EditSchedulers \"my-script\" \"1d\" \"03:41:27\" \"My custom \\r
+ scheduler comment\" false false \"jan/01/1970\" ] = false) do={:set ExitOK\\r
+ \_false; :error true;}\r\\r
+ \n\r\\r
+ \n:set EditSchedulers do={\r\\r
+ \n :global LogPrint;\r\\r
+ \n :local SchedName [ :tostr \$1 ];\r\\r
+ \n :if ([ :len \$SchedName ] = 0) do={ :return false; }\r\\r
+ \n :local Interval [ :tostr \$2 ];\r\\r
+ \n :if ([ :len \$Interval ] = 0) do={ :set Interval \"1d\"; }\r\\r
+ \n :local StartTime [ :tostr \$3 ];\r\\r
+ \n :if ([ :len \$StartTime ] = 0) do={ :set StartTime [/system/clock/get \\r
+ time]; }\r\\r
+ \n :local Comment [ :tostr \$4 ];\r\\r
+ \n :if ([ :len \$Comment ] = 0) do={ :set Comment \"Scheduler for script:\\r
+ \_\$SchedName\"; }\r\\r
+ \n :local OnEvent [ :tostr \$5 ];\r\\r
+ \n :if ([ :len \$OnEvent ] > 0) do={ :set OnEvent \"/system/script { run \\r
+ \$SchedName; }\"; }\r\\r
+ \n :local Policy [ :tostr \$6 ];\r\\r
+ \n :if ([ :len \$Policy ] = 0) do={ :set Policy \"ftp,reboot,read,write,p\\r
+ olicy,test,password,sniff,sensitive,romon\"; }\r\\r
+ \n :local StartDate [ :tostr \$7 ];\r\\r
+ \n :if ([ :len \$StartDate ] = 0) do={ :set StartDate [/system/clock/get \\r
+ date]; }\r\\r
+ \n\r\\r
+ \n :onerror Err {\r\\r
+ \n # Check if scheduler exists, if not - create it\r\\r
+ \n :if ([ :len [ /system/scheduler/find where name=\$SchedName ] ] = 0)\\r
+ \_do={\r\\r
+ \n \$LogPrint warning \$SchedName (\"System Scheduler for script: \" \\r
+ . \$SchedName . \" is NOT SET! Fix It Now!\");\r\\r
+ \n /system/scheduler/add comment=\$Comment interval=\$Interval name=\\r
+ \$SchedName on-event=\$OnEvent policy=\$Policy start-date=\$StartDate star\\r
+ t-time=\$StartTime;\r\\r
+ \n }\r\\r
+ \n # Check if scheduler parameters are correct, if not - fix them\r\\r
+ \n :if ([ /system/scheduler/get \$SchedName comment ] != \$Comment) do=\\r
+ {\r\\r
+ \n /system/scheduler/set \$SchedName comment=\$Comment;\r\\r
+ \n }\r\\r
+ \n :if ([ /system/scheduler/get \$SchedName interval ] != \$Interval) d\\r
+ o={\r\\r
+ \n /system/scheduler/set \$SchedName interval=\$Interval;\r\\r
+ \n }\r\\r
+ \n :if ([ /system/scheduler/get \$SchedName on-event ] != \$OnEvent) do\\r
+ ={\r\\r
+ \n /system/scheduler/set \$SchedName on-event=\$OnEvent;\r\\r
+ \n }\r\\r
+ \n :if ([ /system/scheduler/get \$SchedName policy ] != \$Policy) do={\\r
+ \r\\r
+ \n /system/scheduler/set \$SchedName policy=\$Policy;\r\\r
+ \n }\r\\r
+ \n :if ([ /system/scheduler/get \$SchedName start-date ] != \$StartDate\\r
+ ) do={\r\\r
+ \n /system/scheduler/set \$SchedName start-date=\$StartDate;\r\\r
+ \n }\r\\r
+ \n :if ([ /system/scheduler/get \$SchedName start-time ] != \$StartTime\\r
+ ) do={\r\\r
+ \n /system/scheduler/set \$SchedName start-time=\$StartTime;\r\\r
+ \n }\r\\r
+ \n } do={\$LogPrint error \$0 (\"Failed to add/modify shceduler for '\" .\\r
+ \_\$SchedName . \"' failed: \" . \$Err); :return false};\r\\r
+ \n :return true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n:if ([ \$EditSchedulers \$ScriptName \$SchedInterval \$SchedStartTime \$\\r
+ SchedComment ] = false) do={\r\\r
+ \n \$LogPrint error \$ScriptName (\"Failed to add/modify shceduler for \"\\r
+ \_. \$ScriptName . \"!\");\r\\r
+ \n :set ExitOK false;\r\\r
+ \n :error true;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n\r\\r
+ \n# Add global Function OSUpdateMode\r\\r
+ \n:if ([ :len \$OSUpdateMode ] = 0 || ![\$OSUpdateMode]) do={\r\\r
+ \n :set OSUpdateMode do={\r\\r
+ \n :local NewMode [ :tostr \$1 ];\r\\r
+ \n :global BackupAndUpdateMode;\r\\r
+ \n :global LogPrint;\r\\r
+ \n :global OldMode [ :tostr \$BackupAndUpdateMode ];\r\\r
+ \n :if ([ \$NewMode ] != false && \$NewMode != \$OldMode && \$NewMode =\\r
+ \_\"updateOnce\") do={\r\\r
+ \n :set BackupAndUpdateMode \$NewMode;\r\\r
+ \n \$LogPrint warning \$0 (\"/nOk. /\$OsUpdateMode = \" . \$NewMode .\\r
+ \_\".\\nYou're a good boy! ))\\nI'm launching the update in 5 seconds.\");\\r
+ \r\\r
+ \n :delay 5;\r\\r
+ \n /system/script { run AM-Backup-UpdateEmail; };\r\\r
+ \n } else={\r\\r
+ \n \$LogPrint warning \$0 (\"/nFunction /\$OsUpdateMode is \" . \$NewMo\\r
+ de . \" but is may be only \\\"updateOnce\\\" value!\");\r\\r
+ \n :return false;\r\\r
+ \n }\r\\r
+ \n :error false;\r\\r
+ \n };\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n# :if ([ :len [ /system/scheduler/find where name=\"running-from-backup\\r
+ -partition\" ] ] > 0) do={\r\\r
+ \n# \$LogPrint warning \$ScriptName (\"Running from backup partition, r\\r
+ efusing to act.\");\r\\r
+ \n# :set ExitOK true;\r\\r
+ \n# :error false;\r\\r
+ \n# }\r\\r
+ \n\r\\r
+ \n:global EmailGeneralTo;\r\\r
+ \n:global BackupAndUpdateMode;\r\\r
+ \n:global forceBackup;\r\\r
+ \n:global BackupPassword;\r\\r
+ \n:global BackupSens;\r\\r
+ \n:global updateChannel;\r\\r
+ \n\r\\r
+ \n:global DevInfoIncludeIP;\r\\r
+ \n\r\\r
+ \n# Installs patch updates only (BackupAndUpdateMode = \"osupdate\").\r\\r
+ \n# Works for `stable` and `long-term` channels.\r\\r
+ \n# Updates only if MAJOR.MINOR match (e.g. 6.43.2 > 6.43.6 allowed, 6.44.\\r
+ 1 skipped).\r\\r
+ \n# Sends info if a newer (non-patch) version is found.\r\\r
+ \n:local installOnlyPatchUpdates false\r\\r
+ \n:local scriptVersion \"26.02.12\"\r\\r
+ \n\r\\r
+ \n#Script messages prefix\r\\r
+ \n:local SMP \"BkpAndUpdate:\";\r\\r
+ \n\r\\r
+ \n:local exitErrorMessage \"\$SMP script stopped due to an error. Please c\\r
+ heck logs for more details.\";\r\\r
+ \n:log info \"\\n\\n\$SMP Script \\\"Mikrotik RouterOS automatic backup & \\r
+ update\\\" v.\$scriptVersion started.\";\r\\r
+ \n:log info \"\$SMP Script Mode: `\$BackupAndUpdateMode`, Update channel: \\r
+ `\$updateChannel`, Force backup: `\$forceBackup`, Install only patch updat\\r
+ es: `\$installOnlyPatchUpdates`\";\r\\r
+ \n\r\\r
+ \n## vv FUNCTIONS vv ##\r\\r
+ \n:global WaitCheckUpdates; \$WaitCheckUpdates;\r\\r
+ \n:global MiniDateTimeStamp;\r\\r
+ \n:local MDTSFix [\$MiniDateTimeStamp];\r\\r
+ \n:global Identity;\r\\r
+ \n:global IdentityShort;\r\\r
+ \n:global devBoardName;\r\\r
+ \n:global runningVersion;\r\\r
+ \n:global runningChannel;\r\\r
+ \n:global devModel;\r\\r
+ \n:global devRbSerialNumber;\r\\r
+ \n:global ROsVerAvail;\r\\r
+ \n:global PkgUpdStatus;\r\\r
+ \n\r\\r
+ \n# Checks if two RouterOS version strings differ only by the patch versio\\r
+ n\r\\r
+ \n# :put [\$FuncIsPatchUpdateOnly \"6.2.1\" \"6.2.4\"] # Output: true\r\\r
+ \n# :put [\$FuncIsPatchUpdateOnly \"6.2.1\" \"6.3.1\"] # Output: false\r\\r
+ \n:local FuncIsPatchUpdateOnly do={\r\\r
+ \n :local ver1 \$1;\r\\r
+ \n :local ver2 \$2;\r\\r
+ \n # Extract the major and minor components from a version\r\\r
+ \n :local extractMajorMinor do={\r\\r
+ \n :local ver \$1;\r\\r
+ \n :local dot1 [:find \$ver \".\"];\r\\r
+ \n :if (\$dot1 = -1) do={:return \$ver}\r\\r
+ \n :local major [:pick \$ver 0 \$dot1];\r\\r
+ \n :local rest [:pick \$ver (\$dot1 + 1) [:len \$ver]];\r\\r
+ \n :local dot2 [:find \$rest \".\"];\r\\r
+ \n :local minor \$rest;\r\\r
+ \n :if (\$dot2 >= 0) do={:set minor [:pick \$rest 0 \$dot2]}\r\\r
+ \n :return (\$major . \".\" . \$minor);\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n# Compare the major and minor components of both version strings\r\\r
+ \n:if ([\$extractMajorMinor \$ver1] = [\$extractMajorMinor \$ver2]) do={:r\\r
+ eturn true}\r\\r
+ \n :return false;\r\\r
+ \n}\r\\r
+ \n# Creates backups and returns array of names\r\\r
+ \n# Possible arguments:\r\\r
+ \n# \$1 - file name, without extension\r\\r
+ \n# \$2 - password (optional)\r\\r
+ \n# \$3 - sensitive data in config (optional, default: false)\r\\r
+ \n# Example:\r\\r
+ \n#:put [\$FuncCreateBackups \$backupName]\r\\r
+ \n:local FuncCreateBackups do={\r\\r
+ \n :local backupName [ :tostr \$1 ];\r\\r
+ \n :local BackPass \$2;\r\\r
+ \n :local BackSens \$3;\r\\r
+ \n\r\\r
+ \n #Script messages prefix\r\\r
+ \n :local SMP \"BkpAndUpdate:\";\r\\r
+ \n :local exitErrorMessage \"\$SMP script stopped due to an error. Please\\r
+ \_check logs for more details.\";\r\\r
+ \n :log info (\"\$SMP global function `FuncCreateBackups` started, input:\\r
+ \_`\$backupName`\");\r\\r
+ \n\r\\r
+ \n # validate required parameter: backupName\r\\r
+ \n :if ([:typeof \$backupName] != \"str\" or [:len \$backupName] = 0) do=\\r
+ {\r\\r
+ \n :log error \"\$SMP parameter 'backupName' is required and must be a \\r
+ non-empty string\";\r\\r
+ \n# :log warning \"\$SMP parameter '\\\$backupName' is required and mus\\r
+ t be a non-empty string.\\nI set '\\\$backupName' to 'default-backup'\";\r\\r
+ \n# :set \$backupName \"default-backup\";\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :local backupFileSys \"\$backupName.backup\";\r\\r
+ \n :local backupFileConfig \"\$backupName.rsc\";\r\\r
+ \n :local backupNames {\$backupFileSys;\$backupFileConfig};\r\\r
+ \n\r\\r
+ \n ## Perform system backup\r\\r
+ \n :if ([:len \$BackPass] = 0) do={\r\\r
+ \n :log info (\"\$SMP starting backup without password, backup name: `\\r
+ \$backupName`\");\r\\r
+ \n /system backup save dont-encrypt=yes name=\$backupName;\r\\r
+ \n } else={\r\\r
+ \n :log info (\"\$SMP starting backup with password, backup name: `\$ba\\r
+ ckupName`\");\r\\r
+ \n /system backup save password=\$BackPass name=\$backupName;\r\\r
+ \n }\r\\r
+ \n :log info (\"\$SMP system backup created: `\$backupFileSys`\");\r\\r
+ \n ## Export config file\r\\r
+ \n :if (\$BackSens = true) do={\r\\r
+ \n :log info (\"\$SMP starting export config with sensitive data, backu\\r
+ p name: `\$backupName`\");\r\\r
+ \n # Since RouterOS v7 it needs to be explicitly set that we want to ex\\r
+ port sensitive data\r\\r
+ \n :if ([:pick [/system resource get version] 0 1] < 7) do={\r\\r
+ \n :execute \"/export compact terse file=\$backupName\";\r\\r
+ \n } else={\r\\r
+ \n :execute \"/export compact show-sensitive terse file=\$backupName\\r
+ \";\r\\r
+ \n }\r\\r
+ \n } else={\r\\r
+ \n :log info (\"\$SMP starting export config without sensitive data, ba\\r
+ ckup name: `\$backupName`\");\r\\r
+ \n /export compact hide-sensitive terse file=\$backupName;\r\\r
+ \n }\r\\r
+ \n :log info (\"\$SMP Config export complete: `\$backupFileConfig`\");\r\\r
+ \n :log info (\"\$SMP Waiting a little to ensure backup files are written\\r
+ \");\r\\r
+ \n :delay 20;\r\\r
+ \n :if ([:len [/file find name=\$backupFileSys]] > 0) do={\r\\r
+ \n :log info (\"\$SMP system backup file successfully saved to the file\\r
+ \_system: `\$backupFileSys`\");\r\\r
+ \n } else={\r\\r
+ \n :log error (\"\$SMP system backup was not created, file does not exi\\r
+ st: `\$backupFileSys`\");\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n :if ([:len [/file find name=\$backupFileConfig]] > 0) do={\r\\r
+ \n :log info (\"\$SMP config backup file successfully saved to the file\\r
+ \_system: `\$backupFileConfig`\");\r\\r
+ \n } else={\r\\r
+ \n :log error (\"\$SMP config backup was not created, file does not exi\\r
+ st: `\$backupFileConfig`\");\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n :log info (\"\$SMP global function `FuncCreateBackups` finished. Creat\\r
+ ed backups, system: `\$backupFileSys`, config: `\$backupFileConfig`\")\r\\r
+ \n :return \$backupNames;\r\\r
+ \n}\r\\r
+ \n# Sends an email\r\\r
+ \n# Parameters:\r\\r
+ \n# \$1 - to (email address)\r\\r
+ \n# \$2 - subject\r\\r
+ \n# \$3 - body\r\\r
+ \n# \$4 - file attachments (optional; pass \"\" if not needed)\r\\r
+ \n#\r\\r
+ \n# Example:\r\\r
+ \n# \$FuncSendEmailSafe \"admin@domain.com\" \"Backup Done\" \"Backup comp\\r
+ lete.\" \"backup1.backup\"\r\\r
+ \n:local FuncSendEmailSafe do={\r\\r
+ \n :global EmailGeneralTo;\r\\r
+ \n :local emailSubject \$2;\r\\r
+ \n :local emailBody \$3;\r\\r
+ \n :local emailAttachments \$4;\r\\r
+ \n :local SMP \"Bkp&Upd:\";\r\\r
+ \n :local exitErrorMessage \"\$SMP script stopped due to an error. Please\\r
+ \_check logs for more details.\";\r\\r
+ \n :log info \"\$SMP Attempting to send email to `\$EmailGeneralTo`\";\r\\r
+ \n # SAFETY: wait for any previously queued email to finish\r\\r
+ \n :local waitTimeoutPre 60;\r\\r
+ \n :local waitCounterPre 0;\r\\r
+ \n :while (([/tool e-mail get last-status] = \"resolving-dns\" or [/tool \\r
+ e-mail get last-status] = \"in-progress\")) do={\r\\r
+ \n :if (\$waitCounterPre >= \$waitTimeoutPre) do={\r\\r
+ \n :log error \"\$SMP Email send aborted: previous send did not compl\\r
+ ete after \$waitTimeoutPre seconds\";\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n :log info \"\$SMP Waiting for previous email to finish (status: \$[/\\r
+ tool e-mail get last-status])...\";\r\\r
+ \n :delay 1; \r\\r
+ \n :set waitCounterPre (\$waitCounterPre + 1);\r\\r
+ \n }\r\\r
+ \n # Send the email\r\\r
+ \n :do {\r\\r
+ \n /tool e-mail send to=\$EmailGeneralTo subject=\$emailSubject body=\$\\r
+ emailBody file=\$emailAttachments;\r\\r
+ \n } on-error={\r\\r
+ \n :log error \"\$SMP Email send command failed to execute. Check logs \\r
+ and verify email settings.\";\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n # Wait for send status to change from \"in-progress\" / \"resolving-dn\\r
+ s\"\r\\r
+ \n :local waitTimeout 60;\r\\r
+ \n :local waitCounter 0;\r\\r
+ \n :local emailStatus \"\";\r\\r
+ \n :log info \"\$SMP Waiting for email to be sent, timeout in `\$waitTime\\r
+ out` seconds...\";\r\\r
+ \n :while (\$waitCounter < \$waitTimeout) do={\r\\r
+ \n :set emailStatus [/tool e-mail get last-status];\r\\r
+ \n :if (\$emailStatus != \"in-progress\" and \$emailStatus != \"resolvi\\r
+ ng-dns\") do={\r\\r
+ \n :log info \"\$SMP Email send status received: \$emailStatus\";\r\\r
+ \n # exit loop\r\\r
+ \n :set waitCounter \$waitTimeout;\r\\r
+ \n } else={:delay 1; :set waitCounter (\$waitCounter + 1)}\r\\r
+ \n }\r\\r
+ \n # Final decision based on last status\r\\r
+ \n :if (\$emailStatus = \"succeeded\") do={\r\\r
+ \n :log info \"\$SMP Email successfully sent to `\$EmailGeneralTo`\";\\r
+ \r\\r
+ \n } else={\r\\r
+ \n :log error \"\$SMP Email failed to send. Status: `\$emailStatus`. Ch\\r
+ eck logs for more details and verify email settings.\";\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n# Global variable to track current update step\r\\r
+ \n# They need to be initialized here first to be available in the script\r\\r
+ \n:global buGlobalVarTargetOsVersion;\r\\r
+ \n:global buGlobalVarScriptStep;\r\\r
+ \n:local scriptStep \$buGlobalVarScriptStep;\r\\r
+ \n:do {\r\\r
+ \n /system/script/environment remove buGlobalVarScriptStep;\r\\r
+ \n} on-error={}\r\\r
+ \n:if ([:len \$scriptStep] = 0) do={\r\\r
+ \n :set scriptStep 1;\r\\r
+ \n}\r\\r
+ \n## ^^ FUNCTIONS ^^ ##\r\\r
+ \n#\r\\r
+ \n# Initial validation\r\\r
+ \n## Check email settings\r\\r
+ \n:if ([:len \$EmailGeneralTo] < 3) do={\r\\r
+ \n :log error (\"\$SMP Parameter `\\\$EmailGeneralTo` is not set, or cont\\r
+ ains invalid value. Script stopped.\");\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n}\r\\r
+ \n# Values will be defined later in the script\r\\r
+ \n:local emailServer \"\";\r\\r
+ \n:local emailFromAddress [/tool e-mail get from];\r\\r
+ \n:log info \"\$SMP Validating email settings...\";\r\\r
+ \n:do {\r\\r
+ \n :set emailServer [/tool e-mail get server];\r\\r
+ \n} on-error={\r\\r
+ \n # This is a workaround for the RouterOS v7.12 and older versions\r\\r
+ \n :set emailServer [/tool e-mail get address];\r\\r
+ \n}\r\\r
+ \n:if (\$emailServer = \"0.0.0.0\") do={\r\\r
+ \n :log error (\"\$SMP Email server address is not correct: `\$emailServe\\r
+ r`, check `Tools -> Email`. Script stopped.\");\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n}\r\\r
+ \n:if ([:len \$emailFromAddress] < 3) do={\r\\r
+ \n :log error (\"\$SMP Email configuration FROM address is not correct: `\\r
+ \$emailFromAddress`, check `Tools -> Email`. Script stopped.\");\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n}\r\\r
+ \n# Script mode validation\r\\r
+ \n:if (\$BackupAndUpdateMode != \"backup\" and \$BackupAndUpdateMode != \"\\r
+ osupdate\" and \$BackupAndUpdateMode != \"updateOnce\" and \$BackupAndUpda\\r
+ teMode != \"osnotify\") do={\r\\r
+ \n :log error (\"\$SMP Script parameter `\\\$BackupAndUpdateMode` is not \\r
+ set, or contains invalid value: `\$BackupAndUpdateMode`. Script stopped.\"\\r
+ );\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n}\r\\r
+ \n# Update channel validation\r\\r
+ \n:if (\$updateChannel != \"stable\" and \$updateChannel != \"long-term\" \\r
+ and \$updateChannel != \"testing\" and \$updateChannel != \"development\")\\r
+ \_do={\r\\r
+ \n :log error (\"\$SMP Script parameter `\\\$updateChannel` is not set, o\\r
+ r contains invalid value: `\$updateChannel`. Script stopped.\");\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n}\r\\r
+ \n# Verify if script is set to install patch updates and if the update cha\\r
+ nnel is valid\r\\r
+ \n:if ((\$BackupAndUpdateMode = \"osupdate\" or \$BackupAndUpdateMode = \"\\r
+ updateOnce\") and \$installOnlyPatchUpdates = true) do={\r\\r
+ \n :if (\$updateChannel != \"stable\" and \$updateChannel != \"long-term\\r
+ \") do={\r\\r
+ \n :log error (\"\$SMP Patch-only updates enabled, but update channel `\\r
+ \$updateChannel` is invalid. Only `stable` and `long-term` are supported. \\r
+ Script stopped\");\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n \r\\r
+ \n :if (\$runningChannel != \"stable\" and \$runningChannel != \"long-ter\\r
+ m\") do={\r\\r
+ \n :log error (\"\$SMP Script is set to install only patch updates, but\\r
+ \_the installed RouterOS version is not from `stable` or `long-term` chann\\r
+ el: `\$runningChannel`. Script stopped\");\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n#\r\\r
+ \n\r\\r
+ \n:local rawTime [/system clock get time];\r\\r
+ \n:local rawDate [/system clock get date];\r\\r
+ \n\r\\r
+ \n:local deviceOsVerAndChannelRunning [/system/resource/get version];\r\\r
+ \n\r\\r
+ \n:local backupNameTemplate (\"backup_v\" . \$runningVersion . \"_\" .\\r
+ \_\$runningChannel . \"_\" . \$MDTSFix);\r\\r
+ \n:local backupNameBeforeUpdate (\$backupNameTemplate . \"_before_update\"\\r
+ );\r\\r
+ \n:local backupNameAfterUpdate (\$backupNameTemplate . \"_after_update\")\\r
+ ;\r\\r
+ \n\r\\r
+ \n## Email body template\r\\r
+ \n:local mailSubjectPrefix \"\$SMP Device - `\$IdentityShort`\";\r\\r
+ \n:local mailBodyCopyright \"Mikrotik RouterOS automatic backup & update \\r
+ (ver. \$scriptVersion) \\nhttps://github.com/beeyev/Mikrotik-RouterOS-auto\\r
+ matic-backup-and-update\";\r\\r
+ \n:local changelogUrl \"Check RouterOS changelog: https://mikrotik.com\\r
+ /download/changelogs/\";\r\\r
+ \n:local mailBodyDeviceInfo \"\";\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"Device information:\")\\r
+ ;\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\n-------------------\\r
+ --\");\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nName: \$Identity\")\\r
+ ;\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nModel: \$devModel\"\\r
+ );\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nBoard: \$devBoardNa\\r
+ me\");\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nSerial number: \$de\\r
+ vRbSerialNumber\");\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nRouterOS version: v\\r
+ \$deviceOsVerAndChannelRunning\");\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nBuild time: \$[/sys\\r
+ tem/resource/get build-time]\");\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nRouterboard FW: \$R\\r
+ OsVerAvail\");\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nDevice date-time: \\r
+ \$rawDate \$rawTime (\$[/system/clock/get time-zone-name ])\");\r\\r
+ \n:set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nUptime: \$[/system/\\r
+ resource/get uptime]\");\r\\r
+ \n\r\\r
+ \n:local mailAttachments [:toarray \"\"];\r\\r
+ \n:if (\$scriptStep = 1 or \$scriptStep = 3) do={\r\\r
+ \n :if (\$scriptStep = 3) do={\r\\r
+ \n :log info (\"\$SMP Waiting for one minute before continuing to the f\\r
+ inal step.\");\r\\r
+ \n :delay 1m;\r\\r
+ \n }\r\\r
+ \n## IP address detection\r\\r
+ \n :global DevInfoIncludeIP;\r\\r
+ \n :if ([\$DevInfoIncludeIP] = true) do={\r\\r
+ \n :global GetPubIp;\r\\r
+ \n :local PublicIpAddress \$GetPubIp;\r\\r
+ \n :set mailBodyDeviceInfo (\$mailBodyDeviceInfo . \"\\nPublic IP addre\\r
+ ss: \" . \$PublicIpAddress . \".\");\r\\r
+ \n :log info (\"\$SMP Public IP address detected: \" . \$PublicIpAddres\\r
+ s);\r\\r
+ \n } \r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n## STEP 1: Create backups, check for new RouterOS, and send email\r\\r
+ \n## Steps 2\C3\A23 run only if auto-update is enabled and a new version i\\r
+ s available\r\\r
+ \n:if (\$scriptStep = 1) do={\r\\r
+ \n :global BackupPassword;\r\\r
+ \n :global BackupSens;\r\\r
+ \n :local isNewOsUpdateAvailable false;\r\\r
+ \n :local isLatestOsAlreadyInstalled true;\r\\r
+ \n :local isOsNeedsToBeUpdated false;\r\\r
+ \n :local isUpdateCheckSucceeded false;\r\\r
+ \n :local isEmailNeedsToBeSent false;\r\\r
+ \n :local mailSubjectPartAction \"\";\r\\r
+ \n :local mailPtBodyAction \"\";\r\\r
+ \n :local mailPtSubjectBackup \"\";\r\\r
+ \n :local mailPtBodyBackup \"\";\r\\r
+ \n # Checking for new version\r\\r
+ \n :if (\$BackupAndUpdateMode = \"osupdate\" or \$BackupAndUpdateMode = \\r
+ \"osnotify\" or \$BackupAndUpdateMode = \"updateOnce\") do={\r\\r
+ \n :log info (\"\$SMP Setting update channel to `\$updateChannel`\");\r\\r
+ \n /system/package/update/set channel=\$updateChannel;\r\\r
+ \n :log info (\"\$SMP Checking for new RouterOS version. Current instal\\r
+ led version is: `\$runningVersion`\");\r\\r
+ \n \$LogPrint debug \$ScriptName (\"Checking for updates...\");\r\\r
+ \n \r\\r
+ \n# /system/package/update/check-for-updates without-paging as-value;\\r
+ \r\\r
+ \n# /system/package/update check-for-updates;\r\\r
+ \n :delay 5s;\r\\r
+ \n :set PkgUpdStatus [ /system/package/update/get status ];\r\\r
+ \n :if (\$PkgUpdStatus = \"New version is available\") do={\r\\r
+ \n :set ROsVerAvail [/system/package/update/get latest-version];\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if (\$PkgUpdStatus = \"New version is available\") do={\r\\r
+ \n :log info (\"\$SMP New RouterOS version is available: `\$ROsVerAva\\r
+ il`\");\r\\r
+ \n :set isNewOsUpdateAvailable true;\r\\r
+ \n :set isLatestOsAlreadyInstalled false;\r\\r
+ \n :set isUpdateCheckSucceeded true;\r\\r
+ \n :set isEmailNeedsToBeSent true;\r\\r
+ \n :set mailSubjectPartAction \"New RouterOS available\";\r\\r
+ \n :set mailPtBodyAction \"New RouterOS version is available, curren\\r
+ t version: v\$runningVersion, new version: v\$ROsVerAvail. \\n\$changelogU\\r
+ rl\";\r\\r
+ \n } else={\r\\r
+ \n :if (\$PkgUpdStatus = \"System is already up to date\") do={\r\\r
+ \n :log info (\"\$SMP No new RouterOS version is available, the lat\\r
+ est version is already installed: `v\$runningVersion`\");\r\\r
+ \n :set isUpdateCheckSucceeded true;\r\\r
+ \n :set mailSubjectPartAction \"No os update available\";\r\\r
+ \n :set mailPtBodyAction \"No new RouterOS version is available, t\\r
+ he latest version is already installed: `v\$runningVersion`\";\r\\r
+ \n } else={\r\\r
+ \n :log error (\"\$SMP Failed to check for new RouterOS version. Pa\\r
+ ckage check status: `\$PkgUpdStatus`\");\r\\r
+ \n :set isEmailNeedsToBeSent true;\r\\r
+ \n :set mailSubjectPartAction \"Error unable to check new os versio\\r
+ n\";\r\\r
+ \n :set mailPtBodyAction \"An error occurred while checking for a \\r
+ new RouterOS version.\\nStatus returned: `\$PkgUpdStatus`\\n\\nPlease revi\\r
+ ew the logs on the device for more details and verify internet connectivit\\r
+ y.\";\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n # Checking if the script needs to install new os version\r\\r
+ \n :if ((\$BackupAndUpdateMode = \"osupdate\" or \$BackupAndUpdateMode = \\r
+ \"updateOnce\") and \$isNewOsUpdateAvailable = true) do={\r\\r
+ \n :if (\$installOnlyPatchUpdates = true) do={\r\\r
+ \n :if ([\$FuncIsPatchUpdateOnly \$runningVersion \$ROsVerAvail] = tr\\r
+ ue) do={\r\\r
+ \n :log info \"\$SMP New RouterOS version is available, and it is a\\r
+ \_patch update. Current version: v\$runningVersion, new version: v\$ROsVer\\r
+ Avail\";\r\\r
+ \n :set isOsNeedsToBeUpdated true;\r\\r
+ \n } else={\r\\r
+ \n :log info \"\$SMP The script will not install this update, becau\\r
+ se it is not a patch update. Current version: v\$runningVersion, new versi\\r
+ on: v\$ROsVerAvail\";\r\\r
+ \n :set mailPtBodyAction (\$mailPtBodyAction . \"\\nThis update wil\\r
+ l not be installed, because the script is set to install only patch update\\r
+ s.\");\r\\r
+ \n }\r\\r
+ \n } else={\r\\r
+ \n :set isOsNeedsToBeUpdated true;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n # Checking If the script needs to create a backup\r\\r
+ \n :if (\$forceBackup = true or \$BackupAndUpdateMode = \"backup\" or \$i\\r
+ sOsNeedsToBeUpdated = true) do={\r\\r
+ \n :log info (\"\$SMP Starting backup process.\");\r\\r
+ \n :set isEmailNeedsToBeSent true;\r\\r
+ \n :local backupName \$backupNameTemplate;\r\\r
+ \n # This means it's the first step where we create a backup before the\\r
+ \_update process\r\\r
+ \n :if (\$isOsNeedsToBeUpdated = true) do={\r\\r
+ \n :set backupName \$backupNameBeforeUpdate;\r\\r
+ \n #Email body if the purpose of the script is to update the device\r\\r
+ \n :set mailSubjectPartAction \"Update preparation\";\r\\r
+ \n :set mailPtBodyAction (\$mailPtBodyAction . \"\\nThe update proces\\r
+ s for device '\$Identity' is scheduled to upgrade RouterOS from version v.\\r
+ \$runningVersion to version v.\$ROsVerAvail (Update channel: \$updateChann\\r
+ el)\");\r\\r
+ \n :set mailPtBodyAction (\$mailPtBodyAction . \"\\nPlease note: The \\r
+ update will proceed only after a successful backup.\");\r\\r
+ \n :set mailPtBodyAction (\$mailPtBodyAction . \"\\nA final report wi\\r
+ th detailed information will be sent once the update process is completed.\\r
+ \");\r\\r
+ \n :set mailPtBodyAction (\$mailPtBodyAction . \"\\nIf you do not rec\\r
+ eive a second email within the next 10 minutes, there may be an issue. Ple\\r
+ ase check your device logs for further information.\");\r\\r
+ \n }\r\\r
+ \n :do {\r\\r
+ \n :set mailAttachments [\$FuncCreateBackups \$backupName \$BackupPas\\r
+ sword \$BackupSens];\r\\r
+ \n :set mailPtSubjectBackup \"Backup created\";\r\\r
+ \n :set mailPtBodyBackup \"System backups have been successfully crea\\r
+ ted and attached to this email.\";\r\\r
+ \n } on-error={\r\\r
+ \n :set isOsNeedsToBeUpdated false;\r\\r
+ \n :set mailPtSubjectBackup \"Backup failed\";\r\\r
+ \n :set mailPtBodyBackup \"The script failed to create backups. Pleas\\r
+ e check device logs for more details.\";\r\\r
+ \n :log warning \"\$SMP Backup creation failed. Update process will b\\r
+ e canceled if automatic update is enabled\";\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :if (\$isEmailNeedsToBeSent = true) do={\r\\r
+ \n :log info \"\$SMP Preparing to send email...\";\r\\r
+ \n :local mailStep1Subject \$mailSubjectPrefix;\r\\r
+ \n :local mailStep1Body \"\";\r\\r
+ \n # subject\r\\r
+ \n :if (\$mailSubjectPartAction != \"\") do={:set mailStep1Subject (\$\\r
+ mailStep1Subject . \" - \" . \$mailSubjectPartAction)}\r\\r
+ \n :if (\$mailPtSubjectBackup != \"\") do={:set mailStep1Subject (\$ma\\r
+ ilStep1Subject . \" - \" . \$mailPtSubjectBackup)}\r\\r
+ \n # body\r\\r
+ \n :if (\$mailPtBodyAction != \"\") do={:set mailStep1Body (\$mailStep1\\r
+ Body . \$mailPtBodyAction . \"\\n\\n\")}\r\\r
+ \n :if (\$mailPtBodyBackup != \"\") do={:set mailStep1Body (\$mailStep1\\r
+ Body . \$mailPtBodyBackup . \"\\n\\n\")}\r\\r
+ \n :set mailStep1Body (\$mailStep1Body . \$mailBodyDeviceInfo . \"\\n\\\\r
+ n\" . \$mailBodyCopyright);\r\\r
+ \n # Send email with backups\r\\r
+ \n :do {\$FuncSendEmailSafe \$EmailGeneralTo \$mailStep1Subject \$mailS\\r
+ tep1Body \$mailAttachments} on-error={\r\\r
+ \n :set isOsNeedsToBeUpdated false;\r\\r
+ \n :log error \"\$SMP The script will not proceed with the update pro\\r
+ cess, because the email was not sent.\";\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :if ([:len \$mailAttachments] > 0) do={\r\\r
+ \n :log info \"\$SMP Cleaning up backup files from the file system...\"\\r
+ ;\r\\r
+ \n /file remove \$mailAttachments;\r\\r
+ \n :delay 2s;\r\\r
+ \n }\r\\r
+ \n :if (\$isOsNeedsToBeUpdated = true) do={\r\\r
+ \n :global OldMode;\r\\r
+ \n :log info \"\$SMP everything is ready to install new RouterOS, going\\r
+ \_to start the update process and reboot the device.\";\r\\r
+ \n :do {\r\\r
+ \n :local nextStep 2;\r\\r
+ \n :if (\$isCloudHostedRouter = true) do={\r\\r
+ \n :log info \"\$SMP The device is a cloud hosted router, the secon\\r
+ d step updating the Routerboard firmware will be skipped.\";\r\\r
+ \n :set nextStep 3;\r\\r
+ \n }\r\\r
+ \n :local scheduledCommand (\":delay 5s; /system/scheduler remove BKP\\r
+ UPD-NEXT-BOOT-TASK; \\\r\\r
+ \n :global buGlobalVarScriptStep \$nextStep; :global buGlobalVarTarg\\r
+ etOsVersion \\\"\$ROsVerAvail\\\"; \\\r\\r
+ \n :delay 10s; /system/script { run \$ScriptName; }\");\r\\r
+ \n /system/scheduler add name=BKPUPD-NEXT-BOOT-TASK on-event=\$schedu\\r
+ ledCommand start-time=startup interval=0;\r\\r
+ \n /system/package/update install;\r\\r
+ \n } on-error={\r\\r
+ \n # Failed to install new os version, remove the task and variables\\r
+ \r\\r
+ \n :do {\r\\r
+ \n /system/scheduler remove BKPUPD-NEXT-BOOT-TASK;\r\\r
+ \n :set BackupAndUpdateMode \$OldMode;\r\\r
+ \n :delay 2;\r\\r
+ \n :do {\r\\r
+ \n# /system/script/environment remove [find name=\"buGlobalVarTar\\r
+ getOsVersion\"];\r\\r
+ \n :global buGlobalVarTargetOsVersion (a);\r\\r
+ \n } on-error={\r\\r
+ \n :set \$mailSubjectPrefix (\$mailSubjectPrefix . \"ERROR Remove\\r
+ \_global variable \\\$buGlobalVarTargetOsVersion failed!\");\r\\r
+ \n }\r\\r
+ \n# :if ([ :len \$OldMode ] > 0) do={\r\\r
+ \n# :do {\r\\r
+ \n# #/system/script/environment remove [find name=\"OldMode\"];\\r
+ \r\\r
+ \n# :global OldMode (a);\r\\r
+ \n# } on-error={\r\\r
+ \n# :set \$mailSubjectPrefix (\$mailSubjectPrefix . \" ERROR Re\\r
+ move global variable \\\$OldMode failed!\");\r\\r
+ \n# }\r\\r
+ \n# }\r\\r
+ \n } on-error={\r\\r
+ \n :log error \"\$SMP Failed to install new RouterOS version. Pleas\\r
+ e check device logs for more details. \\\r\\r
+ \n \\nAnd Failed to remove task and variables! Check it!\";\r\\r
+ \n :set \$mailSubjectPrefix (\$mailSubjectPrefix . \" ERROR Remove \\r
+ task and global variables!\");\r\\r
+ \n }\r\\r
+ \n :log error \"\$SMP Failed to install new RouterOS version. Please \\r
+ check device logs for more details.\";\r\\r
+ \n :local mailUpdateErrorSubject (\$mailSubjectPrefix . \" - Update f\\r
+ ailed\");\r\\r
+ \n :local mailUpdateErrorBody \"The script was unable to install new \\r
+ RouterOS version. Please check device logs for more details.\";\r\\r
+ \n # Send email with error\r\\r
+ \n \$FuncSendEmailSafe \$EmailGeneralTo \$mailUpdateErrorSubject \$ma\\r
+ ilUpdateErrorBody \"\";\r\\r
+ \n :error \$exitErrorMessage;\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n## STEP 2: (Post-reboot) Upgrade RouterBOARD firmware\r\\r
+ \n## Runs only if auto-update is enabled and a new RouterOS version was fo\\r
+ und\r\\r
+ \n:if (\$scriptStep = 2) do={\r\\r
+ \n :log info \"\$SMP The script is in the second step, updating Routerboa\\r
+ rd firmware.\";\r\\r
+ \n :log info \"\$SMP Upgrading routerboard firmware from v.\$deviceRbCurr\\r
+ entFw to v.\$deviceRbUpgradeFw\";\r\\r
+ \n /system routerboard upgrade;\r\\r
+ \n :delay 2;\r\\r
+ \n :log info \"\$SMP routerboard upgrade process was completed, going to \\r
+ reboot in a moment!\";\r\\r
+ \n ## Set task to send final report on the next boot\r\\r
+ \n /system scheduler add name=BKPUPD-NEXT-BOOT-TASK on-event=\":delay 2; \\r
+ :global buGlobalVarScriptStep 3; \\\r\\r
+ \n :global buGlobalVarTargetOsVersion \\\"\$buGlobalVarTargetOsVersion\\\\r
+ \"; :delay 10s; /system/script { run \$ScriptName; }; \\ \r\\r
+ \n :delay 5s; /system/scheduler remove BKPUPD-NEXT-BOOT-TASK;\" start-ti\\r
+ me=startup interval=0;\r\\r
+ \n :delay 2;\r\\r
+ \n /system reboot;\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n## STEP 3: Final report (after second reboot, with delay).\r\\r
+ \n## Runs only if auto-update is enabled and a new RouterOS version was fo\\r
+ und.\r\\r
+ \n:if (\$scriptStep = 3) do={\r\\r
+ \n :log info (\"\$SMP The script is in the third step, sending final repo\\r
+ rt.\");\r\\r
+ \n :local targetOsVersion \$buGlobalVarTargetOsVersion;\r\\r
+ \n :do {\r\\r
+ \n# /system/script/environment remove [find name=\"buGlobalVarTargetOsV\\r
+ ersion\"];\r\\r
+ \n :global buGlobalVarTargetOsVersion (a);\r\\r
+ \n } on-error={\r\\r
+ \n :set \$mailSubjectPrefix (\$mailSubjectPrefix . \" ERROR Remove glob\\r
+ al variable \\\$buGlobalVarTargetOsVersion failed!\");\r\\r
+ \n }\r\\r
+ \n\r\\r
+ \n :if ([ :len \$OldMode ] != 0) do={\r\\r
+ \n :do {\r\\r
+ \n# /system/script/environment remove [find name=\"OldMode\"];\r\\r
+ \n :global OldMode (a);\r\\r
+ \n } on-error={\r\\r
+ \n :set \$mailSubjectPrefix (\$mailSubjectPrefix . \" ERROR! Remove\\r
+ \_global variable \\\$OldMode failed!\");\r\\r
+ \n }\r\\r
+ \n }\r\\r
+ \n :if ([:len \$targetOsVersion] = 0) do={\r\\r
+ \n :log warning \"\$SMP Something is wrong, the script was unable to ge\\r
+ t the target updated OS version from the global variable.\";\r\\r
+ \n }\r\\r
+ \n :local mailStep3Subject \$mailSubjectPrefix;\r\\r
+ \n :local mailStep3Body \"\";\r\\r
+ \n :if (\$targetOsVersion = \$runningVersion) do={\r\\r
+ \n :log info \"\$SMP Successfully verified new RouterOS version: target\\r
+ : `\$targetOsVersion`, current: `\$runningVersion`\";\r\\r
+ \n :set mailStep3Subject (\$mailStep3Subject . \" - Update completed - \\r
+ Backup created\");\r\\r
+ \n :set mailStep3Body (\$mailStep3Body . \"RouterOS and routerboard upg\\r
+ rade process was completed\");\r\\r
+ \n :set mailStep3Body (\$mailStep3Body . \"\\nNew RouterOS version: v.\\r
+ \$targetOsVersion, routerboard firmware: v.\$deviceRbCurrentFw\");\r\\r
+ \n :set mailStep3Body (\$mailStep3Body . \"\\n\$changelogUrl\\nBackups \\r
+ of the upgraded system are in the attachment of this email.\\n\\n\$mailBod\\r
+ yDeviceInfo\\n\\n\$mailBodyCopyright\");\r\\r
+ \n :set mailAttachments [\$FuncCreateBackups \$backupNameAfterUpdate \$\\r
+ BackupPassword \$BackupSens];\r\\r
+ \n } else={\r\\r
+ \n :log error \"\$SMP Failed to verify new RouterOS version: target: `\\r
+ \$targetOsVersion`, current: `\$runningVersion`\";\r\\r
+ \n :set mailStep3Subject (\$mailStep3Subject . \" - Update failed\");\r\\r
+ \n :set mailStep3Body (\$mailStep3Body . \"The script was unable to ver\\r
+ ify that the new RouterOS version was installed, target version: `\$target\\r
+ OsVersion`, current version: `\$runningVersion`\\nCheck device logs for mo\\r
+ re details.\\n\\n\$mailBodyDeviceInfo\\n\\n\$mailBodyCopyright\");\r\\r
+ \n }\r\\r
+ \n \$FuncSendEmailSafe \$EmailGeneralTo \$mailStep3Subject \$mailStep3Bod\\r
+ y \$mailAttachments;\r\\r
+ \n :if ([:len \$mailAttachments] > 0) do={\r\\r
+ \n :log info \"\$SMP Cleaning up backup files from the file system...\"\\r
+ ;\r\\r
+ \n /file remove \$mailAttachments;\r\\r
+ \n :delay 2;\r\\r
+ \n }\r\\r
+ \n :log info (\"\$SMP Final report email sent successfully, and the scrip\\r
+ t has finished.\");\r\\r
+ \n}\r\\r
+ \n:log info (\"\$SMP the script has finished, script step: `\$scriptStep` \\r
+ \\n\\n\");\r\\r
+ \n\r\\r
+ \n} do={:global ExitError; \$ExitError \$ExitOK [ :jobname ] \$Err}\r\\r
+ \n"\r
+/user group\r
+add name=backup policy="telnet,ssh,ftp,read,write,policy,test,sniff,sensitive,\\r
+ !local,!reboot,!winbox,!password,!web,!api,!romon,!rest-api"\r
+/caps-man provisioning\r
+add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=\\r
+ cfg-2ghz name-format=prefix-identity name-prefix=2ghz\r
+add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=\\r
+ cfg-5ghz-ac name-format=prefix-identity name-prefix=5ghz-ac\r
+add action=create-dynamic-enabled hw-supported-modes=an master-configuration=\\r
+ cfg-5ghz-an name-format=prefix-identity name-prefix=5ghz-an\r
+/certificate settings\r
+set builtin-trust-store=fetch\r
+/disk settings\r
+set auto-media-interface=lo default-mount-point-template=usb1\r
+/ip smb\r
+set comment=MikroVados domain=WORKGROUP enabled=yes interfaces=Bridge-LAN\r
+/interface bridge port\r
+add bridge=Bridge-LAN ingress-filtering=no interface=ether2 \\r
+ internal-path-cost=10 path-cost=10\r
+add bridge=Bridge-LAN comment=LEN ingress-filtering=no interface=ether3 \\r
+ internal-path-cost=10 path-cost=10\r
+add bridge=Bridge-LAN comment=NUC ingress-filtering=no interface=ether4 \\r
+ internal-path-cost=10 path-cost=10\r
+add bridge=Bridge-LAN ingress-filtering=no interface=ether5 \\r
+ internal-path-cost=10 path-cost=10\r
+/ip firewall connection tracking\r
+set udp-timeout=10s\r
+/ip neighbor discovery-settings\r
+set discover-interface-list=LAN\r
+/ip settings\r
+set max-neighbor-entries=8192 secure-redirects=no\r
+/ipv6 settings\r
+set disable-ipv6=yes max-neighbor-entries=8192\r
+/interface detect-internet\r
+set detect-interface-list=WAN internet-interface-list=WAN lan-interface-list=\\r
+ LAN wan-interface-list=WAN\r
+/interface l2tp-server server\r
+set authentication=mschap2 use-ipsec=yes\r
+/interface list member\r
+add comment=WAN interface="ether1 - Unet" list=WAN\r
+add interface=Bridge-LAN list=LAN\r
+/interface ovpn-server server\r
+add auth=sha1,md5 mac-address=FE:82:A5:78:8E:84 name=ovpn-server1\r
+/interface wifi cap\r
+set caps-man-addresses=10.30.30.10 certificate=request discovery-interfaces=\\r
+ wlan1,wlan2 lock-to-caps-man=no slaves-static=no\r
+/interface wifi capsman\r
+set package-path="" require-peer-certificate=no upgrade-policy=none\r
+/interface wifi provisioning\r
+add action=create-dynamic-enabled disabled=no master-configuration=2G-N \\r
+ name-format=2G-%I slave-configurations=2G-G supported-bands=\\r
+ 2ghz-n,2ghz-g,2ghz-g\r
+add action=create-dynamic-enabled disabled=no master-configuration=5G-AC \\r
+ name-format=5G-%I supported-bands=5ghz-ac,5ghz-ac\r
+/interface wireguard peers\r
+add allowed-address=10.8.0.2/32,0.0.0.0/0 client-allowed-address=0.0.0.0/0 \\r
+ endpoint-address=89.110.101.17 endpoint-port=29185 interface=WG name=\\r
+ MikroVados persistent-keepalive=10s public-key=\\r
+ "64Y25EUZQQt8EIeAJYD8qWt+te8qvGEepnswdBgmzlY="\r
+/interface wireless cap\r
+# \r
+set bridge=Bridge-LAN caps-man-addresses=10.30.30.10 \\r
+ caps-man-certificate-common-names=CAPsMAN-51B25E507D07 certificate=\\r
+ CAP-18FD746E5814 discovery-interfaces=Bridge-LAN enabled=yes interfaces=\\r
+ wlan1,wlan2 lock-to-caps-man=yes\r
+/interface wireless sniffer\r
+set file-name=24g\r
+/ip address\r
+add address=10.30.30.81/24 interface=Bridge-LAN network=10.30.30.0\r
+add address=10.8.0.2/24 interface=WG network=10.8.0.0\r
+/ip dhcp-client\r
+add add-default-route=special-classless default-route-distance=2 \\r
+ default-route-tables=main interface="ether1 - Unet" name="ether1 - Unet" \\r
+ use-peer-dns=no\r
+/ip dhcp-server config\r
+set accounting=no\r
+/ip dhcp-server lease\r
+add address=10.30.30.101 client-id=1:48:8f:5a:8e:ee:a8 mac-address=\\r
+ 48:8F:5A:8E:EE:A8 server=masterDHCP\r
+add address=10.30.30.107 client-id=1:f0:de:f1:91:d:1e mac-address=\\r
+ F0:DE:F1:91:0D:1E server=masterDHCP\r
+add address=10.30.30.83 client-id=1:0:80:77:ec:43:86 mac-address=\\r
+ 00:80:77:EC:43:86 server=masterDHCP\r
+add address=10.30.30.70 dhcp-option=domain-search-list,HostName \\r
+ dhcp-option-set=HP1505n mac-address=00:1E:0B:1A:88:8D server=masterDHCP\r
+add address=10.30.30.50 client-id=1:4:7c:16:36:f5:37 mac-address=\\r
+ 04:7C:16:36:F5:37 server=masterDHCP\r
+add address=10.30.30.71 client-id=1:10:2d:41:2c:20:c2 mac-address=\\r
+ 10:2D:41:2C:20:C2 server=masterDHCP\r
+add address=10.30.30.61 client-id=1:10:8:c1:81:59:5f mac-address=\\r
+ 10:08:C1:81:59:5F server=masterDHCP\r
+add address=10.30.30.72 client-id=1:10:38:1f:d2:5f:13 mac-address=\\r
+ 10:38:1F:D2:5F:13 server=masterDHCP\r
+add address=10.30.30.99 client-id=1:10:b1:df:e9:d0:d5 mac-address=\\r
+ 10:B1:DF:E9:D0:D5 server=masterDHCP\r
+add address=10.30.30.111 client-id=1:fe:2:52:be:3f:16 mac-address=\\r
+ FE:02:52:BE:3F:16 server=masterDHCP\r
+add address=10.30.30.93 client-id=1:7e:8b:1e:cb:b8:cb mac-address=\\r
+ CC:42:10:12:46:94 server=masterDHCP\r
+add address=10.30.30.94 client-id=1:50:cc:f8:85:96:a mac-address=\\r
+ 50:CC:F8:85:96:0A server=masterDHCP\r
+add address=10.30.30.82 client-id=1:e4:18:6b:58:34:ab mac-address=\\r
+ E4:18:6B:58:34:AB server=masterDHCP\r
+add address=10.30.30.77 dhcp-option=HostName dhcp-option-set=StartLife1 \\r
+ mac-address=C4:82:E1:03:49:10 server=masterDHCP\r
+add address=10.30.30.73 client-id=1:10:38:1f:82:81:f2 mac-address=\\r
+ 10:38:1F:82:81:F2 server=masterDHCP\r
+add address=10.30.30.95 client-id=1:88:ae:dd:60:39:54 dhcp-option=HostName \\r
+ dhcp-option-set=VADOS-NUC mac-address=88:AE:DD:60:39:54 server=masterDHCP\r
+add address=10.30.30.98 client-id=1:c8:5b:76:d8:cc:bf dhcp-option=HostName \\r
+ dhcp-option-set=VADOS-LEN mac-address=C8:5B:76:D8:CC:BF server=masterDHCP\r
+add address=10.30.30.96 client-id=iPhone mac-address=4A:91:ED:0E:1F:39 \\r
+ server=masterDHCP\r
+add address=10.30.30.74 client-id=1:20:72:a9:d3:34:36 dhcp-option=HostName \\r
+ dhcp-option-set=MiTV mac-address=20:72:A9:D3:34:36 server=masterDHCP \\r
+ use-src-mac=yes\r
+add address=10.30.30.30 dhcp-option=HostName dhcp-option-set=miller \\r
+ mac-address=F0:75:5D:1E:5F:71 server=masterDHCP\r
+add address=10.30.30.100 client-id=iVados dhcp-option=HostName \\r
+ dhcp-option-set="=\"Client ID\"" mac-address=DE:4D:72:F3:1A:9F server=\\r
+ masterDHCP\r
+add address=10.30.30.86 dhcp-option=HostName dhcp-option-set=MikroYellow \\r
+ mac-address=48:8F:5A:8E:1A:C2 server=masterDHCP\r
+/ip dhcp-server network\r
+add address=10.30.30.0/24 caps-manager=10.30.30.10 dhcp-option=\\r
+ domain-search-list dhcp-option-set=domain-search-set dns-server=\\r
+ 10.30.30.81 domain=WORKGROUP gateway=10.30.30.81 netmask=24 ntp-server=\\r
+ 10.30.30.81,10.30.30.10 wins-server=10.30.30.95,10.30.30.98\r
+/ip dns\r
+set allow-remote-requests=yes cache-max-ttl=1d doh-max-concurrent-queries=100 \\r
+ doh-max-server-connections=20 servers=8.8.8.8,8.8.4.4 verify-doh-cert=yes\r
+/ip dns static\r
+add address=10.30.30.33 name=amster-nuc type=A\r
+add address=10.30.30.33 comment=AMSTER name=amster.vados.ru type=A\r
+add address=10.30.30.33 name=amster type=A\r
+add address=10.30.30.33 name=amster-reg type=A\r
+add address=10.30.30.33 name=mng.vados.ru type=A\r
+add address=10.30.30.33 name=mgr.vados.ru type=A\r
+add address=10.30.30.33 name=prt.vados.ru type=A\r
+add address=10.30.30.33 name=git.vados.ru type=A\r
+add address=10.30.30.33 name=reg.vados.ru type=A\r
+add address=10.30.30.33 match-subdomain=yes name=ros.vados.ru type=A\r
+add address=10.30.30.33 match-subdomain=yes name=mikrots.vados.ru type=A\r
+add address=10.30.30.33 name=oxidized.vados.ru type=A\r
+add address=8.8.4.4 comment="Google-dns IPv4 2" name=dns.google type=A\r
+add address=8.8.8.8 comment="Google-dns IPv4 1" name=dns.google type=A\r
+add address=10.30.30.30 comment=MILLER name=miller.vados.ru type=A\r
+add address=10.30.30.30 name=MILLER-LEN type=A\r
+add address=10.30.30.30 name=miller type=A\r
+add address=1.1.1.1 comment="CloudFlare-doh IPv4 1" name=\\r
+ security.cloudflare-dns.com type=A\r
+add address=1.0.0.1 comment="CloudFlare-doh IPv4 2" name=\\r
+ security.cloudflare-dns.com type=A\r
+add address=9.9.9.9 comment="Cuad9-dns IPv4 1" disabled=yes name=\\r
+ dns.quad9.net type=A\r
+add address=149.112.112.112 comment="Cuad9-dns IPv4 2" disabled=yes name=\\r
+ dns.quad9.net type=A\r
+add address=91.192.189.2 comment=Unet-DNS disabled=yes name=ns1.unet.ws type=\\r
+ A\r
+add address=10.30.30.81 comment=LocalNet name=MikroVados type=A\r
+add address=10.30.30.10 name=MikroNUC type=A\r
+add address=10.30.30.86 name=MikroYellow type=A\r
+add address=10.30.30.85 name=MikroMic type=A\r
+add address=10.30.30.95 name=VADOS-NUC type=A\r
+add address=10.30.30.98 name=VADOS-LEN type=A\r
+add address=10.30.30.20 name=garage type=A\r
+add address=2606:4700:4700::1111 disabled=yes name=\\r
+ security.cloudflare-dns.com type=AAAA\r
+add address=2606:4700:4700::1001 disabled=yes name=\\r
+ security.cloudflare-dns.com type=AAAA\r
+/ip firewall address-list\r
+add address=91.215.120.206 list=TRUSTED\r
+add address=185.71.70.78 disabled=yes list=TRUSTED\r
+add address=176.53.203.171 disabled=yes list=TRUSTED\r
+add address=176.53.203.170 disabled=yes list=TRUSTED\r
+add address=176.53.202.194 disabled=yes list=TRUSTED\r
+add address=10.30.30.100-255 list=KIDS\r
+add address=8.8.4.0/24 list=YouTube\r
+add address=8.8.8.0/24 list=YouTube\r
+add address=8.34.208.0/20 list=YouTube\r
+add address=8.35.192.0/20 list=YouTube\r
+add address=23.236.48.0/20 list=YouTube\r
+add address=23.251.128.0/19 list=YouTube\r
+add address=34.0.0.0/15 list=YouTube\r
+add address=34.2.0.0/16 list=YouTube\r
+add address=34.3.0.0/23 list=YouTube\r
+add address=34.3.3.0/24 list=YouTube\r
+add address=34.3.4.0/24 list=YouTube\r
+add address=34.3.8.0/21 list=YouTube\r
+add address=34.3.16.0/20 list=YouTube\r
+add address=34.3.32.0/19 list=YouTube\r
+add address=34.3.64.0/18 list=YouTube\r
+add address=34.4.0.0/14 list=YouTube\r
+add address=34.8.0.0/13 list=YouTube\r
+add address=34.16.0.0/12 list=YouTube\r
+add address=34.32.0.0/11 list=YouTube\r
+add address=34.64.0.0/10 list=YouTube\r
+add address=34.128.0.0/10 list=YouTube\r
+add address=35.184.0.0/13 list=YouTube\r
+add address=35.192.0.0/14 list=YouTube\r
+add address=35.196.0.0/15 list=YouTube\r
+add address=35.198.0.0/16 list=YouTube\r
+add address=35.199.0.0/17 list=YouTube\r
+add address=35.199.128.0/18 list=YouTube\r
+add address=35.200.0.0/13 list=YouTube\r
+add address=35.208.0.0/12 list=YouTube\r
+add address=35.224.0.0/12 list=YouTube\r
+add address=35.240.0.0/13 list=YouTube\r
+add address=57.140.192.0/18 list=YouTube\r
+add address=64.15.112.0/20 list=YouTube\r
+add address=64.233.160.0/19 list=YouTube\r
+add address=66.22.228.0/23 list=YouTube\r
+add address=66.102.0.0/20 list=YouTube\r
+add address=66.249.64.0/19 list=YouTube\r
+add address=70.32.128.0/19 list=YouTube\r
+add address=72.14.192.0/18 list=YouTube\r
+add address=74.125.0.0/16 list=YouTube\r
+add address=104.154.0.0/15 list=YouTube\r
+add address=104.196.0.0/14 list=YouTube\r
+add address=104.237.160.0/19 list=YouTube\r
+add address=107.167.160.0/19 list=YouTube\r
+add address=107.178.192.0/18 list=YouTube\r
+add address=108.59.80.0/20 list=YouTube\r
+add address=108.170.192.0/18 list=YouTube\r
+add address=108.177.0.0/17 list=YouTube\r
+add address=130.211.0.0/16 list=YouTube\r
+add address=136.22.160.0/20 list=YouTube\r
+add address=136.22.176.0/21 list=YouTube\r
+add address=136.22.184.0/23 list=YouTube\r
+add address=136.22.186.0/24 list=YouTube\r
+add address=142.250.0.0/15 list=YouTube\r
+add address=146.148.0.0/17 list=YouTube\r
+add address=152.65.208.0/22 list=YouTube\r
+add address=152.65.214.0/23 list=YouTube\r
+add address=152.65.218.0/23 list=YouTube\r
+add address=152.65.222.0/23 list=YouTube\r
+add address=152.65.224.0/19 list=YouTube\r
+add address=162.120.128.0/17 list=YouTube\r
+add address=162.216.148.0/22 list=YouTube\r
+add address=162.222.176.0/21 list=YouTube\r
+add address=172.110.32.0/21 list=YouTube\r
+add address=172.217.0.0/16 list=YouTube\r
+add address=172.253.0.0/16 list=YouTube\r
+add address=173.194.0.0/16 list=YouTube\r
+add address=173.255.112.0/20 list=YouTube\r
+add address=192.158.28.0/22 list=YouTube\r
+add address=192.178.0.0/15 list=YouTube\r
+add address=193.186.4.0/24 list=YouTube\r
+add address=199.36.154.0/23 list=YouTube\r
+add address=199.36.156.0/24 list=YouTube\r
+add address=199.192.112.0/22 list=YouTube\r
+add address=199.223.232.0/21 list=YouTube\r
+add address=207.223.160.0/20 list=YouTube\r
+add address=208.65.152.0/22 list=YouTube\r
+add address=208.68.108.0/22 list=YouTube\r
+add address=208.81.188.0/22 list=YouTube\r
+add address=208.117.224.0/19 list=YouTube\r
+add address=209.85.128.0/17 list=YouTube\r
+add address=216.58.192.0/19 list=YouTube\r
+add address=216.73.80.0/20 list=YouTube\r
+add address=216.239.32.0/19 list=YouTube\r
+add address=2ip.ru list=Test\r
+add address=157.240.247.174 list=Instagram\r
+add address=46.53.178.107 list=Instagram\r
+add address=179.60.195.174 list=Instagram\r
+add address=157.240.205.174 list=Instagram\r
+add address=31.13.24.0/21 list=Instagram\r
+add address=31.13.64.0/18 list=Instagram\r
+add address=45.64.40.0/22 list=Instagram\r
+add address=66.220.144.0/20 list=Instagram\r
+add address=69.63.176.0/20 list=Instagram\r
+add address=69.171.224.0/19 list=Instagram\r
+add address=74.119.76.0/22 list=Instagram\r
+add address=103.4.96.0/22 list=Instagram\r
+add address=129.134.0.0/16 list=Instagram\r
+add address=157.240.0.0/16 list=Instagram\r
+add address=173.252.64.0/18 list=Instagram\r
+add address=179.60.192.0/22 list=Instagram\r
+add address=185.60.216.0/22 list=Instagram\r
+add address=204.15.20.0/22 list=Instagram\r
+add address=157.240.200.63 list=Instagram\r
+add address=185.60.219.63 list=Instagram\r
+add address=129.134.31.12 list=Instagram\r
+add address=66.81.203.132 list=Instagram\r
+add address=185.89.218.12 list=Instagram\r
+add address=31.13.66.63 list=Instagram\r
+add address=84.15.65.162 list=Instagram\r
+add address=68.66.224.28 list=Instagram\r
+add address=157.240.253.63 list=Instagram\r
+add address=83.174.11.224 list=Instagram\r
+add address=157.240.9.52 list=Instagram\r
+add address=157.240.252.174 list=Instagram\r
+add address=157.240.195.63 list=Instagram\r
+add address=31.13.71.52 list=Instagram\r
+add address=57.144.110.192 list=Instagram\r
+add address=157.240.252.17 list=Instagram\r
+add address=84.15.66.97 list=Instagram\r
+add address=217.168.6.33 list=Instagram\r
+add address=31.13.83.52 list=Instagram\r
+add address=157.240.241.63 list=Instagram\r
+add address=129.134.30.12 list=Instagram\r
+add address=185.89.219.12 list=Instagram\r
+add address=157.240.252.10 list=Instagram\r
+add address=157.240.201.63 list=Instagram\r
+add address=66.81.203.197 list=Instagram\r
+add address=179.60.195.52 list=Instagram\r
+add address=66.81.203.7 list=Instagram\r
+add address=216.40.34.41 list=Instagram\r
+add address=157.240.202.63 list=Instagram\r
+add address=157.240.229.63 list=Instagram\r
+add address=157.240.252.63 list=Instagram\r
+add address=31.13.72.53 list=Instagram\r
+add address=124.108.16.224 list=Instagram\r
+add address=157.240.205.63 list=Instagram\r
+add address=92.46.37.96 list=Instagram\r
+add address=157.240.247.63 list=Instagram\r
+add address=157.240.234.63 list=Instagram\r
+add address=157.240.235.63 list=Instagram\r
+add address=87.245.208.97 list=Instagram\r
+add address=216.58.192.0/19 list=Instagram\r
+add address=209.85.128.0/17 list=Instagram\r
+add address=198.105.240.0/20 list=Instagram\r
+add address=173.194.0.0/16 list=Instagram\r
+add address=172.217.0.0/16 list=Instagram\r
+add address=142.250.0.0/15 list=Instagram\r
+add address=108.177.0.0/17 list=Instagram\r
+add address=87.245.197.140 list=Instagram\r
+add address=74.125.0.0/16 list=Instagram\r
+add address=64.233.160.0/19 list=Instagram\r
+add address=157.240.0.1 list=Instagram\r
+add address=157.240.238.63 list=Instagram\r
+add address=157.240.238.174 list=Instagram\r
+add address=157.240.0.63 list=Instagram\r
+add address=157.240.224.63 list=Instagram\r
+add address=157.240.224.174 list=Instagram\r
+add address=157.240.251.36 list=Instagram\r
+add address=157.240.253.12 list=Instagram\r
+add address=157.240.253.35 list=Instagram\r
+add address=157.240.238.13 list=Instagram\r
+add address=157.240.238.56 list=Instagram\r
+add address=157.240.238.175 list=Instagram\r
+add address=57.144.112.141 list=Instagram\r
+add address=157.240.251.60 list=Instagram\r
+add address=157.240.251.128 list=Instagram\r
+add address=157.240.238.5 list=Instagram\r
+add address=157.240.253.13 list=Instagram\r
+add address=157.240.253.5 list=Instagram\r
+add address=157.240.238.2 list=Instagram\r
+add address=157.240.238.37 list=Instagram\r
+add address=157.240.251.5 list=Instagram\r
+add address=157.240.251.34 list=Instagram\r
+add address=57.144.112.1 list=Instagram\r
+add address=157.240.238.54 list=Instagram\r
+add address=129.134.26.123 list=Instagram\r
+add address=157.240.252.3 list=Instagram\r
+add address=31.13.84.4 list=Instagram\r
+add address=157.240.224.12 list=Instagram\r
+add address=157.240.238.4 list=Instagram\r
+add address=157.240.0.13 list=Instagram\r
+add address=3.33.139.32 list=Instagram\r
+add address=157.240.0.35 list=Instagram\r
+add address=157.240.238.14 list=Instagram\r
+add address=157.240.238.60 list=Instagram\r
+add address=57.144.112.145 list=Instagram\r
+add address=157.240.251.35 list=Instagram\r
+add address=151.101.84.159 list=Twitter\r
+add address=pbs.twimg.com list=Twitter\r
+add address=89.110.101.17 comment=VDSIna list=TRUSTED\r
+add address=10.8.0.0/24 comment="WG VDSIna" list=TRUSTED\r
+add address=ikus.pesc.ru comment=ikus.pesc.ru list=NoVdsina\r
+add address=love.ru comment=love.ru list=NoVdsina\r
+add address=gosuslugi.ru comment=gosuslugi.ru list=NoVdsina\r
+add address=pochta.ru comment=pochta.ru list=NoVdsina\r
+add address=vdsina.com list=NoVdsina\r
+add address=vdsina.ru list=NoVdsina\r
+add address=youla.ru list=NoVdsina\r
+add address=kupiprodai.ru list=NoVdsina\r
+add address=myip.ru list=Test\r
+add address=geoip.co list=NoVdsina\r
+add address=x.com list=Twitter\r
+add address=facebook.com list=facebook\r
+add address=fbcd.net list=facebook\r
+add address=comp-lenta.ru list=NoVdsina\r
+add address=128.85.102.70 comment=update.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=wu-b-net.trafficmanager.net. comment=\\r
+ ctldl.windowsupdate.com.delivery.microsoft.com list=windowsupdateslist\r
+add address=ctldl.windowsupdate.com.delivery.microsoft.com. comment=\\r
+ ctldl.windowsupdate.com list=windowsupdateslist\r
+add address=redir.update.msft.com.trafficmanager.net. comment=\\r
+ update.microsoft.com list=windowsupdateslist\r
+add address=geo.prod.do.dsp.trafficmanager.net. comment=\\r
+ geo.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=13.74.139.29 comment=array605.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=kv801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ kv801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=e12437.d.akamaiedge.net. comment=\\r
+ kv801.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=displaycatalog-rp.md.mp.microsoft.com.akadns.net. comment=\\r
+ displaycatalog.mp.microsoft.com list=windowsupdateslist\r
+add address=rp-consumer-prod-displaycatalog-geomap.trafficmanager.net. \\r
+ comment=displaycatalog-rp.md.mp.microsoft.com.akadns.net list=\\r
+ windowsupdateslist\r
+add address=sls.update.microsoft.com. comment=slscr.update.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=glb.sls.prod.dcat.dsp.trafficmanager.net. comment=\\r
+ sls.update.microsoft.com list=windowsupdateslist\r
+add address=fe3.delivery.mp.microsoft.com. comment=\\r
+ fe3cr.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=glb.cws.prod.dcat.dsp.trafficmanager.net. comment=\\r
+ fe3.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=fe2cr.update.msft.com.trafficmanager.net. comment=\\r
+ fe2cr.update.microsoft.com list=windowsupdateslist\r
+add address=download.windowsupdate.com.delivery.microsoft.com. comment=\\r
+ download.windowsupdate.com list=windowsupdateslist\r
+add address=wu-f-net.trafficmanager.net. comment=\\r
+ download.windowsupdate.com.delivery.microsoft.com list=windowsupdateslist\r
+add address=tsfe.trafficmanager.net. comment=\\r
+ tsfe.trafficshaping.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com. \\r
+ comment=9.au.download.windowsupdate.com list=windowsupdateslist\r
+add address=52.158.227.125 comment=array812.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=au.download.windowsupdate.com.delivery.microsoft.com. comment=\\r
+ au.download.windowsupdate.com list=windowsupdateslist\r
+add address=a767.dspw65.akamai.net. comment=\\r
+ download.windowsupdate.com.edgesuite.net list=windowsupdateslist\r
+add address=52.151.58.88 comment=array810.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net. \\r
+ comment=licensing.mp.microsoft.com list=windowsupdateslist\r
+add address=licensing-prod-frontdoor-geomap.trafficmanager.net. comment=\\r
+ consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net list=\\r
+ windowsupdateslist\r
+add address=star.f.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedge.f.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=cdp-f-nlu-net.trafficmanager.net. comment=\\r
+ star.f.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedge.b.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=cdp-f-tlu-net.trafficmanager.net. comment=\\r
+ star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=storeedgefd.xbetservices.akadns.net. comment=\\r
+ storeedgefd.dsx.mp.microsoft.com list=windowsupdateslist\r
+add address=\\r
+ storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net. \\r
+ comment=storeedgefd.dsx.mp.microsoft.com.edgekey.net list=\\r
+ windowsupdateslist\r
+add address=e16646.dscg.akamaiedge.net. comment=\\r
+ storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net list=\\r
+ windowsupdateslist\r
+add address=40.69.76.189 comment=array621.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=bg.microsoft.map.fastly.net. comment=\\r
+ 3.au.download.windowsupdate.com list=windowsupdateslist\r
+add list=windowsupdateslist\r
+add address=40.69.75.33 comment=array613.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=cdp-f-ssl-tlu-net.trafficmanager.net. comment=\\r
+ star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=a2033.dscd.akamai.net. comment=\\r
+ star.sb.tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=\\r
+ windowsupdateslist\r
+add address=13.74.138.242 comment=array602.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=dl.delivery.mp.microsoft.com.delivery.microsoft.com. comment=\\r
+ dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=dcat-f-nlu-net.trafficmanager.net. comment=\\r
+ dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=1d.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=1D.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=dcat-b-tlu-net.trafficmanager.net. comment=\\r
+ 1d.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=a122.dscg3.akamai.net. comment=\\r
+ tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=windowsupdateslist\r
+add address=geover.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ geover.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=e10370.d.akamaiedge.net. comment=\\r
+ geover.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=52.232.182.21 comment=array511.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.70.77.95 comment=array519.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=a1683.dscd.akamai.net. comment=\\r
+ dl.delivery.mp.microsoft.com-c.edgesuite.net list=windowsupdateslist\r
+add address=consumer-collections-aks2eap.md.mp.microsoft.com.akadns.net. \\r
+ comment=collections.mp.microsoft.com list=windowsupdateslist\r
+add address=a1847.dscd.akamai.net. comment=\\r
+ wildcard.f.tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=\\r
+ windowsupdateslist\r
+add address=13.74.142.6 comment=array607.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=au.download.windowsupdate.com.edgesuite.net. comment=\\r
+ 2.au.download.windowsupdate.com list=windowsupdateslist\r
+add address=a767.dscg3.akamai.net. comment=\\r
+ au.download.windowsupdate.com.edgesuite.net list=windowsupdateslist\r
+add address=52.156.123.84 comment=array818.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.78.254 comment=array610.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=4.au.download.windowsupdate.com.delivery.microsoft.com. comment=\\r
+ 4.au.download.windowsupdate.com list=windowsupdateslist\r
+add address=cl-glcb907925.gcdn.co. comment=\\r
+ 4.au.download.windowsupdate.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.167.111 comment=array510.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=40.69.70.43 comment=array623.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=tsfe.trafficshaping.dsp.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=tsfe.trafficshaping.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=ts-frontend.trafficmanager.net. comment=\\r
+ tsfe.trafficshaping.dsp.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.75.248 comment=array616.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.74.84 comment=array615.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=sds.trafficmanager.net. comment=software-download.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=40.69.74.80 comment=array611.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.175.242.182 comment=array804.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=dlc-shim.trafficmanager.net. comment=download.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=e12671.dscd.akamaiedge.net. comment=\\r
+ download.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=20.187.55.34 comment=array808.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.167.231 comment=array513.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=52.167.222.13 comment=array518.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=kv601.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ kv601.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=e12358.d.akamaiedge.net. comment=\\r
+ kv601.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. comment=\\r
+ tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=dcat-f-tlu-net.trafficmanager.net. comment=\\r
+ tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=a1856.dspw65.akamai.net. comment=\\r
+ tlu.dl.delivery.mp.microsoft.com-c.edgesuite.net list=windowsupdateslist\r
+add address=52.167.164.252 comment=array506.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=13.74.137.54 comment=array601.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=kv501.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ kv501.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=collections-prod-frontdoor-geomap.trafficmanager.net. comment=\\r
+ consumer-collections-aks2eap.md.mp.microsoft.com.akadns.net list=\\r
+ windowsupdateslist\r
+add address=52.167.160.173 comment=array509.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=40.70.77.148 comment=array516.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.200.126 comment=array507.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=52.167.167.59 comment=array508.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.76.172 comment=array620.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=82.202.162.184 comment=comp-lenta.ru list=NoWG\r
+add address=smtp.mail.me.com.akadns.net. comment=smtp.mail.me.com list=NoWG\r
+add address=17.57.155.37 comment=smtp.mail.me.com.akadns.net list=NoWG\r
+add address=smtp.mail.me.com comment=smtp.mail.me.com list=NoVdsina\r
+add address=40.70.76.5 comment=array514.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.186.119 comment=array618.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.177.176.186 comment=array520.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=40.70.76.27 comment=array515.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.160.43 comment=array503.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.110 comment=array817.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.142.8 comment=array614.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.138.254 comment=array603.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.167.96 comment=array501.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.76.215 comment=array622.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.143.200 comment=array606.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.111 comment=array818.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.112 comment=array819.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.137.53 comment=array608.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.98 comment=array805.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.96 comment=array803.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.104 comment=array811.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.101 comment=array808.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.99 comment=array806.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.17 comment=array802.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.97 comment=array804.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.103 comment=array810.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.16 comment=array801.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.70.77.177 comment=array517.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.164.84 comment=array512.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.105 comment=array812.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.107 comment=array814.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.232.161.82 comment=array502.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.108 comment=array815.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.161.91 comment=array505.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.102 comment=array809.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.109 comment=array816.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.106 comment=array813.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.117 comment=array622.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.107 comment=array612.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.108 comment=array613.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.105 comment=array610.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.113 comment=array618.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.116 comment=array621.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.98 comment=array603.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.114 comment=array619.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.111 comment=array616.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.97 comment=array602.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.106 comment=array611.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.110 comment=array615.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.119 comment=array624.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.135 comment=array514.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.97 comment=array503.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.99 comment=array604.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.61 comment=array504.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.131 comment=array510.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.132 comment=array511.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.96 comment=array601.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.104 comment=array609.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.138 comment=array517.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.60 comment=array501.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.139 comment=array518.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.118 comment=array623.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.113 comment=array820.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.103 comment=array608.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.100 comment=array807.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.129 comment=array508.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.134 comment=array513.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.62 comment=array505.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.137 comment=array516.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.101 comment=array606.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.96 comment=array502.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.130 comment=array509.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.112 comment=array617.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.100 comment=array605.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.115 comment=array620.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.136 comment=array515.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=purchase.md.mp.microsoft.com.akadns.net. comment=\\r
+ purchase.mp.microsoft.com list=windowsupdateslist\r
+add address=e110219.a.akamaiedge.net. comment=\\r
+ purchase.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=72.153.5.140 comment=array519.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.141 list=windowsupdateslist\r
+add address=72.153.5.63 comment=array506.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.128 comment=array507.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.102 comment=array607.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=storesdk.xbetservices.akadns.net. comment=\\r
+ storesdk.dsx.mp.microsoft.com list=windowsupdateslist\r
+add address=e16646.g.akamaiedge.net. comment=\\r
+ storesdk.dsx.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=software-download.microsoft.com.delivery.microsoft.com. comment=\\r
+ software-download.microsoft.com list=windowsupdateslist\r
+add address=download.prss.microsoft.com.akamaized.net. comment=\\r
+ software-download.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.109 comment=array614.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.133 comment=array512.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=213.180.192.0/19 comment=YandexDisk list=NoVdsina\r
+add address=87.250.250.50 comment=YandexDisk list=NoVdsina\r
+add address=consumer-prod-bcfd-v7-afd.trafficmanager.net. comment=\\r
+ displaycatalog.mp.microsoft.com list=windowsupdateslist\r
+add address=purchase-europeeap.md.mp.microsoft.com.akadns.net. comment=\\r
+ purchase.md.mp.microsoft.com.akadns.net list=windowsupdateslist\r
+add address=ne-az-conspurchase-mp.trafficmanager.net. comment=\\r
+ purchase-europeeap.md.mp.microsoft.com.akadns.net list=windowsupdateslist\r
+add address=storeedgefd.dsx.mp.microsoft.com.edgekey.net. comment=\\r
+ cdn.storeedgefd.dsx.mp.microsoft.com list=windowsupdateslist\r
+add address=star.f.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedge.f.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=a1996.dscd.akamai.net. comment=\\r
+ wildcard.f.dl.delivery.mp.microsoft.com.edgesuite.net list=\\r
+ windowsupdateslist\r
+add address=cp801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ cp801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=glb.tas02.sls-prod.dcat.dsp.mp.microsoft.com. comment=\\r
+ tas02.sls.update.microsoft.com list=windowsupdateslist\r
+add address=cp601.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ cp601.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=star.sb.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedgeextensions.sb.tlu.dl.delivery.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=star.sf.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedge.sf.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=cdp-f-ssl-nlu-net.trafficmanager.net. comment=\\r
+ star.sf.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=tm-pifd-prod-gbl-weight.trafficmanager.net. comment=\\r
+ paymentinstruments.mp.microsoft.com list=windowsupdateslist\r
+add address=10.30.30.33 comment=amster-nuc disabled=yes list=NoWG\r
+add address=10.30.30.11 comment=MikroNUC list=NoWG\r
+add address=89.110.101.17 comment=!!!VDSINA!!!! list=NoWG\r
+add address=89.110.101.17 list=VPN-Server\r
+add address=80.85.244.9 list=TRUSTED\r
+add address=8.8.8.8 list=TRUSTED\r
+add address=8.8.4.4 list=TRUSTED\r
+add address=disc801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ disc801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=10.30.30.95 comment=NUC list=NoWG\r
+add address=glb.tas02.cws-prod.dcat.dsp.mp.microsoft.com. comment=\\r
+ tas02.cws.update.microsoft.com list=windowsupdateslist\r
+add address=glb.cwsapp.prod.dcat.dsp.trafficmanager.net. comment=\\r
+ glb.tas01.cwsapp-prod.dcat.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=glb.tas01.cwsapp-prod.dcat.dsp.mp.microsoft.com. comment=\\r
+ tas01.cwsapp.update.microsoft.com list=windowsupdateslist\r
+add address=disc601.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ disc601.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+/ip firewall filter\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=12h chain=input comment="block honeypot DNS" \\r
+ connection-state=new dst-port=53 in-interface="ether1 - Unet" protocol=\\r
+ udp\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=4w2d chain=input connection-state=new dst-port=53 \\r
+ in-interface="ether1 - Unet" protocol=tcp\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=4w2d chain=input comment=\\r
+ "block honeypot ssh rdp winbox" connection-state=new dst-port=\\r
+ 22,8291,2222 in-interface="ether1 - Unet" protocol=tcp src-address-list=\\r
+ !TRUSTED\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=4w2d chain=input comment="block honeypot asterisk" \\r
+ connection-state=new dst-port=5060 in-interface="ether1 - Unet" protocol=\\r
+ udp\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=5d chain=input comment="block honeypot NTP" \\r
+ connection-state=new dst-port=123 in-interface="ether1 - Unet" protocol=\\r
+ udp src-address=!10.30.30.0/24\r
+add action=accept chain=input comment=\\r
+ "accept NTP clients on local area network" dst-port=123 in-interface=\\r
+ Bridge-LAN in-interface-list=LAN protocol=udp\r
+add action=accept chain=input comment="accept WireGuard" dst-port=13231 \\r
+ in-interface="ether1 - Unet" protocol=udp src-address-list=VPN-Server\r
+add action=accept chain=input disabled=yes dst-port=443 in-interface=\\r
+ "ether1 - Unet" protocol=tcp\r
+add action=accept chain=output disabled=yes protocol=tcp src-port=443\r
+add action=fasttrack-connection chain=forward comment=\\r
+ "FastTrack for non-VPN connections" connection-mark=!VPN_No_FastTrack \\r
+ connection-state=established,related,new disabled=yes\r
+add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \\r
+ connection-state=established,related,new disabled=yes routing-mark=\\r
+ !To-VPN\r
+add action=accept chain=input comment=\\r
+ "defconf: accept established,related,untracked" connection-state=\\r
+ established,related,untracked\r
+add action=drop chain=input comment="defconf: drop invalid" connection-state=\\r
+ invalid\r
+add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \\r
+ protocol=icmp\r
+add action=accept chain=input comment=\\r
+ "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \\r
+ dst-address=127.0.0.1\r
+add action=accept chain=output disabled=yes src-address=127.0.0.1\r
+add action=accept chain=forward comment="defconf: accept in ipsec policy" \\r
+ ipsec-policy=in,ipsec\r
+add action=accept chain=forward comment="defconf: accept out ipsec policy" \\r
+ ipsec-policy=out,ipsec\r
+add action=accept chain=forward comment=\\r
+ "defconf: accept established,related, untracked" connection-state=\\r
+ established,related,untracked\r
+add action=drop chain=forward comment="defconf: drop invalid" \\r
+ connection-state=invalid disabled=yes\r
+add action=drop chain=forward comment=\\r
+ "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \\r
+ connection-state=new in-interface="ether1 - Unet"\r
+add action=accept chain=input connection-state=established disabled=yes\r
+add action=accept chain=input connection-state=related disabled=yes\r
+add action=drop chain=input disabled=yes in-interface-list=!LAN\r
+add action=drop chain=forward comment=\\r
+ "Filter Rule to block FB address LIST : )" disabled=yes dst-address-list=\\r
+ facebook\r
+add action=drop chain=forward comment=\\r
+ "Filter Rule to block YOUTUBE address LIST : )" disabled=yes \\r
+ dst-address-list=YouTube\r
+add action=fasttrack-connection chain=forward comment=\\r
+ "FastTrack main traffic" connection-state=established,related disabled=\\r
+ yes\r
+/ip firewall mangle\r
+add action=mark-connection chain=prerouting comment=\\r
+ "Mark VPN connections to exclude from FastTrack" in-interface=WG \\r
+ log-prefix=Mark-VPN-FT new-connection-mark=VPN_No_FastTrack\r
+add action=mark-routing chain=prerouting comment="Test sites" disabled=yes \\r
+ dst-address=!10.30.30.0/24 dst-address-list=Test new-routing-mark=To-VPN \\r
+ passthrough=no src-address=10.30.30.0/24\r
+add action=mark-routing chain=prerouting comment=Instagram dst-address=\\r
+ !10.30.30.0/24 dst-address-list=Instagram new-routing-mark=To-VPN \\r
+ src-address=10.30.30.0/24 src-address-list=!NoWG\r
+add action=mark-routing chain=prerouting comment=Twitter dst-address=\\r
+ !10.30.30.0/24 dst-address-list=Twitter new-routing-mark=To-VPN \\r
+ src-address=10.30.30.0/24 src-address-list=!NoWG\r
+add action=mark-routing chain=prerouting comment=YouTube dst-address=\\r
+ !10.30.30.0/24 dst-address-list=YouTube new-routing-mark=To-VPN \\r
+ src-address=10.30.30.0/24 src-address-list=!NoWG\r
+add action=mark-routing chain=prerouting comment=facebook dst-address=\\r
+ !10.30.30.0/24 dst-address-list=facebook new-routing-mark=To-VPN \\r
+ src-address=10.30.30.0/24 src-address-list=!NoWG\r
+add action=mark-routing chain=prerouting comment="VDSIna for All sites" \\r
+ dst-address=!10.30.30.0/24 dst-address-list=!NoVdsina log-prefix=VPN-all \\r
+ new-routing-mark=To-VPN src-address=10.30.30.0/24 src-address-list=!NoWG\r
+add action=change-mss chain=forward comment="MSS on WG" new-mss=1380 \\r
+ out-interface=WG protocol=tcp tcp-flags=syn tcp-mss=1381-65535\r
+add action=mark-routing chain=prerouting comment="VPN Network" dst-address=\\r
+ 10.8.0.0/24 dst-address-list=!NoVdsina log=yes log-prefix=VPN-Net \\r
+ new-routing-mark=To-VPN src-address=10.30.30.0/24 src-address-list=!NoWG\r
+/ip firewall nat\r
+add action=redirect chain=dstnat comment=\\r
+ "FORCE DNS TO LOCAL MIKROTIK DNS SERVER" dst-port=53 protocol=tcp \\r
+ src-address=10.30.30.0/24 to-ports=53\r
+add action=redirect chain=dstnat dst-port=53 protocol=udp src-address=\\r
+ 10.30.30.0/24 to-ports=53\r
+add action=masquerade chain=srcnat comment="masquerade Default" ipsec-policy=\\r
+ out,none out-interface="ether1 - Unet" routing-mark=!To-VPN\r
+add action=masquerade chain=srcnat comment=WG dst-address-list=!NoVdsina \\r
+ in-interface=Bridge-LAN log-prefix=WG-nat out-interface=WG routing-mark=\\r
+ To-VPN\r
+add action=dst-nat chain=dstnat comment=npm disabled=yes dst-port=81 \\r
+ in-interface="ether1 - Unet" protocol=tcp to-addresses=10.30.30.33 \\r
+ to-ports=81\r
+add action=dst-nat chain=dstnat comment=amster.vados.ruhttps disabled=yes \\r
+ dst-port=443 in-interface="ether1 - Unet" protocol=tcp to-addresses=\\r
+ 10.30.30.33 to-ports=443\r
+add action=dst-nat chain=dstnat comment="amster.vados.ru For Certbot HTTP" \\r
+ disabled=yes dst-port=80 in-interface="ether1 - Unet" protocol=tcp \\r
+ to-addresses=10.30.30.33 to-ports=80\r
+add action=dst-nat chain=dstnat disabled=yes dst-port=80 in-interface=\\r
+ "ether1 - Unet" protocol=tcp to-addresses=10.30.30.33 to-ports=80\r
+add action=dst-nat chain=dstnat comment="Yandex.DNS Family" disabled=yes \\r
+ dst-port=53 in-interface=Bridge-LAN protocol=udp src-address-list=KIDS \\r
+ time=6h-15m,sun,mon,tue,wed,thu,fri,sat to-addresses=77.88.8.3\r
+add action=dst-nat chain=dstnat disabled=yes dst-port=53 in-interface=\\r
+ Bridge-LAN protocol=tcp src-address-list=KIDS time=\\r
+ 6h-15m,sun,mon,tue,wed,thu,fri,sat to-addresses=77.88.8.3\r
+add action=dst-nat chain=dstnat dst-address=146.120.64.211 dst-port=32000 \\r
+ in-interface="ether1 - Unet" protocol=tcp to-addresses=10.30.30.95 \\r
+ to-ports=32000\r
+add action=dst-nat chain=dstnat dst-address=146.120.64.211 dst-port=32000 \\r
+ in-interface="ether1 - Unet" protocol=udp to-addresses=10.30.30.95 \\r
+ to-ports=32000\r
+add action=dst-nat chain=dstnat dst-port=32000 protocol=tcp routing-mark=\\r
+ To-VPN to-addresses=10.30.30.95 to-ports=32000\r
+add action=dst-nat chain=dstnat dst-port=32000 protocol=udp routing-mark=\\r
+ To-VPN to-addresses=10.30.30.95 to-ports=32000\r
+/ip firewall raw\r
+add action=drop chain=prerouting comment="Drop Honeypot Hackers" \\r
+ in-interface="ether1 - Unet" src-address-list="Honeypot Hacker"\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=\\r
+ extras.getpagespeed.com content=extras.getpagespeed.com disabled=yes\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=linux.duke.edu \\r
+ content=linux.duke.edu disabled=yes\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=vk.com \\r
+ content=vk.com\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=ok.ru content=\\r
+ ok.ru\r
+add action=add-dst-to-address-list address-list=Instagram \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=Instagram \\r
+ content=instagram.com\r
+add action=add-dst-to-address-list address-list=Twitter address-list-timeout=\\r
+ none-dynamic chain=prerouting comment=Twitter content=twimg.com\r
+add action=add-dst-to-address-list address-list=Twitter address-list-timeout=\\r
+ none-dynamic chain=prerouting content=x.com\r
+add action=add-dst-to-address-list address-list=Twitter address-list-timeout=\\r
+ none-dynamic chain=prerouting content=twitter.com\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting comment=YouTube content=youtube.com\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting content=googleapis.com\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting content=ggpht.com\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting content=youtu.be\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting content=ytimg.com\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting content=googlevideo.com\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting content=gstatic.com\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting content=googleusercontent.com\r
+add action=add-dst-to-address-list address-list=YouTube address-list-timeout=\\r
+ none-dynamic chain=prerouting content=nhacmp3youtube.com\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=rutube.ru \\r
+ content=rutube.ru\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=me.com \\r
+ content=me.com\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=icloud.com \\r
+ content=icloud.com\r
+add action=add-dst-to-address-list address-list=facebook \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=facebook \\r
+ content=fbcd.net\r
+add action=add-dst-to-address-list address-list=facebook \\r
+ address-list-timeout=none-dynamic chain=prerouting content=facebook.com\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=comp-lenta.ru \\r
+ content=comp-lenta.ru\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=\\r
+ smtp.mail.me.com content=smtp.mail.me.com log=yes\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=gov.ru \\r
+ content=gov.ru\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=\\r
+ r78.fssp.gov.ru content=r78.fssp.gov.ru\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=api.db-ip.com \\r
+ content=api.db-ip.com\r
+add action=add-dst-to-address-list address-list=NoVdsina \\r
+ address-list-timeout=none-dynamic chain=prerouting comment=\\r
+ api.telegram.org content=api.telegram.org\r
+/ip firewall service-port\r
+set ftp disabled=yes\r
+set tftp disabled=yes\r
+set irc disabled=no\r
+set sip disabled=yes\r
+set pptp disabled=yes\r
+set rtsp disabled=no\r
+/ip hotspot walled-garden\r
+add server=*1\r
+/ip ipsec settings\r
+set accounting=no\r
+/ip ipsec policy\r
+set 0 disabled=yes dst-address=0.0.0.0/0 src-address=0.0.0.0/0\r
+/ip ipsec profile\r
+set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5\r
+/ip proxy\r
+set cache-administrator="" max-cache-size=none port=80,443 src-address=\\r
+ 0.0.0.0\r
+/ip route\r
+add disabled=no distance=3 dst-address=192.168.0.0/24 gateway=l2tp-vpn\r
+add disabled=no distance=4 dst-address=192.168.5.0/24 gateway=l2tp-vpn\r
+add disabled=no distance=3 dst-address=192.168.0.0/24 gateway=l2tp-vpn\r
+add disabled=no distance=4 dst-address=192.168.5.0/24 gateway=l2tp-vpn\r
+add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=WG routing-table=\\r
+ To-VPN scope=30 target-scope=10\r
+add disabled=yes distance=2 dst-address=0.0.0.0/0 gateway=146.120.64.209 \\r
+ routing-table=main scope=30 target-scope=10\r
+/ip service\r
+set ftp disabled=yes\r
+set telnet disabled=yes\r
+set ssh address=10.30.30.0/24 port=2222\r
+set winbox address=10.30.30.0/24\r
+set api address=10.30.30.0/24 disabled=yes\r
+set api-ssl address=10.30.30.0/24\r
+set www-ssl port=18443\r
+set www address=10.30.30.0/24 disabled=yes port=18880\r
+/ip service webserver\r
+set acme-plain=no crl-plain=no graphs-plain=no graphs-secure=no index-plain=\\r
+ no index-secure=no rest-plain=no rest-secure=no scep-plain=no \\r
+ webfig-plain=no webfig-secure=no\r
+/ip ssh\r
+set forwarding-enabled=both publickey-authentication-options=verify-required \\r
+ strong-crypto=yes\r
+/ip upnp\r
+set enabled=yes\r
+/ip upnp interfaces\r
+add interface=Bridge-LAN type=internal\r
+add interface="ether1 - Unet" type=external\r
+/ipv6 firewall address-list\r
+add address=::/128 comment="defconf: unspecified address" list=bad_ipv6\r
+add address=::1/128 comment="defconf: lo" list=bad_ipv6\r
+add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6\r
+add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6\r
+add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6\r
+add address=100::/64 comment="defconf: discard only " list=bad_ipv6\r
+add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6\r
+add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6\r
+add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6\r
+/ipv6 firewall filter\r
+add action=add-src-to-address-list address-list=bad_ipv6 \\r
+ address-list-timeout=none-dynamic chain=input comment=\\r
+ "defconf: accept established,related,untracked" connection-state=\\r
+ established,related,untracked in-interface=WG in-interface-list=WAN \\r
+ src-address-list=""\r
+add action=drop chain=input comment="defconf: drop invalid" connection-state=\\r
+ invalid\r
+add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\\r
+ icmpv6\r
+add action=accept chain=input comment="defconf: accept UDP traceroute" \\r
+ dst-port=33434-33534 protocol=udp\r
+add action=accept chain=input comment=\\r
+ "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\\r
+ udp src-address=fe80::/10\r
+add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \\r
+ protocol=udp\r
+add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\\r
+ ipsec-ah\r
+add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\\r
+ ipsec-esp\r
+add action=accept chain=input comment=\\r
+ "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec\r
+add action=drop chain=input comment=\\r
+ "defconf: drop everything else not coming from LAN" in-interface-list=\\r
+ !LAN\r
+add action=accept chain=forward comment=\\r
+ "defconf: accept established,related,untracked" connection-state=\\r
+ established,related,untracked\r
+add action=drop chain=forward comment="defconf: drop invalid" \\r
+ connection-state=invalid\r
+add action=drop chain=forward comment=\\r
+ "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6\r
+add action=drop chain=forward comment=\\r
+ "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6\r
+add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \\r
+ hop-limit=equal:1 protocol=icmpv6\r
+add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\\r
+ icmpv6\r
+add action=accept chain=forward comment="defconf: accept HIP" protocol=139\r
+add action=accept chain=forward comment="defconf: accept IKE" dst-port=\\r
+ 500,4500 protocol=udp\r
+add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\\r
+ ipsec-ah\r
+add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\\r
+ ipsec-esp\r
+add action=accept chain=forward comment=\\r
+ "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec\r
+add action=drop chain=forward comment=\\r
+ "defconf: drop everything else not coming from LAN" in-interface-list=\\r
+ !LAN\r
+/ipv6 nd\r
+set [ find default=yes ] advertise-dns=yes\r
+/ppp secret\r
+add local-address=192.168.60.1 name=vados remote-address=192.168.60.2 \\r
+ service=l2tp\r
+/routing bfd configuration\r
+add disabled=no\r
+/snmp\r
+set contact=@AmsterNL enabled=yes engine-id-suffix=MikroMaster location=NL \\r
+ src-address=10.30.30.81 trap-interfaces=Bridge-LAN,WG trap-target=\\r
+ 10.30.30.10\r
+/system clock\r
+set time-zone-autodetect=no time-zone-name=Europe/Moscow\r
+/system clock manual\r
+set time-zone=+03:00\r
+/system identity\r
+set name=MikroMaster\r
+/system logging\r
+add action=email disabled=yes regex="* added|changed|removed *" topics=\\r
+ system,info\r
+/system ntp client\r
+set enabled=yes\r
+/system ntp server\r
+set enabled=yes manycast=yes multicast=yes use-local-clock=yes\r
+/system ntp client servers\r
+add address=0.ru.pool.ntp.org\r
+add address=1.ru.pool.ntp.org\r
+add address=2.ru.pool.ntp.org\r
+add address=3.ru.pool.ntp.org\r
+add address=time.google.com disabled=yes\r
+/system scheduler\r
+add comment="Windows Update script" interval=2d5m name=WU-script-run-schedule \\r
+ on-event=WU-add-to-list policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-date=2014-02-11 start-time=00:00:00\r
+add comment="Backup Every Week" disabled=yes interval=1w name=BackupEveryWeek \\r
+ on-event=BackupAndUpdate policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-date=2025-07-07 start-time=03:41:27\r
+add comment="DoH Cache Flush" interval=1d name="DNS Cache Flush" on-event=\\r
+ DNS_Flush_Cache policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-date=2019-12-06 start-time=05:30:00\r
+add comment="Create mkdir function on startup" name=\\r
+ create_mkdir_function_on_startup on-event=\\r
+ "/system script run create_mkdir_function;" policy=read,write,policy,test \\r
+ start-time=startup\r
+add comment="Scheduler for Update Certificates CloudFlare Quad9" interval=1w \\r
+ name="Update Certificates CloudFlare Quad9" on-event=\\r
+ "/system/script { run Update-Certificates; }" policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-date=2025-11-28 start-time=05:45:40\r
+add comment="Setup Global Environment for scripts" name=AM-SetGlobalEnv \\r
+ on-event="/system/script { run AM-GlobalConfig; run AM-GlobalFunc; }" \\r
+ policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-time=startup\r
+add comment="Every Day Check For Update Scripts" interval=1d name=\\r
+ AM-ScriptInstallUpdate on-event=\\r
+ ":global ScriptInstallUpdate; \$ScriptInstallUpdate;" policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-time=startup\r
+add comment="Every Day Check For Fake Bridges" interval=1d name=\\r
+ mod/AM-IPbridge on-event="/system/script/run mod/AM-IPbridge;" policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-time=startup\r
+add comment="Every Day Check For Renew Certificates" interval=1d name=\\r
+ AM-CheckCerts on-event="/system/script/run AM-CheckCerts;" policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-time=startup\r
+add comment="Auto-update Cloudflare Root CA for DoH" interval=2w name=\\r
+ AM-DOHCert on-event="/import AM-DOHCert.rsc" policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-date=2026-04-15 start-time=03:00:00\r
+/system watchdog\r
+set watchdog-timer=no\r
+/tool e-mail\r
+set certificate-verification=no from=MikroVados<vadossio@icloud.com> port=587 \\r
+ server=smtp.mail.me.com tls=starttls user=vadossio@icloud.com\r
+/tool mac-server\r
+set allowed-interface-list=LAN\r
+/tool mac-server mac-winbox\r
+set allowed-interface-list=LAN\r
+/tool netwatch\r
+add comment="doh, doh-url=https://security.cloudflare-dns.com/dns-query, notif\\r
+ y, name=CloudFlare-doh IPv4 1" disabled=yes down-script="" host=1.1.1.1 \\r
+ http-codes="" test-script="" type=simple up-script=""\r
+add check-certificate=no comment="doh-fallback, doh-url=https://security.cloud\\r
+ flare-dns.com/dns-query, doh-cert=DigiCert Global Root CA, notify, name=Cl\\r
+ oudFlare-doh IPv4" disabled=yes down-script="" host=1.0.0.1 http-codes="" \\r
+ port=443 test-script="" type=simple up-script=""\r
+add comment="dns-fallback, notify, name=Google-DNS IPv4" disabled=yes \\r
+ down-script="" host=8.8.8.8 http-codes="" test-script="" type=simple \\r
+ up-script=""\r
+add comment="doh-fallback, doh-url=https://dns.google/dns-query, doh-cert=GTS \\r
+ Root R1, notify, name=Google-DOH IPv4" disabled=yes down-script="" host=\\r
+ 8.8.4.4 http-codes="" test-script="" type=simple up-script=""\r
+add comment="dns, notify, name=Cuad9-DOH IPv4" disabled=yes down-script="" \\r
+ host=9.9.9.9 http-codes="" test-script="" type=simple up-script=""\r
+add comment="doh-fallback, doh-url=https://dns.quad9.net/dns-query, name=Cuad9\\r
+ -DOH IPv4" disabled=yes down-script="" host=149.112.112.112 http-codes="" \\r
+ test-script="" type=simple up-script=""\r
+add comment="dns-fallback, notify, name=ns1.unet.ws" disabled=yes \\r
+ down-script="" host=91.192.189.2 http-codes="" test-script="" type=simple \\r
+ up-script=""\r
+/tool sniffer\r
+set filter-interface=Bridge-LAN filter-src-ip-address=10.30.30.50/32\r
+/user aaa\r
+set accounting=no\r
git.vados.ru / Mikrotiks / backups.git / commitdiff
