From: vados-dev <192440777+vados-dev@users.noreply.github.com> Date: Sat, 2 May 2026 00:05:03 +0000 (+0300) Subject: Autocommit in repo: ros.vados.ru, generated by owner: root, in 03:05:02 02.05.2026. X-Git-Url: https://git.vados.ru/gitweb.cgi?a=commitdiff_plain;h=11e6cd2ffac715e00deeeb0a83ce9ca6266bd18a;p=Mikrotiks%2Fros.vados.ru.git Autocommit in repo: ros.vados.ru, generated by owner: root, in 03:05:02 02.05.2026. --- diff --git a/html/AM-GlobalFunc.rsc b/html/AM-GlobalFunc.rsc index 8b375760f..972a8d0ce 100644 --- a/html/AM-GlobalFunc.rsc +++ b/html/AM-GlobalFunc.rsc @@ -17,9 +17,9 @@ :global GlobalFuncReady false; # Git commit id & info, expected configuration version -:global CommitId "main/400/bdb022f2"; +:global CommitId "main/401/b55e8919"; :global CommitTAG "unknown"; -:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 02:40:03 02.05.2026."; +:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 03:05:02 02.05.2026."; # The variables are received right here. :global GlobalConfVersion 138; diff --git a/html/func-collection/git/MikroTik/DNS/adguardhome_container.rsc b/html/func-collection/git/MikroTik/DNS/adguardhome_container.rsc new file mode 100644 index 000000000..a372d3d92 --- /dev/null +++ b/html/func-collection/git/MikroTik/DNS/adguardhome_container.rsc @@ -0,0 +1,56 @@ +# adguard home to container | by @xdenb43 +# tested on hap ax3/RoS 7.17.2+ + +# enable containers, follow https://help.mikrotik.com/docs/spaces/ROS/pages/84901929/Container +/system/device-mode/update container=yes + +# MAIN PART STARTS HERE +/interface veth +add address=192.168.254.5/24 gateway=192.168.254.1 name=ADGUARD-HOME + +/interface bridge +add name=Bridge-Docker port-cost-mode=short +/interface bridge port +add bridge=Bridge-Docker interface=ADGUARD-HOME +/ip address +add address=192.168.254.1/24 interface=Bridge-Docker network=192.168.254.0 + +/ip firewall nat +add action=masquerade chain=srcnat comment=AdGuardHome src-address=192.168.254.5 + +# USB flash drive, FS ext4 +/container config +set ram-high=200.0MiB registry-url=https://registry-1.docker.io tmpdir=/usb1/docker/pull + +/container mounts +add dst=/opt/adguardhome/conf name=adguard_home_conf src=/usb1/docker_configs/adguard_home + +/container +add cmd="-c /opt/adguardhome/conf/AdGuardHome.yaml -h 0.0.0.0 -w /opt/adguardhome/work" entrypoint=/opt/adguardhome/AdGuardHome interface=ADGUARD-HOME logging=yes mounts=\ + adguard_home_conf root-dir=/usb1/docker/adguard_home workdir=/opt/adguardhome/work remote-image=adguard/adguardhome:latest + +/container/start [find where interface=ADGUARD-HOME] + +# ADH available on http://192.168.254.5:300 , configure before use +# Choose one of the options below +# uncomment lines before copying to terminal + +# OPTION 1 +# Just set AGH ip as DNS server. +# /!\ DNS FWD will work. +# /!\ No device-related stats will be gathered (all dns requests are coming from mikrotik) +#/ip dns +#set allow-remote-requests=yes servers=192.168.254.5 +#/ip firewall nat +#add action=redirect chain=dstnat comment="Incoming DNS redirect" dst-address-type=!local dst-port=53 in-interface-list=LAN protocol=udp +#add action=redirect chain=dstnat comment="Incoming DNS redirect" dst-address-type=!local dst-port=53 in-interface-list=LAN protocol=tcp + + +# OPTION 2 +# Forward all DNS requests to ADH +# /!\ DNS FWD will NOT work +# /!\ WILL SHOW stats for every LAN device +#/ip firewall nat +#add action=dst-nat chain=dstnat comment="local AdGuard udp - NO NAT Loopback / local addresses only!" dst-port=53 in-interface-list=LAN protocol=udp src-address=\ +# 192.168.88.0/24 to-addresses=192.168.254.5 to-ports=53 +#add action=dst-nat chain=dstnat comment="local AdGuard tcp" dst-port=53 in-interface-list=LAN protocol=tcp src-address=192.168.88.0/24 to-addresses=192.168.254.5 to-ports=53 diff --git a/html/func-collection/git/MikroTik/DNS/dnsForwarders.rsc b/html/func-collection/git/MikroTik/DNS/dnsForwarders.rsc new file mode 100644 index 000000000..6b292549f --- /dev/null +++ b/html/func-collection/git/MikroTik/DNS/dnsForwarders.rsc @@ -0,0 +1,18 @@ +# DNS Forwarders | by @xmrdenb43 +# tested on hap ac lite tc/hap ax3, RoS 7.18.2+ + +/ip dns static +add address=8.8.8.8 comment="DNS Google" name=dns.google type=A +add address=8.8.4.4 comment="DNS Google" name=dns.google type=A +add address=9.9.9.9 comment="DNS Quad9" name=dns.quad9.net type=A +add address=149.112.112.112 comment="DNS Quad9" name=dns.quad9.net type=A +add address=195.133.25.16 comment="DNS Comss" name=dns.comss.one type=A + +/ip dns forwarders +add doh-servers=https://cloudflare-dns.com/dns-query name="CloudFlare DoH" +add doh-servers=https://secure.cloudflare-dns.com/dns-query name="CloudFlare Secure DoH" +add disabled=yes doh-servers=https://dns.quad9.net/dns-query name="Quad9 Default" verify-doh-cert=no +add doh-servers=https://dns.google/dns-query name="Google DoH" +add dns-servers=dns.comss.one doh-servers=https://dns.comss.one/mikrotik name="Comss DoH" verify-doh-cert=no +add doh-servers=https://cloudflare-dns.com/dns-query,https://dns.google/dns-query name="CF & Google DoH" +add dns-servers=1.0.0.1,8.8.4.4,1.1.1.1,8.8.8.8,77.88.8.1,77.88.8.8 name="CF & G & Ya IPv4" verify-doh-cert=no diff --git a/html/func-collection/git/MikroTik/DNS/minimumDoHCertificates.rsc b/html/func-collection/git/MikroTik/DNS/minimumDoHCertificates.rsc new file mode 100644 index 000000000..c7f3b1354 --- /dev/null +++ b/html/func-collection/git/MikroTik/DNS/minimumDoHCertificates.rsc @@ -0,0 +1,37 @@ +# Import minimum cerificates to have several DOHs servers working +# by xdenb43 | tested on hap ac lite tc/hap ax3, RoS 7.17+ + +#CloudFlare +/tool fetch https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem +/certificate import file-name=DigiCertGlobalRootG2.crt.pem passphrase="" +#/ip dns set allow-remote-requests=yes use-doh-server=https://cloudflare-dns.com/dns-query verify-doh-cert=yes +#secure https://secure.cloudflare-dns.com/dns-query + +#Quad9 +/tool/fetch url=https://cacerts.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crt.pem +/certificate/import file-name=DigiCertGlobalG3TLSECCSHA3842020CA1-2.crt.pem +#/ip dns set allow-remote-requests=yes use-doh-server=https://dns.quad9.net/dns-query verify-doh-cert=yes + +#Google +/tool fetch url=https://i.pki.goog/r1.pem +/tool fetch url=https://i.pki.goog/r2.pem +/tool fetch url=https://i.pki.goog/r3.pem +/tool fetch url=https://i.pki.goog/r4.pem +/tool fetch url=https://i.pki.goog/gsr4.pem +/certificate/import file-name=r1.pem +/certificate/import file-name=r2.pem +/certificate/import file-name=r3.pem +/certificate/import file-name=r4.pem +/certificate/import file-name=gsr4.pem +#/ip dns set allow-remote-requests=yes use-doh-server=https://dns.google/dns-query verify-doh-cert=yes + +#COMSS - rename .crt to .pem!!! +#/tool/fetch url=https://www.tbs-x509.com/USERTrustRSACertificationAuthority.crt dst-path=USERTrustRSACertificationAuthority.crt.pem +/tool/fetch url=https://www.tbs-x509.com/USERTrustRSACertificationAuthority.crt +/certificate/import file-name=USERTrustRSACertificationAuthority.crt +#/ip dns set allow-remote-requests=yes use-doh-server=https://dns.comss.one/mikrotik verify-doh-cert=yes + + +#big list ~ 2Mb +#/tool fetch url=https://curl.se/ca/cacert.pem +#/certificate import file-name=cacert.pem passphrase="" diff --git a/html/func-collection/git/MikroTik/VPNs/vpnClientsConnectionFailoverResolution.rsc b/html/func-collection/git/MikroTik/VPNs/vpnClientsConnectionFailoverResolution.rsc new file mode 100644 index 000000000..f5110272a --- /dev/null +++ b/html/func-collection/git/MikroTik/VPNs/vpnClientsConnectionFailoverResolution.rsc @@ -0,0 +1,44 @@ +# VPN Clients connection failover resolution | by @xdenb43 +# tested on hap ac lite tc, RoS 7.18.2+ +# based on recursive routing and DNS FWD + mangle +# +# VPNs clients configured: +# wg-proton - Wireguard Proton +# wg-bth - Mikrotik Back-To-Home via relay +# wg-warp - CloudFlare Warp +# +# External servers used to check internet availability: +# 77.88.8.2 - Yandex secure DNS +# 1.1.1.3 - CF Family DNS +# +# Cheat by @wiktorbgu MUST be used to have WG working +# https://gist.github.com/wiktorbgu/1f2dfe99837d8f2803483be95814d2e5 + +# Addresses +/ip address +add address=10.2.0.2/24 interface=wg-proton network=10.2.0.0 +add address=172.16.0.2/24 interface=wg-warp network=172.16.0.0 +add address=192.168.216.4/24 interface=wg-bth network=192.168.216.0 + +# Routing tables +# any_vpn_out - used for ANY vpn connection +# geo_vpn_out - used to bypass GEO check +/routing table +add disabled=no fib name=any_vpn_out +add disabled=no fib name=geo_vpn_out + +# Routes with priorities +# Target Scope for recursive route MUST be greater than next hope route targetr scope value +/ip route +add comment="proton recursive routing" disabled=no distance=21 dst-address=0.0.0.0/0 gateway=77.88.8.2 routing-table=any_vpn_out scope=30 suppress-hw-offload=no \ + target-scope=11 +add comment="proton recursive routing" disabled=no distance=20 dst-address=0.0.0.0/0 gateway=77.88.8.2 routing-table=geo_vpn_out scope=30 suppress-hw-offload=no \ + target-scope=11 +add comment="warp recursive routing" disabled=no distance=20 dst-address=0.0.0.0/0 gateway=1.1.1.3 routing-table=any_vpn_out scope=30 suppress-hw-offload=no \ + target-scope=11 +add comment=bth disabled=no distance=21 dst-address=0.0.0.0/0 gateway=192.168.216.1 routing-table=geo_vpn_out scope=30 suppress-hw-offload=no target-scope=10 +add comment=bth disabled=no distance=22 dst-address=0.0.0.0/0 gateway=192.168.216.1 routing-table=any_vpn_out scope=30 suppress-hw-offload=no target-scope=10 +add check-gateway=ping comment="proton monitor external ip" disabled=no distance=20 dst-address=77.88.8.2/32 gateway=10.2.0.1 routing-table=main scope=10 \ + suppress-hw-offload=no target-scope=10 +add check-gateway=ping comment="warp monitor external ip" disabled=no distance=20 dst-address=1.1.1.3/32 gateway=172.16.0.1 routing-table=main scope=10 \ + suppress-hw-offload=no target-scope=10