From: vados-dev Date: Mon, 17 Aug 2026 08:00:07 +0000 (+0300) Subject: Backup for MikroMaster created successfully at Aug 17 11:00:07. X-Git-Url: https://git.vados.ru/gitweb.cgi?a=commitdiff_plain;h=80ac8e969e1c537c13c85c689036bc28790e6506;p=Mikrotiks%2Fbackups.git Backup for MikroMaster created successfully at Aug 17 11:00:07. --- diff --git a/MikroMaster/20260817/20260817110002-Binary.backup b/MikroMaster/20260817/20260817110002-Binary.backup new file mode 100644 index 0000000..e420086 Binary files /dev/null and b/MikroMaster/20260817/20260817110002-Binary.backup differ diff --git a/MikroMaster/20260817/20260817110002-Config.rsc b/MikroMaster/20260817/20260817110002-Config.rsc new file mode 100644 index 0000000..9a9459e --- /dev/null +++ b/MikroMaster/20260817/20260817110002-Config.rsc @@ -0,0 +1,1364 @@ +# 2026-08-17 11:00:03 by RouterOS 7.23.3 +# software id = 2961-C4ZZ +# +# model = RBD52G-5HacD2HnD +# serial number = HCX084RAVFA +/interface bridge +add name=Bridge-Lan +/interface wireless +# managed by CAPsMAN +set [ find default-name=wlan1 ] ssid=MikroTik +# managed by CAPsMAN +set [ find default-name=wlan2 ] ssid=MikroTik +/interface ethernet +set [ find default-name=ether1 ] mac-address=48:8F:5A:8E:1A:BC name=\ + "ether1 - Unet" +/interface list +add comment=defconf name=WAN +add comment=defconf name=LAN +add exclude=LAN include=WAN name=Internet +/interface wireless security-profiles +set [ find default=yes ] supplicant-identity=MikroTik +/ip dhcp-server option +add code=12 name=HostName +add code=119 force=yes name=domain-search-list value="0x03'WORKGROUP'0x00" +/ip dhcp-server option sets +add name=HP1505n options=HostName +add name=StartLife1 options=HostName +add name=amsterDev options=HostName +add name=MiTV options=HostName +add name=miller options=HostName +add name=amster options=HostName +add name=garage options=HostName +add name=domain-search-set options=domain-search-list +add name=VADOS-LEN options=HostName +add name=VADOS-NUC options=HostName +add name=MikroNUC options=HostName +add name=master options=HostName +add name=MikroYellow options=HostName +add name="=\"Client ID\"" options=HostName +/ip dns forwarders +add dns-servers=1.1.1.1,1.0.0.1 name=blsp.at verify-doh-cert=no +add comment=Kra dns-servers=1.0.0.1,1.1.1.1 name=slon2.to verify-doh-cert=no +add dns-servers=1.1.1.1,1.0.0.1 name=slon3.at verify-doh-cert=no +add dns-servers=1.0.0.1,1.1.1.1 name=slon3.cc verify-doh-cert=no +add dns-servers=1.1.1.1,1.0.0.1 name=bs2web.at verify-doh-cert=no +add dns-servers=1.1.1.1,1.0.0.1 name=bs2best.at verify-doh-cert=no +add dns-servers=1.0.0.1,1.1.1.1 name=psrms.is verify-doh-cert=no +/ip pool +add name=dhcp ranges=10.30.30.150-10.30.30.200 +/ip dhcp-server +add address-pool=dhcp bootp-support=dynamic dhcp-option-set=domain-search-set \ + interface=Bridge-Lan name=masterDHCP server-address=10.30.30.81 +/ip smb users +set [ find default=yes ] disabled=yes +add disabled=yes name=vados +/routing table +add disabled=yes fib name=To-VPN +/system script +add dont-require-permissions=no name=fetchCustom owner=admin policy=\ + ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\ + \n\ + \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@10\ + .30.30.10.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.10.pub\";\ + \n\ + \n\ + \n#\ + \n\ + \n#root.mnuc.backuper\ + \n\ + \n\ + \n\ + \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@10\ + .30.30.81.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.81.pub\";\ + \n\ + \n\ + \n#:local Script AM-GlobalConfig;\ + \n\ + \n#/system/script/add name=\$Script owner=\$Script source=([ /tool/fetch c\ + heck-certificate=yes-without-crl url=(\$GlobalScriptsUrl . \$Script . \".r\ + sc\") output=user as-value ]->\"data\");\ + \n\ + \n#/usb1/mikro_bak_rsa.pub\ + \n\ + \n\ + \n#:local FetchFile AM-DOHCert.rsc\ + \n\ + \n\ + \n\ + \n:global GlobalScriptsUrl \"https://ros.vados.ru/tmp/\";\ + \n\ + \n:global MkDir;\ + \n\ + \n\ + \n:local FetchFile Manager@id_rsa.pub\ + \n:local localDir \"/\";\ + \n\ + \n\ + \n\ + \n\$MkDir \$localDir;\ + \n\ + \n\ + \n\ + \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \$FetchFile) dst-path=(\ + \$localDir . \$FetchFile);\ + \n" +add comment="Global Config Script" dont-require-permissions=no name=\ + AM-GlobalConfig owner=AM-GlobalConfig policy=\ + ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\ + !rsc by Vados\r\ + \n# RouterOS script: AM-GlobalConfig\r\ + \n# Script comment: Global Config Script\r\ + \n# Copyright (c) 2007-2026 Vados \r\ + \n#\r\ + \n#\r\ + \n# Warning: Dont touch this line!\r\ + \n:global Identity [/system/identity/get name];\r\ + \n:global GlobalConfReady false;\r\ + \n#\r\ + \n#\r\ + \n# Global Url For Amster scripts to fetch\r\ + \n# most be defined in AM-Init-Script or AM-setup scripts\r\ + \n:global GlobalScriptsUrl \"https://ros.vados.ru/\";\r\ + \n:global ScriptsUrlSuffix (a);\r\ + \n:global CheckSumsVerify true;\r\ + \n\r\ + \n:global ScriptUpdatesCRLF true;\r\ + \n:global CommentsInScripts true;\r\ + \n\r\ + \n# Debug output:\r\ + \n:global PrintDebug true; #false;\r\ + \n\r\ + \n# Debug output for specific script:\r\ + \n#:set (\$PrintDebugOverride->\"AM-GlobalFunc\") true;\r\ + \n\r\ + \n# Debug logs\r\ + \n# Other actions (disk, email, remote or support) can be used as well.\r\ + \n# I do not recommend using echo - use debug output instead (https://rsc.\ + eworm.de/main/DEBUG.html#debug-output).\r\ + \n#/system/logging/add topics=script,debug action=memory;\r\ + \n\r\ + \n:global MikrotikUpgradeUrl \"https://upgrade.mikrotik.com/routeros\";\r\ + \n:global Domain \"WORKGROUP\";\r\ + \n\r\ + \n:global EmailGeneralTo \"vados@vados.ru\";\r\ + \n#:global EmailGeneralCc \"\";\r\ + \n\r\ + \n# \$ScriptInstallUpdate mod/notification-telegram\r\ + \n:global TelegramTokenId \"8390868324:AAG3_d1hfVR2M6pGAgDK6ZvhOe4J97nyopw\ + \";\r\ + \n:global TelegramChatId \"-1003631309063\"; #\"454403445\";\r\ + \n# Use this to send notifications to a specific topic in group.\r\ + \n#:global TelegramThreadId \"30\";\r\ + \n# Using telegram-chat you have to define trusted chat ids (not group ids\ + !)\r\ + \n# or user names. Groups allow to chat with devices simultaneously.\r\ + \n:global TelegramChatIdsTrusted {\r\ + \n \"454403445\"\r\ + \n \"-1003631309063\"\r\ + \n \"-5124482807\"\r\ + \n \"1087968824\";\r\ + \n};\r\ + \n# \"-5294757340\";\r\ + \n\r\ + \n:global TelegramChatGroups \"(all)\";\r\ + \n#:global TelegramChatGroups \"(all|home|office)\";\r\ + \n\r\ + \n:global NotificationFunctions {\r\ + \n \"email\"\r\ + \n \"telegram\";\r\ + \n};\r\ + \n# Toggle this to disable symbols in notifications.\r\ + \n:global NotificationsWithSymbols true;\r\ + \n:global TerminalColorOutput true;\r\ + \n\r\ + \n:global DetectIpAddrDefault \"https://ipv4.mikrotik.ovh/\";\r\ + \n:global DetectIpAddrFallback \"https://api.ipify.org/\";\r\ + \n\r\ + \n## Update channel. Possible values: stable, long-term, testing, developm\ + ent\r\ + \n:global updateChannel \"stable\";\r\ + \n\r\ + \n:global CertRenewUrl (\$GlobalScriptsUrl . \"certs/\" . \$Identity . \"/\ + \");\r\ + \n:global CertRenewTime 2w;\r\ + \n:global CertRenewPass (a); #{\r\ + \n# \"\";\r\ + \n# \"v3ry-s3cr3t\";\r\ + \n# \"4n0th3r-s3cr3t\";\r\ + \n#};\r\ + \n:global CertWarnTime 1w;\r\ + \n:global CertIssuedExportPass (a); # {\r\ + \n# \"\";\r\ + \n# \"cert1-cn\"=\"v3ry-s3cr3t\";\r\ + \n# \"cert2-cn\"=\"4n0th3r-s3cr3t\";\r\ + \n#};\r\ + \n\r\ + \n# Script BackupAndUpdate mode, possible values: backup,\r\ + \n# updateOnce - Update once as \"osnotify\" and back \"osnotify\" mode (i\ + n terminal run :set OSUpdateMode updateOnce; \$OSUpdateMode;). \r\ + \n# osupdate - Update if available and creates backups before/after update\ + \_(ignores `forceBackup`)\r\ + \n# Set `forceBackup` to true to always create backups, even\ + \_without updates\r\ + \n# osnotify - Set `forceBackup` to always create backups on every run\r\ + \n:global DevInfoIncludeIP true;\r\ + \n:global BackupAndUpdateMode \"osnotify\"\r\ + \n\r\ + \n:global forceBackup true;\r\ + \n:global BackupPassword \"Peskar55\";\r\ + \n\r\ + \n# SFTP Backup Variables\r\ + \n:global BackupRandomDelay 0;\r\ + \n:global BackupUploadUrl \"sftp://amster.vados.ru/upload/\";\r\ + \n:global BackupUploadUser \$Identity;\r\ + \n:global BackupUploadPass \"root.mnuc.backuper\";\r\ + \n\r\ + \n:global BackupSendBinary true;\r\ + \n:global BackupSendExport true;\r\ + \n:global BackupSendGlobalConfig true;\r\ + \n:global BackupSendScripts true;\r\ + \n\r\ + \n# Remove local file after uploading if no errors\r\ + \n:global BackupRmLocal true;\r\ + \n\r\ + \n# Local Backups Root Directory \r\ + \n:global BackupLocalRoot \"tmpfs\";\r\ + \n\r\ + \n# Encrypt Backup\r\ + \n:global BackupEncrypt true;\r\ + \n\r\ + \n# Sensitive information in Backups\r\ + \n:global BackupSens true;\r\ + \n\r\ + \n# User Export\r\ + \n:global BackupUser true;\r\ + \n\r\ + \n# License Export (not for CHR, will silently skip)\r\ + \n:global BackupLicense false;\r\ + \n\r\ + \n# SSH Keys\r\ + \n:global BackupSshKeys true;\r\ + \n\r\ + \n# Certificate Export\r\ + \n:global BackupCerts true;\r\ + \n\r\ + \n# Certificate Password\r\ + \n:global BackupCertsPasswd \"\";\r\ + \n\r\ + \n# User-Manager Export\r\ + \n:global BackupUserMan false;\r\ + \n\r\ + \n# The Dude Export\r\ + \n:global BackupDude false;\r\ + \n\r\ + \n# User Files to export, comma-separated string or array of strings\r\ + \n# User Files are not removed on backup\r\ + \n# Any directory paths will be removed (/ -> _) on remote file\r\ + \n# Nonpresent files are silently skipped\r\ + \n:global BackupUserList \"autosupout.rif,autosupout.old.rif\";\r\ + \n\r\ + \n# load functions and any custom scripts\r\ + \n# [ /system/script/find where name=\"global-config-ov\ + erlay\" ], \\\r\ + \n# [ /system/script/find where name~\"^global-config-o\ + verlay\\\\.d/.\" ]\r\ + \n#\r\ + \n#:foreach Script in=([ /system/script/find where name=\"Amster-TGglobalV\ + ars\" ], [ /system/script/find where name=\"Amster-TGglobalFunc\" ]) do={\ + \r\ + \n# :onerror Err {\r\ + \n# /system/script/run \$Script;\r\ + \n# } do={\r\ + \n# :log error (\"Loading configuration from configs and functions\"\ + \_. [ /system/script/get \$Script name ] . \" failed: \" . \$Err);\r\ + \n# }\r\ + \n#}\r\ + \n#:log info \"\\ndevMode = \$devMode\";\r\ + \n#:log info \"\\ndevRunning = \$devRunning\";\r\ + \n:foreach Script in=[ /system/script/find where source~\"^#!rsc by Vados \ + GlobalRUN\\r\?\\n\" ] do={\r\ + \n :onerror Err {\r\ + \n /system/script/run \$Script;\r\ + \n } do={\r\ + \n :log error (\"Run script \" . [ /system/script/get \$Script name \ + ] . \" width marker \\\" GlobalRUN\\\" failed: \" . \$Err);\r\ + \n }\r\ + \n}\r\ + \n\r\ + \n# signal we are ready\r\ + \n:set GlobalConfReady true;\r\ + \n:while (\$GlobalConfReady != true) do={:delay 500ms};\r\ + \n" +add comment=GENERATOR dont-require-permissions=no name=awg2vds owner=vados \ + policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ + source="# ============================================================\ + \n# AWG Proxy -- MikroTik RouterOS (protocol: v2)\ + \n# 2026-07-21 10:33:39\ + \n# ============================================================\ + \n\ + \n# 0. Check prerequisites\ + \n:if ([:len [/system/package/find where name=\"container\" disabled=no]] \ + = 0) do={\ + \n :put \"Container package is not installed or disabled. Install it and \ + reboot.\"\ + \n :error \"Usage: /system/device-mode/update container=yes\"\ + \n}\ + \n\ + \n# Check storage device\ + \n{\ + \n :local targetDisk \"usb1\"\ + \n :local diskFree 0\ + \n :do { :set diskFree [/disk/get [find where mount-point=\$targetDisk] f\ + ree] } on-error={}\ + \n :if (\$diskFree = 0) do={\ + \n :local baseDisk \$targetDisk\ + \n :local dashPos [:find \$targetDisk \"-part\"]\ + \n :if ([:typeof \$dashPos] != \"nil\") do={ :set baseDisk [:pick \$tar\ + getDisk 0 \$dashPos] }\ + \n :if ([:len [/disk/find where slot=\$baseDisk]] > 0) do={\ + \n :put (\"Device \$baseDisk found but \$targetDisk is not available.\ + \")\ + \n :put \"Format \$baseDisk as ext4\? ALL DATA WILL BE ERASED!\"\ + \n :put \"Press 'y' to confirm, any other key to cancel:\"\ + \n :local key [/terminal/inkey timeout=30]\ + \n :if (\$key = 121 || \$key = 89) do={\ + \n :put \"Formatting \$baseDisk as ext4...\"\ + \n /disk/format-drive \$baseDisk file-system=ext4 label=\$baseDisk\ + \n :delay 3s\ + \n :do { :set diskFree [/disk/get [find where mount-point=\$targetD\ + isk] free] } on-error={}\ + \n :if (\$diskFree = 0) do={\ + \n :put (\"ERROR: \$targetDisk not found after formatting.\")\ + \n :put \"Check mount point: /disk/print\"\ + \n :error (\"Mount point \$targetDisk not found after formatting\ + \")\ + \n }\ + \n :put (\"Formatted OK. Free: \" . (\$diskFree / 1048576) . \" MB\ + \")\ + \n } else={\ + \n :error \"Formatting cancelled\"\ + \n }\ + \n } else={\ + \n :put (\"ERROR: Storage device \$targetDisk not found.\")\ + \n :put \"Check available disks: /disk/print\"\ + \n :error (\"Storage not found: \" . \$targetDisk)\ + \n }\ + \n } else={\ + \n :put (\"Storage OK: \$targetDisk (\" . (\$diskFree / 1048576) . \" M\ + B free)\")\ + \n }\ + \n}\ + \n\ + \n# 1. Uninstall script\ + \n/system/script/add name=awg2vds-uninstall comment=awg2vds source={\ + \n :put \"Uninstallimg AmneziaWG...\"\ + \n :log info \"Uninstallimg AmneziaWG...\"\ + \n :local prevDNS \"\"\ + \n :do { :set prevDNS [/container/envs/get [find where list=\"awg2vds-env\ + \" key=\"AWG_PREV_DNS\"] value] } on-error={}\ + \n :local prevTmpdir \"\"\ + \n :do { :set prevTmpdir [/container/envs/get [find where list=\"awg2vds-\ + env\" key=\"AWG_PREV_TMPDIR\"] value] } on-error={}\ + \n /ip/route/remove [find where comment=awg2vds-tunnel]\ + \n /ip/route/remove [find where comment=awg2vds-dns]\ + \n /container/stop [find where interface=veth-awg2vds]\ + \n :delay 7s\ + \n /container/remove [find where interface=veth-awg2vds]\ + \n /container/envs/remove [find where list=\"awg2vds-env\"]\ + \n :if (\$prevDNS != \"\") do={\ + \n :do { /ip/dns/set servers=\"\$prevDNS\" } on-error={}\ + \n :put (\"DNS restored to: \$prevDNS\")\ + \n }\ + \n /container/config set tmpdir=\$prevTmpdir\ + \n :put (\"Container tmpdir restored to: \$prevTmpdir\")\ + \n /ip/firewall/nat/remove [find where out-interface=\"wg-awg2vds\"]\ + \n /ip/firewall/nat/remove [find where src-address=\"172.20.200.68/30\"]\ + \n /ip/address/remove [find where address=\"172.20.200.69/30\"]\ + \n /interface/veth/remove [find where name=\"veth-awg2vds\"]\ + \n /interface/wireguard/peers/remove [find where interface=\"wg-awg2vds\"\ + ]\ + \n /ip/address/remove [find where interface=\"wg-awg2vds\"]\ + \n /interface/wireguard/remove [find where name=\"wg-awg2vds\"]\ + \n :do { /file/remove [find where name~\"awg2vds.+tar\"] } on-error={}\ + \n :do { /file/remove [find where name=\"usb1/awg2vds\"] } on-error={}\ + \n :do { /file/remove [find where name=\"usb1/ru_ranges_timeout.rsc\"] } \ + on-error={}\ + \n :do { /file/remove [find where name~\"usb1/pull\"] } on-error={}\ + \n :put \"Uninstall AmneziaWG Proxy complete!\"\ + \n :log info \"Uninstall AmneziaWG Proxy complete!\"\ + \n /system/script/remove [find where name=awg2vds-uninstall]\ + \n}\ + \n\ + \n# 2. Network infrastructure\ + \n/interface/veth/add name=veth-awg2vds address=172.20.200.70/30 gateway=1\ + 72.20.200.69\ + \n/ip/address/add address=172.20.200.69/30 interface=veth-awg2vds\ + \n/ip/firewall/nat/add chain=srcnat action=masquerade src-address=172.20.2\ + 00.68/30\ + \n\ + \n# 3. WireGuard interface (MikroTik derives the public key automatically)\ + \n/interface/wireguard/add name=wg-awg2vds private-key=\"4LNSJJNEDeT2LFXkF\ + x0XyrNp2Mp7YXlS8SawhqNfKGQ=\" listen-port=26084 disabled=yes\ + \n/interface/wireguard/peers/add interface=wg-awg2vds public-key=\"qHFd72X\ + DJJ5UrUZCZ0vRFQmzxP7eUYcOuaGL9ZbHtyg=\" preshared-key=\"ckhzjCcr15ve+IeDRY\ + veYITR7a/CMZCcOZ2Z0cABKD8=\" endpoint-address=172.20.200.70 endpoint-port=\ + 51820 allowed-address=10.10.10.1/24,10.30.30.0/24,0.0.0.0/0 persistent-kee\ + palive=10\ + \n/ip/address/add address=10.10.10.2/24 interface=wg-awg2vds\ + \n\ + \n# 4. Container environment variables\ + \n/container/envs/add list=awg2vds-env key=AWG_LISTEN value=\":51820\"\ + \n/container/envs/add list=awg2vds-env key=AWG_REMOTE value=\"109.107.177.\ + 79:443\"\ + \n/container/envs/add list=awg2vds-env key=AWG_JC value=\"6\"\ + \n/container/envs/add list=awg2vds-env key=AWG_JMIN value=\"171\"\ + \n/container/envs/add list=awg2vds-env key=AWG_JMAX value=\"481\"\ + \n/container/envs/add list=awg2vds-env key=AWG_S1 value=\"50\"\ + \n/container/envs/add list=awg2vds-env key=AWG_S2 value=\"139\"\ + \n/container/envs/add list=awg2vds-env key=AWG_H1 value=\"1189447486-11894\ + 48396\"\ + \n/container/envs/add list=awg2vds-env key=AWG_H2 value=\"538303610-538304\ + 276\"\ + \n/container/envs/add list=awg2vds-env key=AWG_H3 value=\"101001960-101002\ + 598\"\ + \n/container/envs/add list=awg2vds-env key=AWG_H4 value=\"1783887443-17838\ + 87851\"\ + \n/container/envs/add list=awg2vds-env key=AWG_SERVER_PUB value=\"qHFd72XD\ + JJ5UrUZCZ0vRFQmzxP7eUYcOuaGL9ZbHtyg=\"\ + \n/container/envs/add list=awg2vds-env key=AWG_CLIENT_PUB value=[/interfac\ + e/wireguard/get [find name=wg-awg2vds] public-key]\ + \n/container/envs/add list=awg2vds-env key=AWG_S3 value=\"17\"\ + \n/container/envs/add list=awg2vds-env key=AWG_S4 value=\"6\"\ + \n/container/envs/add list=awg2vds-env key=AWG_I1 value=\"\"\ + \n/container/envs/add list=awg2vds-env key=AWG_I2 value=\"\"\ + \n/container/envs/add list=awg2vds-env key=AWG_I3 value=\"\"\ + \n/container/envs/add list=awg2vds-env key=AWG_I4 value=\"\"\ + \n/container/envs/add list=awg2vds-env key=AWG_I5 value=\"\"\ + \n\ + \n# 5. DNS\ + \n{ :local rawDNS [/ip/dns/get servers]; :local prevDNS \"\"; :foreach s i\ + n=[:toarray \$rawDNS] do={ :if ([:len \$prevDNS] > 0) do={ :set prevDNS \"\ + \$prevDNS,\$s\" } else={ :set prevDNS \$s } }; /container/envs/add list=aw\ + g2vds-env key=AWG_PREV_DNS value=\"\$prevDNS\" }\ + \n# NOTE: replaces existing DNS configuration\ + \n/ip/dns/set servers=10.10.10.1\ + \n/ip/route/add dst-address=10.10.10.1/32 gateway=wg-awg2vds distance=1 co\ + mment=awg2vds-dns\ + \n\ + \n# 6. Download, create and start container\ + \n:local prevTmpdir [/container/config/get tmpdir]\ + \n/container/envs/add list=awg2vds-env key=AWG_PREV_TMPDIR value=\$prevTmp\ + dir\ + \n/container/config set tmpdir=usb1/pull memory-high=200M\ + \n{\ + \n :local arch [/system/resource/get architecture-name]\ + \n :local ver [/system/resource/get version]\ + \n :local dotPos [:find \$ver \".\"]\ + \n :local rest [:pick \$ver (\$dotPos + 1) [:len \$ver]]\ + \n :local endPos [:find \$rest \".\"]\ + \n :if ([:typeof \$endPos] = \"nil\") do={ :set endPos [:find \$rest \" \ + \"] }\ + \n :local minor [:tonum [:pick \$rest 0 \$endPos]]\ + \n :local suffix \"\"\ + \n :if (\$minor <= 20) do={ :set suffix \"-7.20-Docker\" }\ + \n :local file \"\"\ + \n :if (\$arch = \"arm64\") do={ :set file (\"awg-proxy-arm64\" . \$suffi\ + x . \".tar.gz\") }\ + \n :if (\$arch = \"arm\") do={ :set file (\"awg-proxy-arm\" . \$suffix . \ + \".tar.gz\") }\ + \n :if (\$arch ~ \"x86\") do={ :set file (\"awg-proxy-amd64\" . \$suffix \ + . \".tar.gz\") }\ + \n :if (\$file = \"\") do={ :error \"Unsupported architecture: \$arch\" }\ + \n :local url \"https://github.com/timbrs/amneziawg-mikrotik-c/releases/l\ + atest/download/\$file\"\ + \n :local filePath (\"usb1/pull/\" . \$file)\ + \n :do { /file/make-directory usb1/pull } on-error={}\ + \n :if ([:len [/file/find where name=\$filePath]] = 0) do={\ + \n :local freeStorage 0\ + \n :do { :set freeStorage [/disk/get [find where mount-point=\"usb1\"] \ + free] } on-error={}\ + \n :if (\$freeStorage < 262144) do={\ + \n :put (\"WARNING: Low disk space (\" . (\$freeStorage / 1024) . \"K\ + B free). Need at least 256KB.\")\ + \n :put \"See: https://github.com/timbrs/amneziawg-mikrotik-c#insuffi\ + cient-disk-space\"\ + \n :error \"Insufficient disk space\"\ + \n }\ + \n :put (\"Fetching: \$url -> \" . \$filePath)\ + \n /tool/fetch url=\$url dst-path=\$filePath http-max-redirect-count=10\ + \n } else={\ + \n :put (\"File already exists: \" . \$filePath)\ + \n }\ + \n /container/add file=\$filePath interface=veth-awg2vds envlist=awg2vds-\ + env hostname=awg2vds root-dir=usb1/awg2vds logging=no start-on-boot=yes co\ + mment=awg2vds\ + \n :if (\$minor > 20) do={ [:parse \"/container/set [find where interface\ + =veth-awg2vds] shm-size=4M\"] }\ + \n /file/remove \$filePath\ + \n :local freeMem [/system/resource/get free-memory]\ + \n :if (\$freeMem < 16777216) do={\ + \n :put (\"WARNING: Low memory (\" . (\$freeMem / 1048576) . \"MB free)\ + . 16MB+ recommended.\")\ + \n }\ + \n /container/start [find where interface=veth-awg2vds]\ + \n :do { /file/remove [find where name=\"console-dump.txt\"] } on-error={\ + }\ + \n :put \"Waiting for container to start...\"\ + \n :delay 5s\ + \n /interface/wireguard/enable wg-awg2vds\ + \n :put \"WireGuard interface enabled\"\ + \n :put \"Installation complete!\"\ + \n :put \"Ping test: 10.10.10.1 via AmneziaWG tunnel. repeat 10 times\"\ + \n /ping 10.10.10.1 count=10 interval=1\ + \n :put \"\"\ + \n :put \"======= NEXT STEPS =======\"\ + \n :put \"\"\ + \n :put \"Route specific traffic through the AmneziaWG tunnel:\"\ + \n :put \"\"\ + \n :put \" Route a single host:\"\ + \n :put \" /ip/route/add dst-address=8.8.8.8/32 gateway=wg-awg2vds com\ + ment=awg2vds-tunnel\"\ + \n :put \"\"\ + \n :put \" Route a subnet:\"\ + \n :put \" /ip/route/add dst-address=100.0.0.0/8 gateway=wg-awg2vds co\ + mment=awg2vds-tunnel\"\ + \n :put \"\"\ + \n :put \" Remove a route:\"\ + \n :put \" /ip/route/remove [find where comment=awg2vds-tunnel dst-add\ + ress=8.8.8.8/32]\"\ + \n :put \"\"\ + \n :put \" Show all tunnel routes:\"\ + \n :put \" /ip/route/print where comment=awg2vds-tunnel\"\ + \n :put \"\"\ + \n :put \" Uninstall:\"\ + \n :put \" /system/script/run awg2vds-uninstall\"\ + \n :put \"=========================\"\ + \n}\ + \n\ + \n# 7. Verification\ + \n# /container/print\ + \n# /interface/wireguard/print\ + \n# /interface/wireguard/peers/print\ + \n" +/user group +add name=backup policy="telnet,ssh,ftp,read,write,policy,test,sniff,sensitive,\ + !local,!reboot,!winbox,!password,!web,!api,!romon,!rest-api" +add name=manager policy="local,ssh,ftp,read,write,policy,api,rest-api,!telnet,\ + !reboot,!test,!winbox,!password,!web,!sniff,!sensitive,!romon" +/certificate settings +set builtin-trust-store=fetch +/container config +set memory-high=200.0MiB +/disk settings +set auto-media-interface=Bridge-Lan +/ip smb +set domain=WORKGROUP enabled=no interfaces=lo +/interface bridge port +add bridge=Bridge-Lan interface=ether2 +add bridge=Bridge-Lan interface=ether3 +add bridge=Bridge-Lan interface=ether4 +add bridge=Bridge-Lan interface=ether5 +add bridge=Bridge-Lan interface=wlan1 +add bridge=Bridge-Lan interface=wlan2 +/interface bridge settings +set allow-fast-path=no use-ip-firewall=yes +/ip neighbor discovery-settings +set discover-interface-list=LAN +/ip settings +set accept-redirects=yes allow-fast-path=no +/ipv6 settings +set accept-router-advertisements-on=none allow-fast-path=no disable-ipv6=yes \ + disable-link-local-address=yes +/interface detect-internet +set detect-interface-list=static internet-interface-list=WAN \ + lan-interface-list=LAN wan-interface-list=WAN +/interface list member +add interface="ether1 - Unet" list=Internet +add interface=Bridge-Lan list=LAN +/interface wireless cap +# +set bridge=Bridge-Lan caps-man-addresses=10.30.30.10 \ + caps-man-certificate-common-names=CAPsMAN-ABE2F4E9EE17 certificate=\ + CAP-18FD746E5814 discovery-interfaces=Bridge-Lan enabled=yes interfaces=\ + wlan1,wlan2 lock-to-caps-man=yes +/ip address +add address=10.30.30.81/24 interface=Bridge-Lan network=10.30.30.0 +/ip cloud +set ddns-enabled=yes +/ip dhcp-client +add check-gateway=bfd default-route-tables=main:1 dhcp-options=\ + clientid,clientid_duid interface="ether1 - Unet" name=client1 \ + use-peer-dns=no use-peer-ntp=no +/ip dhcp-server config +set accounting=no +/ip dhcp-server lease +add address=10.30.30.101 client-id=1:48:8f:5a:8e:ee:a8 mac-address=\ + 48:8F:5A:8E:EE:A8 server=masterDHCP +add address=10.30.30.107 client-id=1:f0:de:f1:91:d:1e mac-address=\ + F0:DE:F1:91:0D:1E server=masterDHCP +add address=10.30.30.83 client-id=1:0:80:77:ec:43:86 mac-address=\ + 00:80:77:EC:43:86 server=masterDHCP +add address=10.30.30.50 client-id=1:4:7c:16:36:f5:37 mac-address=\ + 04:7C:16:36:F5:37 server=masterDHCP +add address=10.30.30.71 client-id=1:10:2d:41:2c:20:c2 mac-address=\ + 10:2D:41:2C:20:C2 server=masterDHCP +add address=10.30.30.61 client-id=1:10:8:c1:81:59:5f mac-address=\ + 10:08:C1:81:59:5F server=masterDHCP +add address=10.30.30.72 client-id=1:10:38:1f:d2:5f:13 mac-address=\ + 10:38:1F:D2:5F:13 server=masterDHCP +add address=10.30.30.99 client-id=1:10:b1:df:e9:d0:d5 mac-address=\ + 10:B1:DF:E9:D0:D5 server=masterDHCP +add address=10.30.30.111 client-id=1:fe:2:52:be:3f:16 mac-address=\ + FE:02:52:BE:3F:16 server=masterDHCP +add address=10.30.30.92 client-id=1:d4:6d:6d:fd:e5:49 mac-address=\ + D4:6D:6D:FD:E5:49 server=masterDHCP +add address=10.30.30.93 client-id=1:7e:8b:1e:cb:b8:cb mac-address=\ + CC:42:10:12:46:94 server=masterDHCP +add address=10.30.30.94 client-id=1:50:cc:f8:85:96:a mac-address=\ + 50:CC:F8:85:96:0A server=masterDHCP +add address=10.30.30.82 client-id=1:e4:18:6b:58:34:ab mac-address=\ + E4:18:6B:58:34:AB server=masterDHCP +add address=10.30.30.75 client-id=1:0:27:15:41:97:a9 mac-address=\ + 00:27:15:41:97:A9 server=masterDHCP +add address=10.30.30.77 dhcp-option=HostName dhcp-option-set=StartLife1 \ + mac-address=C4:82:E1:03:49:10 server=masterDHCP +add address=10.30.30.73 client-id=1:10:38:1f:82:81:f2 mac-address=\ + 10:38:1F:82:81:F2 server=masterDHCP +add address=10.30.30.96 client-id=iPhone mac-address=4A:91:ED:0E:1F:39 \ + server=masterDHCP +add address=10.30.30.74 client-id=MiTV dhcp-option=HostName dhcp-option-set=\ + MiTV mac-address=20:72:A9:D3:34:36 server=masterDHCP +/ip dhcp-server network +add address=10.30.30.0/24 caps-manager=10.30.30.10 dhcp-option=\ + domain-search-list dhcp-option-set=domain-search-set dns-server=\ + 10.30.30.81 domain=WORKGROUP gateway=10.30.30.81 netmask=24 ntp-server=\ + 10.30.30.81,10.30.30.10 wins-server=10.30.30.95,10.30.30.98 +/ip dns +set allow-remote-requests=yes servers=89.110.101.17,10.30.30.33,8.8.4.4 +/ip dns static +add address=10.30.30.81 comment=defconf name=router.lan type=A +add address=10.30.30.81 comment=defconf name=master type=A +add address=10.30.30.33 comment=amster name=amster.vados.ru type=A +add address=8.8.8.8 name=dns.google type=A +add address=8.8.4.4 name=dns.google type=A +add address=1.0.0.1 comment="CloudFlare-doh IPv4 2" name=\ + security.cloudflare-dns.com type=A +add address=1.1.1.1 comment="CloudFlare-doh IPv4 1" disabled=yes name=\ + security.cloudflare-dns.com type=A +add address=149.112.112.112 comment="Cuad9-dns IPv4 2" disabled=yes name=\ + dns.quad9.net type=A +add address=9.9.9.9 comment="Cuad9-dns IPv4 1" disabled=yes name=\ + dns.quad9.net type=A +add address=91.192.189.2 comment=Unet-DNS disabled=yes name=ns1.unet.ws type=\ + A +add address=91.192.189.2 comment=Unet-DNS disabled=yes name=ns1.unet.ws type=\ + A +/ip firewall address-list +add address=10.0.0.0/8 list=RFC1918 +add address=172.16.0.0/12 list=RFC1918 +add address=192.168.0.0/16 list=RFC1918 +add address=91.215.120.206 list=TRUSTED +add address=185.71.70.78 disabled=yes list=TRUSTED +add address=176.53.203.171 disabled=yes list=TRUSTED +add address=176.53.203.170 disabled=yes list=TRUSTED +add address=176.53.202.194 disabled=yes list=TRUSTED +add address=8.8.4.4 disabled=yes list=to_vpn +add address=10.30.30.98 comment=vados-len list=Local2Vpn +add address=89.110.101.17 list=VDS +add address=109.107.177.79 list=TRUSTED +add address=185.71.70.78 disabled=yes list=TRUSTED +add address=176.53.203.171 disabled=yes list=TRUSTED +add address=176.53.203.170 disabled=yes list=TRUSTED +add address=176.53.202.194 disabled=yes list=TRUSTED +add address=2ip.ru list=Test +add address=89.110.101.17 comment=VDSIna list=TRUSTED +add address=10.8.0.0/24 comment="WG VDSIna" list=TRUSTED +add address=ikus.pesc.ru comment=ikus.pesc.ru list=NoVdsina +add address=love.ru comment=love.ru list=NoVdsina +add address=gosuslugi.ru comment=gosuslugi.ru list=NoVdsina +add address=pochta.ru comment=pochta.ru list=NoVdsina +add address=vdsina.com comment=vdsina.com list=NoVdsina +add address=vdsina.ru comment=vdsina.ru list=NoVdsina +add address=youla.ru comment=youla.ru list=NoVdsina +add address=kupiprodai.ru comment=kupiprodai.ru list=NoVdsina +add address=myip.ru list=Test +add address=geoip.co comment=geoip.co list=NoVdsina +add address=x.com list=Twitter +add address=facebook.com list=facebook +add address=fbcd.net list=facebook +add address=comp-lenta.ru comment=comp-lenta.ru list=NoVdsina +add address=128.85.102.70 comment=update.microsoft.com list=\ + windowsupdateslist +add address=wu-b-net.trafficmanager.net. comment=\ + ctldl.windowsupdate.com.delivery.microsoft.com list=windowsupdateslist +add address=ctldl.windowsupdate.com.delivery.microsoft.com. comment=\ + ctldl.windowsupdate.com list=windowsupdateslist +add address=redir.update.msft.com.trafficmanager.net. comment=\ + update.microsoft.com list=windowsupdateslist +add address=geo.prod.do.dsp.trafficmanager.net. comment=\ + geo.prod.do.dsp.mp.microsoft.com list=windowsupdateslist +add address=13.74.139.29 comment=array605.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=kv801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\ + kv801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist +add address=e12437.d.akamaiedge.net. comment=\ + kv801.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist +add address=displaycatalog-rp.md.mp.microsoft.com.akadns.net. comment=\ + displaycatalog.mp.microsoft.com list=windowsupdateslist +add address=rp-consumer-prod-displaycatalog-geomap.trafficmanager.net. \ + comment=displaycatalog-rp.md.mp.microsoft.com.akadns.net list=\ + windowsupdateslist +add address=sls.update.microsoft.com. comment=slscr.update.microsoft.com \ + list=windowsupdateslist +add address=glb.sls.prod.dcat.dsp.trafficmanager.net. comment=\ + sls.update.microsoft.com list=windowsupdateslist +add address=fe3.delivery.mp.microsoft.com. comment=\ + fe3cr.delivery.mp.microsoft.com list=windowsupdateslist +add address=glb.cws.prod.dcat.dsp.trafficmanager.net. comment=\ + fe3.delivery.mp.microsoft.com list=windowsupdateslist +add address=fe2cr.update.msft.com.trafficmanager.net. comment=\ + fe2cr.update.microsoft.com list=windowsupdateslist +add address=download.windowsupdate.com.delivery.microsoft.com. comment=\ + download.windowsupdate.com list=windowsupdateslist +add address=wu-f-net.trafficmanager.net. comment=\ + download.windowsupdate.com.delivery.microsoft.com list=windowsupdateslist +add address=tsfe.trafficmanager.net. comment=\ + tsfe.trafficshaping.dsp.mp.microsoft.com list=windowsupdateslist +add address=edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com. \ + comment=9.au.download.windowsupdate.com list=windowsupdateslist +add address=52.158.227.125 comment=array812.prod.do.dsp.mp.microsoft.com \ + list=windowsupdateslist +add address=au.download.windowsupdate.com.delivery.microsoft.com. comment=\ + au.download.windowsupdate.com list=windowsupdateslist +add address=a767.dspw65.akamai.net. comment=\ + download.windowsupdate.com.edgesuite.net list=windowsupdateslist +add address=52.151.58.88 comment=array810.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net. \ + comment=licensing.mp.microsoft.com list=windowsupdateslist +add address=licensing-prod-frontdoor-geomap.trafficmanager.net. comment=\ + consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net list=\ + windowsupdateslist +add address=star.f.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \ + comment=msedge.f.dl.delivery.mp.microsoft.com list=windowsupdateslist +add address=cdp-f-nlu-net.trafficmanager.net. comment=\ + star.f.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \ + comment=msedge.b.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist +add address=cdp-f-tlu-net.trafficmanager.net. comment=\ + star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=storeedgefd.xbetservices.akadns.net. comment=\ + storeedgefd.dsx.mp.microsoft.com list=windowsupdateslist +add address=\ + storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net. \ + comment=storeedgefd.dsx.mp.microsoft.com.edgekey.net list=\ + windowsupdateslist +add address=e16646.dscg.akamaiedge.net. comment=\ + storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net list=\ + windowsupdateslist +add address=40.69.76.189 comment=array621.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=bg.microsoft.map.fastly.net. comment=\ + 3.au.download.windowsupdate.com list=windowsupdateslist +add list=windowsupdateslist +add address=40.69.75.33 comment=array613.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \ + comment=msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com list=\ + windowsupdateslist +add address=cdp-f-ssl-tlu-net.trafficmanager.net. comment=\ + star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=a2033.dscd.akamai.net. comment=\ + star.sb.tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=\ + windowsupdateslist +add address=13.74.138.242 comment=array602.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=dl.delivery.mp.microsoft.com.delivery.microsoft.com. comment=\ + dl.delivery.mp.microsoft.com list=windowsupdateslist +add address=dcat-f-nlu-net.trafficmanager.net. comment=\ + dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=1d.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \ + comment=1D.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist +add address=dcat-b-tlu-net.trafficmanager.net. comment=\ + 1d.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=a122.dscg3.akamai.net. comment=\ + tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=windowsupdateslist +add address=geover.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\ + geover.prod.do.dsp.mp.microsoft.com list=windowsupdateslist +add address=e10370.d.akamaiedge.net. comment=\ + geover.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist +add address=52.232.182.21 comment=array511.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=40.70.77.95 comment=array519.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=a1683.dscd.akamai.net. comment=\ + dl.delivery.mp.microsoft.com-c.edgesuite.net list=windowsupdateslist +add address=consumer-collections-aks2eap.md.mp.microsoft.com.akadns.net. \ + comment=collections.mp.microsoft.com list=windowsupdateslist +add address=a1847.dscd.akamai.net. comment=\ + wildcard.f.tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=\ + windowsupdateslist +add address=13.74.142.6 comment=array607.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=au.download.windowsupdate.com.edgesuite.net. comment=\ + 2.au.download.windowsupdate.com list=windowsupdateslist +add address=a767.dscg3.akamai.net. comment=\ + au.download.windowsupdate.com.edgesuite.net list=windowsupdateslist +add address=52.156.123.84 comment=array818.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=40.69.78.254 comment=array610.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=4.au.download.windowsupdate.com.delivery.microsoft.com. comment=\ + 4.au.download.windowsupdate.com list=windowsupdateslist +add address=cl-glcb907925.gcdn.co. comment=\ + 4.au.download.windowsupdate.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=52.167.167.111 comment=array510.prod.do.dsp.mp.microsoft.com \ + list=windowsupdateslist +add address=40.69.70.43 comment=array623.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=tsfe.trafficshaping.dsp.mp.microsoft.com.delivery.microsoft.com. \ + comment=tsfe.trafficshaping.dsp.mp.microsoft.com list=windowsupdateslist +add address=ts-frontend.trafficmanager.net. comment=\ + tsfe.trafficshaping.dsp.mp.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=40.69.75.248 comment=array616.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=40.69.74.84 comment=array615.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=sds.trafficmanager.net. comment=software-download.microsoft.com \ + list=windowsupdateslist +add address=40.69.74.80 comment=array611.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.175.242.182 comment=array804.prod.do.dsp.mp.microsoft.com \ + list=windowsupdateslist +add address=dlc-shim.trafficmanager.net. comment=download.microsoft.com list=\ + windowsupdateslist +add address=e12671.dscd.akamaiedge.net. comment=\ + download.microsoft.com.edgekey.net list=windowsupdateslist +add address=20.187.55.34 comment=array808.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.167.167.231 comment=array513.prod.do.dsp.mp.microsoft.com \ + list=windowsupdateslist +add address=52.167.222.13 comment=array518.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=kv601.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\ + kv601.prod.do.dsp.mp.microsoft.com list=windowsupdateslist +add address=e12358.d.akamaiedge.net. comment=\ + kv601.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist +add address=tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. comment=\ + tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist +add address=dcat-f-tlu-net.trafficmanager.net. comment=\ + tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=a1856.dspw65.akamai.net. comment=\ + tlu.dl.delivery.mp.microsoft.com-c.edgesuite.net list=windowsupdateslist +add address=52.167.164.252 comment=array506.prod.do.dsp.mp.microsoft.com \ + list=windowsupdateslist +add address=13.74.137.54 comment=array601.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=kv501.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\ + kv501.prod.do.dsp.mp.microsoft.com list=windowsupdateslist +add address=collections-prod-frontdoor-geomap.trafficmanager.net. comment=\ + consumer-collections-aks2eap.md.mp.microsoft.com.akadns.net list=\ + windowsupdateslist +add address=52.167.160.173 comment=array509.prod.do.dsp.mp.microsoft.com \ + list=windowsupdateslist +add address=40.70.77.148 comment=array516.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.167.200.126 comment=array507.prod.do.dsp.mp.microsoft.com \ + list=windowsupdateslist +add address=52.167.167.59 comment=array508.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=40.69.76.172 comment=array620.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=82.202.162.184 comment=comp-lenta.ru list=NoWG +add address=smtp.mail.me.com.akadns.net. comment=smtp.mail.me.com list=NoWG +add address=17.57.155.37 comment=smtp.mail.me.com.akadns.net list=NoWG +add address=smtp.mail.me.com comment=smtp.mail.me.com list=NoVdsina +add address=40.70.76.5 comment=array514.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=13.74.186.119 comment=array618.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.177.176.186 comment=array520.prod.do.dsp.mp.microsoft.com \ + list=windowsupdateslist +add address=40.70.76.27 comment=array515.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.167.160.43 comment=array503.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.110 comment=array817.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=13.74.142.8 comment=array614.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=13.74.138.254 comment=array603.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.167.167.96 comment=array501.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=40.69.76.215 comment=array622.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=13.74.143.200 comment=array606.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.111 comment=array818.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.112 comment=array819.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=13.74.137.53 comment=array608.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.98 comment=array805.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.96 comment=array803.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.104 comment=array811.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.101 comment=array808.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.99 comment=array806.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.17 comment=array802.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.97 comment=array804.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.103 comment=array810.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.16 comment=array801.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=40.70.77.177 comment=array517.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.167.164.84 comment=array512.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.105 comment=array812.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.107 comment=array814.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.232.161.82 comment=array502.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.108 comment=array815.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=52.167.161.91 comment=array505.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.102 comment=array809.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.109 comment=array816.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.106 comment=array813.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.117 comment=array622.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.107 comment=array612.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.108 comment=array613.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.105 comment=array610.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.113 comment=array618.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.116 comment=array621.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.98 comment=array603.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.114 comment=array619.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.111 comment=array616.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.97 comment=array602.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.106 comment=array611.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.110 comment=array615.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.119 comment=array624.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.135 comment=array514.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.97 comment=array503.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.99 comment=array604.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.61 comment=array504.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.131 comment=array510.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.132 comment=array511.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.96 comment=array601.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.104 comment=array609.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.138 comment=array517.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.60 comment=array501.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.139 comment=array518.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.118 comment=array623.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.113 comment=array820.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.103 comment=array608.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.154.7.100 comment=array807.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.129 comment=array508.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.134 comment=array513.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.62 comment=array505.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.137 comment=array516.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.101 comment=array606.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.96 comment=array502.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.130 comment=array509.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.112 comment=array617.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.100 comment=array605.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.115 comment=array620.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.136 comment=array515.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=purchase.md.mp.microsoft.com.akadns.net. comment=\ + purchase.mp.microsoft.com list=windowsupdateslist +add address=e110219.a.akamaiedge.net. comment=\ + purchase.mp.microsoft.com.edgekey.net list=windowsupdateslist +add address=72.153.5.140 comment=array519.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.141 list=windowsupdateslist +add address=72.153.5.63 comment=array506.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.128 comment=array507.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.102 comment=array607.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=storesdk.xbetservices.akadns.net. comment=\ + storesdk.dsx.mp.microsoft.com list=windowsupdateslist +add address=e16646.g.akamaiedge.net. comment=\ + storesdk.dsx.mp.microsoft.com.edgekey.net list=windowsupdateslist +add address=software-download.microsoft.com.delivery.microsoft.com. comment=\ + software-download.microsoft.com list=windowsupdateslist +add address=download.prss.microsoft.com.akamaized.net. comment=\ + software-download.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=72.145.35.109 comment=array614.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=72.153.5.133 comment=array512.prod.do.dsp.mp.microsoft.com list=\ + windowsupdateslist +add address=213.180.192.0/19 comment=YandexDisk list=NoVdsina +add address=87.250.250.50 comment=YandexDisk list=NoVdsina +add address=consumer-prod-bcfd-v7-afd.trafficmanager.net. comment=\ + displaycatalog.mp.microsoft.com list=windowsupdateslist +add address=purchase-europeeap.md.mp.microsoft.com.akadns.net. comment=\ + purchase.md.mp.microsoft.com.akadns.net list=windowsupdateslist +add address=ne-az-conspurchase-mp.trafficmanager.net. comment=\ + purchase-europeeap.md.mp.microsoft.com.akadns.net list=windowsupdateslist +add address=storeedgefd.dsx.mp.microsoft.com.edgekey.net. comment=\ + cdn.storeedgefd.dsx.mp.microsoft.com list=windowsupdateslist +add address=star.f.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \ + comment=msedge.f.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist +add address=a1996.dscd.akamai.net. comment=\ + wildcard.f.dl.delivery.mp.microsoft.com.edgesuite.net list=\ + windowsupdateslist +add address=cp801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\ + cp801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist +add address=glb.tas02.sls-prod.dcat.dsp.mp.microsoft.com. comment=\ + tas02.sls.update.microsoft.com list=windowsupdateslist +add address=cp601.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\ + cp601.prod.do.dsp.mp.microsoft.com list=windowsupdateslist +add address=star.sb.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \ + comment=msedgeextensions.sb.tlu.dl.delivery.mp.microsoft.com list=\ + windowsupdateslist +add address=star.sf.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \ + comment=msedge.sf.dl.delivery.mp.microsoft.com list=windowsupdateslist +add address=cdp-f-ssl-nlu-net.trafficmanager.net. comment=\ + star.sf.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\ + windowsupdateslist +add address=tm-pifd-prod-gbl-weight.trafficmanager.net. comment=\ + paymentinstruments.mp.microsoft.com list=windowsupdateslist +add address=10.30.30.33 comment=NUC disabled=yes list=NoWG +add address=10.30.30.10 comment=MikroNUC disabled=yes list=NoWG +add address=89.110.101.17 comment=!!!VDSINA!!!! disabled=yes list=NoWG +add address=wg.vados.ru comment=VDSina-vpn list=Trusted-VPN +add address=80.85.244.9 list=TRUSTED +add address=disc801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\ + disc801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist +add address=185.71.70.78 disabled=yes list=TRUSTED +add address=176.53.203.171 disabled=yes list=TRUSTED +add address=176.53.203.170 disabled=yes list=TRUSTED +add address=176.53.202.194 disabled=yes list=TRUSTED +add address=vdsina.vados.ru comment="!!!VDSina Server!!!" list=NoVdsina +add address=dns.quad9.net comment=Quad9-dns disabled=yes list=Trusted-DNS +add address=dns.google comment=Google-dns list=Trusted-DNS +add address=security.cloudflare-dns.com comment=CloudFlare-dns list=\ + Trusted-DNS +add address=time.google.com comment=Google-time list=Trusted-NTP +add address=0.ru.pool.ntp.org comment=ru.pool.ntp.org disabled=yes list=\ + Trusted-NTP +add address=1.ru.pool.ntp.org disabled=yes list=Trusted-NTP +add address=2.ru.pool.ntp.org comment=2.ru.pool.ntp.org disabled=yes list=\ + Trusted-NTP +add address=3.ru.pool.ntp.org comment=3.ru.pool.ntp.org disabled=yes list=\ + Trusted-NTP +add address=cp.vdsina.com comment=VDSina-vpn list=Trusted-VPN +add address=vdsina.ru comment=VDSina-vpn list=Trusted-VPN +add address=ns.vados.ru comment=VDSina-vpn list=Trusted-VPN +add address=vdsina.com comment=VDSina-vpn list=Trusted-VPN +add address=cp.vdsina.ru comment=VDSina-vpn list=Trusted-VPN +add address=ns1.vdsina.ru comment=VDSina-vpn list=Trusted-VPN +add address=ghcr.io comment=GitHub list=Trusted-VPN +add address=github.com comment=GitHub list=Trusted-VPN +add address=149.154.164.13 comment=telegra.ph list=FuckRKN +add address=194.85.61.76 comment=grani.ru list=FuckRKN +add address=109.70.26.37 comment=grani.ru list=FuckRKN +add address=104.16.4.81 comment=xhamster.com list=FuckRKN +add address=104.16.3.81 comment=xhamster.com list=FuckRKN +add address=188.114.96.1 comment=lostfilm.tv list=FuckRKN +add address=188.114.97.1 comment=lostfilm.tv list=FuckRKN +add address=172.67.182.196 comment=rutracker.org list=FuckRKN +add address=104.21.32.39 comment=rutracker.org list=FuckRKN +add address=104.247.81.99 comment=lurkmore.to list=FuckRKN +add address=8.47.69.6 comment=dou.ua list=FuckRKN +add address=8.6.112.6 comment=dou.ua list=FuckRKN +add address=66.254.114.79 comment=youporn.com list=FuckRKN +add address=185.110.92.40 comment=pornolab.net list=FuckRKN +add address=185.110.92.41 comment=pornolab.net list=FuckRKN +add address=104.21.71.238 comment=crimerussia.com list=FuckRKN +add address=172.67.172.95 comment=crimerussia.com list=FuckRKN +add address=149.154.167.99 comment=telegram.org list=FuckRKN +add address=149.154.166.110 comment=api.telegram.org list=FuckRKN +add address=myip.ru comment="!!! Check IP (MYIP.RU) !!!" disabled=yes list=\ + NoVdsina +add address=ipinfo.io comment="!!! Check IP (IPINFO.IO) !!!" list=NoVdsina +/ip firewall filter +add action=add-src-to-address-list address-list="Honeypot Hacker" \ + address-list-timeout=12h chain=input comment="block honeypot DNS UDP" \ + connection-state=new dst-port=53 in-interface="ether1 - Unet" protocol=\ + udp src-address-list=!VDS +add action=add-src-to-address-list address-list="Honeypot Hacker" \ + address-list-timeout=4w2d chain=input comment="block honeypot DNS TCP" \ + connection-state=new dst-port=53 in-interface="ether1 - Unet" protocol=\ + tcp src-address-list=!VDS +add action=add-src-to-address-list address-list="Honeypot Hacker" \ + address-list-timeout=4w2d chain=input comment="block honeypot NTP" \ + connection-state=new dst-port=123 in-interface="ether1 - Unet" protocol=\ + udp +add action=add-src-to-address-list address-list="Honeypot Hacker" \ + address-list-timeout=4w2d chain=input comment="block honeypot asterisk" \ + connection-state=new dst-port=5060 in-interface="ether1 - Unet" protocol=\ + udp +add action=add-src-to-address-list address-list="Honeypot Hacker" \ + address-list-timeout=4w2d chain=input comment=\ + "block honeypot ssh rdp winbox" connection-state=new dst-port=22,8291 \ + in-interface-list=WAN protocol=tcp src-address-list=!TRUSTED +add action=accept chain=input comment=\ + "defconf: accept established,related,untracked" connection-state=\ + established,related,untracked +add action=drop chain=input comment="defconf: drop invalid" connection-state=\ + invalid +add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp +add action=accept chain=input comment=\ + "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \ + dst-address=127.0.0.1 in-interface=lo src-address=127.0.0.1 +add action=drop chain=input comment="defconf: drop all not coming from LAN" \ + in-interface-list=!LAN +add action=accept chain=forward comment="defconf: accept in ipsec policy" \ + disabled=yes ipsec-policy=in,ipsec +add action=accept chain=forward comment="defconf: accept out ipsec policy" \ + disabled=yes ipsec-policy=out,ipsec +add action=accept chain=forward comment=\ + "defconf: accept established,related, untracked" connection-state=\ + established,related,untracked +add action=drop chain=forward comment="defconf: drop invalid" \ + connection-state=invalid +add action=drop chain=forward comment=\ + "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \ + in-interface-list=WAN +/ip firewall mangle +add action=accept chain=prerouting dst-address-list=RFC1918 \ + in-interface-list=!WAN +add action=mark-connection chain=prerouting comment="NO VPN" disabled=yes \ + dst-address-list=NoVdsina in-interface-list=!WAN new-connection-mark=\ + To-ISP +add action=mark-routing chain=prerouting comment=All2vpn connection-mark=\ + !To-ISP disabled=yes dst-address=!89.110.101.17 dst-address-list=\ + !NoVdsina new-routing-mark=To-VPN src-address=10.30.30.0/24 \ + src-address-list=!NoWG +add action=change-mss chain=forward comment="MSS on WG" connection-mark=\ + !To-ISP disabled=yes in-interface-list=!WAN new-mss=1380 protocol=tcp \ + tcp-flags=syn tcp-mss=1381-65535 +add action=mark-routing chain=prerouting connection-mark=to-vpn-conn \ + disabled=yes new-routing-mark=To-VPN routing-mark=To-VPN src-address=\ + 10.30.30.0/24 +add action=mark-connection chain=prerouting comment=\ + "Mark VPN connections to exclude from FastTrack" disabled=yes \ + in-interface=*B log-prefix=Mark-VPN-FT new-connection-mark=\ + VPN_No_FastTrack +add action=accept chain=prerouting comment="SSH To ME" disabled=yes \ + dst-address=10.30.30.81 dst-port=2222 in-interface-list=!WAN protocol=tcp \ + src-address=10.30.30.0/24 +add action=mark-routing chain=prerouting comment="VPN Network" disabled=yes \ + dst-address=10.8.0.0/24 log-prefix=VPN-Net new-routing-mark=To-VPN \ + src-address=10.30.30.0/24 +/ip firewall nat +add action=masquerade chain=srcnat comment="Default NAT" dst-address=\ + !10.30.30.0/24 ipsec-policy=out,none out-interface="ether1 - Unet" \ + routing-mark=!To-VPN src-address=10.30.30.0/24 +add action=masquerade chain=srcnat comment="NAT for VPN" disabled=yes \ + out-interface=lo routing-mark=To-VPN +add action=dst-nat chain=dstnat comment="dst-nat for acme" dst-port=80 \ + in-interface="ether1 - Unet" protocol=tcp to-addresses=10.30.30.33 \ + to-ports=80 +add action=dst-nat chain=dstnat comment="dst-nat for amster HTTPS" dst-port=\ + 443 in-interface="ether1 - Unet" protocol=tcp to-addresses=10.30.30.33 \ + to-ports=443 +add action=dst-nat chain=dstnat comment="dst-nat for amster ssh" disabled=yes \ + dst-port=22 protocol=tcp src-address-list=VDS to-addresses=10.30.30.33 \ + to-ports=22 +add action=dst-nat chain=dstnat comment="dst-nat for amster DNS (TCP)" \ + dst-port=53 in-interface="ether1 - Unet" protocol=tcp src-address-list=\ + VDS to-addresses=10.30.30.33 to-ports=53 +add action=dst-nat chain=dstnat comment="dst-nat for amster DNS (UDP)" \ + dst-port=53 in-interface="ether1 - Unet" protocol=udp src-address-list=\ + VDS to-addresses=10.30.30.33 to-ports=53 +/ip firewall service-port +set ftp disabled=yes +set tftp disabled=yes +set irc disabled=no +set sip disabled=yes +set pptp disabled=yes +set rtsp disabled=no +/ip hotspot user profile +set [ find default=yes ] address-pool=dhcp +/ip route +add check-gateway=ping disabled=yes distance=1 dst-address=10.10.10.0/24 \ + gateway=10.30.30.33 routing-table=main scope=30 target-scope=10 +add comment=awg2all-dns disabled=yes distance=1 dst-address=10.9.0.1/32 \ + gateway="" +add comment=awg2all-dns disabled=yes distance=1 dst-address=8.8.4.4/32 \ + gateway="" +/ip service +set ftp disabled=yes +set telnet disabled=yes +set www disabled=yes port=188 +set reverse-proxy disabled=yes +set ssh port=2222 +set api disabled=yes +set api-ssl disabled=yes +/ip service webserver +set acme-plain=no crl-plain=no graphs-plain=no graphs-secure=no index-plain=\ + no index-secure=no rest-plain=no rest-secure=no scep-plain=no \ + webfig-plain=no webfig-secure=no +/ip ssh +set forwarding-enabled=both publickey-authentication-options=verify-required \ + strong-crypto=yes +/ip upnp +set enabled=yes +/ip upnp interfaces +add interface="ether1 - Unet" type=external +/ipv6 firewall filter +add action=accept chain=input comment=\ + "defconf: accept established,related,untracked" connection-state=\ + established,related,untracked disabled=yes +add action=drop chain=input comment="defconf: drop invalid" connection-state=\ + invalid disabled=yes +add action=accept chain=input comment="defconf: accept ICMPv6" disabled=yes \ + protocol=icmpv6 +add action=accept chain=input comment="defconf: accept UDP traceroute" \ + disabled=yes dst-port=33434-33534 protocol=udp +add action=accept chain=input comment=\ + "defconf: accept DHCPv6-Client prefix delegation." disabled=yes dst-port=\ + 546 protocol=udp src-address=fe80::/10 +add action=accept chain=input comment="defconf: accept IKE" disabled=yes \ + dst-port=500,4500 protocol=udp +add action=accept chain=input comment="defconf: accept ipsec AH" disabled=yes \ + protocol=ipsec-ah +add action=accept chain=input comment="defconf: accept ipsec ESP" disabled=\ + yes protocol=ipsec-esp +add action=accept chain=input comment=\ + "defconf: accept all that matches ipsec policy" disabled=yes \ + ipsec-policy=in,ipsec +add action=drop chain=input comment=\ + "defconf: drop everything else not coming from LAN" disabled=yes \ + in-interface-list=!LAN +add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \ + connection-state=established,related +add action=accept chain=forward comment=\ + "defconf: accept established,related,untracked" connection-state=\ + established,related,untracked +add action=drop chain=forward comment="defconf: drop invalid" \ + connection-state=invalid +add action=drop chain=forward comment=\ + "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6 +add action=drop chain=forward comment=\ + "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6 +add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \ + hop-limit=equal:1 protocol=icmpv6 +add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\ + icmpv6 +add action=accept chain=forward comment="defconf: accept HIP" protocol=139 +add action=accept chain=forward comment="defconf: accept IKE" dst-port=\ + 500,4500 protocol=udp +add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\ + ipsec-ah +add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\ + ipsec-esp +add action=accept chain=forward comment=\ + "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec +add action=drop chain=forward comment=\ + "defconf: drop everything else not coming from LAN" in-interface-list=\ + !LAN +/system clock +set time-zone-autodetect=no time-zone-name=Europe/Moscow +/system identity +set name=MikroMaster +/system ntp client +set enabled=yes +/system ntp server +set enabled=yes manycast=yes multicast=yes use-local-clock=yes +/system ntp client servers +add address=time.google.com +/system scheduler +add comment="Every Day Set Global Environment Variables" name=AM-SetGlobalEnv \ + on-event="/system/script { run AM-GlobalConfig; run AM-GlobalFunc; }" \ + policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ + start-time=startup +add comment="Every Day Check For Update Scripts" interval=1d name=\ + AM-ScriptInstallUpdate on-event=\ + ":global ScriptInstallUpdate; \$ScriptInstallUpdate;" policy=\ + ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ + start-time=startup +/tool e-mail +set certificate-verification=no from=MikroVados port=587 \ + server=smtp.mail.me.com tls=starttls user=vadossio@icloud.com +/tool netwatch +add comment="doh-fallback, doh-url=https://security.cloudflare-dns.com/dns-que\ + ry, doh-cert=DigiCert Global Root CA, notify, name=CloudFlare-doh IPv4 1" \ + disabled=yes host=1.1.1.1 type=simple +add comment="doh, doh-url=https://security.cloudflare-dns.com/dns-query, doh-c\ + ert=DigiCert Global Root CA, notify, name=CloudFlare-doh IPv4 2" \ + disabled=yes host=1.0.0.1 type=simple +add comment="doh-fallback, dns-fallback, doh-url=https://dns.google/dns-query,\ + \_doh-cert=DigiCert Global Root G2, notify, name=Google-doh IPv4 1" \ + disabled=yes host=8.8.8.8 type=simple +add comment="doh-fallback, dns-fallback, doh-url=https://dns.google/dns-query,\ + \_doh-cert=DigiCert Global Root G2, notify, name=Google-doh IPv4 2" \ + disabled=yes host=8.8.4.4 type=simple +add comment="doh-fallback, dns-fallback, doh-url=https://dns.quad9.net/dns-que\ + ry, doh-cert=DigiCert Global Root G3, notify, name=Cuad9-doh IPv4 1" \ + disabled=yes host=9.9.9.9 type=simple +add comment="doh-fallback, dns-fallback, doh-url=https://dns.quad9.net/dns-que\ + ry, doh-cert=DigiCert Global Root G3, notify, name=Cuad9-doh IPv4 2" \ + disabled=yes host=149.112.112.112 type=simple +add comment="dns, notify, name=ns1.unet.ws" disabled=yes host=91.192.189.2 \ + type=simple +/user aaa +set accounting=no diff --git a/MikroMaster/history/20260817/20260817110002-Diff-Config.rsc b/MikroMaster/history/20260817/20260817110002-Diff-Config.rsc new file mode 100644 index 0000000..e9e6f10 --- /dev/null +++ b/MikroMaster/history/20260817/20260817110002-Diff-Config.rsc @@ -0,0 +1,3690 @@ +1,2c1,2 +< # 2026-08-17 11:00:03 by RouterOS 7.23.3 +< # software id = 2961-C4ZZ +--- +> # 2026-07-15 07:40:20 by RouterOS 7.23.1 +> # software id = A8L5-07YF +4,5c4,5 +< # model = RBD52G-5HacD2HnD +< # serial number = HCX084RAVFA +--- +> # model = RB952Ui-5ac2nD +> # serial number = D3D50CEDCD38 +7,12c7,9 +< add name=Bridge-Lan +< /interface wireless +< # managed by CAPsMAN +< set [ find default-name=wlan1 ] ssid=MikroTik +< # managed by CAPsMAN +< set [ find default-name=wlan2 ] ssid=MikroTik +--- +> add admin-mac=48:8F:5A:8E:1A:BF auto-mac=no dhcpv6-agent-circuit-id=\ +> "\$(INTERFACE):\$(VID)" dhcpv6-agent-remote-id="\$(BRIDGEMAC)" name=\ +> Bridge-LAN port-cost-mode=short +14,15c11,30 +< set [ find default-name=ether1 ] mac-address=48:8F:5A:8E:1A:BC name=\ +< "ether1 - Unet" +--- +> set [ find default-name=ether1 ] advertise="10M-baseT-half,10M-baseT-full,100M\ +> -baseT-half,100M-baseT-full,1G-baseT-full,1G-baseX" comment=Unet-cable \ +> loop-protect=on name=Unet-ether1 rx-flow-control=auto tx-flow-control=\ +> auto +> set [ find default-name=ether2 ] comment=LAN-2 +> set [ find default-name=ether3 ] advertise="10M-baseT-half,10M-baseT-full,100M\ +> -baseT-half,100M-baseT-full,1G-baseT-full,1G-baseX" comment=LAN-3 +> set [ find default-name=ether4 ] comment=LAN-4 +> set [ find default-name=ether5 ] advertise="10M-baseT-half,10M-baseT-full,100M\ +> -baseT-half,100M-baseT-full,1G-baseT-full,1G-baseX" comment=LAN-5 \ +> loop-protect=on poe-out=off rx-flow-control=auto tx-flow-control=auto +> /interface wireless +> set [ find default-name=wlan1 ] country=belarus disabled=no mode=ap-bridge \ +> ssid=vados wireless-protocol=802.11 +> set [ find default-name=wlan2 ] country=belarus disabled=no mode=ap-bridge \ +> ssid=vados5g wireless-protocol=802.11 +> /interface wireguard +> add comment=WG listen-port=13231 mtu=1360 name=WG +> add comment="WG interface for Amnezia route" disabled=yes listen-port=33033 \ +> mtu=1360 name=wg-nuc +17,19c32,33 +< add comment=defconf name=WAN +< add comment=defconf name=LAN +< add exclude=LAN include=WAN name=Internet +--- +> add include=static name=LAN +> add name=Internet +21c35,38 +< set [ find default=yes ] supplicant-identity=MikroTik +--- +> set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\ +> dynamic-keys supplicant-identity=MikroTik +> /iot wiliot servers +> set *1 address=mqtt.us-east-2.prod.wiliot.cloud name="Wiliot US East" +39a57 +> add name=iVados options=HostName +41,47c59,70 +< add dns-servers=1.1.1.1,1.0.0.1 name=blsp.at verify-doh-cert=no +< add comment=Kra dns-servers=1.0.0.1,1.1.1.1 name=slon2.to verify-doh-cert=no +< add dns-servers=1.1.1.1,1.0.0.1 name=slon3.at verify-doh-cert=no +< add dns-servers=1.0.0.1,1.1.1.1 name=slon3.cc verify-doh-cert=no +< add dns-servers=1.1.1.1,1.0.0.1 name=bs2web.at verify-doh-cert=no +< add dns-servers=1.1.1.1,1.0.0.1 name=bs2best.at verify-doh-cert=no +< add dns-servers=1.0.0.1,1.1.1.1 name=psrms.is verify-doh-cert=no +--- +> add disabled=yes dns-servers=1.0.0.1,1.1.1.1 name=blsp.at verify-doh-cert=no +> add comment=Kra disabled=yes dns-servers=1.0.0.1,1.1.1.1 name=slon2.to \ +> verify-doh-cert=no +> add disabled=yes dns-servers=1.1.1.1,1.0.0.1 name=slon3.at verify-doh-cert=no +> add disabled=yes dns-servers=1.0.0.1,1.1.1.1 name=slon3.cc verify-doh-cert=no +> add disabled=yes dns-servers=1.1.1.1,1.0.0.1 name=bs2web.at verify-doh-cert=\ +> no +> add disabled=yes dns-servers=1.1.1.1,1.0.0.1 name=bs2best.at verify-doh-cert=\ +> no +> add disabled=yes dns-servers=1.0.0.1,1.1.1.1 name=psrms.is verify-doh-cert=no +> /ip ipsec proposal +> set [ find default=yes ] disabled=yes +49c72 +< add name=dhcp ranges=10.30.30.150-10.30.30.200 +--- +> add name=dhcp ranges=10.30.30.83-10.30.30.254 +51,52c74,76 +< add address-pool=dhcp bootp-support=dynamic dhcp-option-set=domain-search-set \ +< interface=Bridge-Lan name=masterDHCP server-address=10.30.30.81 +--- +> add add-arp=yes address-pool=dhcp always-broadcast=yes bootp-support=none \ +> dhcp-option-set=domain-search-set interface=Bridge-LAN lease-time=10m \ +> name=masterDHCP server-address=10.30.30.81 +55a80,93 +> /ipv6 dhcp-client option +> add code=119 name=domain-search-list value="0x03'WORKGROUP'0x00" +> add code=12 name=HostName value="\$(HOSTNAME)" +> add code=61 name=DUID value=0x00030001488f5a8e1abc +> add code=61 name=clientid +> /ipv6 dhcp-server option +> add code=119 name=domain-search-list value="0x03'WORKGROUP'0x00" +> add code=12 name=HostName value="\$(HOSTNAME)" +> add code=61 name=CLIENT_DUID +> add code=61 name=CLIENT_MAC +> /ppp profile +> set *FFFFFFFE use-upnp=no +> /routing bgp template +> set default disabled=no output.network=bgp-networks +57c95,98 +< add disabled=yes fib name=To-VPN +--- +> add disabled=no fib name=To-VPN +> add disabled=yes name=r_to_vpn +> /system logging action +> add email-start-tls=yes email-to=vados@vados.ru name=email target=email +59,63c100,111 +< add dont-require-permissions=no name=fetchCustom owner=admin policy=\ +< ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\ +< \n\ +< \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@10\ +< .30.30.10.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.10.pub\";\ +--- +> add dont-require-permissions=no name=fetchCustom owner=vados policy=\ +> ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\ +> global GlobalScriptsUrl \"https://ros.vados.ru/\";\r\ +> \n\r\ +> \n#/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@1\ +> 0.30.30.86.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.86.pub\";\ +> \n\r\ +> \n#:local Script AM-setup\ +> \n;\r\ +> \n#/system/script/add name=\$Script owner=\$Script source=([ /tool/fetch c\ +> heck-certificate=yes-without-crl url=(\$GlobalScriptsUrl . \$Script . \".r\ +> sc\") output=user as-value ]->\"data\");\r\ +64a113 +> \n#/usb1/mikro_bak_rsa.pub\ +65a115 +> \n\r\ +66a117,121 +> \n\r\ +> \n#/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@1\ +> 0.30.30.10.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.10.pub\";\ +> \n\r\ +> \n#\r\ +70,71c125 +< \n\ +< \n\ +--- +> \n\r\ +73,74c127 +< .30.30.81.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.81.pub\";\ +< \n\ +--- +> .30.30.81.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.81.pub\";\r\ +77c130 +< \n\ +--- +> \n\r\ +80c133 +< sc\") output=user as-value ]->\"data\");\ +--- +> sc\") output=user as-value ]->\"data\");\r\ +83,84d135 +< \n\ +< \n\ +87,90c138,140 +< \n\ +< \n\ +< \n:global GlobalScriptsUrl \"https://ros.vados.ru/tmp/\";\ +< \n\ +--- +> \n\r\ +> \n\r\ +> \n#\ +91a142 +> \n\r\ +92a144,145 +> \n#:local FetchFile Binary.backup\ +> \n:local localDir \"\";\ +94,101c147,148 +< \n:local FetchFile Manager@id_rsa.pub\ +< \n:local localDir \"/\";\ +< \n\ +< \n\ +< \n\ +< \n\$MkDir \$localDir;\ +< \n\ +< \n\ +--- +> \n\r\ +> \n#\$MkDir \$localDir;\r\ +102a150 +> \n#\ +104c152 +< \$localDir . \$FetchFile);\ +--- +> \$localDir . \$FetchFile);\r\ +293c341,2276 +< add comment=GENERATOR dont-require-permissions=no name=awg2vds owner=vados \ +--- +> add comment="Global functions" dont-require-permissions=no name=AM-GlobalFunc \ +> owner=AM-GlobalFunc policy=\ +> ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\ +> !rsc by Vados\r\ +> \n# RouterOS script: AM-GglobalFunc\r\ +> \n# Script comment: Global functions\r\ +> \n# Copyright (c) 2005-2026 Vados \r\ +> \n#\r\ +> \n#\r\ +> \n# requires RouterOS, version=7.19\r\ +> \n# requires device-mode, fetch, scheduler\r\ +> \n:local ExitOK false;\r\ +> \n:local ScriptName [ :jobname ];\r\ +> \n#:global checkRunJob \$SriptName;\r\ +> \n#:global fixCRLF;\r\ +> \n#:if (\$fixCRLF != false) do={\r\ +> \n#:foreach fixScript in=([ /system/script/find where name~\"*\" ]) do={/s\ +> ystem/script/set source=[ :tocrlf [ get \$fixScript source ] ] \$fixScript\ +> }\r\ +> \n#:if (\$fixCRLF != \"LF\") do={ /system/script/set source=[ :tocrlf [ g\ +> et \$fixScript source ] ] \$fixScript};};\r\ +> \n#}\r\ +> \n:global GlobalFuncReady false;\r\ +> \n\r\ +> \n# Git commit id & info, expected configuration version\r\ +> \n:global CommitId \"main/729/f42d43ae\";\r\ +> \n:global CommitTAG \"unknown\";\r\ +> \n:global CommitInfo \"Autocommit in repo: ros.vados.ru, generated by owne\ +> r: root, in 00:05:03 01.07.2026.\";\r\ +> \n\r\ +> \n# The variables are received right here.\r\ +> \n:global GlobalConfVersion 140;\r\ +> \n\r\ +> \n:global SumsDirAndFileName \"tmp/checksums.json\";\r\ +> \n\r\ +> \n:global Identity [/system/identity/get name];\r\ +> \n:global IdentityShort [:pick \$Identity 0 18];\r\ +> \n\r\ +> \n:global devBoardName [/system/resource/get board-name];\r\ +> \n:global devMode [/system/device-mode/get mode];\r\ +> \n:global devCurArch [/system/resource/get architecture-name];\r\ +> \n:global devCurVersion [/system/resource/get version];\r\ +> \n\r\ +> \n# Variables defined in AM-GlobalConfig.rsc\r\ +> \n:global TerminalColorOutput;\r\ +> \n:global CommentsInScripts;\r\ +> \n:global DetectIpAddrDefault;\r\ +> \n:global DetectIpAddrFallback;\r\ +> \n:global updateChannel;\r\ +> \n:global Domain;\r\ +> \n:global EmailGeneralTo;\r\ +> \n:global BackupAndUpdateMode;\r\ +> \n\r\ +> \n# Single functions, without nested functions.\r\ +> \n:global MiniDateTimeStamp;\r\ +> \n:global MicroDateTimeStamp;\r\ +> \n\r\ +> \n# Include globals \$PrintDebug and \$PrintDebugOverride\r\ +> \n:global LogPrint;\r\ +> \n\r\ +> \n# DeviceInfo and Updates\r\ +> \n:global IsCheckUpdates;\r\ +> \n:global WaitCheckUpdates;\r\ +> \n:global GetPubIp;\r\ +> \n\r\ +> \n:global GetArrDeviceInfo;\r\ +> \n:global WaitArrDeviceInfo;\r\ +> \n\r\ +> \n:global devModel;\r\ +> \n:global devRunningMode;\r\ +> \n\r\ +> \n:global devRbRevision;\r\ +> \n:global devRbSerialNumber;\r\ +> \n:global devRbVerAvail;\r\ +> \n\r\ +> \n:global runningChannelVersion;\r\ +> \n:global runningChannel;\r\ +> \n:global runningVersion;\r\ +> \n\r\ +> \n:global devBuildTime;\r\ +> \n:global ROsVerAvail;\r\ +> \n:global PkgUpdStatus;\r\ +> \n:global currentUpdateChannel;\r\ +> \n\r\ +> \n:global ScriptInstallUpdate;\r\ +> \n\r\ +> \n:global DeviceInfo;\r\ +> \n\r\ +> \n:global OldMode;\r\ +> \n\r\ +> \n:global ParseKeyValueStore;\r\ +> \n:global RandomDelay;\r\ +> \n:global GetRandomNumber;\r\ +> \n:global EscapeForRegEx;\r\ +> \n:global CharacterMultiply;\r\ +> \n:global CharacterReplace;\r\ +> \n:global CleanFilePath;\r\ +> \n:global CleanName;\r\ +> \n\r\ +> \n:global CommitBrief;\r\ +> \n\r\ +> \n:global EitherOr;\r\ +> \n:global FormatLine;\r\ +> \n:global GetRandom20CharAlNum;\r\ +> \n:global GetRandom20CharHex;\r\ +> \n:global GetRandomNumber;\r\ +> \n:global Grep;\r\ +> \n:global IfThenElse;\r\ +> \n:global MAX;\r\ +> \n:global MIN;\r\ +> \n:global HumanReadableNum;\r\ +> \n\r\ +> \n:global IsFullyConnected;\r\ +> \n:global IsDNSResolving;\r\ +> \n:global IsTimeSync;\r\ +> \n:global IsTimeSyncCached;\r\ +> \n:global IsTimeSyncResetNtp;\r\ +> \n\r\ +> \n:global MkDir;\r\ +> \n:global RmDir;\r\ +> \n:global RmFile;\r\ +> \n:global FileGet;\r\ +> \n:global Unix2Dos;\r\ +> \n:global UrlEncode;\r\ +> \n:global WaitForFile;\r\ +> \n:global ScriptLock;\r\ +> \n:global SendTelegram;\r\ +> \n:global NotificationFunctions;\r\ +> \n:global SendNotification;\r\ +> \n:global SendNotification2;\r\ +> \n:global SymbolForNotification;\r\ +> \n:global SymbolByUnicodeName;\r\ +> \n:global ValidateSyntax;\r\ +> \n:global CheckSumsVerify;\r\ +> \n:global GlobalConfChanges;\r\ +> \n:global GlobalConfMigration;\r\ +> \n:global VersionToNum;\r\ +> \n:global RequiredRouterOS;\r\ +> \n:global ExitError;\r\ +> \n:global ExitOnError;\r\ +> \n\r\ +> \n:global FetchHugeFiles;\r\ +> \n:global FetchUserAgentStr;\r\ +> \n:global FileExists;\r\ +> \n:global CertificateAvailable;\r\ +> \n:global CertificateDownload;\r\ +> \n:global CertificateNameByCN;\r\ +> \n:global CharacterMultiply;\r\ +> \n\r\ +> \n:global InspectVar;\r\ +> \n:global InspectVarRet;\r\ +> \n:global ParseCustom;\r\ +> \n\r\ +> \n:set IsCheckUpdates do={\r\ +> \n :local isInfo [:tobool \$1];\r\ +> \n :global updateChannel;\r\ +> \n :global PkgUpdStatus;\r\ +> \n :global currentUpdateChannel;\r\ +> \n :global ROsVerAvail;\r\ +> \n :global arrDeviceInfo;\r\ +> \n :log info (\$0 . \" \\\$isInfo = \" . \$isInfo); \r\ +> \n :local CurrentChannel [ /system/package/update/get channel ];\r\ +> \n :if ([ :len \$updateChannel ] > 0 && \$CurrentChannel != \$updateChann\ +> el) do={\r\ +> \n :retry command={/system/package/update set channel=\$updateChannel} \ +> \_delay=300ms max=5 on-error={};\r\ +> \n :log info (\$0 . \" Set updates channel to: \$updateChannel\");\r\ +> \n }\r\ +> \n :local Update [ /system/package/update/get ];\r\ +> \n :local Channel [ :tostr (\$Update->\"channel\") ];\r\ +> \n :set currentUpdateChannel \$Channel;\r\ +> \n :log info (\$0 . \" Update Channel: \" . \$Channel . \".\");\r\ +> \n :local StatusPkg \"undefined\";\r\ +> \n :log info (\$0 . \" Checking for updates...\");\r\ +> \n :retry command={:set \$StatusPkg ([/system/package/update/check-for-up\ +> dates without-paging as-value]->\"status\")} \\\r\ +> \n delay=300ms max=5 on-error={};\r\ +> \n :log info (\$0 . \" \\\$StatusPkg = \" . \$StatusPkg);\r\ +> \n :if (\$StatusPkg = \"New version is available\") do={ :set PkgUpdStatu\ +> s true; } else={ :set PkgUpdStatus false; }\r\ +> \n :set ROsVerAvail [ :tostr [ /system/package/update/get latest-version \ +> ] ];\r\ +> \n :log info (\$0 . \" \\\$PkgUpdStatus = \" . \$PkgUpdStatus);\r\ +> \n :if (\$isInfo != false || \$PkgUpdStatus = true) do={\r\ +> \n :log info (\$0 . \" \\\$PkgUpdStatus = \" . \$PkgUpdStatus);\r\ +> \n :if ([ :typeof \$arrDeviceInfo ] != \"array\") do={\r\ +> \n :set arrDeviceInfo [:toarray \$arrDeviceInfo];\r\ +> \n }\r\ +> \n :retry command={:set (\$arrDeviceInfo->\"devUpdates\") [ /system/pac\ +> kage/update/get ]} delay=500ms max=5 on-error={:log error (\"Error\")};\r\ +> \n :return true;\r\ +> \n } else={\r\ +> \n :return \$PkgUpdStatus;\r\ +> \n }\r\ +> \n}\r\ +> \n\r\ +> \n:set WaitCheckUpdates do={\r\ +> \n :global IsCheckUpdates;\r\ +> \n :global PkgUpdStatus;\r\ +> \n :global currentUpdateChannel;\r\ +> \n :global ROsVerAvail;\r\ +> \n :global arrDeviceInfo;\r\ +> \n :local Status \"\";\r\ +> \n :local Update;\r\ +> \n :local WaitCount 0;\r\ +> \n :if ([ \$IsCheckUpdates true ] = false) do={\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :set Status [ :tostr [ /system/package/update/get status ] ];\r\ +> \n :while ((\$Status = \"\" || \$Status = \"finding out latest version...\ +> \") && \$WaitCount < 60) do={\r\ +> \n :delay 1s;\r\ +> \n :set WaitCount (\$WaitCount + 1);\r\ +> \n :set Status [ :tostr [ /system/package/update/get status ] ];\r\ +> \n }\r\ +> \n :set Update [ /system/package/update/get ];\r\ +> \n :set currentUpdateChannel [ :tostr (\$Update->\"channel\") ];\r\ +> \n :set ROsVerAvail [ :tostr (\$Update->\"latest-version\") ];\r\ +> \n :if ((\$Update->\"status\") = \"New version is available\") do={\r\ +> \n :set PkgUpdStatus true;\r\ +> \n } else={\r\ +> \n :set PkgUpdStatus false;\r\ +> \n }\r\ +> \n :if ([ :typeof \$arrDeviceInfo ] != \"array\") do={\r\ +> \n :set arrDeviceInfo [:toarray \$arrDeviceInfo];\r\ +> \n }\r\ +> \n :set (\$arrDeviceInfo->\"devUpdates\") \$Update;\r\ +> \n :if (\$Status = \"\" || \$Status = \"finding out latest version...\") \ +> do={\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set WaitArrDeviceInfo do={\r\ +> \n :global GetArrDeviceInfo;\r\ +> \n :while ([ \$GetArrDeviceInfo ] = false) do={\r\ +> \n :delay 1s;\r\ +> \n }\r\ +> \n}\r\ +> \n\r\ +> \n:set GetArrDeviceInfo do={\r\ +> \n :global LogPrint;\r\ +> \n :global arrDeviceInfo;\r\ +> \n :global devBoardName;\r\ +> \n :global devModel;\r\ +> \n :global devRunning;\r\ +> \n :global devCurArch;\r\ +> \n :global devRbRevision;\r\ +> \n :global devRbSerialNumber;\r\ +> \n :global devBuildTime;\r\ +> \n :global runningChannelVersion;\r\ +> \n :global runningChannel;\r\ +> \n :global runningVersion;\r\ +> \n :global currentUpdateChannel;\r\ +> \n :global ROsVerAvail;\r\ +> \n\r\ +> \n :local DeviceInfo;\r\ +> \n :local Resource [/system/resource/get];\r\ +> \n :local Update [ /system/package/update/get ];\r\ +> \n :local VersionString [ :tostr (\$Resource->\"version\") ];\r\ +> \n :local ChannelStart [ :find \$VersionString \" (\" ];\r\ +> \n :local RouterBoard;\r\ +> \n :local IsRouterBoard false;\r\ +> \n :local RunningMode \"\";\r\ +> \n\r\ +> \n :set devCurArch [ :tostr (\$Resource->\"architecture-name\") ];\r\ +> \n :set devBuildTime [ :tostr (\$Resource->\"build-time\") ];\r\ +> \n :set runningChannelVersion \$VersionString;\r\ +> \n :set runningVersion \$VersionString;\r\ +> \n :set runningChannel \"\";\r\ +> \n\r\ +> \n :if ([ :typeof \$ChannelStart ] = \"num\" && \$ChannelStart >= 0) do=\ +> {\r\ +> \n :set runningVersion [ :pick \$VersionString 0 \$ChannelStart ];\r\ +> \n :local ChannelRest [ :pick \$VersionString (\$ChannelStart + 2) [ :\ +> len \$VersionString ] ];\r\ +> \n :local ChannelEnd [ :find \$ChannelRest \")\" ];\r\ +> \n :if ([ :typeof \$ChannelEnd ] = \"num\" && \$ChannelEnd >= 0) do={\ +> \r\ +> \n :set runningChannel [ :pick \$ChannelRest 0 \$ChannelEnd ];\r\ +> \n }\r\ +> \n }\r\ +> \n\r\ +> \n :if ([:pick \$devBoardName 0 3] != \"CHR\" or [:pick \$devBoardName 0\ +> \_3] != \"x86\") do={\r\ +> \n :do {\r\ +> \n :set RouterBoard [[ :parse \"/system/routerboard/get\" ]];\r\ +> \n# :set RouterBoard [ /system/routerboard/get ];\r\ +> \n :if ((\$RouterBoard->\"routerboard\") = true) do={\r\ +> \n :set IsRouterBoard true;\r\ +> \n }\r\ +> \n } on-error={}\r\ +> \n }\r\ +> \n\r\ +> \n :do {\r\ +> \n :set RunningMode [ /system/device-mode/get mode ];\r\ +> \n } on-error={\r\ +> \n :do {\r\ +> \n :set RunningMode [ /system/device-mode/get running ];\r\ +> \n } on-error={\r\ +> \n :set RunningMode \"\";\r\ +> \n }\r\ +> \n }\r\ +> \n :set devRunning \$RunningMode;\r\ +> \n\r\ +> \n :if (\$IsRouterBoard = true) do={\r\ +> \n :set devModel [ :tostr (\$RouterBoard->\"model\") ];\r\ +> \n :set devRbRevision [ :tostr (\$RouterBoard->\"revision\") ];\r\ +> \n :set devRbSerialNumber [ :tostr (\$RouterBoard->\"serial-number\") \ +> ];\r\ +> \n } else={\r\ +> \n :set devModel \$devBoardName;\r\ +> \n :set devRbRevision \"\";\r\ +> \n :set devRbSerialNumber \"\";\r\ +> \n }\r\ +> \n\r\ +> \n :set currentUpdateChannel [ :tostr (\$Update->\"channel\") ];\r\ +> \n :set ROsVerAvail [ :tostr (\$Update->\"latest-version\") ];\r\ +> \n\r\ +> \n :set (\$DeviceInfo->\"board-name\") \$devBoardName;\r\ +> \n :set (\$DeviceInfo->\"architecture-name\") \$devCurArch;\r\ +> \n :set (\$DeviceInfo->\"model\") \$devModel;\r\ +> \n :set (\$DeviceInfo->\"revision\") \$devRbRevision;\r\ +> \n :set (\$DeviceInfo->\"serial-number\") \$devRbSerialNumber;\r\ +> \n :set (\$DeviceInfo->\"running-mode\") \$devRunning;\r\ +> \n :set (\$DeviceInfo->\"build-time\") \$devBuildTime;\r\ +> \n :set (\$DeviceInfo->\"running-channel-version\") \$runningChannelVers\ +> ion;\r\ +> \n :set (\$DeviceInfo->\"running-version\") \$runningVersion;\r\ +> \n :set (\$DeviceInfo->\"running-channel\") \$runningChannel;\r\ +> \n :set (\$DeviceInfo->\"routerboard\") \$IsRouterBoard;\r\ +> \n :set (\$DeviceInfo->\"current-firmware\") [ :tostr (\$RouterBoard->\"\ +> current-firmware\") ];\r\ +> \n :set (\$DeviceInfo->\"upgrade-firmware\") [ :tostr (\$RouterBoard->\"\ +> upgrade-firmware\") ];\r\ +> \n :set (\$DeviceInfo->\"package-channel\") \$currentUpdateChannel;\r\ +> \n :set (\$DeviceInfo->\"installed-version\") [ :tostr (\$Update->\"inst\ +> alled-version\") ];\r\ +> \n :set (\$DeviceInfo->\"latest-version\") \$ROsVerAvail;\r\ +> \n :set (\$DeviceInfo->\"update-status\") [ :tostr (\$Update->\"status\"\ +> ) ];\r\ +> \n\r\ +> \n :set arrDeviceInfo \$DeviceInfo;\r\ +> \n :return \$DeviceInfo;\r\ +> \n}\r\ +> \n\r\ +> \n:set DeviceInfo do={\r\ +> \n :global GetArrDeviceInfo;\r\ +> \n :global GlobalConfVersion;\r\ +> \n :global Identity;\r\ +> \n :global IfThenElse;\r\ +> \n :global FormatLine;\r\ +> \n :global CommitBrief;\r\ +> \n\r\ +> \n :local License [/system/license/get];\r\ +> \n :local Snmp [ /snmp/get ];\r\ +> \n :local Info [ \$GetArrDeviceInfo ];\r\ +> \n\r\ +> \n :if ([ :typeof \$Info ] != \"array\") do={\r\ +> \n :return false;\r\ +> \n }\r\ +> \n\r\ +> \n :return ( \\\r\ +> \n [ \$FormatLine \"Hostname\" \$Identity ] . \"\\n\" . \\\r\ +> \n [ \$IfThenElse ([ :len (\$Snmp->\"location\") ] > 0) \\\r\ +> \n ([ \$FormatLine \"Location\" (\$Snmp->\"location\") ] . \"\\n\") ]\ +> \_. \\\r\ +> \n [ \$IfThenElse ([ :len (\$Snmp->\"contact\") ] > 0) \\\r\ +> \n ([ \$FormatLine \"Contact\" (\$Snmp->\"contact\") ] . \"\\n\") ] .\ +> \_\\\r\ +> \n \"Hardware:\\n\" . \\\r\ +> \n [ \$FormatLine \" Board\" (\$Info->\"board-name\") ] . \"\\n\" . \ +> \\\r\ +> \n [ \$FormatLine \" Arch\" (\$Info->\"architecture-name\") ] . \"\\\ +> n\" . \\\r\ +> \n [ \$FormatLine \" Model\" (\$Info->\"model\") ] . \\\r\ +> \n [ \$IfThenElse ([ :len (\$Info->\"revision\") ] > 0) \\\r\ +> \n (\" \" . (\$Info->\"revision\")) ] . \"\\n\" . \\\r\ +> \n [ \$IfThenElse ([ :len (\$Info->\"serial-number\") ] > 0) \\\r\ +> \n ([ \$FormatLine \" Serial\" (\$Info->\"serial-number\") ] . \"\ +> \\n\") ] . \\\r\ +> \n [ \$IfThenElse ([ :len (\$License->\"nlevel\") ] > 0) \\\r\ +> \n ([ \$FormatLine \" License\" (\"level \" . (\$License->\"nlevel\ +> \")) ] . \"\\n\") ] . \\\r\ +> \n \"RouterOS:\\n\" . \\\r\ +> \n [ \$IfThenElse ([ :len (\$License->\"level\") ] > 0) \\\r\ +> \n ([ \$FormatLine \" License\" (\"level \" . (\$License->\"level\ +> \")) ] . \"\\n\") ] . \\\r\ +> \n [ \$FormatLine \" Channel\" (\$Info->\"package-channel\") ] . \"\ +> \\n\" . \\\r\ +> \n [ \$FormatLine \" Installed\" (\$Info->\"installed-version\") ] .\ +> \_\"\\n\" . \\\r\ +> \n [ \$IfThenElse ([ :len (\$Info->\"running-channel\") ] > 0) \\\r\ +> \n ([ \$FormatLine \" Running\" ((\$Info->\"running-version\") . \ +> \" (\" . (\$Info->\"running-channel\") . \")\") ] . \"\\n\") \\\r\ +> \n ([ \$FormatLine \" Running\" (\$Info->\"running-version\") ] . \ +> \"\\n\") ] . \\\r\ +> \n [ \$IfThenElse ([ :len (\$Info->\"latest-version\") ] > 0 && \\\r\ +> \n (\$Info->\"installed-version\") != (\$Info->\"latest-version\"))\ +> \_\\\r\ +> \n ([ \$FormatLine \" Available\" (\$Info->\"latest-version\") ] .\ +> \_\"\\n\") ] . \\\r\ +> \n [ \$IfThenElse ((\$Info->\"routerboard\") = true && \\\r\ +> \n (\$Info->\"current-firmware\") != (\$Info->\"upgrade-firmware\")\ +> ) \\\r\ +> \n ([ \$FormatLine \" Firmware\" ((\$Info->\"current-firmware\") .\ +> \_\" -> \" . (\$Info->\"upgrade-firmware\")) ] . \"\\n\") ] . \\\r\ +> \n \"RouterOS-Scripts:\\n\" . \\\r\ +> \n [ \$FormatLine \" Commit\" [ \$CommitBrief ] ] . \"\\n\" . \\\r\ +> \n [ \$FormatLine \" Version\" \$GlobalConfVersion ]);\r\ +> \n}\r\ +> \n\r\ +> \n:if ([ :typeof \$NotificationFunctions ] != \"array\") do={:set Notifica\ +> tionFunctions ({})}\r\ +> \n\r\ +> \n:set GetRandom20CharAlNum do={\r\ +> \n :global EitherOr;\r\ +> \n :return [ :rndstr length=[ \$EitherOr [ :tonum \$1 ] 20 ] from=\"ABCDE\ +> FGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\" ];\r\ +> \n}\r\ +> \n\r\ +> \n:set GetRandom20CharHex do={:global EitherOr; :return [ :rndstr length=[\ +> \_\$EitherOr [ :tonum \$1 ] 20 ] from=\"0123456789abcdef\" ]; }\r\ +> \n:set GetRandomNumber do={:global EitherOr; :return [ :rndnum from=0 to=[\ +> \_\$EitherOr [ :tonum \$1 ] 4294967295 ] ]; }\r\ +> \n\r\ +> \n:global checkRunJob;\r\ +> \n:set checkRunJob do={\r\ +> \n :local Script [ :tostr \$1 ];\r\ +> \n :global ScriptLock; \r\ +> \n :if ([ \$ScriptLock \$Script ] = false) do={:return false}\r\ +> \n :foreach Job in=[ /system/script/job/find where script=\$Script ] do={\ +> :set Job [ /system/script/job/get \$Job ];\r\ +> \n :while ([ :typeof (\$Job->\"parent\") ] = \"id\") do={:set Job [ /sy\ +> stem/script/job/get [ find where .id=(\$Job->\"parent\") ] ]}\r\ +> \n :if ((\$Job->\"type\") = \"login\") do={:return true};}; :return fa\ +> lse; \r\ +> \n}\r\ +> \n\r\ +> \n:set InspectVar do={\r\ +> \n :global InspectVarRet;\r\ +> \n :put [ :tocrlf [ \$InspectVarRet \$1 ] ];\r\ +> \n}\r\ +> \n\r\ +> \n:set CommitBrief do={\r\ +> \n :global CommitId;\r\ +> \n :global CommitInfo;\r\ +> \n :if (\$CommitId = \"unknown\") do={\r\ +> \n :return \"unknown\";\r\ +> \n }\r\ +> \n :return (\$CommitInfo . \"/\" . [ :pick \$CommitId 0 8 ]);\r\ +> \n}\r\ +> \n\r\ +> \n:set InspectVarRet do={\r\ +> \n :local Input \$1;\r\ +> \n :local Level (0 + [ :tonum \$2 ]);\r\ +> \n :global CharacterReplace;\r\ +> \n :global IfThenElse;\r\ +> \n :global InspectVarRet;\r\ +> \n :local IndentReturn do={\r\ +> \n :local Prefix [ :tostr \$1 ];\r\ +> \n :local Value [ :tostr \$2 ];\r\ +> \n :local Level [ :tonum \$3 ];\r\ +> \n :global CharacterMultiply;\r\ +> \n :return ([ \$CharacterMultiply \" \" (\$Level * 2) ] . \"-\" . \$Pre\ +> fix . \"-> \" . \$Value);\r\ +> \n }\r\ +> \n :local TypeOf [ :typeof \$Input ];\r\ +> \n :local Len [ :len \$Input ];\r\ +> \n :local Return [ \$IndentReturn \"type\" \$TypeOf \$Level ];\r\ +> \n :if (\$TypeOf = \"array\") do={\r\ +> \n :foreach Key,Value in=\$Input do={\r\ +> \n :set \$Return (\$Return . \"\\n\" . \\\r\ +> \n [ \$IndentReturn \"key\" \$Key (\$Level + 1) ] . \"\\n\" . \\\r\ +> \n [ \$InspectVarRet \$Value (\$Level + 2) ]);\r\ +> \n }\r\ +> \n } else={\r\ +> \n :if (\$TypeOf = \"str\") do={\r\ +> \n :set \$Return (\$Return . \"\\n\" . \\\r\ +> \n [ \$IndentReturn \"len\" \$Len \$Level ]);\r\ +> \n :if ([ :typeof [ :find \$Input (\"\\r\") ] ] = \"num\") do={\r\ +> \n :set Input [ \$CharacterReplace \$Input (\"\\r\") \"\" ];\r\ +> \n }\r\ +> \n :if ([ :typeof [ :find \$Input (\"\\n\") ] ] = \"num\") do={\r\ +> \n :set Input [ \$CharacterReplace \$Input (\"\\n\") \" \" ];\r\ +> \n }\r\ +> \n }\r\ +> \n :if (\$TypeOf != \"nothing\") do={\r\ +> \n :set \$Return (\$Return . \"\\n\" . \\\r\ +> \n [ \$IndentReturn \"value\" [ \$IfThenElse ([ :len \$Input ] > 80)\ +> \_\\\r\ +> \n ([ :pick \$Input 0 77 ] . \"...\") \$Input ] \$Level ]);\r\ +> \n }\r\ +> \n }\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set GetPubIp do={\r\ +> \n :global DetectIpAddrDefault;\r\ +> \n :global DetectIpAddrFallback;\r\ +> \n\r\ +> \n :local PubIpAddr false;\r\ +> \n :local Url \$DetectIpAddrDefault;\r\ +> \n :local JobName [ :jobname ];\r\ +> \n\r\ +> \n :do {\r\ +> \n :log debug (\$0 . \" Trying to detect public IP using default serv\ +> ice: \" . \$Url . \"...\");\r\ +> \n :retry command={:set PubIpAddr ([ /tool/fetch http-method=\"get\"\ +> \_check-certificate=yes-without-crl \$Url output=user as-value ]->\"data\"\ +> )} \\\r\ +> \n delay=50ms max=5 on-error={:log error (\$JobName . \" Failed to \ +> detect public IP using default service: \" . \$Url . \".\")}\r\ +> \n } on-error={\r\ +> \n :log error (\$0 . \" Failed to detect public IP using default serv\ +> ice: \" . \$Url . \".\");\r\ +> \n :set Url \$DetectIpAddrFallBack;\r\ +> \n :log debug (\$0 . \" Trying to detect public IP using fallback ser\ +> vice: \" . \$Url . \"...\");\r\ +> \n :retry command={:set PubIpAddr ([ /tool/fetch http-method=\"get\"\ +> \_check-certificate=yes-without-crl \$Url output=user as-value ]->\"data\"\ +> )} \\\r\ +> \n delay=200ms max=5 on-error={:log error (\$JobName . \" Failed to\ +> \_detect public IP using fallback service: \" . \$Url . \".\")}\r\ +> \n };\r\ +> \n :local IpLen ([ :len \$PubIpAddr ] -1);\r\ +> \n :if (\$PubIpAddr = false) do={:set PubIpAddr \"not-detected\"} else=\ +> {:set PubIpAddr [:pick \$PubIpAddr 0 \$IpLen]}\r\ +> \n :return \$PubIpAddr;\r\ +> \n}\r\ +> \n\r\ +> \n:set FormatLine do={\r\ +> \n :local Key [ :tostr \$1 ];\r\ +> \n :local Value [ :tostr \$2 ];\r\ +> \n :local Indent [ :tonum \$3 ];\r\ +> \n :local Spaces;\r\ +> \n :local Return \"\";\r\ +> \n :global CharacterMultiply;\r\ +> \n :global EitherOr;\r\ +> \n :set Indent [ \$EitherOr \$Indent 16 ];\r\ +> \n :local Spaces [ \$CharacterMultiply \" \" \$Indent ];\r\ +> \n :if ([ :len \$Key ] > 0) do={ :set Return (\$Key . \":\")}\r\ +> \n :if ([ :len \$Key ] > (\$Indent - 2)) do={:set Return (\$Return . \"\\\ +> n\" . [ :pick \$Spaces 0 \$Indent ] . \$Value);\r\ +> \n } else={:set Return (\$Return . [ :pick \$Spaces 0 (\$Indent - [ :len \ +> \$Return ]) ] . \$Value)}\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set ParseCustom do={\r\ +> \n :local Str [ :tostr \$1 ];\r\ +> \n :local Start [:find [ \$Str ] [:tostr \$2]];\r\ +> \n :local End [ :tostr \$3 ];\r\ +> \n :local Num [ :tonum \$4 ];\r\ +> \n :local Return;\r\ +> \n :if ([:len \$Num] = 0) do={:set Num \"0\"}\r\ +> \n :local rest [:pick \$Str (\$Start+\$Num) [:len \$Str]]; \r\ +> \n :if ([:len \$End ] = 0) do={:set Return [:pick \$Str \$Num \$Start]} e\ +> lse={\r\ +> \n :set End [:find \$rest \$End];\r\ +> \n :set Return [:pick \$rest 0 \$End];\r\ +> \n }\r\ +> \n:return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set LogPrint do={\r\ +> \n :local Severity [ :tostr \$1 ];\r\ +> \n :local Name [ :tostr \$2 ];\r\ +> \n :local Message [ :tostr \$3 ];\r\ +> \n :global PrintDebug;\r\ +> \n :global PrintDebugOverride;\r\ +> \n :global EitherOr;\r\ +> \n :local Debug [ \$EitherOr (\$PrintDebugOverride->\$Name) \$PrintDebug \ +> ];\r\ +> \n :local PrintSeverity do={\r\ +> \n :global TerminalColorOutput;\r\ +> \n :if (\$TerminalColorOutput != true) do={:return \$1}\r\ +> \n :local Color { debug=96; info=97; warning=93; error=91 };\r\ +> \n :return (\"\\1B[\" . \$Color->\$1 . \"m\" . \$1 . \"\\1B[0m\");\r\ +> \n}\r\ +> \n :local Log ([ \$EitherOr \$Name \"\" ] . \": \" . \$Message);\ +> \r\ +> \n :if (\$Severity ~ (\"^(custom|debug|error|info)\\\$\")) do={\r\ +> \n :if (\$Severity = \"debug\") do={:log debug \$Log}\r\ +> \n :if (\$Severity = \"error\") do={:log error \$Log}\r\ +> \n :if (\$Severity = \"info\" ) do={:log info \$Log}\r\ +> \n } else={:log warning \$Log; :set Severity \"warning\"}\r\ +> \n :if (\$Severity != \"debug\" || \$Debug = true) do={:put ([ \$PrintSev\ +> erity \$Severity ] . \": \" . \$Message)}\r\ +> \n}\r\ +> \n\r\ +> \n:set CertificateAvailable do={\r\ +> \n :local CommonName [ :tostr \$1 ];\r\ +> \n :local UseFor [ :tostr \$2 ];\r\ +> \n\r\ +> \n :global CertificateDownload;\r\ +> \n :global ParseKeyValueStore;\r\ +> \n\r\ +> \n :if ([ :len \$UseFor ] = 0) do={\r\ +> \n :log warning (\$0 . \"The intended use is undefined!\");\r\ +> \n :set UseFor \"undefined\";\r\ +> \n }\r\ +> \n :if ([ /system/resource/get free-hdd-space ] < 8388608 && \\\r\ +> \n [ /certificate/settings/get crl-download ] = true && \\\r\ +> \n [ /certificate/settings/get crl-store ] = \"system\") do={\r\ +> \n :log warning (\$0 . \"This system has low free flash space but \" . \ +> \\\r\ +> \n \"is configured to download certificate CRLs to system!\");\r\ +> \n }\r\ +> \n :if ([ :len \$CommonName ] = 0) do={\r\ +> \n :log warning (\$0 . \"No CommonName given!\");\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :local CertSettings [ /certificate/settings/get ];\r\ +> \n :if (((\$CertSettings->\"builtin-trust-anchors\") = \"trusted\" || \\\ +> \r\ +> \n (\$CertSettings->\"builtin-trust-store\") ~ \$UseFor || \\\r\ +> \n (\$CertSettings->\"builtin-trust-store\") = \"all\") && \\\r\ +> \n [ :len [ /certificate/builtin/find where common-name=\$CommonName\ +> \_] ] > 0) do={\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :if ([ :len [ /certificate/find where common-name=\$CommonName ] ] = 0\ +> ) do={\r\ +> \n :log info (\$0 . \"Certificate with CommonName '\" . \$CommonName . \ +> \"' not available.\");\r\ +> \n :if ([ \$CertificateDownload \$CommonName ] = false) do={\r\ +> \n :return false;\r\ +> \n }\r\ +> \n }\r\ +> \n :if ([ :len [ /certificate/find where common-name=\$CommonName ] ] > 1\ +> ) do={\r\ +> \n :log info (\$0 . \"There are \" . \$CertCount . \" Certificates with\ +> \_CommonName '\" . \$CommonName . \"'. Should be ok.\");\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :local CertVal [ /certificate/get [ find where common-name=\$CommonNam\ +> e ] ];\r\ +> \n :while ((\$CertVal->\"akid\") != \"\" && (\$CertVal->\"akid\") != (\$C\ +> ertVal->\"skid\")) do={\r\ +> \n :if ([ :len [ /certificate/find where skid=(\$CertVal->\"akid\") ] ]\ +> \_= 0) do={\r\ +> \n :local IssuerCN ([ \$ParseKeyValueStore (\$CertVal->\"issuer\") ]-\ +> >\"CN\");\r\ +> \n :log info (\$0 . \"Certificate chain for '\" . \$CommonName . \"' \ +> is incomplete, missing '\" . \$IssuerCN . \"'.\");\r\ +> \n :if ([ \$CertificateDownload \$IssuerCN ] = false) do={\r\ +> \n :return false;\r\ +> \n }\r\ +> \n }\r\ +> \n :set CertVal [ /certificate/get [ find where skid=(\$CertVal->\"akid\ +> \") ] ];\r\ +> \n }\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set CertificateDownload do={\r\ +> \n :local CommonName [ :tostr \$1 ];\r\ +> \n :global ScriptUpdatesBaseUrl;\r\ +> \n :global ScriptUpdatesUrlSuffix;\r\ +> \n :global CertificateNameByCN;\r\ +> \n :global CleanName;\r\ +> \n :global FetchUserAgentStr;\r\ +> \n :global RmFile;\r\ +> \n :global WaitForFile;\r\ +> \n\r\ +> \n :log info (\$0 . \"Downloading and importing certificate with \" . \\\ +> \r\ +> \n \"CommonName '\" . \$CommonName . \"'.\");\r\ +> \n :local FileName ([ \$CleanName \$CommonName ] . \".pem\");\r\ +> \n :do {\r\ +> \n /tool/fetch check-certificate=yes-without-crl mode=https http-header\ +> -field=({ [ \$FetchUserAgentStr \$0 ] }) \\\r\ +> \n (\$ScriptUpdatesBaseUrl . \"certs/\" . \$FileName . \$ScriptUpdate\ +> sUrlSuffix) \\\r\ +> \n dst-path=\$FileName as-value;\r\ +> \n \$WaitForFile \$FileName;\r\ +> \n } on-error={\r\ +> \n :log warning (\$0 . \" Failed downloading certificate with CommonNam\ +> e '\" . \$CommonName . \\\r\ +> \n \"' from repository! Trying fallback to mkcert.org...\");\r\ +> \n :do {\r\ +> \n :local CertSettings [ /certificate/settings/get ];\r\ +> \n :if ([ :len [ /certificate/find where common-name=\"ISRG Root X1\"\ +> \_] ] = 0 && \\\r\ +> \n !(((\$CertSettings->\"builtin-trust-anchors\") = \"trusted\" \ +> || \\\r\ +> \n (\$CertSettings->\"builtin-trust-store\") ~ \"fetch\" || \ +> \\\r\ +> \n (\$CertSettings->\"builtin-trust-store\") = \"all\") && \\\ +> \r\ +> \n [ :len [ /certificate/builtin/find where common-name=\"ISRG\ +> \_Root X1\" ] ] > 0)) do={\r\ +> \n :log error (\$0 . \" Required certificate is not available.\");\ +> \r\ +> \n :return false;\r\ +> \n }\r\ +> \n /tool/fetch check-certificate=yes-without-crl mode=https http-head\ +> er-field=({ [ \$FetchUserAgentStr \$0 ] }) \\\r\ +> \n url=\"https://mkcert.org/generate/\" http-data=[ :serialize to=jso\ +> n ({ \$CommonName }) ] \\\r\ +> \n dst-path=\$FileName as-value;\r\ +> \n \$WaitForFile \$FileName;\r\ +> \n :if ([ /file/get \$FileName size ] = 0) do={\r\ +> \n \$RmFile \$FileName;\r\ +> \n :error false;\r\ +> \n }\r\ +> \n } on-error={\r\ +> \n :log error (\$0 . \" Failed downloading certificate with CommonNam\ +> e '\" . \$CommonName . \"'!\");\r\ +> \n :return false;\r\ +> \n }\r\ +> \n }\r\ +> \n /certificate/import file-name=\$FileName passphrase=\"\" as-value;\r\ +> \n :delay 1s;\r\ +> \n \$RmFile \$FileName;\r\ +> \n :if ([ :len [ /certificate/find where common-name=\$CommonName ] ] = 0\ +> ) do={\r\ +> \n /certificate/remove [ find where name~(\"^\" . \$FileName . \"_[0-9]\ +> +\\\$\") ];\r\ +> \n :log warning (\$0 . \" Certificate with CommonName '\" . \$CommonNam\ +> e . \"' still unavailable!\");\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :foreach Cert in=[ /certificate/find where name~(\"^\" . \$FileName . \ +> \"_[0-9]+\\\$\") ] do={\r\ +> \n \$CertificateNameByCN [ /certificate/get \$Cert common-name ];\r\ +> \n }\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set CertificateNameByCN do={\r\ +> \n :local Match [ :tostr \$1 ];\r\ +> \n :global CleanName;\r\ +> \n :local Cert ([ /certificate/find where (common-name=\$Match or fingerp\ +> rint=\$Match or name=\$Match) ]->0);\r\ +> \n :if ([ :len \$Cert ] = 0) do={\r\ +> \n :log warning (\$0 .\" No matching certificate found.\");\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :local CommonName [ /certificate/get \$Cert common-name ];\r\ +> \n /certificate/set \$Cert name=[ \$CleanName \$CommonName ];\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set CharacterMultiply do={\r\ +> \n :local Str [ :tostr \$1 ];\r\ +> \n :local Num [ :tonum \$2 ];\r\ +> \n :if (\$Num = 0) do={:return \"\"}\r\ +> \n :local Return \"\";\r\ +> \n :for I from=1 to=\$Num do={:set Return (\$Return . \$Str)}\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set FileExists do={\r\ +> \n :local FileName [ :tostr \$1 ];\r\ +> \n :local Type [ :tostr \$2 ];\r\ +> \n :global FileGet;\r\ +> \n :local FileVal [ \$FileGet \$FileName ];\r\ +> \n :if (\$FileVal = false) do={ :return false; }\r\ +> \n :if ([ :len (\$FileVal->\"size\") ] = 0) do={ :return false; }\r\ +> \n :if ([ :len \$Type ] = 0 || \$FileVal->\"type\" = \$Type) do={ :return\ +> \_true; }\r\ +> \n :return false;\r\ +> \n}\r\ +> \n\r\ +> \n:set Grep do={\r\ +> \n :local Input ([ :tostr \$1 ] . \"\\n\");\r\ +> \n :local Pattern [ :tostr \$2 ];\r\ +> \n :if ([ :typeof [ :find \$Input \$Pattern ] ] = \"nil\") do={:return []\ +> }\r\ +> \n :do {\r\ +> \n :local Line [ :pick \$Input 0 [ :find \$Input \"\\n\" ] ];\r\ +> \n :if ([ :typeof [ :find \$Line \$Pattern ] ] = \"num\") do={:return \ +> \$Line}\r\ +> \n :set Input [ :pick \$Input ([ :find \$Input \"\\n\" ] + 1) [ :len \$\ +> Input ] ];\r\ +> \n } while=([ :len \$Input ] > 0);\r\ +> \n :return [];\r\ +> \n}\r\ +> \n\r\ +> \n:set HumanReadableNum do={\r\ +> \n :local Input [ :tonum \$1 ];\r\ +> \n :local Base [ :tonum \$2 ];\r\ +> \n :global EitherOr;\r\ +> \n :global IfThenElse;\r\ +> \n :local Prefix \"kMGTPE\";\r\ +> \n :local Pow 1;\r\ +> \n :set Base [ \$EitherOr \$Base 1024 ];\r\ +> \n :local Bin [ \$IfThenElse (\$Base = 1024) \"i\" \"\" ];\r\ +> \n :if (\$Input < \$Base) do={:return \$Input}\r\ +> \n :for I from=0 to=[ :len \$Prefix ] do={\r\ +> \n :set Pow (\$Pow * \$Base);\r\ +> \n :if (\$Input / \$Base < \$Pow) do={\r\ +> \n :set Prefix [ :pick \$Prefix \$I ];\r\ +> \n :local Tmp1 (\$Input * 100 / \$Pow);\r\ +> \n :local Tmp2 (\$Tmp1 / 100);\r\ +> \n :if (\$Tmp2 >= 100) do={:return (\$Tmp2 . \$Prefix . \$Bin)}\r\ +> \n :return (\$Tmp2 . \".\" . \\\r\ +> \n [ :pick \$Tmp1 [ :len \$Tmp2 ] ([ :len \$Tmp1 ] - [ :len \$Tmp\ +> 2 ] + 1) ] . \\\r\ +> \n \$Prefix . \$Bin);\r\ +> \n }\r\ +> \n }\r\ +> \n}\r\ +> \n\r\ +> \n:set CleanFilePath do={\r\ +> \n :local Path [ :tostr \$1 ];\r\ +> \n :global CharacterReplace;\r\ +> \n :while (\$Path ~ \"//\") do={ :set \$Path [ \$CharacterReplace \$Path \ +> \"//\" \"/\" ]; }\r\ +> \n :if ([ :pick \$Path 0 ] = \"/\") do={ :set Path [ :pick \$Path 1 [ :le\ +> n \$Path ] ]; }\r\ +> \n :if ([ :pick \$Path ([ :len \$Path ] - 1) ] = \"/\") do={ :set Path [ \ +> :pick \$Path 0 ([ :len \$Path ] - 1) ]; }\r\ +> \n :return \$Path;\r\ +> \n}\r\ +> \n\r\ +> \n:set CleanName do={\r\ +> \n :local Input [ :tostr \$1 ];\r\ +> \n :local Return \"\";\r\ +> \n :for I from=0 to=([ :len \$Input ] - 1) do={\r\ +> \n :local Char [ :pick \$Input \$I ];\r\ +> \n :if ([ :typeof [ find \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqr\ +> stuvwxyz0123456789\" \$Char ] ] = \"nil\") do={\r\ +> \n :do {:if ([ :len \$Return ] = 0) do={:error true};\r\ +> \n :if ([ :pick \$Return ([ :len \$Return ] - 1) ] = \"-\") do={:er\ +> ror true}; :set Char \"-\"} on-error={:set Char \"\"}; \r\ +> \n };\r\ +> \n :set Return (\$Return . \$Char)};\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set RandomDelay do={\r\ +> \n :local Time [ :tonum \$1 ];\r\ +> \n :local Unit [ :tostr \$2 ];\r\ +> \n :global EitherOr;\r\ +> \n :global GetRandomNumber;\r\ +> \n :global MAX;\r\ +> \n :if (\$Time = 0) do={:return false}\r\ +> \n :delay ([ \$MAX 10 [ \$GetRandomNumber ([ :tonsec [ :totime (\$Time . \ +> [ \$EitherOr \$Unit \"s\" ]) ] ] / 1000000) ] ] . \"ms\");\r\ +> \n}\r\ +> \n\r\ +> \n:set EscapeForRegEx do={\r\ +> \n :local Input [ :tostr \$1 ];\r\ +> \n :if ([ :len \$Input ] = 0) do={:return \"\"}\r\ +> \n :local Return \"\";\r\ +> \n :local Chars (\"^.[]\\\$()|*+\?{}\\\\\");\r\ +> \n :for I from=0 to=([ :len \$Input ] - 1) do={\r\ +> \n :local Char [ :pick \$Input \$I ];\r\ +> \n :if ([ :find \$Chars \$Char ]) do={:set Char (\"\\\\\" . \$Char)}\r\ +> \n :set Return (\$Return . \$Char);\r\ +> \n }\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set ExitError do={\r\ +> \n :local ExitOK [ :tostr \$1 ];\r\ +> \n :local Name [ :tostr \$2 ];\r\ +> \n :local Error [ :tostr \$3 ];\r\ +> \n :global IfThenElse;\r\ +> \n :if (\$ExitOK = \"false\") do={\r\ +> \n :log error (\$Name [ \$IfThenElse ([ :pick \$Name 0 1 ] = \"\\\$\") \ +> \\\r\ +> \n \"Function\" \"Script\" ] . \" '\" . \$Name . \"' exited with er\ +> ror\" . \\\r\ +> \n [ \$IfThenElse (!(\$Error ~ \"^(|true|false)\\\$\")) (\": \" . \ +> \$Error) \".\" ]);\r\ +> \n }\r\ +> \n}\r\ +> \n\r\ +> \n:set ExitOnError do={\r\ +> \n :local Name [ :tostr \$1 ];\r\ +> \n :local Error [ :tostr \$2 ];\r\ +> \n :global IfThenElse;\r\ +> \n :log error (\$Name . \" \" . [ \$IfThenElse ([ :pick \$Name 0 1 ] = \"\ +> \\\$\") \\\r\ +> \n \"Function\" \"Script\" ] . \" '\" . \$Name . \"' exited with erro\ +> r\" . \\\r\ +> \n [ \$IfThenElse (!(\$Error ~ \"^(|true|false)\\\$\")) (\": \" . \$E\ +> rror) \".\" ]);\r\ +> \n}\r\ +> \n\r\ +> \n:set MiniDateTimeStamp do={\r\ +> \n :local mikro [ :tobool \$1 ];\r\ +> \n /system/clock;\r\ +> \n :local vdate [get date];\r\ +> \n :local vtime [get time];\r\ +> \n :local vdoff [:toarray \"0,4,5,7,8,10\"];\r\ +> \n :local MM [:pick \$vdate (\$vdoff->2) (\$vdoff->3)];\r\ +> \n :local M [:tonum \$MM];\r\ +> \n :if (\$vdate ~ \".../../....\") do={\r\ +> \n :set vdoff [:toarray \"7,11,1,3,4,6\"];\r\ +> \n :set M ([:find \"xxanebarprayunulugepctovecANEBARPRAYUNULUGE\ +> PCTOVEC\" [:pick \$vdate (\$vdoff->2) (\$vdoff->3)] -1] / 2);\r\ +> \n :if (\$M>12) do={:set M (\$M - 12)}\r\ +> \n :set MM [:pick (100 + \$M) 1 3];\r\ +> \n }\r\ +> \n :local yyyy [:pick \$vdate (\$vdoff->0) (\$vdoff->1)];\r\ +> \n :local dd [:pick \$vdate (\$vdoff->4) (\$vdoff->5)];\r\ +> \n :local HH [:pick \$vtime 0 2];\r\ +> \n :local mm [:pick \$vtime 3 5];\r\ +> \n :local ss [:pick \$vtime 6 8];\r\ +> \n :local Return;\r\ +> \n :if (\$mikro = true) do={\r\ +> \n :set Return ([:pick \$yyyy 2 4] . [:pick \$dd 0 1] . [:pick \$HH 0\ +> \_1] . [:pick \$mm 3 4] . [:pick \$ss 6 7]);\r\ +> \n } else={\r\ +> \n :set Return ([\$yyyy] . [\$MM] . [\$dd] . [\$HH] . [\$mm] . [\$ss]);\ +> \r\ +> \n }\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set WaitForFile do={\r\ +> \n :local FileName [ :tostr \$1 ];\r\ +> \n :local WaitTime [ :totime \$2 ];\r\ +> \n :global CleanFilePath;\r\ +> \n :global EitherOr;\r\ +> \n :global MAX;\r\ +> \n :set FileName [ \$CleanFilePath \$FileName ];\r\ +> \n :local Delay ([ \$MAX [ \$EitherOr \$WaitTime 2s ] 100ms ] / 9);\r\ +> \n :do {\r\ +> \n :retry {\r\ +> \n /file/get \$FileName;\r\ +> \n :return true;\r\ +> \n } delay=\$Delay max=10;\r\ +> \n } on-error={ }\r\ +> \n :while ([ :len [ /file/find where name=\$FileName ] ] > 0) do={\r\ +> \n :do {\r\ +> \n /file/get \$FileName;\r\ +> \n :return true;\r\ +> \n } on-error={ }\r\ +> \n :delay \$Delay;\r\ +> \n :set Delay (\$Delay * 3 / 2);\r\ +> \n }\r\ +> \n :return false;\r\ +> \n}\r\ +> \n\r\ +> \n:set FileGet do={\r\ +> \n :local FileName [ :tostr \$1 ];\r\ +> \n :global WaitForFile;\r\ +> \n :if ([ \$WaitForFile \$FileName 0s ] = false) do={\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :local FileVal false;\r\ +> \n :do {\r\ +> \n :set FileVal [ /file/get \$FileName ];\r\ +> \n } on-error={ }\r\ +> \n :return \$FileVal;\r\ +> \n}\r\ +> \n\r\ +> \n:set RmDir do={\r\ +> \n :local DirName [ :tostr \$1 ];\r\ +> \n :global FileGet;\r\ +> \n :log debug (\$0 . \" Removing directory: \". \$DirName);\r\ +> \n :local DirVal [ \$FileGet \$DirName ];\r\ +> \n :if (\$DirVal = false) do={\r\ +> \n :log debug (\$0 . \" ... which does not exist.\");\r\ +> \n :return true;\r\ +> \n };\r\ +> \n :if (\$DirVal->\"type\" != \"directory\") do={\r\ +> \n :log error (\$0 . \" Directory '\" . \$DirName . \"' is not a direct\ +> ory.\");\r\ +> \n :return false;\r\ +> \n };\r\ +> \n :onerror Err {\r\ +> \n /file/remove \$DirName;\r\ +> \n } do={\r\ +> \n :log error (\$0 . \" Removing directory '\" . \$DirName . \"' failed\ +> : \" . \$Err);\r\ +> \n :return false;\r\ +> \n };\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set RmFile do={\r\ +> \n :local FileName [ :tostr \$1 ];\r\ +> \n :global FileGet;\r\ +> \n :log debug (\$0 . \" Removing file: \". \$FileName);\r\ +> \n :local FileVal [ \$FileGet \$FileName ];\r\ +> \n :if (\$FileVal = false) do={\r\ +> \n :log debug (\$0 . \" ... which does not exist.\");\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :if (\$FileVal->\"type\" = \"directory\" || \$FileVal->\"type\" = \"di\ +> sk\") do={\r\ +> \n :log error (\$0 . \" File '\" . \$FileName . \"' is not a file.\");\ +> \r\ +> \n :return false;\r\ +> \n }\r\ +> \n :onerror Err {\r\ +> \n /file/remove \$FileName;\r\ +> \n } do={\r\ +> \n :log error (\$0 . \" Removing file '\" . \$FileName . \"' failed: \"\ +> \_. \$Err); :return false;\r\ +> \n }\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set MkDir do={\r\ +> \n :local Path [ :tostr \$1 ];\r\ +> \n :global CleanFilePath;\r\ +> \n :global FileGet;\r\ +> \n :global RmDir;\r\ +> \n :global WaitForFile;\r\ +> \n\r\ +> \n :local MkTmpfs do={\r\ +> \n :global WaitForFile;\r\ +> \n :local TmpFs [ /disk/find where slot=tmpfs type=tmpfs ];\r\ +> \n :if ([ :len \$TmpFs ] = 1) do={\r\ +> \n :if ([ /disk/get \$TmpFs disabled ] = true) do={\r\ +> \n :log info (\$0 . \" The tmpfs is disabled, enabling.\");\r\ +> \n /disk/enable \$TmpFs;\r\ +> \n }\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :log info (\$0 . \" Creating disk of type tmpfs.\");\r\ +> \n \$RmDir \"tmpfs\";\r\ +> \n :onerror Err {\r\ +> \n /disk/add slot=tmpfs type=tmpfs tmpfs-max-size=([ /system/resource\ +> /get total-memory ] / 3);\r\ +> \n \$WaitForFile \"tmpfs\";\r\ +> \n } do={\r\ +> \n :log warning (\$0 . \" Creating disk of type tmpfs failed: \" . \$\ +> Err);\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :set Path [ \$CleanFilePath \$Path ];\r\ +> \n :if (\$Path = \"\") do={\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :log debug (\$0 . \" Making directory: \" . \$Path);\r\ +> \n :local PathVal [ \$FileGet \$Path ];\r\ +> \n :if (\$PathVal->\"type\" = \"directory\") do={\r\ +> \n :log debug (\$0 . \" ... which already exists.\");\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :if ([ :pick \$Path 0 5 ] = \"tmpfs\") do={\r\ +> \n :if ([ \$MkTmpfs ] = false) do={\r\ +> \n :return false;\r\ +> \n }\r\ +> \n }\r\ +> \n :onerror Err {\r\ +> \n /file/add type=\"directory\" name=\$Path;\r\ +> \n \$WaitForFile \$Path;\r\ +> \n } do={\r\ +> \n :log warning (\$0 . \" Making directory '\" . \$Path . \"' failed: \ +> \" . \$Err);\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set MAX do={:if (\$1 > \$2) do={:return \$1}\r\ +> \n :return \$2;\r\ +> \n}\r\ +> \n:set MIN do={:if (\$1 < \$2) do={:return \$1}\r\ +> \n :return \$2;\r\ +> \n}\r\ +> \n\r\ +> \n:set CharacterMultiply do={\r\ +> \n :local Str [ :tostr \$1 ];\r\ +> \n :local Num [ :tonum \$2 ];\r\ +> \n :if (\$Num = 0) do={:return \"\"}\r\ +> \n :local Return \"\";\r\ +> \n :for I from=1 to=\$Num do={:set Return (\$Return . \$Str)}\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set CharacterReplace do={\r\ +> \n :local String [ :tostr \$1 ];\r\ +> \n :local ReplaceFrom [ :tostr \$2 ];\r\ +> \n :local ReplaceWith [ :tostr \$3 ];\r\ +> \n :local Return \"\";\r\ +> \n :if (\$ReplaceFrom = \"\") do={:return \$String}\r\ +> \n :while ([ :typeof [ :find \$String \$ReplaceFrom ] ] != \"nil\") do={\ +> \r\ +> \n :local Pos [ :find \$String \$ReplaceFrom ];\r\ +> \n :set Return (\$Return . [ :pick \$String 0 \$Pos ] . \$ReplaceWith);\ +> \r\ +> \n :set String [ :pick \$String (\$Pos + [ :len \$ReplaceFrom ]) [ :len\ +> \_\$String ] ];\r\ +> \n }\r\ +> \n :return (\$Return . \$String);\r\ +> \n}\r\ +> \n\r\ +> \n:set IfThenElse do={\r\ +> \n :if ([ :tostr \$1 ] = \"true\" || [ :tobool \$1 ] = true) do={:return \ +> \$2};\r\ +> \n :return \$3;\r\ +> \n}\r\ +> \n\r\ +> \n:set EitherOr do={\r\ +> \n :global IfThenElse;\r\ +> \n :if ([ :typeof \$1 ] = \"num\") do={:return [ \$IfThenElse (\$1 != 0) \ +> \$1 \$2 ]}\r\ +> \n :if ([ :typeof \$1 ] = \"time\") do={:return [ \$IfThenElse (\$1 > 0s)\ +> \_\$1 \$2 ]}\r\ +> \n# this works for boolean values, literal ones with parentheses\r\ +> \n :return [ \$IfThenElse ([ :len [ :tostr \$1 ] ] > 0) \$1 \$2 ];\r\ +> \n}\r\ +> \n\r\ +> \n:set ParseKeyValueStore do={\r\ +> \n :local Source \$1;\r\ +> \n :if ([ :pick \$Source 0 1 ] = \"{\") do={\r\ +> \n :do {\r\ +> \n :return [ :deserialize from=json \$Source ];\r\ +> \n } on-error={ }\r\ +> \n } \r\ +> \n :if ([ :typeof \$Source ] != \"array\") do={:set Source [ :tostr \$1 ]\ +> }\r\ +> \n :local Result ({});\r\ +> \n :foreach KeyValue in=[ :toarray \$Source ] do={\r\ +> \n :if ([ :find \$KeyValue \"=\" ]) do={\r\ +> \n :local Key [ :pick \$KeyValue 0 [ :find \$KeyValue \"=\" ] ];\r\ +> \n :local Value [ :pick \$KeyValue ([ :find \$KeyValue \"=\" ] + 1) [\ +> \_:len \$KeyValue ] ];\r\ +> \n :if (\$Value=\"true\") do={:set Value true}\r\ +> \n :if (\$Value=\"false\") do={:set Value false}\r\ +> \n :set (\$Result->\$Key) \$Value;\r\ +> \n } else={:set (\$Result->\$KeyValue) true}\r\ +> \n }\r\ +> \n :return \$Result;\r\ +> \n}\r\ +> \n:set RequiredRouterOS do={\r\ +> \n :local Caller [ :tostr \$1 ];\r\ +> \n :local Required [ :tostr \$2 ];\r\ +> \n :local Warn [ :tostr \$3 ];\r\ +> \n :global IfThenElse;\r\ +> \n :global VersionToNum;\r\ +> \n :if (!(\$Required ~ \"^\\\\d+\\\\.\\\\d+((alpha|beta|rc|\\\\.)\\\\d+|)\ +> \\\$\")) do={\r\ +> \n :log error (\$0 . \" No valid RouterOS version: \" . \$Required);\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :if ([ \$VersionToNum \$Required ] > [ \$VersionToNum [ /system/packag\ +> e/update/get installed-version ] ]) do={\r\ +> \n :if (\$Warn = \"true\") do={\r\ +> \n :log warning (\$0 . \" This \" . [ \$IfThenElse ([ :pick \$Caller \ +> 0 ] = (\"\\\$\")) \"function\" \"script\" ] . \\\r\ +> \n \" '\" . \$Caller . \"' (at least specific functionality) requir\ +> es RouterOS \" . \$Required . \". Please update!\");\r\ +> \n }\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set ValidateSyntax do={\r\ +> \n :local Code [ :tostr \$1 ];\r\ +> \n :global LogPrint;\r\ +> \n :onerror Err {\r\ +> \n [ :parse (\":local Validate do={\\n\" . \$Code . \"\\n}\") ];\r\ +> \n } do={\r\ +> \n \$LogPrint debug \$0 (\"Valdation failed: \" . \$Err);\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set VersionToNum do={\r\ +> \n :local Input [ :tostr \$1 ];\r\ +> \n :local Multi 0x1000000;\r\ +> \n :local Return 0;\r\ +> \n :global CharacterReplace;\r\ +> \n :set Input [ \$CharacterReplace \$Input \".\" \",\" ];\r\ +> \n :foreach I in={ \"zero\"; \"alpha\"; \"beta\"; \"rc\" } do={\r\ +> \n :set Input [ \$CharacterReplace \$Input \$I (\",\" . \$I . \",\") ];\ +> \r\ +> \n }\r\ +> \n :foreach Value in=([ :toarray \$Input ], 0) do={\r\ +> \n :local Num [ :tonum \$Value ];\r\ +> \n :if (\$Multi = 0x100) do={\r\ +> \n :if ([ :typeof \$Num ] = \"num\") do={\r\ +> \n :set Return (\$Return + 0xff00);\r\ +> \n :set Multi (\$Multi / 0x100);\r\ +> \n } else={\r\ +> \n :if (\$Value = \"zero\") do={ }\r\ +> \n :if (\$Value = \"alpha\") do={ :set Return (\$Return + 0x3f00); \ +> }\r\ +> \n :if (\$Value = \"beta\") do={ :set Return (\$Return + 0x5f00); }\ +> \r\ +> \n :if (\$Value = \"rc\") do={ :set Return (\$Return + 0x7f00); }\r\ +> \n }\r\ +> \n }\r\ +> \n :if ([ :typeof \$Num ] = \"num\") do={ :set Return (\$Return + (\$Va\ +> lue * \$Multi)); }\r\ +> \n :set Multi (\$Multi / 0x100);\r\ +> \n }\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set ScriptLock do={\r\ +> \n :local Script [ :tostr \$1 ];\r\ +> \n :local WaitMax [ :totime \$2 ];\r\ +> \n :global GetRandom20CharAlNum;\r\ +> \n :global IfThenElse;\r\ +> \n :global ScriptLockOrder;\r\ +> \n :if ([ :typeof \$ScriptLockOrder ] = \"nothing\") do={\r\ +> \n :set ScriptLockOrder ({});\r\ +> \n }\r\ +> \n :if ([ :typeof (\$ScriptLockOrder->\$Script) ] = \"nothing\") do={\r\ +> \n :set (\$ScriptLockOrder->\$Script) ({});\r\ +> \n }\r\ +> \n :local JobCount do={\r\ +> \n :local Script [ :tostr \$1 ];\r\ +> \n :return [ :len [ /system/script/job/find where script=\$Script ] ];\ +> \r\ +> \n }\r\ +> \n :local TicketCount do={\r\ +> \n :local Script [ :tostr \$1 ];\r\ +> \n :global ScriptLockOrder;\r\ +> \n :local Count 0;\r\ +> \n :foreach Ticket in=(\$ScriptLockOrder->\$Script) do={\r\ +> \n :if ([ :typeof \$Ticket ] != \"nothing\") do={:set Count (\$Count \ +> + 1)}\r\ +> \n }\r\ +> \n :return \$Count;\r\ +> \n }\r\ +> \n :local IsFirstTicket do={\r\ +> \n :local Script [ :tostr \$1 ];\r\ +> \n :local Check [ :tostr \$2 ];\r\ +> \n :global ScriptLockOrder;\r\ +> \n :foreach Ticket in=(\$ScriptLockOrder->\$Script) do={\r\ +> \n :if (\$Ticket = \$Check) do={:return true}\r\ +> \n :if ([ :typeof \$Ticket ] != \"nothing\" && \$Ticket != \$Check) d\ +> o={:return false}\r\ +> \n }\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :local AddTicket do={\r\ +> \n :local Script [ :tostr \$1 ];\r\ +> \n :local Add [ :tostr \$2 ];\r\ +> \n :global ScriptLockOrder;\r\ +> \n :while (true) do={\r\ +> \n :local Pos [ :len (\$ScriptLockOrder->\$Script) ];\r\ +> \n :set (\$ScriptLockOrder->\$Script->\$Pos) \$Add;\r\ +> \n :delay 10ms;\r\ +> \n :if ((\$ScriptLockOrder->\$Script->\$Pos) = \$Add) do={:return tru\ +> e}\r\ +> \n }\r\ +> \n }\r\ +> \n :local RemoveTicket do={\r\ +> \n :local Script [ :tostr \$1 ];\r\ +> \n :local Remove [ :tostr \$2 ];\r\ +> \n :global ScriptLockOrder;\r\ +> \n :foreach Id,Ticket in=(\$ScriptLockOrder->\$Script) do={\r\ +> \n :while ((\$ScriptLockOrder->\$Script->\$Id) = \$Remove) do={\r\ +> \n :set (\$ScriptLockOrder->\$Script->\$Id);\r\ +> \n :delay 10ms;\r\ +> \n }\r\ +> \n }\r\ +> \n }\r\ +> \n :local CleanupTickets do={\r\ +> \n :local Script [ :tostr \$1 ];\r\ +> \n :global ScriptLockOrder;\r\ +> \n :foreach Ticket in=(\$ScriptLockOrder->\$Script) do={\r\ +> \n :if ([ :typeof \$Ticket ] != \"nothing\") do={:return false}\r\ +> \n }\r\ +> \n :set (\$ScriptLockOrder->\$Script) ({});\r\ +> \n }\r\ +> \n :if ([ :typeof \$WaitMax ] = \"nil\" ) do={:set WaitMax 0s}\r\ +> \n :if ([ :len [ /system/script/find where name=\$Script ] ] = 0) do={\r\ +> \n :log error (\$0 . \" A script named '\" . \$Script . \"' does not ex\ +> ist!\");\r\ +> \n :error false;\r\ +> \n }\r\ +> \n :if ([ \$JobCount \$Script ] = 0) do={\r\ +> \n \$LogPrint error \$0 (\"No script '\" . \$Script . \"' is running!\"\ +> );\r\ +> \n :error false;\r\ +> \n }\r\ +> \n :if ([ \$TicketCount \$Script ] >= [ \$JobCount \$Script ]) do={\r\ +> \n :log error (\$0 . \" More tickets than running scripts '\" . \$Scrip\ +> t . \"', resetting!\");\r\ +> \n :set (\$ScriptLockOrder->\$Script) ({});\r\ +> \n /system/script/job/remove [ find where script=\$Script ];\r\ +> \n }\r\ +> \n :local MyTicket [ \$GetRandom20CharAlNum 6 ];\r\ +> \n \$AddTicket \$Script \$MyTicket;\r\ +> \n :local WaitInterval (\$WaitMax / 20);\r\ +> \n :local WaitTime \$WaitMax;\r\ +> \n :while (\$WaitTime > 0 && \\\r\ +> \n ([ \$IsFirstTicket \$Script \$MyTicket ] = false || \\\r\ +> \n [ \$TicketCount \$Script ] < [ \$JobCount \$Script ])) do={\r\ +> \n :set WaitTime (\$WaitTime - \$WaitInterval);\r\ +> \n :delay \$WaitInterval;\r\ +> \n }\r\ +> \n :if ([ \$IsFirstTicket \$Script \$MyTicket ] = true && \\\r\ +> \n [ \$TicketCount \$Script ] = [ \$JobCount \$Script ]) do={\r\ +> \n \$RemoveTicket \$Script \$MyTicket;\r\ +> \n \$CleanupTickets \$Script;\r\ +> \n :return true;\r\ +> \n }\r\ +> \n \$RemoveTicket \$Script \$MyTicket;\r\ +> \n \$LogPrint debug \$0 (\"Script '\" . \$Script . \"' started more than \ +> once\" . \\\r\ +> \n [ \$IfThenElse (\$WaitTime < \$WaitMax) \" and timed out waiting for\ +> \_lock\" \"\" ] . \"...\");\r\ +> \n :return false;\r\ +> \n}\r\ +> \n\r\ +> \n:set SendNotification do={ :onerror Err {\r\ +> \n :global SendNotification2;\r\ +> \n \$SendNotification2 ({ origin=\$0; subject=\$1; message=\$2; link=\$3;\ +> \_silent=\$4 });\r\ +> \n} do={:global ExitOnError; \$ExitOnError \$0 \$Err}\r\ +> \n}\r\ +> \n\r\ +> \n:set SendNotification2 do={\r\ +> \n :local Notification \$1;\r\ +> \n :global NotificationFunctions;\r\ +> \n :foreach FunctionName,Discard in=\$NotificationFunctions do={\r\ +> \n (\$NotificationFunctions->\$FunctionName) (\"\\\$NotificationFunctio\ +> ns->\\\"\" . \$FunctionName . \"\\\"\") \$Notification;\r\ +> \n }\r\ +> \n}\r\ +> \n\r\ +> \n:set SymbolByUnicodeName do={\r\ +> \n :local Name [ :tostr \$1 ];\r\ +> \n :global EitherOr;\r\ +> \n :global SymbolsExtra;\r\ +> \n :local Symbols ({\r\ +> \n \"abacus\"=\"\\F0\\9F\\A7\\AE\";\r\ +> \n \"alarm-clock\"=\"\\E2\\8F\\B0\";\r\ +> \n \"arrow-down\"=\"\\E2\\AC\\87\";\r\ +> \n \"arrow-up\"=\"\\E2\\AC\\86\";\r\ +> \n \"calendar\"=\"\\F0\\9F\\93\\85\";\r\ +> \n \"card-file-box\"=\"\\F0\\9F\\97\\83\";\r\ +> \n \"chart-decreasing\"=\"\\F0\\9F\\93\\89\";\r\ +> \n \"chart-increasing\"=\"\\F0\\9F\\93\\88\";\r\ +> \n \"cloud\"=\"\\E2\\98\\81\";\r\ +> \n \"cross-mark\"=\"\\E2\\9D\\8C\";\r\ +> \n \"earth\"=\"\\F0\\9F\\8C\\8D\";\r\ +> \n \"fire\"=\"\\F0\\9F\\94\\A5\";\r\ +> \n \"floppy-disk\"=\"\\F0\\9F\\92\\BE\";\r\ +> \n \"gear\"=\"\\E2\\9A\\99\";\r\ +> \n \"heart\"=\"\\E2\\99\\A5\";\r\ +> \n \"high-voltage-sign\"=\"\\E2\\9A\\A1\";\r\ +> \n \"incoming-envelope\"=\"\\F0\\9F\\93\\A8\";\r\ +> \n \"information\"=\"\\E2\\84\\B9\";\r\ +> \n \"large-orange-circle\"=\"\\F0\\9F\\9F\\A0\";\r\ +> \n \"large-red-circle\"=\"\\F0\\9F\\94\\B4\";\r\ +> \n \"link\"=\"\\F0\\9F\\94\\97\";\r\ +> \n \"lock-with-ink-pen\"=\"\\F0\\9F\\94\\8F\";\r\ +> \n \"memo\"=\"\\F0\\9F\\93\\9D\";\r\ +> \n \"mobile-phone\"=\"\\F0\\9F\\93\\B1\";\r\ +> \n \"pushpin\"=\"\\F0\\9F\\93\\8C\";\r\ +> \n \"scissors\"=\"\\E2\\9C\\82\";\r\ +> \n \"scroll\"=\"\\F0\\9F\\93\\9C\";\r\ +> \n \"smiley-partying-face\"=\"\\F0\\9F\\A5\\B3\";\r\ +> \n \"smiley-smiling-face\"=\"\\E2\\98\\BA\";\r\ +> \n \"smiley-winking-face-with-tongue\"=\"\\F0\\9F\\98\\9C\";\r\ +> \n \"sparkles\"=\"\\E2\\9C\\A8\";\r\ +> \n \"speech-balloon\"=\"\\F0\\9F\\92\\AC\";\r\ +> \n \"star\"=\"\\E2\\AD\\90\";\r\ +> \n \"warning-sign\"=\"\\E2\\9A\\A0\";\r\ +> \n \"white-heavy-check-mark\"=\"\\E2\\9C\\85\"\r\ +> \n }, \$SymbolsExtra);\r\ +> \n :local Magic [ :pick [ /system/clock/get date ] 4 10 ];\r\ +> \n :local Special {\r\ +> \n \"information-04-01\"=\"\\F0\\9F\\9A\\BB\";\r\ +> \n \"large-orange-circle-04-01\"=\"\\F0\\9F\\8D\\8A\";\r\ +> \n \"large-orange-circle-10-31\"=\"\\F0\\9F\\8E\\83\";\r\ +> \n \"large-red-circle-04-01\"=\"\\F0\\9F\\8D\\92\" };\r\ +> \n :if ([ :len (\$Symbols->\$Name) ] = 0) do={\r\ +> \n :log warning (\$0 . \"No symbol available for name '\" . \$Name . \"\ +> '!\");\r\ +> \n :return \"\";\r\ +> \n }\r\ +> \n :return ([ \$EitherOr (\$Special->(\$Name . \$Magic)) (\$Symbols->\$Na\ +> me) ] . \"\\EF\\B8\\8F\");\r\ +> \n}\r\ +> \n\r\ +> \n:set SymbolForNotification do={\r\ +> \n :global NotificationsWithSymbols;\r\ +> \n :global SymbolByUnicodeName;\r\ +> \n :global IfThenElse;\r\ +> \n :if (\$NotificationsWithSymbols != true) do={:return [ \$IfThenElse ([\ +> \_:len \$2 ] > 0) ([ :tostr \$2 ] . \" \") \"\" ]}\r\ +> \n :local Return \"\";\r\ +> \n :foreach Symbol in=[ :toarray \$1 ] do={:set Return (\$Return . [ \$Sy\ +> mbolByUnicodeName \$Symbol ])}\r\ +> \n :return (\$Return . \" \");\r\ +> \n}\r\ +> \n\r\ +> \n:set Unix2Dos do={:return [ :tocrlf [ :tostr \$1 ] ]}\r\ +> \n:set UrlEncode do={\r\ +> \n :local Input [ :tostr \$1 ];\r\ +> \n :if ([ :len \$Input ] = 0) do={:return \"\"}\r\ +> \n :local Return \"\";\r\ +> \n :local Chars (\"\\n\\r !\\\"#\\\$%&'()*+,:;<=>\?@[\\\\]^`{|}~\");\r\ +> \n :local Subs { \"%0A\"; \"%0D\"; \"%20\"; \"%21\"; \"%22\"; \"%23\"; \"\ +> %24\"; \"%25\"; \"%26\"; \"%27\";\r\ +> \n \"%28\"; \"%29\"; \"%2A\"; \"%2B\"; \"%2C\"; \"%3A\"; \"%3B\"; \ +> \"%3C\"; \"%3D\"; \"%3E\"; \"%3F\";\r\ +> \n \"%40\"; \"%5B\"; \"%5C\"; \"%5D\"; \"%5E\"; \"%60\"; \"%7B\"; \ +> \"%7C\"; \"%7D\"; \"%7E\" };\r\ +> \n :for I from=0 to=([ :len \$Input ] - 1) do={\r\ +> \n :local Char [ :pick \$Input \$I ];\r\ +> \n :local Replace [ :find \$Chars \$Char ];\r\ +> \n :if ([ :typeof \$Replace ] = \"num\") do={:set Char (\$Subs->\$Repla\ +> ce)}\r\ +> \n :set Return (\$Return . \$Char);\r\ +> \n }\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set IsDNSResolving do={\r\ +> \n :do {:resolve \"api.telegram.org\"} on-error={:return false}\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set IsFullyConnected do={\r\ +> \n :global IsDNSResolving;\r\ +> \n :global IsTimeSync;\r\ +> \n :if ([ \$IsDNSResolving ] = false) do={:return false};\r\ +> \n :if ([ \$IsTimeSync ] = false) do={:return false};\r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set IsTimeSync do={\r\ +> \n :global IsTimeSyncCached;\r\ +> \n :global IsTimeSyncResetNtp;\r\ +> \n :if (\$IsTimeSyncCached = true) do={:return true}\r\ +> \n :if ([ /system/ntp/client/get enabled ] = true) do={\r\ +> \n :if ([ /system/ntp/client/get status ] = \"synchronized\") do={\r\ +> \n :set IsTimeSyncCached true;\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :local Uptime [ /system/resource/get uptime ];\r\ +> \n :if ([ :typeof \$IsTimeSyncResetNtp ] = \"nothing\") do={\r\ +> \n :set IsTimeSyncResetNtp \$Uptime;\r\ +> \n }\r\ +> \n :if (\$Uptime - \$IsTimeSyncResetNtp < 3m) do={:return false}\r\ +> \n :log warning \"\$0 The ntp client is configured, but did not sync.\"\ +> ;\r\ +> \n :set IsTimeSyncResetNtp \$Uptime;\r\ +> \n /system/ntp/client/set enabled=no;\r\ +> \n :delay 20ms;\r\ +> \n /system/ntp/client/set enabled=yes;\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :if ([ /system/license/get ]->\"level\" = \"free\" || \\\r\ +> \n [ /system/resource/get ]->\"board-name\" = \"x86\") do={\r\ +> \n :log debug \"\$0 No ntp client configured, relying on RTC for CHR fr\ +> ee license and x86.\";\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :if ([ /ip/cloud/get update-time ] = true) do={\r\ +> \n :if ([ :typeof [ /ip/cloud/get public-address ] ] = \"ip\") do={\r\ +> \n :set IsTimeSyncCached true;\r\ +> \n :return true;\r\ +> \n }\r\ +> \n :return false;\r\ +> \n }\r\ +> \n :log debug \"\$0 No time source configured! Returning gracefully...\";\ +> \r\ +> \n :return true;\r\ +> \n}\r\ +> \n\r\ +> \n:set FetchHugeFiles do={\r\ +> \n :local ScriptName [ :tostr \$1 ];\r\ +> \n :local Url [ :tostr \$2 ];\r\ +> \n :local CheckCert [ :tostr \$3 ];\r\ +> \n\r\ +> \n :global CleanName;\r\ +> \n :global FetchUserAgentStr;\r\ +> \n :global GetRandom20CharAlNum;\r\ +> \n :global IfThenElse;\r\ +> \n :global LogPrint;\r\ +> \n :global MkDir;\r\ +> \n :global RmDir;\r\ +> \n :global RmFile;\r\ +> \n :global WaitForFile;\r\ +> \n\r\ +> \n :set CheckCert [ \$IfThenElse (\$CheckCert = \"false\") \"no\" \"yes-w\ +> ithout-crl\" ];\r\ +> \n\r\ +> \n :local DirName (\"tmpfs/\" . [ \$CleanName \$ScriptName ]);\r\ +> \n :if ([ \$MkDir \$DirName ] = false) do={\r\ +> \n \$LogPrint error \$0 (\"Failed creating directory!\");\r\ +> \n :return false;\r\ +> \n }\r\ +> \n\r\ +> \n :local FileName (\$DirName . \"/\" . [ \$CleanName \$0 ] . \"-\" . [ \ +> \$GetRandom20CharAlNum ]);\r\ +> \n :onerror Err {\r\ +> \n /tool/fetch check-certificate=\$CheckCert \$Url dst-path=\$FileName \ +> \\\r\ +> \n http-header-field=({ [ \$FetchUserAgentStr \$ScriptName ] }) as-va\ +> lue;\r\ +> \n } do={\r\ +> \n :if ([ \$WaitForFile \$FileName 500ms ] = true) do={\r\ +> \n \$RmFile \$FileName;\r\ +> \n }\r\ +> \n \$LogPrint debug \$0 (\"Failed downloading from \" . \$Url . \" - \"\ +> \_. \$Err);\r\ +> \n \$RmDir \$DirName;\r\ +> \n :return false;\r\ +> \n }\r\ +> \n\r\ +> \n :if ([ \$WaitForFile \$FileName 5s ] = false) do={\r\ +> \n \$LogPrint debug \$0 (\"The file downloaded from \" . \$Url . \" did\ +> \_not show up.\");\r\ +> \n :return false;\r\ +> \n }\r\ +> \n\r\ +> \n :local FileSize [ /file/get \$FileName size ];\r\ +> \n :local Return \"\";\r\ +> \n :local VarSize 0;\r\ +> \n :while (\$VarSize != \$FileSize) do={\r\ +> \n :set Return (\$Return . ([ /file/read offset=\$VarSize chunk-size=32\ +> 768 file=\$FileName as-value ]->\"data\"));\r\ +> \n :set FileSize [ /file/get \$FileName size ];\r\ +> \n :set VarSize [ :len \$Return ];\r\ +> \n :if (\$VarSize > \$FileSize) do={\r\ +> \n :delay 100ms;\r\ +> \n }\r\ +> \n }\r\ +> \n \$RmDir \$DirName;\r\ +> \n :return \$Return;\r\ +> \n}\r\ +> \n\r\ +> \n:set FetchUserAgentStr do={\r\ +> \n :local Caller [ :tostr \$1 ];\r\ +> \n :global GlobalScriptsUrl;\r\ +> \n :global CommitBrief;\r\ +> \n :global IfThenElse;\r\ +> \n :local Resource [ /system/resource/get ];\r\ +> \n :return (\"User-Agent: Mikrotik/\" . \$Resource->\"version\" . \" \" .\ +> \_\$Resource->\"architecture-name\" . \\\r\ +> \n \" \" . \$Caller . \"/Fetch (\" . \$GlobalScriptsUrl . \"; \" . [ \$\ +> CommitBrief ] . \")\");\r\ +> \n}\r\ +> \n\r\ +> \n:set ScriptInstallUpdate do={ :onerror Err {\r\ +> \n :local Scripts [ :toarray \$1 ];\r\ +> \n :local NewComment [ :tostr \$2 ];\r\ +> \n :global InitSetup;\r\ +> \n\r\ +> \n :global CommitId;\r\ +> \n :global ScriptUpdatesCRLF;\r\ +> \n :global GlobalConfVersion;\r\ +> \n :global Identity;\r\ +> \n :global CertificateAvailable;\r\ +> \n :global CheckSumsVerify;\r\ +> \n :global GlobalScriptsUrl;\r\ +> \n :global SumsDirAndFileName;\r\ +> \n :global GlobalScriptsUrlSuffix;\r\ +> \n :global EitherOr;\r\ +> \n :global FetchUserAgentStr;\r\ +> \n :global Grep;\r\ +> \n :global IfThenElse;\r\ +> \n :global LogPrint;\r\ +> \n :global ParseKeyValueStore;\r\ +> \n :global RequiredRouterOS;\r\ +> \n :global SendNotification2;\r\ +> \n :global SymbolForNotification;\r\ +> \n :global ValidateSyntax;\r\ +> \n :global CommentsInScripts;\r\ +> \n\r\ +> \n :if ([ \$CertificateAvailable \"Root YE\" \"fetch\" ] = false) do={\r\ +> \n \$LogPrint warning \$0 (\"Downloading certificate failed, trying wit\ +> hout.\");\r\ +> \n }\r\ +> \n\r\ +> \n :foreach Script in=\$Scripts do={\r\ +> \n :if ([ :len [ /system/script/find where name=\$Script ] ] = 0) do={\ +> \r\ +> \n \$LogPrint info \$0 (\"Adding new script: \" . \$Script);\r\ +> \n /system/script/add name=\$Script owner=\$Script source=\"#!rsc by \ +> Vados\\n\" comment=\$NewComment;\r\ +> \n }\r\ +> \n }\r\ +> \n\r\ +> \n :local CommitIdBefore \$CommitId;\r\ +> \n :local GlobalConfVersionBefore \$GlobalConfVersion;\r\ +> \n :local ReloadGlobal false;\r\ +> \n :local DeviceMode [ /system/device-mode/get ];\r\ +> \n\r\ +> \n :if (\$CheckSumsVerify = true) do={\r\ +> \n :local CheckSums ({});\r\ +> \n :do {\r\ +> \n :local Url (\$GlobalScriptsUrl . \$SumsDirAndFileName . \$GlobalScr\ +> iptsUrlSuffix);\r\ +> \n \$LogPrint debug \$0 (\"Fetching checksums from url: \" . \$Url);\ +> \r\ +> \n :set CheckSums [ :deserialize from=json ([ /tool/fetch check-certi\ +> ficate=yes-without-crl \\\r\ +> \n http-header-field=({ [ \$FetchUserAgentStr \$0 ] }) \$Url output\ +> =user as-value ]->\"data\") ];\r\ +> \n } on-error={ \$LogPrint warning \$0 (\"Err = \" . \$Err); }\r\ +> \n }\r\ +> \n\r\ +> \n :foreach Script in=[ /system/script/find where source~\"^#!rsc by Vado\ +> s\" ] do={\r\ +> \n :local ScriptVal [ /system/script/get \$Script ];\r\ +> \n :local ScriptInfo [ \$ParseKeyValueStore (\$ScriptVal->\"comment\") \ +> ];\r\ +> \n :local SourceNew;\r\ +> \n\r\ +> \n :foreach Scheduler in=[ /system/scheduler/find where on-event~(\"\\\ +> \\b\" . \$ScriptVal->\"name\" . \"\\\\b\") ] do={\r\ +> \n :local SchedulerVal [ /system/scheduler/get \$Scheduler ];\r\ +> \n :if (\$ScriptVal->\"policy\" != \$SchedulerVal->\"policy\") do={\r\ +> \n \$LogPrint warning \$0 (\"Policies differ for script '\" . \$Scr\ +> iptVal->\"name\" . \"' and its scheduler '\" . \$SchedulerVal->\"name\" . \ +> \"'!\");\r\ +> \n }\r\ +> \n }\r\ +> \n :do {\r\ +> \n :if (\$ScriptInfo->\"ignore\" = true) do={\r\ +> \n \$LogPrint debug \$0 (\"Ignoring script '\" . \$ScriptVal->\"nam\ +> e\" . \"', as requested.\");\r\ +> \n :error true;\r\ +> \n }\r\ +> \n :if (\$CheckSumsVerify = true) do={\r\ +> \n :local CheckSum (\$CheckSums->(\$ScriptVal->\"name\"));\r\ +> \n :if ([ :len (\$ScriptInfo->\"base-url\") ] = 0 && [ :len (\$Scri\ +> ptInfo->\"url-suffix\") ] = 0 && \\\r\ +> \n [ :convert transform=md5 to=hex [ :tolf (\$ScriptVal->\"sou\ +> rce\") ] ] = \$CheckSum) do={\r\ +> \n \$LogPrint debug \$0 (\"Checksum for script '\" . \$ScriptVal-\ +> >\"name\" . \"' matches, ignoring.\");\r\ +> \n :error true;\r\ +> \n }\r\ +> \n }\r\ +> \n :if ([ :len (\$ScriptInfo->\"certificate\") ] > 0) do={\r\ +> \n :if ([ \$CertificateAvailable (\$ScriptInfo->\"certificate\") \"\ +> fetch\" ] = false) do={\r\ +> \n \$LogPrint warning \$0 (\"Downloading certificate failed, tryi\ +> ng without.\");\r\ +> \n }\r\ +> \n }\r\ +> \n :onerror Err {\r\ +> \n :local BaseUrl [ \$EitherOr (\$ScriptInfo->\"base-url\") \$Globa\ +> lScriptsUrl ];\r\ +> \n :local UrlSuffix [ \$EitherOr (\$ScriptInfo->\"url-suffix\") \$G\ +> lobalScriptsUrlSuffix ];\r\ +> \n :local Url (\$BaseUrl . \$ScriptVal->\"name\" . \".rsc\" . \$Url\ +> Suffix);\r\ +> \n \$LogPrint warning \$0 (\"Fetching script '\" . (\$ScriptVal->\"\ +> name\") . \"' from url: \" . \$Url);\r\ +> \n :local Result [ /tool/fetch check-certificate=yes-without-crl \\\ +> \r\ +> \n http-header-field=({ [ \$FetchUserAgentStr \$0 ] }) \$Url outp\ +> ut=user as-value ];\r\ +> \n :if (\$Result->\"status\" = \"finished\") do={\r\ +> \n :set SourceNew [ :tolf (\$Result->\"data\") ];\r\ +> \n } \r\ +> \n } do={\r\ +> \n \$LogPrint warning \$0 (\"Failed fetching script '\" . \$ScriptV\ +> al->\"name\" . \"': \" . \$Err);\r\ +> \n :if (\$Err != \"Fetch failed with status 404\") do={\r\ +> \n :error false;\r\ +> \n }\r\ +> \n :if (\$ScriptVal->\"source\" = \"#!rsc by Vados\") do={\r\ +> \n \$LogPrint warning \$0 (\"Removing dummy. Typo on installation\ +> \?\");\r\ +> \n /system/script/remove \$Script;\r\ +> \n :error false;\r\ +> \n }\r\ +> \n :if (\$CheckSumsVerify = true) do={\r\ +> \n :if ([ :len (\$ScriptInfo->\"base-url\") ] = 0 && [ :len (\$Sc\ +> riptInfo->\"url-suffix\") ] = 0 && \\\r\ +> \n [ :len \$CheckSum ] = 0) do={\r\ +> \n \$LogPrint warning \$0 (\"Added the script manually\? Skip u\ +> pdates with 'ignore=true' in comment.\");\r\ +> \n }\r\ +> \n }\r\ +> \n :error false;\r\ +> \n }\r\ +> \n\r\ +> \n :if ([ :len \$SourceNew ] = 0) do={\r\ +> \n \$LogPrint debug \$0 (\"No update for script '\" . (\$ScriptVal-\ +> >\"name\") . \"'.\");\r\ +> \n :error false;\r\ +> \n }\r\ +> \n\r\ +> \n :local SourceCRLF [ :tocrlf \$SourceNew ];\r\ +> \n :if (\$InitSetup != true && ((\$ScriptVal->\"name\") != \"AM-Globa\ +> lConfig\" || (\$ScriptVal->\"name\") != \"AM-GlobalFunc\")) do={\r\ +> \n :if (\$SourceNew = (\$ScriptVal->\"source\") || \$SourceCRLF = (\ +> \$ScriptVal->\"source\")) do={\r\ +> \n \$LogPrint debug \$0 (\"Script '\" . (\$ScriptVal->\"name\") \ +> . \"' source did not change. End of lines set to CRLF.\");\r\ +> \n if (\$ScriptUpdatesCRLF = false) do={\r\ +> \n :put [ :tolf \$SourceNew ];\r\ +> \n \$LogPrint debug \$0 (\"Script '\" . (\$ScriptVal->\"name\"\ +> ) . \"' source update end of lines to LF.\");\r\ +> \n }\r\ +> \n :error false;\r\ +> \n }\r\ +> \n }\r\ +> \n\r\ +> \n :if ([ :pick \$SourceNew 0 14 ] != \"#!rsc by Vados\") do={\r\ +> \n \$LogPrint warning \$0 (\"Looks like new script '\" . \$ScriptVa\ +> l->\"name\" . \"' is not valid (missing shebang = '\$shebang') Ignoring!\"\ +> );\r\ +> \n :error false;\r\ +> \n }\r\ +> \n\r\ +> \n :if (\$CommentsInScripts = true) do={\r\ +> \n :local CommentLine [ \$Grep \$SourceNew (\"\\23 Script comment:\ +> \_\") ];\r\ +> \n :if ([ :len \$CommentLine ] = 0) do={\r\ +> \n \$LogPrint debug \$0 (\"The search in new script '\" . (\$Scr\ +> iptVal->\"name\") . \"' for comment in script body, is not found result Ig\ +> noring!\");\r\ +> \n :error false;\r\ +> \n } else={\r\ +> \n :if ([ :len (\$ScriptVal->\"comment\")] = 0 || [ :len (\$Scri\ +> ptVal->\"comment\")] != [ :pick \$CommentLine ([ :find \$CommentLine \":\"\ +> ] + 2) [ :len \$CommentLine] ]) do={\r\ +> \n \$LogPrint debug \$0 (\"Exsiting comment for script '\" . (\ +> \$ScriptVal->\"name\") . \"' is '\" . (\$ScriptVal->\"comment\") . \"'.\")\ +> ;\r\ +> \n :set (\$ScriptVal->\"comment\") [ :pick \$CommentLine ([ :f\ +> ind \$CommentLine \":\"] + 2) [ :len \$CommentLine] ];\r\ +> \n \$LogPrint debug \$0 (\"New comment (\" . (\$ScriptVal->\"c\ +> omment\") . \") for script '\" . (\$ScriptVal->\"name\") . \"' has been ad\ +> ded!\");\r\ +> \n } else={\r\ +> \n \$LogPrint debug \$0 (\"Comment for script '\" . (\$ScriptV\ +> al->\"name\") . \"' did not change.\");\r\ +> \n :error false;\r\ +> \n }\r\ +> \n } \r\ +> \n }\r\ +> \n\r\ +> \n :local RequiredROS ([ \$ParseKeyValueStore [ \$Grep \$SourceNew (\ +> \"\\23 requires RouterOS, \") ] ]->version);\r\ +> \n :if ([ \$RequiredRouterOS \$0 [ \$EitherOr \$RequiredROS \"0.0\" ]\ +> \_false ] = false) do={\r\ +> \n \$LogPrint warning \$0 (\"The script '\" . (\$ScriptVal->\"name\ +> \") . \"' requires RouterOS \" . \\\r\ +> \n \$RequiredROS . \", which is not met by your installation. I\ +> gnoring!\");\r\ +> \n :error false;\r\ +> \n }\r\ +> \n :local RequiredDM [ \$ParseKeyValueStore [ \$Grep \$SourceNew (\"\ +> \\23 requires device-mode, \") ] ];\r\ +> \n :local MissingDM ({});\r\ +> \n :foreach Feature,Value in=\$RequiredDM do={\r\ +> \n :if ([ :typeof (\$DeviceMode->\$Feature) ] = \"bool\" && (\$Devi\ +> ceMode->\$Feature) = false) do={\r\ +> \n :set MissingDM (\$MissingDM, \$Feature);\r\ +> \n }\r\ +> \n }\r\ +> \n :if ([ :len \$MissingDM ] > 0) do={\r\ +> \n \$LogPrint warning \$0 (\"The script '\" . (\$ScriptVal->\"name\ +> \") . \"' requires disabled \" . \\\r\ +> \n \"device-mode features (\" . [ :tostr \$MissingDM ] . \"). I\ +> gnoring!\");\r\ +> \n :error false;\r\ +> \n }\r\ +> \n\r\ +> \n :if ([ \$ValidateSyntax \$SourceNew ] = false) do={\r\ +> \n \$LogPrint warning \$0 (\"Syntax validation for script '\" . (\$\ +> ScriptVal->\"name\") . \"' failed! Ignoring!\");\r\ +> \n :error false;\r\ +> \n }\r\ +> \n \r\ +> \n :log info (\"Updating script: \" . (\$ScriptVal->\"name\") . \" Sc\ +> ript comment: \" . (\$ScriptVal->\"comment\"));\r\ +> \n\r\ +> \n /system/script/set owner=(\$ScriptVal->\"name\") comment=(\$Script\ +> Val->\"comment\") \\\r\ +> \n source=[ \$IfThenElse (\$ScriptUpdatesCRLF = true) \$SourceCRL\ +> F \$SourceNew ] \$Script;\r\ +> \n :if (\$ScriptVal->\"name\" = \"AM-GlobalConfig\" || \\\r\ +> \n \$ScriptVal->\"name\" = \"AM-GlobalFunc\" || \\\r\ +> \n \$ScriptVal->\"name\" ~ (\"^(AM-GlobalFunc\\\\.d|mod)/.\")) d\ +> o={\r\ +> \n :set ReloadGlobal true;\r\ +> \n }\r\ +> \n } on-error={ }\r\ +> \n }\r\ +> \n :if (\$ReloadGlobal = true) do={\r\ +> \n \$LogPrint info \$0 (\"Reloading global configuration and functions.\ +> \");\r\ +> \n :onerror Err {\r\ +> \n :global InitSetup (a);\r\ +> \n /system/script {run AM-GlobalConfig; run AM-GlobalFunc;};\r\ +> \n } do={\$LogPrint error \$0 (\"Reloading global configuration and fun\ +> ctions failed! \" . \$Err)}\r\ +> \n }\r\ +> \n :if (\$GlobalConfVersionBefore > \$GlobalConfVersion) do={\r\ +> \n \$LogPrint warning \$0 (\"The configuration version decreased from \ +> \" . \\\r\ +> \n \$GlobalConfVersionBefore . \" to \" . \$GlobalConfVersion . \\\r\ +> \n \". Installed an older version\?\");\r\ +> \n }\r\ +> \n :if (\$GlobalConfVersionBefore < \$GlobalConfVersion) do={\r\ +> \n :global GlobalConfChanges;\r\ +> \n :global GlobalConfMigration;\r\ +> \n :local ChangeLogCode;\r\ +> \n :if ([ :len \$ChangeLogCode ] > 0) do={\r\ +> \n :if ([ \$ValidateSyntax \$ChangeLogCode ] = true) do={\r\ +> \n :onerror Err {\r\ +> \n [ :parse \$ChangeLogCode ];\r\ +> \n } do={\$LogPrint warning \$0 (\"The changelog failed to run: \" \ +> . \$Err)}\r\ +> \n } else={\$LogPrint warning \$0 (\"The changelog failed syntax vali\ +> dation!\")}\r\ +> \n }\r\ +> \n :if ([ :len \$GlobalConfMigration ] > 0) do={\r\ +> \n :for I from=(\$GlobalConfVersionBefore + 1) to=\$GlobalConfVersion\ +> \_do={\r\ +> \n :local Migration (\$GlobalConfMigration->[ :tostr \$I ]);\r\ +> \n :do {\r\ +> \n :if ([ :typeof \$Migration ] != \"str\") do={\r\ +> \n \$LogPrint debug \$0 (\"Migration code for change \" . \$I .\ +> \_\" is not available.\");\r\ +> \n :error false;\r\ +> \n }\r\ +> \n :if ([ \$ValidateSyntax \$Migration ] = false) do={\r\ +> \n \$LogPrint warning \$0 (\"Migration code for change \" . \$I\ +> \_. \" failed syntax validation!\");\r\ +> \n :error false}\r\ +> \n \$LogPrint info \$0 (\"Applying migration for change \" . \$I \ +> . \": \" . \$Migration);\r\ +> \n :onerror Err {\r\ +> \n [ :parse \$Migration ];\r\ +> \n } do={\$LogPrint warning \$0 (\"Migration code for change \" .\ +> \_\$I . \" failed to run: \" . \$Err)}\r\ +> \n } on-error={ }\r\ +> \n }\r\ +> \n }\r\ +> \n :local NotificationMessage (\"The configuration version on \" . \$Id\ +> entity . \" increased \" . \\\r\ +> \n \"to \" . \$GlobalConfVersion . \", current configuration may nee\ +> d modification. \" . \\\r\ +> \n \"Please review and update global-config-overlay, then re-run glo\ +> bal-config.\");\r\ +> \n \$LogPrint info \$0 (\$NotificationMessage);\r\ +> \n :if ([ :len \$GlobalConfChanges ] > 0) do={\r\ +> \n :set NotificationMessage (\$NotificationMessage . \"\\n\\nChanges:\ +> \");\r\ +> \n :for I from=(\$GlobalConfVersionBefore + 1) to=\$GlobalConfVersion\ +> \_do={\r\ +> \n :local Change (\$GlobalConfChanges->[ :tostr \$I ]);\r\ +> \n :set NotificationMessage (\$NotificationMessage . \"\\n \" . \\\ +> \r\ +> \n [ \$SymbolForNotification \"pushpin\" \"*\" ] . \$Change);\r\ +> \n \$LogPrint info \$0 (\"Change \" . \$I . \": \" . \$Change);\r\ +> \n }\r\ +> \n } else={\r\ +> \n :set NotificationMessage (\$NotificationMessage . \"\\n\\nNews and\ +> \_changes are not available.\");\r\ +> \n\r\ +> \n }\r\ +> \n\r\ +> \n :if ([ :len \$GlobalConfChanges ] > 0) do={ :set GlobalConfChanges; \ +> } else={ :global GlobalConfChanges (a); }\r\ +> \n :if ([ :len \$GlobalConfMigration ] > 0) do={ :set GlobalConfMigrati\ +> on; } else={ :global GlobalConfMigration (a); }\r\ +> \n }\r\ +> \n} do={\r\ +> \n :global ExitOnError; \$ExitOnError \$0 \$Err;\r\ +> \n} }\r\ +> \n\r\ +> \n# load modules\r\ +> \n:foreach Script in=[ /system/script/find where name ~ \"^(global-functio\ +> ns\\\\.d|mod)/.\" ] do={\r\ +> \n :local ScriptVal [ /system/script/get \$Script ];\r\ +> \n :if ([ \$ValidateSyntax (\$ScriptVal->\"source\") ] = true) do={\r\ +> \n :onerror Err {\r\ +> \n /system/script/run \$Script;\r\ +> \n } do={\r\ +> \n \$LogPrint error \$0 (\"Module '\" . \$ScriptVal->\"name\" . \"' f\ +> ailed to run: \" . \$Err);\r\ +> \n }\r\ +> \n } else={\r\ +> \n \$LogPrint error \$0 (\"Module '\" . \$ScriptVal->\"name\" . \"' fai\ +> led syntax validation, skipping.\");\r\ +> \n }\r\ +> \n}\r\ +> \n\r\ +> \n# Add and fix global scheduler\r\ +> \n:put \"Add or/and fix Global scheduler...\";\r\ +> \n:local OnEvent \"/system/script { run AM-GlobalConfig; run AM-GlobalFunc\ +> ; }\";\r\ +> \n:local Comment \"Every Day Set Global Environment Variables\";\r\ +> \n:if ([ :len [ /system/scheduler/find where name=\"AM-SetGlobalEnv\" ] ] \ +> = 0) do={\r\ +> \n /system/scheduler/add name=\"AM-SetGlobalEnv\" comment=\$Comment on-ev\ +> ent=\$OnEvent start-time=startup;\r\ +> \n}\r\ +> \n:if ([ /system/scheduler/get \"AM-SetGlobalEnv\" comment ] != \$Comment)\ +> \_do={\r\ +> \n /system/scheduler/set \"AM-SetGlobalEnv\" comment=\$Comment;\r\ +> \n}\r\ +> \n:if ([ /system/scheduler/get \"AM-SetGlobalEnv\" on-event ] != \$OnEvent\ +> ) do={\r\ +> \n /system/scheduler/set \"AM-SetGlobalEnv\" on-event=\$OnEvent;\r\ +> \n}\r\ +> \n# Add Update Script scheduler\r\ +> \n:put \"Add or/and fix Update Script scheduler\";\r\ +> \n:set OnEvent \":global ScriptInstallUpdate; \\\$ScriptInstallUpdate;\";\ +> \r\ +> \n:set Comment \"Every Day Check For Update Scripts\";\r\ +> \n:if ([ :len [ /system/scheduler/find where name=\"AM-ScriptInstallUpdate\ +> \" ] ] = 0) do={\r\ +> \n/system/scheduler/add name=\"AM-ScriptInstallUpdate\" comment=\$Comment \ +> start-time=startup interval=1d on-event=\$OnEvent;\r\ +> \n}\r\ +> \n\r\ +> \n:onerror Err {\r\ +> \n :global GlobalConfReady;\r\ +> \n :retry { :if (\$GlobalConfReady != true) do={ :error (\"Global configs\ +> \_not ready.\"); }; } delay=100ms max=5;\r\ +> \n\r\ +> \n:log warning (\"This script \$ScriptName Loaded \" . \\\r\ +> \n [ \$IfThenElse (\$CommitId != \"unknown\") ([ \$CommitBrief ] . \" \ +> \") ] . \\\r\ +> \n \"on \" . \$devBoardName . \"\\nRouterOS: \" . \$devCurVersion . \"\ +> \\nArchitecture: \" . \$devCurArch . \"\\nIdentity: \" . \$Identity);\r\ +> \n # signal we are ready\r\ +> \n:set GlobalFuncReady true;\r\ +> \n:set ExitOK true;\r\ +> \n\r\ +> \n:log info (\$0 . \"Global configs ready!\");\r\ +> \n} do={\r\ +> \n :global ExitOnError; \$ExitOnError \$0 \$Err;\r\ +> \n}\r\ +> \n" +> add comment=\ +> "Lookup IP addresses for RKN list and add them to firewall address-list" \ +> dont-require-permissions=no name=AM-RKN-dnsLookup owner=AM-RKN-dnsLookup \ +295,305c2278,2416 +< source="# ============================================================\ +< \n# AWG Proxy -- MikroTik RouterOS (protocol: v2)\ +< \n# 2026-07-21 10:33:39\ +< \n# ============================================================\ +< \n\ +< \n# 0. Check prerequisites\ +< \n:if ([:len [/system/package/find where name=\"container\" disabled=no]] \ +< = 0) do={\ +< \n :put \"Container package is not installed or disabled. Install it and \ +< reboot.\"\ +< \n :error \"Usage: /system/device-mode/update container=yes\"\ +--- +> source="#!rsc by Vados\r\ +> \n# RouterOS script: AM-RKN-dnsLookup\r\ +> \n# Script comment: Lookup IP addresses for RKN list and add them to firew\ +> all address-list\r\ +> \n# Copyright (c) 2007-2026 Vados \r\ +> \n#\r\ +> \n#\r\ +> \n# requires RouterOS, version=7.19\r\ +> \n# requires device-mode, fetch\r\ +> \n#\r\ +> \n# Script description: This script is intended to be run periodically, e.\ +> g. once a day, to update the IP addresses in the firewall address-list bas\ +> ed on the RKN list.\r\ +> \n# It resolves the domain names in the RKN list and a\ +> dds the corresponding IP addresses to the specified firewall address-list.\ +> \r\ +> \n# The script also handles CNAME records by following\ +> \_them until it finds A records.\r\ +> \n# Usage:\r\ +> \n# /system/script { run AM-RKN-dnsLookup; }\r\ +> \n:local ScriptName [ :jobname ];\r\ +> \n\r\ +> \n:global dnsLookupReady false;\r\ +> \n:if ([:typeof \$dnsLookupReady] != \"boolean\") do={ :set dnsLookupReady\ +> \_true; }\r\ +> \nwhile (!\$dnsLookupReady) do={ :nothing; }\r\ +> \n:set dnsLookupReady false;\r\ +> \n\r\ +> \n:local arrRKN {\r\ +> \n \"telegra.ph\"\r\ +> \n \"grani.ru\"\r\ +> \n \"xhamster.com\"\r\ +> \n \"lostfilm.tv\"\r\ +> \n \"rutracker.org\"\r\ +> \n \"lurkmore.to\"\r\ +> \n \"dou.ua\"\r\ +> \n \"youporn.com\"\r\ +> \n \"pornolab.net\"\r\ +> \n \"crimerussia.com\"\r\ +> \n \"telegram.org\"\r\ +> \n \"api.telegram.org\"\r\ +> \n \"facebook.com\"\r\ +> \n \"instagram.com\"\r\ +> \n \"x.com\"\r\ +> \n \"twitter.com\"\r\ +> \n \"youtube.com\"\r\ +> \n \"googleapis.com\"\r\ +> \n \"youtu.be\"\r\ +> \n \"googlevideo.com\"\r\ +> \n \"gstatic.com\"\r\ +> \n \"googleusercontent.com\"\r\ +> \n \"nhacmp3youtube.com\"\r\ +> \n \"telegram.me\"\r\ +> \n \"t.me\";}\r\ +> \n\r\ +> \n:local ListRKN \"RKN-dnsLookup\";\r\ +> \n:local ListComment (\"ListRKN managed by \" . \$ScriptName);\r\ +> \n:foreach aListItem in=[/ip/firewall/address-list find list=\$ListRKN] do\ +> ={\r\ +> \n /ip firewall address-list remove \$aListItem;\r\ +> \n}\r\ +> \n:foreach aItem in=\$arrRKN do={\r\ +> \n# :do {\r\ +> \n :retry delay=500ms max=5 on-error={:log error \"dns resolve fail\ +> ure [ \$aItem - resolve ip ]\"} command={:resolve \$aItem}\r\ +> \n# } on-error={\r\ +> \n# :log error \"dns resolve failure [ \$arItem - resolve ip ]\";\r\ +> \n# }\r\ +> \n :foreach dnsRecord in=[/ip dns cache all find where (name=\$aItem)] \ +> do={\r\ +> \n :if ([/ip dns cache all get \$dnsRecord type]=\"A\") do={\r\ +> \n :local newAddress [/ip dns cache all get \$dnsRecord data];\ +> \r\ +> \n :do {\r\ +> \n /ip firewall address-list add list=\$ListRKN address=\$newA\ +> ddress comment=\$aItem;\r\ +> \n :log warning \"Successfully adding ip to list A record: \ +> \$dnsRecord, address: \$newAddress domain: \$aItem\";\r\ +> \n } on-error={\r\ +> \n :log error \"error when adding ip to list A record: \$dn\ +> sRecord, address: \$newAddress domain: \$aItem\";\r\ +> \n }\r\ +> \n }\r\ +> \n :if ([/ip dns cache all get \$dnsRecord type]=\"CNAME\") do={\r\ +> \n :local cname;\r\ +> \n :local nextCname;\r\ +> \n :local cnameAddress;\r\ +> \n :set cname [/ip dns cache all find where (name=\$aItem && ty\ +> pe=\"CNAME\")];\r\ +> \n :set nextCname [/ip dns cache all find where (name=[/ip dns \ +> cache all get \$cname data] && type=\"CNAME\")];\r\ +> \n :while (\$nextCname != \"\") do={\r\ +> \n :set cname \$nextCname;\r\ +> \n :set nextCname [/ip dns cache all find where (name=[/ip \ +> dns cache all get \$cname data] && type=\"CNAME\")];\r\ +> \n }\r\ +> \n :foreach aRecord in=[/ip dns cache all find where (name=[/ip\ +> \_dns cache all get \$cname data] && type=\"A\")] do={\r\ +> \n :do {\r\ +> \n :set cnameAddress [/ip dns cache all get \$aRecord d\ +> ata];\r\ +> \n /ip firewall address-list add list=\$ListRKN address\ +> =\$cnameAddress comment=\$aItem;\r\ +> \n :log warning \"Succesfully adding ip to list CNAME r\ +> ecord: \$cname, A record: \$aRecord, address: \$newAddress, from domain: \ +> \$aItem.\";\r\ +> \n# /ip firewall raw add action=add-dst-to-address-list\ +> \_address-list=\$ListRKN address-list-timeout=none-dynamic chain=preroutin\ +> g comment=\$aItem content=\$aItem;\r\ +> \n } on-error={\r\ +> \n :log error \"error when adding ip to list CNAME reco\ +> rd: \$cname, A record: \$aRecord, address: \$newAddress, from domain: \$aI\ +> tem.\";\r\ +> \n }\r\ +> \n }\r\ +> \n }\r\ +> \n }\r\ +> \n}\r\ +> \n\r\ +> \n:if ([ :len [ /system/scheduler/find where name=\$ScriptName ] ] = 0) do\ +> ={\r\ +> \n :log error (\$ScriptName . \"System Scheduler for script: \" . \$Scri\ +> ptName . \" is NOT SET! Fix It Now!\");\r\ +> \n /system/scheduler/add name=\$ScriptName on-event=\"/system/script { \ +> run \$ScriptName; }\" comment=\"Update RKN DNS Looup\" interval=00:30:00 p\ +> olicy=\"ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon\"\ +> \_start-time=startup;\r\ +> \n }\r\ +> \n:set dnsLookupReady true;\r\ +> \ndelay 2s; \r\ +> \n:global dnsLookupReady (a);\r\ +> \n" +> add dont-require-permissions=no name="renameLists " owner=vados policy=\ +> ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\ +> local oldName \"Test\";\ +> \n:local newName \"Test-IP\";\ +> \n/ip firewall address-list\ +> \n:foreach i in=[find list=\$oldName] do={\ +> \nset \$i list=\$newName;\ +306a2418,2421 +> \n" +> add dont-require-permissions=no name=IPv6-Settings owner=vados policy=\ +> ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\ +> #############Script Settings##################\ +308,335c2423,2446 +< \n# Check storage device\ +< \n{\ +< \n :local targetDisk \"usb1\"\ +< \n :local diskFree 0\ +< \n :do { :set diskFree [/disk/get [find where mount-point=\$targetDisk] f\ +< ree] } on-error={}\ +< \n :if (\$diskFree = 0) do={\ +< \n :local baseDisk \$targetDisk\ +< \n :local dashPos [:find \$targetDisk \"-part\"]\ +< \n :if ([:typeof \$dashPos] != \"nil\") do={ :set baseDisk [:pick \$tar\ +< getDisk 0 \$dashPos] }\ +< \n :if ([:len [/disk/find where slot=\$baseDisk]] > 0) do={\ +< \n :put (\"Device \$baseDisk found but \$targetDisk is not available.\ +< \")\ +< \n :put \"Format \$baseDisk as ext4\? ALL DATA WILL BE ERASED!\"\ +< \n :put \"Press 'y' to confirm, any other key to cancel:\"\ +< \n :local key [/terminal/inkey timeout=30]\ +< \n :if (\$key = 121 || \$key = 89) do={\ +< \n :put \"Formatting \$baseDisk as ext4...\"\ +< \n /disk/format-drive \$baseDisk file-system=ext4 label=\$baseDisk\ +< \n :delay 3s\ +< \n :do { :set diskFree [/disk/get [find where mount-point=\$targetD\ +< isk] free] } on-error={}\ +< \n :if (\$diskFree = 0) do={\ +< \n :put (\"ERROR: \$targetDisk not found after formatting.\")\ +< \n :put \"Check mount point: /disk/print\"\ +< \n :error (\"Mount point \$targetDisk not found after formatting\ +< \")\ +--- +> \n:local \"IF-TUN\" \"6to4-tun\"\ +> \n:local \"IF-LOC\" \"Bridge-LAN\"\ +> \n:local \"POOL-6TO4\" \"poolV6-local\"\ +> \n:local \"force-update\" false\ +> \n############ use then static ip #######################\ +> \n:local \"lease-address\" [/ip address get [find interface=\$\"IF-LOC\"] \ +> address]\ +> \n#:local \"interface\" \"ext\"\ +> \n:local bound 0\ +> \n\ +> \n###############################################\ +> \n\ +> \n:local 6to4prefix do={\ +> \n :global dec2hex\ +> \n :local ipv4 \$1\ +> \n :local ipv6 \"2002:\"\ +> \n :for i from=0 to=2 step=1 do={ \ +> \n :if ( \$i = 2) do={\ +> \n :set ipv6 (\$ipv6.\":\")\ +> \n }\ +> \n :local fp [:find \$ipv4 \".\"]\ +> \n :if ( \$fp > 0 ) do={\ +> \n :set ipv6 (\$ipv6.[\$dec2hex [:pick \$ipv4 0 \$fp]])\ +> \n :set ipv4 [:pick \$ipv4 (\$fp + 1 ) [:len \$ipv4]]\ +337,345d2447 +< \n :put (\"Formatted OK. Free: \" . (\$diskFree / 1048576) . \" MB\ +< \")\ +< \n } else={\ +< \n :error \"Formatting cancelled\"\ +< \n }\ +< \n } else={\ +< \n :put (\"ERROR: Storage device \$targetDisk not found.\")\ +< \n :put \"Check available disks: /disk/print\"\ +< \n :error (\"Storage not found: \" . \$targetDisk)\ +347,350c2449 +< \n } else={\ +< \n :put (\"Storage OK: \$targetDisk (\" . (\$diskFree / 1048576) . \" M\ +< B free)\")\ +< \n }\ +--- +> \n :return (\$ipv6.[\$dec2hex \$ipv4])\ +352,390c2451,2468 +< \n\ +< \n# 1. Uninstall script\ +< \n/system/script/add name=awg2vds-uninstall comment=awg2vds source={\ +< \n :put \"Uninstallimg AmneziaWG...\"\ +< \n :log info \"Uninstallimg AmneziaWG...\"\ +< \n :local prevDNS \"\"\ +< \n :do { :set prevDNS [/container/envs/get [find where list=\"awg2vds-env\ +< \" key=\"AWG_PREV_DNS\"] value] } on-error={}\ +< \n :local prevTmpdir \"\"\ +< \n :do { :set prevTmpdir [/container/envs/get [find where list=\"awg2vds-\ +< env\" key=\"AWG_PREV_TMPDIR\"] value] } on-error={}\ +< \n /ip/route/remove [find where comment=awg2vds-tunnel]\ +< \n /ip/route/remove [find where comment=awg2vds-dns]\ +< \n /container/stop [find where interface=veth-awg2vds]\ +< \n :delay 7s\ +< \n /container/remove [find where interface=veth-awg2vds]\ +< \n /container/envs/remove [find where list=\"awg2vds-env\"]\ +< \n :if (\$prevDNS != \"\") do={\ +< \n :do { /ip/dns/set servers=\"\$prevDNS\" } on-error={}\ +< \n :put (\"DNS restored to: \$prevDNS\")\ +< \n }\ +< \n /container/config set tmpdir=\$prevTmpdir\ +< \n :put (\"Container tmpdir restored to: \$prevTmpdir\")\ +< \n /ip/firewall/nat/remove [find where out-interface=\"wg-awg2vds\"]\ +< \n /ip/firewall/nat/remove [find where src-address=\"172.20.200.68/30\"]\ +< \n /ip/address/remove [find where address=\"172.20.200.69/30\"]\ +< \n /interface/veth/remove [find where name=\"veth-awg2vds\"]\ +< \n /interface/wireguard/peers/remove [find where interface=\"wg-awg2vds\"\ +< ]\ +< \n /ip/address/remove [find where interface=\"wg-awg2vds\"]\ +< \n /interface/wireguard/remove [find where name=\"wg-awg2vds\"]\ +< \n :do { /file/remove [find where name~\"awg2vds.+tar\"] } on-error={}\ +< \n :do { /file/remove [find where name=\"usb1/awg2vds\"] } on-error={}\ +< \n :do { /file/remove [find where name=\"usb1/ru_ranges_timeout.rsc\"] } \ +< on-error={}\ +< \n :do { /file/remove [find where name~\"usb1/pull\"] } on-error={}\ +< \n :put \"Uninstall AmneziaWG Proxy complete!\"\ +< \n :log info \"Uninstall AmneziaWG Proxy complete!\"\ +< \n /system/script/remove [find where name=awg2vds-uninstall]\ +--- +> \n:local \"str_replace\" do={\ +> \n :local \"str-pos\" [:find \$1 \$2]\ +> \n :local \"str-len\" [:len \$2]\ +> \n :local str \"\"\ +> \n :local rest \$1\ +> \n :while (\$\"str-pos\" >= 0) do={\ +> \n :local t [:pick \$rest 0 \$\"str-pos\"]\ +> \n :if ( \$4 > 0 ) do={\ +> \n :for i from=1 to=(\$4 - [:len \$t]) step=1 do={\ +> \n :set str (\$str.\$5)\ +> \n }\ +> \n }\ +> \n :set str (\$str.\$t.\$3)\ +> \n :set rest [:pick \$rest (\$\"str-pos\"+\$\"str-len\") [:len \$re\ +> st]]\ +> \n :set \"str-pos\" [:find \$rest \$2]\ +> \n }\ +> \n :return (\$str.\$rest)\ +393,438c2471,2472 +< \n# 2. Network infrastructure\ +< \n/interface/veth/add name=veth-awg2vds address=172.20.200.70/30 gateway=1\ +< 72.20.200.69\ +< \n/ip/address/add address=172.20.200.69/30 interface=veth-awg2vds\ +< \n/ip/firewall/nat/add chain=srcnat action=masquerade src-address=172.20.2\ +< 00.68/30\ +< \n\ +< \n# 3. WireGuard interface (MikroTik derives the public key automatically)\ +< \n/interface/wireguard/add name=wg-awg2vds private-key=\"4LNSJJNEDeT2LFXkF\ +< x0XyrNp2Mp7YXlS8SawhqNfKGQ=\" listen-port=26084 disabled=yes\ +< \n/interface/wireguard/peers/add interface=wg-awg2vds public-key=\"qHFd72X\ +< DJJ5UrUZCZ0vRFQmzxP7eUYcOuaGL9ZbHtyg=\" preshared-key=\"ckhzjCcr15ve+IeDRY\ +< veYITR7a/CMZCcOZ2Z0cABKD8=\" endpoint-address=172.20.200.70 endpoint-port=\ +< 51820 allowed-address=10.10.10.1/24,10.30.30.0/24,0.0.0.0/0 persistent-kee\ +< palive=10\ +< \n/ip/address/add address=10.10.10.2/24 interface=wg-awg2vds\ +< \n\ +< \n# 4. Container environment variables\ +< \n/container/envs/add list=awg2vds-env key=AWG_LISTEN value=\":51820\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_REMOTE value=\"109.107.177.\ +< 79:443\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_JC value=\"6\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_JMIN value=\"171\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_JMAX value=\"481\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_S1 value=\"50\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_S2 value=\"139\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_H1 value=\"1189447486-11894\ +< 48396\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_H2 value=\"538303610-538304\ +< 276\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_H3 value=\"101001960-101002\ +< 598\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_H4 value=\"1783887443-17838\ +< 87851\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_SERVER_PUB value=\"qHFd72XD\ +< JJ5UrUZCZ0vRFQmzxP7eUYcOuaGL9ZbHtyg=\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_CLIENT_PUB value=[/interfac\ +< e/wireguard/get [find name=wg-awg2vds] public-key]\ +< \n/container/envs/add list=awg2vds-env key=AWG_S3 value=\"17\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_S4 value=\"6\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_I1 value=\"\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_I2 value=\"\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_I3 value=\"\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_I4 value=\"\"\ +< \n/container/envs/add list=awg2vds-env key=AWG_I5 value=\"\"\ +--- +> \n:if (\$bound=1) do={\ +> \n :local t [:find \$\"lease-address\" \"/\"]\ +440,487c2474,2556 +< \n# 5. DNS\ +< \n{ :local rawDNS [/ip/dns/get servers]; :local prevDNS \"\"; :foreach s i\ +< n=[:toarray \$rawDNS] do={ :if ([:len \$prevDNS] > 0) do={ :set prevDNS \"\ +< \$prevDNS,\$s\" } else={ :set prevDNS \$s } }; /container/envs/add list=aw\ +< g2vds-env key=AWG_PREV_DNS value=\"\$prevDNS\" }\ +< \n# NOTE: replaces existing DNS configuration\ +< \n/ip/dns/set servers=10.10.10.1\ +< \n/ip/route/add dst-address=10.10.10.1/32 gateway=wg-awg2vds distance=1 co\ +< mment=awg2vds-dns\ +< \n\ +< \n# 6. Download, create and start container\ +< \n:local prevTmpdir [/container/config/get tmpdir]\ +< \n/container/envs/add list=awg2vds-env key=AWG_PREV_TMPDIR value=\$prevTmp\ +< dir\ +< \n/container/config set tmpdir=usb1/pull memory-high=200M\ +< \n{\ +< \n :local arch [/system/resource/get architecture-name]\ +< \n :local ver [/system/resource/get version]\ +< \n :local dotPos [:find \$ver \".\"]\ +< \n :local rest [:pick \$ver (\$dotPos + 1) [:len \$ver]]\ +< \n :local endPos [:find \$rest \".\"]\ +< \n :if ([:typeof \$endPos] = \"nil\") do={ :set endPos [:find \$rest \" \ +< \"] }\ +< \n :local minor [:tonum [:pick \$rest 0 \$endPos]]\ +< \n :local suffix \"\"\ +< \n :if (\$minor <= 20) do={ :set suffix \"-7.20-Docker\" }\ +< \n :local file \"\"\ +< \n :if (\$arch = \"arm64\") do={ :set file (\"awg-proxy-arm64\" . \$suffi\ +< x . \".tar.gz\") }\ +< \n :if (\$arch = \"arm\") do={ :set file (\"awg-proxy-arm\" . \$suffix . \ +< \".tar.gz\") }\ +< \n :if (\$arch ~ \"x86\") do={ :set file (\"awg-proxy-amd64\" . \$suffix \ +< . \".tar.gz\") }\ +< \n :if (\$file = \"\") do={ :error \"Unsupported architecture: \$arch\" }\ +< \n :local url \"https://github.com/timbrs/amneziawg-mikrotik-c/releases/l\ +< atest/download/\$file\"\ +< \n :local filePath (\"usb1/pull/\" . \$file)\ +< \n :do { /file/make-directory usb1/pull } on-error={}\ +< \n :if ([:len [/file/find where name=\$filePath]] = 0) do={\ +< \n :local freeStorage 0\ +< \n :do { :set freeStorage [/disk/get [find where mount-point=\"usb1\"] \ +< free] } on-error={}\ +< \n :if (\$freeStorage < 262144) do={\ +< \n :put (\"WARNING: Low disk space (\" . (\$freeStorage / 1024) . \"K\ +< B free). Need at least 256KB.\")\ +< \n :put \"See: https://github.com/timbrs/amneziawg-mikrotik-c#insuffi\ +< cient-disk-space\"\ +< \n :error \"Insufficient disk space\"\ +--- +> \n :if ( \$t >= 0 ) do={\ +> \n :set \"lease-address\" [:pick \$\"lease-address\" 0 \$t]\ +> \n }\ +> \n\ +> \n :if ( [/interface 6to4 print count-only where name=\$\"IF-TUN\"] = 0\ +> ) do={\ +> \n /interface 6to4 add !keepalive local-address=\$\"lease-address\"\ +> \_mtu=1280 name=\$\"IF-TUN\" remote-address=10.30.30.0\ +> \n :set \"force-update\" true\ +> \n }\ +> \n\ +> \n :local \"IPv4-TUN\" [/interface 6to4 get [find name=\$\"IF-TUN\"] lo\ +> cal-address];\ +> \n\ +> \n :if ( \$\"lease-address\" != \$\"IPv4-TUN\" || \$\"force-update\" = \ +> true) do={\ +> \n /interface 6to4 set [find name=\$\"IF-TUN\"] local-address=\$\"l\ +> ease-address\"\ +> \n /ipv6 address remove [find interface=\$\"IF-TUN\"]\ +> \n /ipv6 address remove [find interface=\$\"IF-LOC\"]\ +> \n /ipv6 route remove [find gateway ~ \$\"IF-TUN\" and dst-address=\ +> \"::/0\"]\ +> \n :local \"pool-prefix\" [\$6to4prefix \$\"lease-address\"]\ +> \n :if ( [/ipv6 pool print count-only where name=\$\"POOL-6TO4\"] =\ +> \_0) do={ \ +> \n /ipv6 pool add name=\$\"POOL-6TO4\" prefix=(\$\"pool-prefix\ +> \".\":1::/64\") prefix-length=64\ +> \n } else={\ +> \n /ipv6 pool set [/ipv6 pool find where name=\$\"POOL-6TO4\"] \ +> prefix=(\$\"pool-prefix\".\":1::/64\")\ +> \n }\ +> \n /ipv6 address add address=(\$\"pool-prefix\".\"::\".[\$MAC2EUI64\ +> \_[/interface get [find name=\$\"interface\"] mac-address]].\"/3\") interf\ +> ace=\$\"IF-TUN\" advertise=no\ +> \n /ipv6 address add eui-64=yes from-pool=\$\"POOL-6TO4\" interface\ +> =\$\"IF-LOC\" advertise=yes\ +> \n /ipv6 route add dst-address=::/0 gateway=(\"::10.30.30.81%\".\$\ +> \"IF-TUN\")\ +> \n :local t [/ipv6 address get [find interface=\$\"IF-LOC\"] addres\ +> s]\ +> \n :set t [:pick \$t 0 [:find \$t \"/\"]]\ +> \n :if ( [/ipv6 dhcp-server option print count-only where name=DNS]\ +> \_= 0) do={\ +> \n /ipv6 dhcp-server option add code=23 name=DNS value=(\"0x\".\ +> [\$\"str_replace\" \$t \":\" \"\" 4 \"0\"])\ +> \n } else={\ +> \n /ipv6 dhcp-server option set [/ipv6 dhcp-server option find \ +> where name=DNS] value=(\"0x\".[\$\"str_replace\" \$t \":\" \"\" 4 \"0\"])\ +> \n }\ +> \n :if ( [/ipv6 dhcp-server print count-only where interface=\$\"IF\ +> -LOC\"] = 0) do={\ +> \n /ipv6 dhcp-server add address-pool=\$\"POOL-6TO4\" dhcp-opti\ +> on=DNS interface=\$\"IF-LOC\" lease-time=1d name=\$\"IF-LOC\"\ +> \n }\ +> \n :if ( [ipv6 nd print count-only where interface=\$\"IF-LOC\"] = \ +> 0) do={\ +> \n /ipv6 nd add advertise-dns=no interface=\$\"IF-LOC\" other-c\ +> onfiguration=yes\ +> \n }\ +> \n }\ +> \n}" +> add dont-require-permissions=no name=IPv6-GlobalFunc owner=vados policy=\ +> ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\ +> global MAC2EUI64 do={\ +> \n :local EUI64 \"\"\ +> \n :local MAC \$1\ +> \n :local HEX2DEC \"0123456789ABCDEF\"\ +> \n :for i from=0 to=5 step=1 do={\ +> \n :if ( \$i = 0 ) do={\ +> \n :set EUI64 [:pick \$MAC 0]\ +> \n :set EUI64 (\$EUI64.[:tostr [:pick \$\"HEX2DEC\" ([:find \$\ +> \"HEX2DEC\" [:pick \$MAC 1]] ^ 2)]])\ +> \n }\ +> \n :if ( \$i = 1 || \$i = 3) do={\ +> \n :set EUI64 (\$EUI64.\":\")\ +> \n }\ +> \n :if ( \$i = 2 ) do={\ +> \n :set EUI64 (\$EUI64.\"FF:FE\")\ +> \n }\ +> \n :if ( [:find \$MAC \":\"] = 2 ) do={\ +> \n :set MAC [:pick \$MAC 3 [:len \$MAC]]\ +> \n :set EUI64 (\$EUI64.[:pick \$MAC 0 2])\ +> \n }\ +489,537c2558 +< \n :put (\"Fetching: \$url -> \" . \$filePath)\ +< \n /tool/fetch url=\$url dst-path=\$filePath http-max-redirect-count=10\ +< \n } else={\ +< \n :put (\"File already exists: \" . \$filePath)\ +< \n }\ +< \n /container/add file=\$filePath interface=veth-awg2vds envlist=awg2vds-\ +< env hostname=awg2vds root-dir=usb1/awg2vds logging=no start-on-boot=yes co\ +< mment=awg2vds\ +< \n :if (\$minor > 20) do={ [:parse \"/container/set [find where interface\ +< =veth-awg2vds] shm-size=4M\"] }\ +< \n /file/remove \$filePath\ +< \n :local freeMem [/system/resource/get free-memory]\ +< \n :if (\$freeMem < 16777216) do={\ +< \n :put (\"WARNING: Low memory (\" . (\$freeMem / 1048576) . \"MB free)\ +< . 16MB+ recommended.\")\ +< \n }\ +< \n /container/start [find where interface=veth-awg2vds]\ +< \n :do { /file/remove [find where name=\"console-dump.txt\"] } on-error={\ +< }\ +< \n :put \"Waiting for container to start...\"\ +< \n :delay 5s\ +< \n /interface/wireguard/enable wg-awg2vds\ +< \n :put \"WireGuard interface enabled\"\ +< \n :put \"Installation complete!\"\ +< \n :put \"Ping test: 10.10.10.1 via AmneziaWG tunnel. repeat 10 times\"\ +< \n /ping 10.10.10.1 count=10 interval=1\ +< \n :put \"\"\ +< \n :put \"======= NEXT STEPS =======\"\ +< \n :put \"\"\ +< \n :put \"Route specific traffic through the AmneziaWG tunnel:\"\ +< \n :put \"\"\ +< \n :put \" Route a single host:\"\ +< \n :put \" /ip/route/add dst-address=8.8.8.8/32 gateway=wg-awg2vds com\ +< ment=awg2vds-tunnel\"\ +< \n :put \"\"\ +< \n :put \" Route a subnet:\"\ +< \n :put \" /ip/route/add dst-address=100.0.0.0/8 gateway=wg-awg2vds co\ +< mment=awg2vds-tunnel\"\ +< \n :put \"\"\ +< \n :put \" Remove a route:\"\ +< \n :put \" /ip/route/remove [find where comment=awg2vds-tunnel dst-add\ +< ress=8.8.8.8/32]\"\ +< \n :put \"\"\ +< \n :put \" Show all tunnel routes:\"\ +< \n :put \" /ip/route/print where comment=awg2vds-tunnel\"\ +< \n :put \"\"\ +< \n :put \" Uninstall:\"\ +< \n :put \" /system/script/run awg2vds-uninstall\"\ +< \n :put \"=========================\"\ +--- +> \n :return (\$EUI64)\ +540,543c2561,2634 +< \n# 7. Verification\ +< \n# /container/print\ +< \n# /interface/wireguard/print\ +< \n# /interface/wireguard/peers/print\ +--- +> \n:global dec2hex do={\ +> \n :local hex \"\"\ +> \n :local dec [:tonum \$1]\ +> \n :for i from=0 to=4 step=4 do={\ +> \n :set hex ([:pick \"0123456789ABCDEF\" ((\$dec>>\$i)&0xf) (((\$de\ +> c>>\$i)&0xf)+1)].\$hex)\ +> \n }\ +> \n :return ([:tostr \$hex])\ +> \n}" +> add comment=Generator dont-require-permissions=no name=proxySet owner=vados \ +> policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ +> source="# 2. WireGuard interface\r\ +> \n/interface/wireguard/add name=wg-VDSina private-key=\"4CHyNhbOs923/EyNDg\ +> uMXJXdghL2I3UyzXPwrANVgHs=\" listen-port=21641\r\ +> \n/interface/wireguard/peers/add interface=wg-VDSina public-key=\"o5IgCl1/\ +> G6xbl6j7sPaP4ZNYREeYOmqZjKbm+v0b9jU=\" preshared-key=\"RNvF7T1cg5tyXcYQnD9\ +> N5BEp6e20vVJQTv0GMjyvHU0=\" endpoint-address=10.30.30.33 endpoint-port=518\ +> 20 allowed-address=0.0.0.0/0 persistent-keepalive=11\r\ +> \n/ip/address/add address=10.9.0.3/32 interface=wg-VDSina\r\ +> \n\r\ +> \n# 3. DNS\r\ +> \n{ :local rawDNS [/ip/dns/get servers]; :local prevDNS \"\"; :foreach s i\ +> n=[:toarray \$rawDNS] do={ :if ([:len \$prevDNS] > 0) do={ :set prevDNS \"\ +> \$prevDNS,\$s\" } else={ :set prevDNS \$s } }; /system/script/add name=VDS\ +> ina-prev-dns comment=\"\$prevDNS\" source=\"\" }\r\ +> \n/ip/dns/set servers=8.8.4.4\r\ +> \n/ip/route/add dst-address=8.8.4.4/32 gateway=wg-VDSina distance=1 commen\ +> t=VDSina-dns\r\ +> \n\r\ +> \n# 4. Enable WireGuard\r\ +> \n/interface/wireguard/enable wg-VDSina\r\ +> \n" +> add dont-require-permissions=no name=AM-Telegram-Send owner=vados policy=\ +> ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\ +> !rsc by Vados\ +> \n# RouterOS script: AM-Telegram-Send\ +> \n# Script comment: Mini script for send messages to admin Telegram chat\ +> \n# Copyright (c) 2007-2026 Vados \ +> \n#\ +> \n#\ +> \n# requires RouterOS, version=7.19\ +> \n# requires device-mode, fetch\ +> \n#\ +> \n# Script description: \ +> \n#\ +> \n#\ +> \n# Usage:\ +> \n# /system/script { run AM-Telegram-Send \"Message here )))\"; }\ +> \n\ +> \n/system/script\ +> \nadd name=telegram-send dont-require-permissions=no source={\ +> \n :global TelegramTokenId;\ +> \n :global TelegramChatId;\ +> \n :local message [:tostr \$1];\ +> \n :local identity [/system/identity/get name];\ +> \n :local sendMsg (\"[\".\$identity.\"] \".\$message)\ +> \n /tool/fetch url=(\"https://api.telegram.org/bot\".\$TelegramTokenId.\\\ +> \n \"/sendMessage\\\?chat_id=\".\$TelegramChatId.\\\ +> \n \"&text=\".\$sendMsg.\\\ +> \n \"&parse_mode=HTML\") \\\ +> \n mode=https keep-result=no\ +> \n}" +> add dont-require-permissions=no name=telegram-send owner=vados policy=\ +> ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\ +> \n :global TelegramTokenId;\ +> \n :global TelegramChatId;\ +> \n :local message [:tostr \$1];\ +> \n :local identity [/system/identity/get name];\ +> \n :local sendMsg (\"[\".\$identity.\"] \".\$message)\ +> \n /tool/fetch url=(\"https://api.telegram.org/bot\".\$TelegramTokenId.\\\ +> \n \"/sendMessage\\\?chat_id=\".\$TelegramChatId.\\\ +> \n \"&text=\".\$sendMsg.\\\ +> \n \"&parse_mode=HTML\") \\\ +> \n mode=https keep-result=no\ +546,549c2637,2638 +< add name=backup policy="telnet,ssh,ftp,read,write,policy,test,sniff,sensitive,\ +< !local,!reboot,!winbox,!password,!web,!api,!romon,!rest-api" +< add name=manager policy="local,ssh,ftp,read,write,policy,api,rest-api,!telnet,\ +< !reboot,!test,!winbox,!password,!web,!sniff,!sensitive,!romon" +--- +> add name=backup policy="ssh,read,write,policy,test,web,sniff,sensitive,api,res\ +> t-api,!local,!telnet,!ftp,!reboot,!winbox,!password,!romon" +551,555c2640 +< set builtin-trust-store=fetch +< /container config +< set memory-high=200.0MiB +< /disk settings +< set auto-media-interface=Bridge-Lan +--- +> set builtin-trust-store=all crl-download=yes crl-store=system crl-use=yes +557c2642 +< set domain=WORKGROUP enabled=no interfaces=lo +--- +> set enabled=no interfaces=lo +559,564c2644,2650 +< add bridge=Bridge-Lan interface=ether2 +< add bridge=Bridge-Lan interface=ether3 +< add bridge=Bridge-Lan interface=ether4 +< add bridge=Bridge-Lan interface=ether5 +< add bridge=Bridge-Lan interface=wlan1 +< add bridge=Bridge-Lan interface=wlan2 +--- +> add bridge=Bridge-LAN interface=ether5 +> add bridge=Bridge-LAN interface=ether2 +> add bridge=Bridge-LAN interface=ether4 trusted=yes +> add bridge=Bridge-LAN interface=ether3 +> add bridge=Bridge-LAN interface=wlan2 +> add bridge=Bridge-LAN interface=wlan1 +> add bridge=Bridge-LAN disabled=yes interface=Unet-ether1 +566c2652,2654 +< set allow-fast-path=no use-ip-firewall=yes +--- +> set use-ip-firewall=yes +> /ip firewall connection tracking +> set udp-timeout=10s +568c2656 +< set discover-interface-list=LAN +--- +> set discover-interface-list=LAN lldp-med=no lldp-poe-power=no +570c2658,2659 +< set accept-redirects=yes allow-fast-path=no +--- +> set accept-redirects=yes ipv4-multipath-hash-policy=l4 max-neighbor-entries=\ +> 8192 +572,573c2661,2662 +< set accept-router-advertisements-on=none allow-fast-path=no disable-ipv6=yes \ +< disable-link-local-address=yes +--- +> set disable-ipv6=yes disable-link-local-address=yes forward=no \ +> max-neighbor-entries=8192 multipath-hash-policy=l4 +575,576c2664,2669 +< set detect-interface-list=static internet-interface-list=WAN \ +< lan-interface-list=LAN wan-interface-list=WAN +--- +> set detect-interface-list=WAN internet-interface-list=Internet \ +> lan-interface-list=LAN request-interval=1m wan-interface-list=WAN +> /interface l2tp-server server +> set authentication=mschap2 use-ipsec=yes +> /interface list +> add exclude=*2000016,LAN include=*2000017 name=WAN +578,579c2671,2683 +< add interface="ether1 - Unet" list=Internet +< add interface=Bridge-Lan list=LAN +--- +> add interface=lo list=LAN +> add interface=Unet-ether1 list=Internet +> add interface=WG list=WAN +> add interface=Bridge-LAN list=LAN +> /interface wireguard peers +> add allowed-address=0.0.0.0/0 client-allowed-address=::/0 endpoint-address=\ +> 109.107.177.79 endpoint-port=29185 interface=WG name=VDSina \ +> persistent-keepalive=10s public-key=\ +> "zuRsO+dL/j6awaBWZ/NgnHR+bCNUjRWbaHFpdzkNnw4=" +> add allowed-address=0.0.0.0/0 client-allowed-address=::/0 disabled=yes \ +> endpoint-address=10.30.30.33 endpoint-port=55055 interface=wg-nuc name=\ +> NUC persistent-keepalive=11s public-key=\ +> "+OvzAjLC45Td52hjkQPmpGvC3RGhZ+Q2CDMJ1U/D4Rw=" +581,585c2685,2688 +< # +< set bridge=Bridge-Lan caps-man-addresses=10.30.30.10 \ +< caps-man-certificate-common-names=CAPsMAN-ABE2F4E9EE17 certificate=\ +< CAP-18FD746E5814 discovery-interfaces=Bridge-Lan enabled=yes interfaces=\ +< wlan1,wlan2 lock-to-caps-man=yes +--- +> set bridge=Bridge-LAN caps-man-addresses=10.30.30.10 \ +> caps-man-certificate-common-names=CAPsMAN-51B25E507D07 certificate=\ +> CAP-488F5A8E1ABC discovery-interfaces=Bridge-LAN interfaces=wlan2,wlan1 \ +> lock-to-caps-man=yes +587c2690,2691 +< add address=10.30.30.81/24 interface=Bridge-Lan network=10.30.30.0 +--- +> add address=10.30.30.81/24 interface=Bridge-LAN network=10.30.30.0 +> add address=10.8.0.2/24 interface=WG network=10.8.0.0 +589c2693 +< set ddns-enabled=yes +--- +> set update-time=no +591,592c2695,2697 +< add check-gateway=bfd default-route-tables=main:1 dhcp-options=\ +< clientid,clientid_duid interface="ether1 - Unet" name=client1 \ +--- +> add add-default-route=special-classless comment=Unet-client \ +> default-route-distance=2 default-route-tables=main:2 dhcp-options=\ +> hostname,clientid_duid,clientid interface=Unet-ether1 name=UnetDHCP \ +602a2708,2709 +> add address=10.30.30.70 dhcp-option=domain-search-list,HostName \ +> dhcp-option-set=HP1505n mac-address=00:1E:0B:1A:88:8D server=masterDHCP +628a2736,2739 +> add address=10.30.30.95 client-id=1:88:ae:dd:60:39:54 dhcp-option=HostName \ +> dhcp-option-set=VADOS-NUC mac-address=88:AE:DD:60:39:54 server=masterDHCP +> add address=10.30.30.98 client-id=1:c8:5b:76:d8:cc:bf dhcp-option=HostName \ +> dhcp-option-set=VADOS-LEN mac-address=C8:5B:76:D8:CC:BF server=masterDHCP +632a2744,2751 +> add address=10.30.30.30 dhcp-option=HostName dhcp-option-set=miller \ +> mac-address=F0:75:5D:1E:5F:71 server=masterDHCP +> add address=10.30.30.100 client-id=iVados dhcp-option=HostName \ +> dhcp-option-set=iVados mac-address=DE:4D:72:F3:1A:9F server=masterDHCP +> add address=10.30.30.10 allow-dual-stack-queue=yes client-id=\ +> ff:0:0:0:df:0:3:0:1:f0:75:5d:1e:5f:85 dhcp-option=HostName \ +> dhcp-option-set=MikroNUC mac-address=F0:75:5D:1E:5F:85 server=masterDHCP \ +> use-src-mac=yes +634,636c2753,2755 +< add address=10.30.30.0/24 caps-manager=10.30.30.10 dhcp-option=\ +< domain-search-list dhcp-option-set=domain-search-set dns-server=\ +< 10.30.30.81 domain=WORKGROUP gateway=10.30.30.81 netmask=24 ntp-server=\ +--- +> add address=0.0.0.0/24 caps-manager=10.30.30.10 dhcp-option=\ +> domain-search-list dhcp-option-set=domain-search-set dns-server=0.0.0.0 \ +> domain=WORKGROUP gateway=0.0.0.0 netmask=24 ntp-server=\ +637a2757,2758 +> add address=10.30.30.0/24 dns-server=10.30.30.81 gateway=10.30.30.81 netmask=\ +> 24 +639c2760,2762 +< set allow-remote-requests=yes servers=89.110.101.17,10.30.30.33,8.8.4.4 +--- +> set allow-remote-requests=yes cache-max-ttl=1d doh-max-concurrent-queries=100 \ +> doh-max-server-connections=20 servers=10.30.30.33,109.107.177.79 \ +> verify-doh-cert=yes +641,646c2764,2796 +< add address=10.30.30.81 comment=defconf name=router.lan type=A +< add address=10.30.30.81 comment=defconf name=master type=A +< add address=10.30.30.33 comment=amster name=amster.vados.ru type=A +< add address=8.8.8.8 name=dns.google type=A +< add address=8.8.4.4 name=dns.google type=A +< add address=1.0.0.1 comment="CloudFlare-doh IPv4 2" name=\ +--- +> add address=109.107.177.79 comment="VDSina Server DNS" name=ns1.vados.ru \ +> type=A +> add address=109.107.177.79 name=vds.vados.ru type=A +> add comment="Local DNS server for vados.ru" disabled=yes ns=10.30.30.81 \ +> regexp=*.vados.ru type=NS +> add comment="*.vados.ru Regexp" disabled=yes forward-to=10.30.30.81 regexp=\ +> "\".*\\\\.vados\\\\.ru\"" type=FWD +> add comment="*.30.30.10.in-addr.arpa Regexp" disabled=yes forward-to=\ +> 10.30.30.81 regexp="\".*\\\\.30\\\\.30\\\\.10\\\\.in-addr\\\\.arpa" type=\ +> FWD +> add address=10.30.30.81 comment=NS.vados.ru.local disabled=yes name=\ +> ns.vados.ru.local type=A +> add comment="DNS ns.vados.ru.local" disabled=yes match-subdomain=yes name=\ +> vados.ru ns=ns.vados.ru.local type=NS +> add address=10.30.30.33 comment=reg.vados.ru name=reg.vados.ru type=A +> add address=8.8.8.8 comment="Google-dns IPv4 1" match-subdomain=yes name=\ +> dns.google type=A +> add address=8.8.4.4 comment="Google-dns IPv4 2" name=dns.google type=A +> add address=10.30.30.33 comment=AMSTER name=amster.vados.ru type=A +> add address=10.30.30.33 name=ros.vados.ru type=A +> add address=10.30.30.95 name=vados-nuc type=A +> add address=10.30.30.33 name=amster-nuc type=A +> add address=10.30.30.33 name=amster type=A +> add address=10.30.30.33 name=amster-reg type=A +> add address=10.30.30.33 disabled=yes name=mng.vados.ru type=A +> add address=10.30.30.33 name=mgr.vados.ru type=A +> add address=10.30.30.33 name=prt.vados.ru type=A +> add address=10.30.30.33 disabled=yes match-subdomain=yes name=\ +> mikrots.vados.ru type=A +> add address=10.30.30.30 comment=MILLER name=miller.vados.ru type=A +> add address=10.30.30.30 name=MILLER-LEN type=A +> add address=10.30.30.30 name=miller type=A +> add address=1.0.0.1 comment="CloudFlare-doh IPv4 2" disabled=yes name=\ +650,651d2799 +< add address=149.112.112.112 comment="Cuad9-dns IPv4 2" disabled=yes name=\ +< dns.quad9.net type=A +653a2802,2811 +> add address=149.112.112.112 comment="Cuad9-dns IPv4 2" disabled=yes name=\ +> dns.quad9.net type=A +> add address=195.133.25.16 comment="DNS Comss" disabled=yes name=dns.comss.one \ +> type=A +> add address=10.30.30.81 comment=LocalNet name=MikroVados type=A +> add address=10.30.30.10 name=MikroNUC type=A +> add address=10.30.30.86 disabled=yes name=MikroYellow type=A +> add address=10.30.30.85 disabled=yes name=MikroMic type=A +> add address=10.30.30.95 name=VADOS-NUC type=A +> add address=10.30.30.98 name=VADOS-LEN type=A +656,657c2814 +< add address=91.192.189.2 comment=Unet-DNS disabled=yes name=ns1.unet.ws type=\ +< A +--- +> add address=10.30.30.20 disabled=yes name=garage type=A +659,661d2815 +< add address=10.0.0.0/8 list=RFC1918 +< add address=172.16.0.0/12 list=RFC1918 +< add address=192.168.0.0/16 list=RFC1918 +667,677c2821,2907 +< add address=8.8.4.4 disabled=yes list=to_vpn +< add address=10.30.30.98 comment=vados-len list=Local2Vpn +< add address=89.110.101.17 list=VDS +< add address=109.107.177.79 list=TRUSTED +< add address=185.71.70.78 disabled=yes list=TRUSTED +< add address=176.53.203.171 disabled=yes list=TRUSTED +< add address=176.53.203.170 disabled=yes list=TRUSTED +< add address=176.53.202.194 disabled=yes list=TRUSTED +< add address=2ip.ru list=Test +< add address=89.110.101.17 comment=VDSIna list=TRUSTED +< add address=10.8.0.0/24 comment="WG VDSIna" list=TRUSTED +--- +> add address=8.8.4.0/24 list=YouTube +> add address=8.8.8.0/24 list=YouTube +> add address=8.34.208.0/20 list=YouTube +> add address=8.35.192.0/20 list=YouTube +> add address=23.236.48.0/20 list=YouTube +> add address=23.251.128.0/19 list=YouTube +> add address=34.0.0.0/15 list=YouTube +> add address=34.2.0.0/16 list=YouTube +> add address=34.3.0.0/23 list=YouTube +> add address=34.3.3.0/24 list=YouTube +> add address=34.3.4.0/24 list=YouTube +> add address=34.3.8.0/21 list=YouTube +> add address=34.3.16.0/20 list=YouTube +> add address=34.3.32.0/19 list=YouTube +> add address=34.3.64.0/18 list=YouTube +> add address=34.4.0.0/14 list=YouTube +> add address=34.8.0.0/13 list=YouTube +> add address=34.16.0.0/12 list=YouTube +> add address=34.32.0.0/11 list=YouTube +> add address=34.64.0.0/10 list=YouTube +> add address=34.128.0.0/10 list=YouTube +> add address=35.184.0.0/13 list=YouTube +> add address=35.192.0.0/14 list=YouTube +> add address=35.196.0.0/15 list=YouTube +> add address=35.198.0.0/16 list=YouTube +> add address=35.199.0.0/17 list=YouTube +> add address=35.199.128.0/18 list=YouTube +> add address=35.200.0.0/13 list=YouTube +> add address=35.208.0.0/12 list=YouTube +> add address=35.224.0.0/12 list=YouTube +> add address=35.240.0.0/13 list=YouTube +> add address=57.140.192.0/18 list=YouTube +> add address=64.15.112.0/20 list=YouTube +> add address=64.233.160.0/19 list=YouTube +> add address=66.22.228.0/23 list=YouTube +> add address=66.102.0.0/20 list=YouTube +> add address=66.249.64.0/19 list=YouTube +> add address=70.32.128.0/19 list=YouTube +> add address=72.14.192.0/18 list=YouTube +> add address=74.125.0.0/16 list=YouTube +> add address=104.154.0.0/15 list=YouTube +> add address=104.196.0.0/14 list=YouTube +> add address=104.237.160.0/19 list=YouTube +> add address=107.167.160.0/19 list=YouTube +> add address=107.178.192.0/18 list=YouTube +> add address=108.59.80.0/20 list=YouTube +> add address=108.170.192.0/18 list=YouTube +> add address=108.177.0.0/17 list=YouTube +> add address=130.211.0.0/16 list=YouTube +> add address=136.22.160.0/20 list=YouTube +> add address=136.22.176.0/21 list=YouTube +> add address=136.22.184.0/23 list=YouTube +> add address=136.22.186.0/24 list=YouTube +> add address=142.250.0.0/15 list=YouTube +> add address=146.148.0.0/17 list=YouTube +> add address=152.65.208.0/22 list=YouTube +> add address=152.65.214.0/23 list=YouTube +> add address=152.65.218.0/23 list=YouTube +> add address=152.65.222.0/23 list=YouTube +> add address=152.65.224.0/19 list=YouTube +> add address=162.120.128.0/17 list=YouTube +> add address=162.216.148.0/22 list=YouTube +> add address=162.222.176.0/21 list=YouTube +> add address=172.110.32.0/21 list=YouTube +> add address=172.217.0.0/16 list=YouTube +> add address=172.253.0.0/16 list=YouTube +> add address=173.194.0.0/16 list=YouTube +> add address=173.255.112.0/20 list=YouTube +> add address=192.158.28.0/22 list=YouTube +> add address=192.178.0.0/15 list=YouTube +> add address=193.186.4.0/24 list=YouTube +> add address=199.36.154.0/23 list=YouTube +> add address=199.36.156.0/24 list=YouTube +> add address=199.192.112.0/22 list=YouTube +> add address=199.223.232.0/21 list=YouTube +> add address=207.223.160.0/20 list=YouTube +> add address=208.65.152.0/22 list=YouTube +> add address=208.68.108.0/22 list=YouTube +> add address=208.81.188.0/22 list=YouTube +> add address=208.117.224.0/19 list=YouTube +> add address=209.85.128.0/17 list=YouTube +> add address=216.58.192.0/19 list=YouTube +> add address=216.73.80.0/20 list=YouTube +> add address=216.239.32.0/19 list=YouTube +> add address=2ip.ru list=Test-IP +> add address=wg.vados.ru comment=VDSIna list=TRUSTED +> add address=10.8.0.0/24 comment="WG VDSIna" disabled=yes list=TRUSTED +682,691c2912,2918 +< add address=vdsina.com comment=vdsina.com list=NoVdsina +< add address=vdsina.ru comment=vdsina.ru list=NoVdsina +< add address=youla.ru comment=youla.ru list=NoVdsina +< add address=kupiprodai.ru comment=kupiprodai.ru list=NoVdsina +< add address=myip.ru list=Test +< add address=geoip.co comment=geoip.co list=NoVdsina +< add address=x.com list=Twitter +< add address=facebook.com list=facebook +< add address=fbcd.net list=facebook +< add address=comp-lenta.ru comment=comp-lenta.ru list=NoVdsina +--- +> add address=vdsina.com list=NoVdsina +> add address=vdsina.ru list=NoVdsina +> add address=youla.ru list=NoVdsina +> add address=kupiprodai.ru list=NoVdsina +> add address=myip.ru list=Test-IP +> add address=geoip.co list=NoVdsina +> add address=comp-lenta.ru list=NoVdsina +882,884d3108 +< add address=82.202.162.184 comment=comp-lenta.ru list=NoWG +< add address=smtp.mail.me.com.akadns.net. comment=smtp.mail.me.com list=NoWG +< add address=17.57.155.37 comment=smtp.mail.me.com.akadns.net list=NoWG +1087c3311 +< add address=10.30.30.33 comment=NUC disabled=yes list=NoWG +--- +> add address=10.30.30.33 comment=amster list=NoWG +1090c3314 +< add address=wg.vados.ru comment=VDSina-vpn list=Trusted-VPN +--- +> add address=wg.vados.ru comment=VDSina-vpn list=VDSina +1098c3322 +< add address=vdsina.vados.ru comment="!!!VDSina Server!!!" list=NoVdsina +--- +> add address=89.110.101.17 comment="!!!VDSina Server!!!" list=NoVdsina +1111,1140c3335,3356 +< add address=cp.vdsina.com comment=VDSina-vpn list=Trusted-VPN +< add address=vdsina.ru comment=VDSina-vpn list=Trusted-VPN +< add address=ns.vados.ru comment=VDSina-vpn list=Trusted-VPN +< add address=vdsina.com comment=VDSina-vpn list=Trusted-VPN +< add address=cp.vdsina.ru comment=VDSina-vpn list=Trusted-VPN +< add address=ns1.vdsina.ru comment=VDSina-vpn list=Trusted-VPN +< add address=ghcr.io comment=GitHub list=Trusted-VPN +< add address=github.com comment=GitHub list=Trusted-VPN +< add address=149.154.164.13 comment=telegra.ph list=FuckRKN +< add address=194.85.61.76 comment=grani.ru list=FuckRKN +< add address=109.70.26.37 comment=grani.ru list=FuckRKN +< add address=104.16.4.81 comment=xhamster.com list=FuckRKN +< add address=104.16.3.81 comment=xhamster.com list=FuckRKN +< add address=188.114.96.1 comment=lostfilm.tv list=FuckRKN +< add address=188.114.97.1 comment=lostfilm.tv list=FuckRKN +< add address=172.67.182.196 comment=rutracker.org list=FuckRKN +< add address=104.21.32.39 comment=rutracker.org list=FuckRKN +< add address=104.247.81.99 comment=lurkmore.to list=FuckRKN +< add address=8.47.69.6 comment=dou.ua list=FuckRKN +< add address=8.6.112.6 comment=dou.ua list=FuckRKN +< add address=66.254.114.79 comment=youporn.com list=FuckRKN +< add address=185.110.92.40 comment=pornolab.net list=FuckRKN +< add address=185.110.92.41 comment=pornolab.net list=FuckRKN +< add address=104.21.71.238 comment=crimerussia.com list=FuckRKN +< add address=172.67.172.95 comment=crimerussia.com list=FuckRKN +< add address=149.154.167.99 comment=telegram.org list=FuckRKN +< add address=149.154.166.110 comment=api.telegram.org list=FuckRKN +< add address=myip.ru comment="!!! Check IP (MYIP.RU) !!!" disabled=yes list=\ +< NoVdsina +< add address=ipinfo.io comment="!!! Check IP (IPINFO.IO) !!!" list=NoVdsina +--- +> add address=cp.vdsina.com comment=VDSina-vpn list=VDSina +> add address=vdsina.ru comment=VDSina-vpn list=VDSina +> add address=ns.vados.ru comment=VDSina-vpn list=VDSina +> add address=vdsina.com comment=VDSina-vpn list=VDSina +> add address=cp.vdsina.ru comment=VDSina-vpn list=VDSina +> add address=ns1.vdsina.ru comment=VDSina-vpn list=VDSina +> add address=10.30.30.0/24 comment="Local Network" list=Local-Net +> add address=10.8.0.0/24 comment="WireGuard Network" list=Local-Net +> add address=146.120.64.208/29 comment="External Net" list=Unet +> add address=esia.gosuslugi.ru comment=esia.gosuslugi.ru list=NoVdsina +> add address=lk.gosuslugi.ru comment=lk.gosuslugi.ru list=NoVdsina +> add address=trudvsem.ru comment=trudvsem.ru list=NoVdsina +> add address=10.30.30.30 comment=miller disabled=yes list=NoWG +> add address=10.30.30.33 comment="Direct connet to DNS servers" list=\ +> Direct-DNS +> add address=109.107.177.79 list=VPN-Server +> add address=10.0.0.0/8 list=RFC1918 +> add address=172.16.0.0/12 list=RFC1918 +> add address=192.168.0.0/16 list=RFC1918 +> add address=8.8.4.4 disabled=yes list=to_vpn +> add address=myip.ru disabled=yes list=to_vpn +> add address=10.30.30.98 disabled=yes list=to_vpn +1142,1172c3358,3370 +< add action=add-src-to-address-list address-list="Honeypot Hacker" \ +< address-list-timeout=12h chain=input comment="block honeypot DNS UDP" \ +< connection-state=new dst-port=53 in-interface="ether1 - Unet" protocol=\ +< udp src-address-list=!VDS +< add action=add-src-to-address-list address-list="Honeypot Hacker" \ +< address-list-timeout=4w2d chain=input comment="block honeypot DNS TCP" \ +< connection-state=new dst-port=53 in-interface="ether1 - Unet" protocol=\ +< tcp src-address-list=!VDS +< add action=add-src-to-address-list address-list="Honeypot Hacker" \ +< address-list-timeout=4w2d chain=input comment="block honeypot NTP" \ +< connection-state=new dst-port=123 in-interface="ether1 - Unet" protocol=\ +< udp +< add action=add-src-to-address-list address-list="Honeypot Hacker" \ +< address-list-timeout=4w2d chain=input comment="block honeypot asterisk" \ +< connection-state=new dst-port=5060 in-interface="ether1 - Unet" protocol=\ +< udp +< add action=add-src-to-address-list address-list="Honeypot Hacker" \ +< address-list-timeout=4w2d chain=input comment=\ +< "block honeypot ssh rdp winbox" connection-state=new dst-port=22,8291 \ +< in-interface-list=WAN protocol=tcp src-address-list=!TRUSTED +< add action=accept chain=input comment=\ +< "defconf: accept established,related,untracked" connection-state=\ +< established,related,untracked +< add action=drop chain=input comment="defconf: drop invalid" connection-state=\ +< invalid +< add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp +< add action=accept chain=input comment=\ +< "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \ +< dst-address=127.0.0.1 in-interface=lo src-address=127.0.0.1 +< add action=drop chain=input comment="defconf: drop all not coming from LAN" \ +< in-interface-list=!LAN +--- +> add action=fasttrack-connection chain=forward comment=\ +> "FastTrack for non-VPN connections" connection-mark=!VPN_No_FastTrack \ +> connection-state=established,related,new disabled=yes +> add action=accept chain=output comment="accept WireGuard" disabled=yes \ +> dst-address-list=VPN-Server out-interface=Unet-ether1 protocol=udp \ +> src-port=13231 +> add action=accept chain=output dst-address-list=VPN-Server dst-port=29185 \ +> out-interface=Unet-ether1 protocol=udp +> add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ +> connection-state=established,related,new disabled=yes routing-mark=\ +> !To-VPN +> add action=accept chain=output disabled=yes protocol=tcp src-port=443 +> add action=accept chain=output disabled=yes src-address=127.0.0.1 +1179c3377 +< established,related,untracked +--- +> established,related,untracked disabled=yes +1181c3379,3380 +< connection-state=invalid +--- +> connection-state=invalid in-interface=Unet-ether1 src-address=\ +> !10.30.30.0/24 +1184c3383,3387 +< in-interface-list=WAN +--- +> connection-state=new in-interface=Unet-ether1 src-address-list=!VDSina +> add action=accept chain=input protocol=icmp +> add action=accept chain=input connection-state=established +> add action=accept chain=input connection-state=related +> add action=drop chain=input in-interface-list=!LAN +1186,1192c3389,3424 +< add action=accept chain=prerouting dst-address-list=RFC1918 \ +< in-interface-list=!WAN +< add action=mark-connection chain=prerouting comment="NO VPN" disabled=yes \ +< dst-address-list=NoVdsina in-interface-list=!WAN new-connection-mark=\ +< To-ISP +< add action=mark-routing chain=prerouting comment=All2vpn connection-mark=\ +< !To-ISP disabled=yes dst-address=!89.110.101.17 dst-address-list=\ +--- +> add action=accept chain=prerouting comment=RFC1918 dst-address-list=RFC1918 \ +> in-interface-list=!LAN +> add action=mark-connection chain=prerouting comment=\ +> "Mark connection \"no-mark\" to NoWG" new-connection-mark=no-mark \ +> src-address-list=NoWG +> add action=mark-connection chain=prerouting comment=\ +> "Mark connection \"no-mark\" to NoVdsina" dst-address-list=NoVdsina \ +> new-connection-mark=no-mark src-address=10.30.30.0/24 +> add action=mark-connection chain=prerouting comment=\ +> "Transit for address-list \"to_vpn\"" connection-mark=!no-mark disabled=\ +> yes dst-address-list=to_vpn new-connection-mark=to-vpn-conn routing-mark=\ +> To-VPN +> add action=mark-routing chain=prerouting comment=\ +> "Find routing over table r_to_vpn" connection-mark=to-vpn-conn disabled=\ +> yes in-interface-list=!LAN new-routing-mark=*401 +> add action=mark-connection chain=prerouting comment=\ +> "Mark connection \"no-mark\" to VDSina" dst-address-list=VPN-Server \ +> new-connection-mark=no-mark passthrough=no src-address=10.30.30.0/24 +> add action=mark-connection chain=prerouting comment=\ +> "Mark Routing main for MikroNuc" disabled=yes dst-address-list=AWG-Proxy \ +> new-connection-mark=no-mark src-address=10.30.30.0/24 +> add action=mark-routing chain=prerouting comment=\ +> "!!!ERROR Mark Routing main for Unet!!!" disabled=yes dst-address-list=\ +> Unet new-routing-mark=main passthrough=no +> add action=mark-routing chain=prerouting comment="Test-IP sites" disabled=yes \ +> dst-address=!10.30.30.0/24 dst-address-list=Test-IP new-routing-mark=\ +> To-VPN src-address=10.30.30.0/24 +> add action=mark-routing chain=prerouting comment=FuckRKN disabled=yes \ +> dst-address=!10.30.30.0/24 dst-address-list=RKN-dnsLookup \ +> new-routing-mark=To-VPN passthrough=no src-address=10.30.30.0/24 +> add action=change-mss chain=forward comment="MSS on WG (1380)" \ +> connection-mark=!no-mark dst-address=!10.30.30.0/24 new-mss=1380 \ +> out-interface=WG protocol=tcp routing-mark=To-VPN src-address=\ +> 10.30.30.0/24 tcp-flags=syn tcp-mss=1381-65535 +> add action=mark-routing chain=prerouting comment="WG for all" \ +> connection-mark=!no-mark dst-address=!10.30.30.0/24 dst-address-list=\ +1195,1200d3426 +< add action=change-mss chain=forward comment="MSS on WG" connection-mark=\ +< !To-ISP disabled=yes in-interface-list=!WAN new-mss=1380 protocol=tcp \ +< tcp-flags=syn tcp-mss=1381-65535 +< add action=mark-routing chain=prerouting connection-mark=to-vpn-conn \ +< disabled=yes new-routing-mark=To-VPN routing-mark=To-VPN src-address=\ +< 10.30.30.0/24 +1202,1207c3428,3431 +< "Mark VPN connections to exclude from FastTrack" disabled=yes \ +< in-interface=*B log-prefix=Mark-VPN-FT new-connection-mark=\ +< VPN_No_FastTrack +< add action=accept chain=prerouting comment="SSH To ME" disabled=yes \ +< dst-address=10.30.30.81 dst-port=2222 in-interface-list=!WAN protocol=tcp \ +< src-address=10.30.30.0/24 +--- +> "Mark VPN connections to exclude from FastTrack" connection-mark=!no-mark \ +> disabled=yes dst-address-list=!NoVdsina new-connection-mark=\ +> VPN_No_FastTrack routing-mark=To-VPN src-address=10.30.30.0/24 \ +> src-address-list=!NoWG +1209,1210c3433,3438 +< dst-address=10.8.0.0/24 log-prefix=VPN-Net new-routing-mark=To-VPN \ +< src-address=10.30.30.0/24 +--- +> dst-address=10.8.0.0/24 new-routing-mark=To-VPN src-address=10.30.30.0/24 +> add action=mark-connection chain=output comment="For this router" \ +> connection-mark=no-mark dst-address-list=to_vpn new-connection-mark=\ +> to-vpn-conn-local +> add action=mark-routing chain=output comment="For this router" \ +> connection-mark=to-vpn-conn-local new-routing-mark=*401 +1211a3440,3460 +> add action=redirect chain=dstnat comment="udp Redirect DNS in NAT" disabled=\ +> yes dst-port=53 protocol=udp src-address=10.30.30.0/24 src-address-list=\ +> !NoWG to-addresses=10.30.30.33 to-ports=53 +> add action=redirect chain=dstnat comment="tcp Redirect DNS in NAT" disabled=\ +> yes dst-port=53 protocol=tcp src-address=10.30.30.0/24 src-address-list=\ +> !NoWG to-addresses=10.30.30.33 to-ports=53 +> add action=masquerade chain=srcnat comment=\ +> "Nat Addresses for routing mark r_to_vpn" disabled=yes routing-mark=*401 +> add action=dst-nat chain=dstnat comment=\ +> "53/tcp dst-nat to amster.loc. From VDSina Server" dst-port=53 \ +> in-interface=Unet-ether1 protocol=tcp src-address-list=VPN-Server \ +> to-addresses=10.30.30.33 to-ports=53 +> add action=dst-nat chain=dstnat comment=\ +> "53/udp dst-nat to amster.loc. From VDSina Server" dst-port=53 protocol=\ +> udp src-address-list=VPN-Server to-addresses=10.30.30.33 to-ports=53 +> add action=dst-nat chain=dstnat disabled=yes dst-port=44333 in-interface=\ +> Unet-ether1 protocol=udp src-address=!10.30.30.0/24 to-addresses=\ +> 10.30.30.33 to-ports=44333 +> add action=masquerade chain=srcnat comment=WG disabled=yes dst-address=\ +> !10.30.30.0/24 dst-address-list=!NoVdsina out-interface=WG routing-mark=\ +> To-VPN src-address=10.30.30.0/24 src-address-list=!NoWG +1213,1224c3462,3492 +< !10.30.30.0/24 ipsec-policy=out,none out-interface="ether1 - Unet" \ +< routing-mark=!To-VPN src-address=10.30.30.0/24 +< add action=masquerade chain=srcnat comment="NAT for VPN" disabled=yes \ +< out-interface=lo routing-mark=To-VPN +< add action=dst-nat chain=dstnat comment="dst-nat for acme" dst-port=80 \ +< in-interface="ether1 - Unet" protocol=tcp to-addresses=10.30.30.33 \ +< to-ports=80 +< add action=dst-nat chain=dstnat comment="dst-nat for amster HTTPS" dst-port=\ +< 443 in-interface="ether1 - Unet" protocol=tcp to-addresses=10.30.30.33 \ +< to-ports=443 +< add action=dst-nat chain=dstnat comment="dst-nat for amster ssh" disabled=yes \ +< dst-port=22 protocol=tcp src-address-list=VDS to-addresses=10.30.30.33 \ +--- +> !10.30.30.0/24 out-interface=Unet-ether1 routing-mark=!To-VPN \ +> src-address=10.30.30.0/24 +> add action=dst-nat chain=dstnat disabled=yes dst-port=44044 in-interface=\ +> Unet-ether1 protocol=udp src-address=109.107.177.79 to-addresses=\ +> 10.30.30.33 to-ports=44044 +> add action=dst-nat chain=dstnat comment=amster.vados.ruhttps dst-port=443 \ +> fragment=no in-interface=Unet-ether1 protocol=tcp routing-mark=main \ +> to-addresses=10.30.30.33 to-ports=443 +> add action=dst-nat chain=dstnat comment="amster.vados.ru For Certbot HTTP" \ +> dst-port=80 in-interface=Unet-ether1 protocol=tcp to-addresses=\ +> 10.30.30.33 to-ports=80 +> add action=dst-nat chain=dstnat comment="amster.vados.ru 3x-ui" disabled=yes \ +> dst-port=2904 in-interface=Unet-ether1 protocol=tcp to-addresses=\ +> 10.30.30.33 to-ports=2904 +> add action=dst-nat chain=dstnat comment=reg.vados.ru disabled=yes dst-port=\ +> 5000 in-interface=Unet-ether1 protocol=tcp to-addresses=10.30.30.33 \ +> to-ports=5000 +> add action=dst-nat chain=dstnat comment="Docker swarm" disabled=yes dst-port=\ +> 2377 in-interface=Unet-ether1 protocol=tcp to-addresses=10.30.30.33 \ +> to-ports=2377 +> add action=dst-nat chain=dstnat comment=npm dst-port=81 in-interface=\ +> Unet-ether1 protocol=tcp routing-mark=To-VPN to-addresses=10.30.30.33 \ +> to-ports=81 +> add action=dst-nat chain=dstnat comment=SSH dst-port=22 in-interface=\ +> Unet-ether1 protocol=tcp src-address-list=TRUSTED to-addresses=\ +> 10.30.30.33 to-ports=22 +> add action=dst-nat chain=dstnat comment="portainer agent" disabled=yes \ +> dst-port=2377 in-interface=Unet-ether1 protocol=tcp to-addresses=\ +> 10.30.30.33 to-ports=2377 +> add action=dst-nat chain=dstnat disabled=yes dst-port=22 in-interface=\ +> Unet-ether1 protocol=tcp routing-mark=!To-VPN to-addresses=10.30.30.33 \ +1226,1231c3494,3562 +< add action=dst-nat chain=dstnat comment="dst-nat for amster DNS (TCP)" \ +< dst-port=53 in-interface="ether1 - Unet" protocol=tcp src-address-list=\ +< VDS to-addresses=10.30.30.33 to-ports=53 +< add action=dst-nat chain=dstnat comment="dst-nat for amster DNS (UDP)" \ +< dst-port=53 in-interface="ether1 - Unet" protocol=udp src-address-list=\ +< VDS to-addresses=10.30.30.33 to-ports=53 +--- +> add action=dst-nat chain=dstnat comment="Yandex.DNS Family" disabled=yes \ +> dst-port=53 in-interface=Bridge-LAN protocol=udp src-address-list=KIDS \ +> time=6h-15m,sun,mon,tue,wed,thu,fri,sat to-addresses=77.88.8.3 +> add action=dst-nat chain=dstnat disabled=yes dst-port=53 in-interface=\ +> Bridge-LAN protocol=tcp src-address-list=KIDS time=\ +> 6h-15m,sun,mon,tue,wed,thu,fri,sat to-addresses=77.88.8.3 +> /ip firewall raw +> add action=drop chain=prerouting comment="Drop Honeypot Hackers" \ +> in-interface=Unet-ether1 src-address-list="Honeypot Hacker" +> add action=accept chain=prerouting comment="Trusted DNS" disabled=yes \ +> in-interface-list=*2000012 src-address-list=Trusted-DNS +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=\ +> extras.getpagespeed.com content=extras.getpagespeed.com disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=linux.duke.edu \ +> content=linux.duke.edu disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=youtube.com \ +> disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=\ +> googleapis.com disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=ggpht.com \ +> disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=youtu.be \ +> disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=ytimg.com \ +> disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=\ +> googlevideo.com disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=gstatic.com \ +> disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=\ +> googleusercontent.com disabled=yes +> add action=add-dst-to-address-list address-list=FuckRKN address-list-timeout=\ +> none-dynamic chain=prerouting comment="YouTube raw" content=\ +> nhacmp3youtube.com disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=rutube.ru \ +> content=rutube.ru disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment="me.com raw" \ +> content=me.com disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=\ +> "icloud.com raw" content=icloud.com disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=\ +> "smtp.mail.me.com raw" content=smtp.mail.me.com disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=\ +> "smtp.mail.me.com.akadns.net raw" content=smtp.mail.me.com.akadns.net \ +> disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=\ +> "api.db-ip.com raw" content=api.db-ip.com disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=\ +> esia.gosuslugi.ru content=esia.gosuslugi.ru disabled=yes +> add action=add-dst-to-address-list address-list=NoVdsina \ +> address-list-timeout=none-dynamic chain=prerouting comment=gosuslugi.ru \ +> content=gosuslugi.ru disabled=yes +1239,1240c3570,3578 +< /ip hotspot user profile +< set [ find default=yes ] address-pool=dhcp +--- +> /ip ipsec settings +> set accounting=no +> /ip ipsec policy +> set 0 disabled=yes dst-address=0.0.0.0/0 src-address=0.0.0.0/0 +> /ip ipsec profile +> set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5 +> /ip proxy +> set cache-administrator="" max-cache-size=none port=80,443 src-address=\ +> 0.0.0.0 +1242,1247c3580,3581 +< add check-gateway=ping disabled=yes distance=1 dst-address=10.10.10.0/24 \ +< gateway=10.30.30.33 routing-table=main scope=30 target-scope=10 +< add comment=awg2all-dns disabled=yes distance=1 dst-address=10.9.0.1/32 \ +< gateway="" +< add comment=awg2all-dns disabled=yes distance=1 dst-address=8.8.4.4/32 \ +< gateway="" +--- +> add check-gateway="(unknown)" disabled=no distance=1 dst-address=0.0.0.0/0 \ +> gateway=WG routing-table=To-VPN scope=30 target-scope=10 +1251d3584 +< set www disabled=yes port=188 +1253,1255c3586,3591 +< set ssh port=2222 +< set api disabled=yes +< set api-ssl disabled=yes +--- +> set ssh address=10.30.30.0/24 port=2222 +> set www disabled=yes port=8080 +> set winbox address=10.30.30.0/24 +> set api address=10.30.30.0/24 +> set api-ssl address=10.30.30.0/24 disabled=yes +> set www-ssl certificate=*15 port=18443 +1261,1262c3597 +< set forwarding-enabled=both publickey-authentication-options=verify-required \ +< strong-crypto=yes +--- +> set forwarding-enabled=both publickey-authentication-options=verify-required +1266c3601,3622 +< add interface="ether1 - Unet" type=external +--- +> add interface=Bridge-LAN type=internal +> add forced-ip=146.120.64.211 interface=Unet-ether1 type=external +> add forced-ip=109.107.177.79 interface=*E type=external +> add interface=lo type=internal +> add interface=wlan2 type=internal +> add interface=wlan1 type=internal +> /ipv6 dhcp-client +> add add-default-route=yes disabled=yes interface=*F rapid-commit=no request=\ +> info use-interface-duid=yes validate-server-duid=no +> /ipv6 dhcp-server option sets +> add name=domain-search-set options=domain-search-list +> add name="=\"Client ID\"" options=HostName +> /ipv6 firewall address-list +> add address=::/128 comment="defconf: unspecified address" list=bad_ipv6 +> add address=::1/128 comment="defconf: lo" list=bad_ipv6 +> add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6 +> add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6 +> add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6 +> add address=100::/64 comment="defconf: discard only " list=bad_ipv6 +> add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6 +> add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6 +> add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6 +1270c3626 +< established,related,untracked disabled=yes +--- +> established,related,untracked +1272,1274c3628,3630 +< invalid disabled=yes +< add action=accept chain=input comment="defconf: accept ICMPv6" disabled=yes \ +< protocol=icmpv6 +--- +> invalid +> add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\ +> icmpv6 +1276c3632 +< disabled=yes dst-port=33434-33534 protocol=udp +--- +> dst-port=33434-33534 protocol=udp +1278,1285c3634,3641 +< "defconf: accept DHCPv6-Client prefix delegation." disabled=yes dst-port=\ +< 546 protocol=udp src-address=fe80::/10 +< add action=accept chain=input comment="defconf: accept IKE" disabled=yes \ +< dst-port=500,4500 protocol=udp +< add action=accept chain=input comment="defconf: accept ipsec AH" disabled=yes \ +< protocol=ipsec-ah +< add action=accept chain=input comment="defconf: accept ipsec ESP" disabled=\ +< yes protocol=ipsec-esp +--- +> "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\ +> udp src-address=fe80::/10 +> add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \ +> protocol=udp +> add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\ +> ipsec-ah +> add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\ +> ipsec-esp +1287,1288c3643 +< "defconf: accept all that matches ipsec policy" disabled=yes \ +< ipsec-policy=in,ipsec +--- +> "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec +1290,1293c3645,3646 +< "defconf: drop everything else not coming from LAN" disabled=yes \ +< in-interface-list=!LAN +< add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \ +< connection-state=established,related +--- +> "defconf: drop everything else not coming from LAN" in-interface-list=\ +> !LAN +1318a3672,3684 +> /ipv6 nd +> set [ find default=yes ] advertise-dns=yes disabled=yes interface=Bridge-LAN \ +> managed-address-configuration=yes other-configuration=yes pref64=::/64 +> /ipv6 nd prefix +> add autonomous=no disabled=yes interface=Bridge-LAN on-link=no prefix=none +> /ipv6 nd prefix default +> set dhcp6-pd-preferred=yes +> /ipv6 nd proxy +> add disabled=yes interface=lo +> /ipv6 nd settings +> set router-advertisement-route-distance=100 +> /routing settings +> set single-process=no +1320c3686,3688 +< set time-zone-autodetect=no time-zone-name=Europe/Moscow +--- +> set time-zone-name=Europe/Moscow +> /system clock manual +> set time-zone=+03:00 +1322a3691,3693 +> /system logging +> add action=email disabled=yes regex="* added|changed|removed *" topics=\ +> system,info +1327a3699,3702 +> add address=0.ru.pool.ntp.org +> add address=1.ru.pool.ntp.org +> add address=2.ru.pool.ntp.org +> add address=3.ru.pool.ntp.org +1328a3704,3705 +> /system package update +> set check-certificate=yes-without-crl ip-version=ipv4 +1338a3716,3721 +> add comment="Update RKN DNS Looup" disabled=yes interval=20m name=\ +> AM-RKN-dnsLookup on-event="/system/script { run AM-RKN-dnsLookup; }" \ +> policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ +> start-time=startup +> /system watchdog +> set watchdog-timer=no +1341a3725,3728 +> /tool mac-server +> set allowed-interface-list=LAN +> /tool mac-server mac-winbox +> set allowed-interface-list=LAN +1343,1362c3730,3822 +< add comment="doh-fallback, doh-url=https://security.cloudflare-dns.com/dns-que\ +< ry, doh-cert=DigiCert Global Root CA, notify, name=CloudFlare-doh IPv4 1" \ +< disabled=yes host=1.1.1.1 type=simple +< add comment="doh, doh-url=https://security.cloudflare-dns.com/dns-query, doh-c\ +< ert=DigiCert Global Root CA, notify, name=CloudFlare-doh IPv4 2" \ +< disabled=yes host=1.0.0.1 type=simple +< add comment="doh-fallback, dns-fallback, doh-url=https://dns.google/dns-query,\ +< \_doh-cert=DigiCert Global Root G2, notify, name=Google-doh IPv4 1" \ +< disabled=yes host=8.8.8.8 type=simple +< add comment="doh-fallback, dns-fallback, doh-url=https://dns.google/dns-query,\ +< \_doh-cert=DigiCert Global Root G2, notify, name=Google-doh IPv4 2" \ +< disabled=yes host=8.8.4.4 type=simple +< add comment="doh-fallback, dns-fallback, doh-url=https://dns.quad9.net/dns-que\ +< ry, doh-cert=DigiCert Global Root G3, notify, name=Cuad9-doh IPv4 1" \ +< disabled=yes host=9.9.9.9 type=simple +< add comment="doh-fallback, dns-fallback, doh-url=https://dns.quad9.net/dns-que\ +< ry, doh-cert=DigiCert Global Root G3, notify, name=Cuad9-doh IPv4 2" \ +< disabled=yes host=149.112.112.112 type=simple +< add comment="dns, notify, name=ns1.unet.ws" disabled=yes host=91.192.189.2 \ +< type=simple +--- +> add certificate=DigiCert-Global-Root-CA check-certificate=no comment="doh, doh\ +> -url=https://security.cloudflare-dns.com/dns-query, notify, name=CloudFlar\ +> e-doh IPv4 1" disabled=yes down-script="" host=1.1.1.1 http-codes="" \ +> interval=10s name="CloudFlare-doh IPv4 1" port=443 test-script="" type=\ +> https-get up-script="" +> add check-certificate=no comment="doh-fallback, doh-url=https://security.cloud\ +> flare-dns.com/dns-query, doh-cert=DigiCert Global Root CA, notify, name=Cl\ +> oudFlare-doh IPv4" disabled=yes down-script="" host=1.0.0.1 http-codes="" \ +> name="CloudFlare-doh IPv4" port=443 test-script="" type=https-get \ +> up-script="" +> add comment="dns, notify, name=Google-DNS IPv4" disabled=yes dns-server=\ +> 8.8.8.8 down-script="" host=dns.google http-codes="" name=\ +> "Google-DNS IPv4" test-script="" type=dns up-script="" +> add certificate=GTS-Root-R4 check-certificate=yes comment="doh-fallback, doh-u\ +> rl=https://dns.google/dns-query, doh-cert=GTS Root R1, notify, name=Google\ +> -DOH IPv4" disabled=yes dns-server=8.8.4.4 down-script="" host=dns.google \ +> http-codes="" name="Google-DOH IPv4" port=443 record-type=NS src-address=\ +> "" test-script="" type=dns up-script="" +> add comment="dns-fallback, notify, name=Cuad9-DOH IPv4" disabled=yes \ +> dns-server=9.9.9.9 down-script="" host=dns9.quad9.net http-codes="" \ +> interval=10s name="Cuad9-DOH IPv4" src-address=146.120.64.211 \ +> test-script="" timeout=800ms type=dns up-script="" +> add certificate=DigiCert-Assured-ID-Root-CA comment="doh-fallback, doh-url=htt\ +> ps://dns.quad9.net/dns-query, name=Cuad9-DOH IPv4" disabled=yes \ +> down-script="" host=149.112.112.112 http-codes="" interval=10s name=\ +> "Cuad9-DOH IPv4" port=443 test-script="" type=https-get up-script="" +> add comment="dns-fallback, notify, name=ns1.unet.ws" disabled=yes \ +> down-script="" host=91.192.189.2 http-codes="" interval=10s name=\ +> ns1.unet.ws test-script="" type=simple up-script="" +> add check-certificate=yes comment=\ +> "doh, doh-url=https://vds.vados.ru/vds-query, name=vds.vados.ru" \ +> disabled=yes down-script="" host=109.107.177.79 http-codes="" name=\ +> vds.vados.ru port=443 test-script="" type=https-get up-script="" +> add comment="WireGuard NAT " disabled=yes down-script="/log info \"[WG-Monitor\ +> ] WireGuard is NOT running - reverting rules\"\ +> \n/ip firewall nat remove [find comment=\"Redirect to Router\"]\ +> \n/ip dns set servers=8.8.8.8\ +> \n/ip dns cache flush\ +> \n/ip route remove [find comment=\"wg-auto-route\"]\ +> \n" host=10.8.0.1 http-codes="" interval=15s name=WG test-script="" \ +> timeout=5s type=simple up-script="/log info \"[WG-Monitor] WireGuard is RU\ +> NNING - applying rules\";\ +> \n:local routeFile \"ips.txt\";\ +> \n:local routeDefAddr \"0.0.0.0/0\";\ +> \n:local routeGateway \"10.8.0.1\";\ +> \n:local routeIF \"WG\";\ +> \n:local routeTable \"To-VPN\";\ +> \n:local routeComment \"wg-auto-route\";\ +> \n/ip dns cache flush;\ +> \n:if ([:len [/ip firewall nat find comment=\"Redirect to Router\"]] > 0) \ +> do={\ +> \n /ip firewall nat remove [find comment=\"Redirect to Router\"];\ +> \n}\ +> \n/ip firewall nat add action=redirect chain=dstnat src-address-list=\"Red\ +> irectDNS\" dst-port=53 protocol=udp comment=\"Redirect to Router\";\ +> \n/ip dns set servers=\$routeGateway;\ +> \n:local content [/file get \$routeFile contents];\ +> \n:if ([:len \$content] > 0) do={\ +> \n :local line \"\";\ +> \n :for i from=0 to=([:len \$content] - 1) do={\ +> \n :local char [:pick \$content \$i];\ +> \n :if (\$char != \"\\r\" && \$char != \"\\n\") do={\ +> \n :set line (\$line . \$char);\ +> \n } else={\ +> \n :if ([:len \$line] > 5) do={\ +> \n :do { /ip route add disabled=no dst-address=\$routeDefAd\ +> dr gateway=\$routeIF distance=1 scope=30 target-scope=10 routing-table=\$r\ +> outeTable comment=\$routeComment check-gateway=none } on-error={}\ +> \n }\ +> \n :set line \"\";\ +> \n }\ +> \n }\ +> \n :if ([:len \$line] > 5) do={\ +> \n# :do { /ip route add dst-address=\$line gateway=\$routeGateway \ +> distance=1 comment=\$routeComment } on-error={}\ +> \n :do { /ip route add disabled=no dst-address=\$routeDefAddr ga\ +> teway=\$routeIF distance=1 scope=30 target-scope=10 routing-table=\$routeT\ +> able comment=\$routeComment check-gateway=none } on-error={}\ +> \n }\ +> \n}\ +> \n:local dotPos [:find \$routeGateway \".\"];\ +> \n:if (\$dotPos != \"\") do={\ +> \n :local firstOctet [:pick \$routeGateway 0 \$dotPos];\ +> \n :local derivedDstAddress (\$firstOctet . \".30.0.0/15\");\ +> \n :do { /ip route add dst-address=\$derivedDstAddress gateway=\$routeG\ +> ateway distance=1 comment=\$routeComment } on-error={}\ +> \n}\ +> \n\ +> \n" +> add comment=WG-Default disabled=yes down-script=\ +> "/ip route disable [find comment=\"WG-Default\"];" host=10.8.0.1 \ +> interval=15s name=WG packet-count=20 test-script="" thr-loss-count=5 \ +> type=icmp up-script="/ip route enable [find comment=\"WG-Default\"];" diff --git a/MikroMaster/tmp/Config.rsc b/MikroMaster/tmp/Config.rsc deleted file mode 100644 index e69de29..0000000 diff --git a/MikroMaster/tmp/Diff-Config.rsc b/MikroMaster/tmp/Diff-Config.rsc deleted file mode 100644 index 48974ef..0000000 --- a/MikroMaster/tmp/Diff-Config.rsc +++ /dev/null @@ -1,65 +0,0 @@ -28c28 -< add comment=WG listen-port=13231 mtu=1360 name=WG ---- -> add comment=WG disabled=yes listen-port=13231 mtu=1360 name=WG -2664c2664 -< set detect-interface-list=WAN internet-interface-list=Internet \ ---- -> set detect-interface-list=all internet-interface-list=Internet \ -2676,2678c2676,2678 -< add allowed-address=0.0.0.0/0 client-allowed-address=::/0 endpoint-address=\ -< 109.107.177.79 endpoint-port=29185 interface=WG name=VDSina \ -< persistent-keepalive=10s public-key=\ ---- -> add allowed-address=0.0.0.0/0 client-allowed-address=::/0 disabled=yes \ -> endpoint-address=109.107.177.79 endpoint-port=29185 interface=WG name=\ -> VDSina persistent-keepalive=10s public-key=\ -2691d2690 -< add address=10.8.0.2/24 interface=WG network=10.8.0.0 -3392,3393c3391,3392 -< "Mark connection \"no-mark\" to NoWG" new-connection-mark=no-mark \ -< src-address-list=NoWG ---- -> "Mark connection \"no-mark\" to NoWG" disabled=yes new-connection-mark=\ -> no-mark src-address-list=NoWG -3395,3396c3394,3395 -< "Mark connection \"no-mark\" to NoVdsina" dst-address-list=NoVdsina \ -< new-connection-mark=no-mark src-address=10.30.30.0/24 ---- -> "Mark connection \"no-mark\" to NoVdsina" disabled=yes dst-address-list=\ -> NoVdsina new-connection-mark=no-mark src-address=10.30.30.0/24 -3405,3406c3404,3406 -< "Mark connection \"no-mark\" to VDSina" dst-address-list=VPN-Server \ -< new-connection-mark=no-mark passthrough=no src-address=10.30.30.0/24 ---- -> "Mark connection \"no-mark\" to VDSina" disabled=yes dst-address-list=\ -> VPN-Server new-connection-mark=no-mark passthrough=no src-address=\ -> 10.30.30.0/24 -3420,3421c3420,3421 -< connection-mark=!no-mark dst-address=!10.30.30.0/24 new-mss=1380 \ -< out-interface=WG protocol=tcp routing-mark=To-VPN src-address=\ ---- -> connection-mark=!no-mark disabled=yes dst-address=!10.30.30.0/24 new-mss=\ -> 1380 out-interface=WG protocol=tcp routing-mark=To-VPN src-address=\ -3424,3426c3424,3426 -< connection-mark=!no-mark dst-address=!10.30.30.0/24 dst-address-list=\ -< !NoVdsina new-routing-mark=To-VPN src-address=10.30.30.0/24 \ -< src-address-list=!NoWG ---- -> connection-mark=!no-mark disabled=yes dst-address=!10.30.30.0/24 \ -> dst-address-list=!NoVdsina new-routing-mark=To-VPN src-address=\ -> 10.30.30.0/24 src-address-list=!NoWG -3435,3436c3435,3436 -< connection-mark=no-mark dst-address-list=to_vpn new-connection-mark=\ -< to-vpn-conn-local ---- -> connection-mark=no-mark disabled=yes dst-address-list=to_vpn \ -> new-connection-mark=to-vpn-conn-local -3438c3438 -< connection-mark=to-vpn-conn-local new-routing-mark=*401 ---- -> connection-mark=to-vpn-conn-local disabled=yes new-routing-mark=*401 -3579,3581d3578 -< /ip route -< add check-gateway="(unknown)" disabled=no distance=1 dst-address=0.0.0.0/0 \ -< gateway=WG routing-table=To-VPN scope=30 target-scope=10