From: vados-dev <192440777+vados-dev@users.noreply.github.com> Date: Tue, 21 Jul 2026 01:45:04 +0000 (+0300) Subject: Autocommit in repo: ros.vados.ru, generated by owner: root, in 04:45:04 21.07.2026. X-Git-Url: https://git.vados.ru/gitweb.cgi?a=commitdiff_plain;h=a39d807390d5dc8320d6946b008d1e5b3d6dd1d3;p=Mikrotiks%2Fros.vados.ru.git Autocommit in repo: ros.vados.ru, generated by owner: root, in 04:45:04 21.07.2026. --- diff --git a/html/AM-GlobalFunc.rsc b/html/AM-GlobalFunc.rsc index 6c3f721e6..22f52dffa 100644 --- a/html/AM-GlobalFunc.rsc +++ b/html/AM-GlobalFunc.rsc @@ -17,9 +17,9 @@ :global GlobalFuncReady false; # Git commit id & info, expected configuration version -:global CommitId "main/1617/d7661db2"; +:global CommitId "main/1618/edbfb5d3"; :global CommitTAG "unknown"; -:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 04:40:02 21.07.2026."; +:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 04:45:04 21.07.2026."; # The variables are received right here. :global GlobalConfVersion 140; diff --git a/html/tmp/default-arm.rsc b/html/tmp/default-arm.rsc new file mode 100644 index 000000000..947ee4dbf --- /dev/null +++ b/html/tmp/default-arm.rsc @@ -0,0 +1,383 @@ +# 2026-07-21 03:39:31 by RouterOS 7.23.2 +# software id = 2961-C4ZZ +# + script: #| Welcome to RouterOS! + #| 1) Set a strong router password in the System > Users menu + #| 2) Upgrade the software in the System > Packages menu + #| 3) Enable firewall on untrusted networks + #| 4) Set a strong WiFi password in the WiFi > Security menu + #| 5) Set your country name to observe wireless regulations + #| ----------------------------------------------------------------------------- + #| RouterMode: + #| * WAN port is protected by firewall and enabled DHCP client + #| * Wireless and Ethernet interfaces (except WAN port/s) + #| are part of LAN bridge + #| LAN Configuration: + #| IP address 192.168.88.1/24 is set on bridge (LAN port) + #| DHCP Server: enabled; + #| DNS: enabled; + #| wlan1 Configuration: + #| mode: ap-bridge; + #| band: 2ghz-b/g/n; + #| tx-chains: 0;1; + #| rx-chains: 0;1; + #| installation: any; + #| wpa2: no; + #| ht-extension: 20/40mhz-XX; + #| wlan2 Configuration: + #| mode: ap-bridge; + #| band: 5ghz-a/n/ac; + #| tx-chains: 0;1; + #| rx-chains: 0;1; + #| installation: any; + #| wpa2: no; + #| ht-extension: 20/40/80mhz-XXXX; + #| WAN (gateway) Configuration: + #| gateway: ether1; + #| ip4 firewall: enabled; + #| ip6 firewall: enabled; + #| NAT: enabled; + #| DHCP Client: enabled; + #| Login + #| admin user protected by password + :global ssid; + :global defconfMode; + :log info "Starting defconf script"; + #------------------------------------------------------------------------------- + # Apply configuration. + # these commands are executed after installation or configuration reset + #------------------------------------------------------------------------------- + :if ($action = "apply") do={ + # wait for interfaces + :local count 0; + :while ([/interface ethernet find] = "") do={ + :if ($count = 30) do={ + :log warning "DefConf: Unable to find ethernet interfaces"; + /quit; + } + :delay 1s; :set count ($count +1); + }; + :local count 0; + :while ([/interface wireless print count-only] < 2) do={ + :set count ($count +1); + :if ($count = 40) do={ + :log warning "DefConf: Unable to find wireless interface(s)"; + /ip address add address=192.168.88.1/24 interface=ether1 comment="defconf"; + /quit + } + :delay 1s; + }; + /interface list add name=WAN comment="defconf" + /interface list add name=LAN comment="defconf" + /interface bridge + add name=bridge disabled=no auto-mac=yes protocol-mode=rstp comment=defconf; + :local bMACIsSet 0; + :foreach k in=[/interface find where !(slave=yes || name="ether1" || name~"bridge" \ + || passthrough=yes || type=loopback)] do={ + :local tmpPortName [/interface get $k name]; + :if ($bMACIsSet = 0) do={ + :if ([/interface get $k type] = "ether") do={ + /interface bridge set "bridge" auto-mac=no admin-mac=[/interface get $tmpPortName mac-address]; + :set bMACIsSet 1; + } + } + :if (([/interface get $k type] != "ppp-out") && ([/interface get $k type] != "lte")) do={ + /interface bridge port + add bridge=bridge interface=$tmpPortName comment=defconf; + } + } + /ip pool add name="default-dhcp" ranges=192.168.88.10-192.168.88.254; + /ip dhcp-server + add name=defconf address-pool="default-dhcp" interface=bridge disabled=no; + /ip dhcp-server network + add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1 comment="defconf"; + /ip address add address=192.168.88.1/24 interface=bridge comment="defconf"; + /ip dns { + set allow-remote-requests=yes + static add name=router.lan address=192.168.88.1 comment=defconf + } + /interface wireless { + :local ifcId [/interface wireless find where default-name=wlan1] + :local currentName [/interface wireless get $ifcId name] + set $ifcId mode=ap-bridge band=2ghz-b/g/n disabled=no wireless-protocol=802.11 \ + distance=indoors installation=any + set $ifcId channel-width=20/40mhz-XX; + set $ifcId frequency=auto + :local wlanMac [/interface wireless get wlan1 mac-address]; + :set ssid "MikroTik-$[:pick $wlanMac 9 11]$[:pick $wlanMac 12 14]$[:pick $wlanMac 15 17]" + set $ifcId ssid=$ssid + } + /interface wireless { + :local ifcId [/interface wireless find where default-name=wlan2] + :local currentName [/interface wireless get $ifcId name] + set $ifcId mode=ap-bridge band=5ghz-a/n/ac disabled=no wireless-protocol=802.11 \ + distance=indoors installation=any + set $ifcId channel-width=20/40/80mhz-XXXX; + set $ifcId frequency=auto + :local wlanMac [/interface wireless get wlan1 mac-address]; + :set ssid "MikroTik-$[:pick $wlanMac 9 11]$[:pick $wlanMac 12 14]$[:pick $wlanMac 15 17]" + set $ifcId ssid=$ssid + } + /ip dhcp-client add interface=ether1 disabled=no comment="defconf"; + /interface list member add list=LAN interface=bridge comment="defconf" + /interface list member add list=WAN interface=ether1 comment="defconf" + /ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="defconf: masquerade" + /ip firewall { + filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked" + filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid" + filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP" + filter add chain=input action=accept src-address=127.0.0.1 dst-address=127.0.0.1 in-interface=lo comment="defconf: accept to local loopback (for CAPsMAN)" + filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN" + filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy" + filter add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy" + filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack" + filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked" + filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid" + filter add chain=forward action=drop connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed" + } + /ipv6 firewall { + address-list add list=bad_ipv6 address=::/128 comment="defconf: unspecified address" + address-list add list=bad_ipv6 address=::1 comment="defconf: lo" + address-list add list=bad_ipv6 address=fec0::/10 comment="defconf: site-local" + address-list add list=bad_ipv6 address=::ffff:0:0/96 comment="defconf: ipv4-mapped" + address-list add list=bad_ipv6 address=::/96 comment="defconf: ipv4 compat" + address-list add list=bad_ipv6 address=100::/64 comment="defconf: discard only " + address-list add list=bad_ipv6 address=2001:db8::/32 comment="defconf: documentation" + address-list add list=bad_ipv6 address=2001:10::/28 comment="defconf: ORCHID" + address-list add list=bad_ipv6 address=3ffe::/16 comment="defconf: 6bone" + filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked" + filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid" + filter add chain=input action=accept protocol=icmpv6 comment="defconf: accept ICMPv6" + filter add chain=input action=accept protocol=udp dst-port=33434-33534 comment="defconf: accept UDP traceroute" + filter add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/10 comment="defconf: accept DHCPv6-Client prefix delegation." + filter add chain=input action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE" + filter add chain=input action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH" + filter add chain=input action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP" + filter add chain=input action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy" + filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN" + filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack6" + filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked" + filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid" + filter add chain=forward action=drop src-address-list=bad_ipv6 comment="defconf: drop packets with bad src ipv6" + filter add chain=forward action=drop dst-address-list=bad_ipv6 comment="defconf: drop packets with bad dst ipv6" + filter add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="defconf: rfc4890 drop hop-limit=1" + filter add chain=forward action=accept protocol=icmpv6 comment="defconf: accept ICMPv6" + filter add chain=forward action=accept protocol=139 comment="defconf: accept HIP" + filter add chain=forward action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE" + filter add chain=forward action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH" + filter add chain=forward action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP" + filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy" + filter add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN" + } + /ip neighbor discovery-settings set discover-interface-list=LAN + /tool mac-server set allowed-interface-list=LAN + /tool mac-server mac-winbox set allowed-interface-list=LAN + :if (!($keepUsers = "yes")) do={ + :if (!($defconfPassword = "" || $defconfPassword = nil)) do={ + /user set admin password=$defconfPassword + :delay 0.5 + /user expire-password admin + } + } + /disk settings + set auto-smb-sharing=yes auto-media-sharing=yes auto-media-interface=bridge + } + #------------------------------------------------------------------------------- + # Revert configuration. + # these commands are executed if user requests to remove default configuration + #------------------------------------------------------------------------------- + :if ($action = "revert") do={ + :if (!($keepUsers = "yes")) do={ + /user set admin password="" + :delay 0.5 + /user expire-password admin + } + /disk settings + set auto-smb-sharing=no auto-media-sharing=no auto-media-interface=none + /ip firewall filter remove [find comment~"defconf"] + /ipv6 firewall filter remove [find comment~"defconf"] + /ipv6 firewall address-list remove [find comment~"defconf"] + /ip firewall nat remove [find comment~"defconf"] + /interface list member remove [find comment~"defconf"] + /interface detect-internet set detect-interface-list=none + /interface detect-internet set lan-interface-list=none + /interface detect-internet set wan-interface-list=none + /interface detect-internet set internet-interface-list=none + /interface list remove [find comment~"defconf"] + /tool mac-server set allowed-interface-list=all + /tool mac-server mac-winbox set allowed-interface-list=all + /ip neighbor discovery-settings set discover-interface-list=!dynamic + :local o [/ip dhcp-server network find comment="defconf"] + :if ([:len $o] != 0) do={ /ip dhcp-server network remove $o } + :local o [/ip dhcp-server find name="defconf" !disabled] + :if ([:len $o] != 0) do={ /ip dhcp-server remove $o } + /ip pool { + :local o [find name="default-dhcp" ranges=192.168.88.10-192.168.88.254] + :if ([:len $o] != 0) do={ remove $o } + } + :local o [/ip dhcp-client find comment="defconf"] + :if ([:len $o] != 0) do={ /ip dhcp-client remove $o } + /ip dns { + set allow-remote-requests=no + :local o [static find comment="defconf"] + :if ([:len $o] != 0) do={ static remove $o } + } + /ip address { + :local o [find comment="defconf"] + :if ([:len $o] != 0) do={ remove $o } + } + :foreach iface in=[/interface ethernet find] do={ + /interface ethernet set $iface name=[get $iface default-name] + } + /interface bridge port remove [find comment="defconf"] + /interface bridge remove [find comment="defconf"] + /interface bonding remove [find comment="defconf"] + /ip neighbor discovery-settings set discover-interface-list=static + /interface wireless cap set enabled=no interfaces="" caps-man-addresses="" + /interface wireless reset-configuration wlan1 + /interface wireless reset-configuration wlan2 + /interface wireless security-profile set default mode=none\ + authentication-types="" disable-pmkid=no wpa2-pre-shared-key="" comment="" + /caps-man manager set enabled=no + /caps-man manager interface remove [find comment="defconf"] + /caps-man manager interface set [ find default=yes ] forbid=no + /caps-man provisioning remove [find comment="defconf"] + /caps-man configuration remove [find comment="defconf"] + /caps-man security remove [find comment="defconf"] + } + :log info Defconf_script_finished; + :set defconfMode; + :set ssid; + caps-mode-script: #| CAP configuration + #| + #| * Wireless interfaces are set to be managed by CAPsMAN. + #| * All ethernet interfaces and CAPsMAN managed interfaces are bridged. + #| * DHCP client is set on bridge interface. + #| * If printed on the sticker, "admin" user is protected by password. + :global action; + :local brName "bridgeLocal"; + :local logPref "defconf:"; + :local wirelessMenu "wireless" + :local usingWifiPack false; + :local needAdminPass 1; + :if ([:len [/system package find name~"wifi" !disabled]] != 0) do={ + :set usingWifiPack true; + :set wirelessMenu "wifi"; + } + :if ($action = "apply") do={ + # wait for ethernet interfaces + :local count 0; + :while ([/interface ethernet find] = "") do={ + :if ($count = 30) do={ + :log warning "DefConf: Unable to find ethernet interfaces"; + /quit; + } + :delay 1s; :set count ($count + 1); + } + :local macSet 0; + :local tmpMac ""; + :foreach k in=[/interface ethernet find] do={ + # first ethernet is found; add bridge and set mac address of the ethernet port + :if ($macSet = 0) do={ + :set tmpMac [/interface ethernet get $k mac-address]; + /interface bridge add name=$brName auto-mac=no admin-mac=$tmpMac comment="defconf"; + :set macSet 1; + } + # add bridge ports + /interface bridge port add bridge=$brName interface=$k comment="defconf" + } + # try to add dhcp client on bridge interface (may fail if already exist) + :do { + /ip dhcp-client add interface=$brName disabled=no comment="defconf" + } on-error={ :log warning "$logPref unable to add dhcp client";} + # try to configure caps (may fail if for example specified interfaces are missing) + :local findWireless [:parse ":local count 0; + :while ([/interface $wirelessMenu find] = \"\") do={ + :if (\$count = 30) do={ + :log warning \"DefConf: Unable to find wireless interfaces\"; /quit + }; + :delay 1s; + :set count (\$count + 1) + }"] + [$findWireless] + :if ($usingWifiPack) do={ + :local addDatapath [:parse "/interface $wirelessMenu datapath + add comment=\"defconf\" name=capdp disabled=no bridge=$brName"] + [$addDatapath] + } + # delay just to make sure that all wireless interfaces are loaded + :delay 5s; + :do { + :local setCap "" + if ($usingWifiPack) do={ + :set setCap [:parse ":foreach i in=[/interface $wirelessMenu find] do={ + /interface $wirelessMenu set \$i configuration.manager=capsman datapath=capdp + } + /interface $wirelessMenu cap + set enabled=yes discovery-interfaces=$brName slaves-datapath=capdp"] + } else={ + :set setCap [:parse " + :local interfacesList \"\"; + :local bFirst 1; + :foreach i in=[/interface $wirelessMenu find] do={ + if (\$bFirst = 1) do={ + :set interfacesList [/interface $wirelessMenu get \$i name]; + :set bFirst 0; + } else={ + :set interfacesList \"\$interfacesList,\$[/interface wireless get \$i name]\"; + } + } + /interface $wirelessMenu cap set enabled=yes interfaces=\$interfacesList \\ + discovery-interfaces=$brName bridge=$brName"] + } + [$setCap] + } on-error={ :log warning "$logPref unable to configure caps";} + # do not set admin pass for RBD25 boards that do not have it printed + :if ([:pick [/system routerboard get model] 0 5] = "RBD25") do={ + if ((($defconfPassword = "" || $defconfPassword = nil) && \ + !($defconfWpsPassword = "" || $defconfWpsPassword = nil)) || \ + (!($defconfPassword = "" || $defconfPassword = nil) && \ + ($defconfWpsPassword = "" || $defconfWpsPassword = nil))) do={ + :set needAdminPass 0; + } + } + # set admin password + :if ($needAdminPass = 1) do={ + :if (!($keepUsers = "yes")) do={ + :if (!($defconfPassword = "" || $defconfPassword = nil)) do={ + /user set admin password=$defconfPassword + :delay 0.5 + /user expire-password admin + } + } + } + } + :if ($action = "revert") do={ + :if (!($keepUsers = "yes")) do={ + /user set admin password="" + :delay 0.5 + /user expire-password admin + } + :do { + :local removeCap "" + if ($usingWifiPack) do={ + :set removeCap [:parse ":foreach i in=[/interface $wirelessMenu find] do={ + /interface $wirelessMenu set \$i !configuration.manager !datapath } + /interface $wirelessMenu cap + set enabled=no !slaves-datapath !discovery-interfaces"] + } else={ + :set removeCap [:parse "/interface $wirelessMenu cap + set enabled=no interfaces=\"\" discovery-interfaces=\"\" bridge=none"] + } + [$removeCap] + } on-error={ :log warning "$logPref unable to unset caps";} + :if ($usingWifiPack) do={ + :local removeDatapath [:parse "/interface $wirelessMenu datapath remove [find comment=\"defconf\"]"] + [$removeDatapath] + } + :local o [/ip dhcp-client find comment="defconf"] + :if ([:len $o] != 0) do={ /ip dhcp-client remove $o } + /interface bridge port remove [find comment="defconf"] + /interface bridge remove [find comment="defconf"] + } + custom-script: