changed Files: config_hex.grote.lan.rsc
config_rb5009.grote.lan.rsc x Signed-off-by: Michael Grote <michael.grote@posteo.de>
This commit is contained in:
parent
696c4b901d
commit
73224a3d28
3 changed files with 21 additions and 3262 deletions
|
|
@ -1,174 +0,0 @@
|
||||||
# 2023-07-21 18:40:20 by RouterOS 7.10
|
|
||||||
# software id = NPZE-DVQU
|
|
||||||
#
|
|
||||||
# model = RB750Gr3
|
|
||||||
# serial number = CC210C7265A3
|
|
||||||
/interface ethernet
|
|
||||||
set [ find default-name=ether1 ] disabled=yes
|
|
||||||
set [ find default-name=ether3 ] disabled=yes
|
|
||||||
set [ find default-name=ether4 ] disabled=yes
|
|
||||||
set [ find default-name=ether5 ] disabled=yes
|
|
||||||
/interface wireguard
|
|
||||||
add listen-port=13233 mtu=1420 name=wireguard_clients private-key=\
|
|
||||||
"4EsatRG85+HxsoPF1gm6A5vZQ88xRo/fHb0xsdJMb3w="
|
|
||||||
add listen-port=13232 mtu=1420 name=wireguard_s2s_hex private-key=\
|
|
||||||
"ABE3o3tWAw2GeLfJDAKeNqG9OwudiOLFhT+ghQ6P1Fc="
|
|
||||||
/interface list
|
|
||||||
add name=LAN
|
|
||||||
add name=VPN
|
|
||||||
add name=winbox-access
|
|
||||||
/interface lte apn
|
|
||||||
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
|
|
||||||
/interface wireless security-profiles
|
|
||||||
set [ find default=yes ] supplicant-identity=MikroTik
|
|
||||||
/port
|
|
||||||
set 1 name=serial0
|
|
||||||
/routing ospf instance
|
|
||||||
add disabled=no name=ospf-instance-s2s redistribute=connected router-id=\
|
|
||||||
10.25.26.2
|
|
||||||
/routing ospf area
|
|
||||||
add area-id=0.0.0.1 disabled=no instance=ospf-instance-s2s name=ospf-area-1
|
|
||||||
/snmp community
|
|
||||||
set [ find default=yes ] read-access=no security=private
|
|
||||||
add addresses=::/0 authentication-password=9IEYe5R-usuhdH7y-LEcJpWcfeQ319 \
|
|
||||||
authentication-protocol=SHA1 encryption-password=\
|
|
||||||
GjYze03kkkeRMH3sDVbAJp9Gl6WC-I encryption-protocol=AES name=librenms-v3
|
|
||||||
/system logging action
|
|
||||||
set 0 memory-lines=10000
|
|
||||||
/ip neighbor discovery-settings
|
|
||||||
set discover-interface-list=winbox-access
|
|
||||||
/ip settings
|
|
||||||
set tcp-syncookies=yes
|
|
||||||
/ipv6 settings
|
|
||||||
set disable-ipv6=yes max-neighbor-entries=8192
|
|
||||||
/interface list member
|
|
||||||
add interface=ether2 list=LAN
|
|
||||||
add interface=wireguard_s2s_hex list=VPN
|
|
||||||
add interface=wireguard_clients list=LAN
|
|
||||||
add interface=wireguard_s2s_hex list=winbox-access
|
|
||||||
add interface=wireguard_clients list=winbox-access
|
|
||||||
add interface=ether2 list=winbox-access
|
|
||||||
/interface ovpn-server server
|
|
||||||
set auth=sha1,md5
|
|
||||||
/interface wireguard peers
|
|
||||||
add allowed-address=0.0.0.0/0 endpoint-address=mgrote.net endpoint-port=13232 \
|
|
||||||
interface=wireguard_s2s_hex persistent-keepalive=10s public-key=\
|
|
||||||
"/drwUkzCR7umH4YFTRa+D9WB8KOvTXIZxRf/9gC9kkM="
|
|
||||||
add allowed-address=10.25.27.2/24 comment=iphone_andreas interface=\
|
|
||||||
wireguard_clients public-key=\
|
|
||||||
"Y/3GVIZsdAUpKr2XJ42MVPte4qJvPpe6ZWj7lQIjPEM="
|
|
||||||
add allowed-address=10.25.27.200/32 comment=iphone_maximilian interface=\
|
|
||||||
wireguard_clients public-key=\
|
|
||||||
"45IEON4osDmTxIv/pkDTWwdUb6X33uTmZFbebkrkdHo="
|
|
||||||
add allowed-address=10.25.27.100/24 comment=ipad_maximilian interface=\
|
|
||||||
wireguard_clients public-key=\
|
|
||||||
"45/22voZXBbjYhtLLQqwPQ00tMZVB6sglrLbkEnlTUM="
|
|
||||||
/ip address
|
|
||||||
add address=10.25.26.2/30 interface=wireguard_s2s_hex network=10.25.26.0
|
|
||||||
add address=10.25.27.1/24 interface=wireguard_clients network=10.25.27.0
|
|
||||||
/ip cloud
|
|
||||||
set ddns-enabled=yes ddns-update-interval=5m
|
|
||||||
/ip dhcp-client
|
|
||||||
add interface=ether2
|
|
||||||
/ip firewall address-list
|
|
||||||
add address=192.168.2.0/24 list=subnet2
|
|
||||||
add address=192.168.2.0/24 list=mgmt_access
|
|
||||||
add address=192.168.3.0/24 list=subnet3
|
|
||||||
add address=10.25.25.0/24 list=subnet2525
|
|
||||||
add address=10.25.26.0/24 list=mgmt_access
|
|
||||||
add address=10.25.26.0/24 list=subnet2526
|
|
||||||
add address=192.168.3.0/24 list=mgmt_access
|
|
||||||
add address=10.25.27.0/24 list=subnet2527
|
|
||||||
add address=10.25.27.0/24 list=mgmt_access
|
|
||||||
add address=192.168.2.43 list=snmp_server
|
|
||||||
/ip firewall filter
|
|
||||||
add action=accept chain=input connection-state=established,related \
|
|
||||||
log-prefix="Allow established, related: "
|
|
||||||
add action=drop chain=input connection-state=invalid log-prefix=\
|
|
||||||
"Drop invalid:"
|
|
||||||
add action=accept chain=input in-interface=wireguard_s2s_hex log-prefix=\
|
|
||||||
"Allow OSPF: " protocol=ospf
|
|
||||||
add action=accept chain=input icmp-options=!5:0-255 log-prefix="Allow ICMP: " \
|
|
||||||
protocol=icmp
|
|
||||||
add action=accept chain=input dst-port=13232,13233 in-interface=ether2 \
|
|
||||||
log-prefix="Allow Wireguard: " protocol=udp
|
|
||||||
add action=accept chain=input dst-port=22,8291 log-prefix=\
|
|
||||||
"Allow ssh+winbox: " protocol=tcp src-address-list=mgmt_access
|
|
||||||
add action=drop chain=input log-prefix="INPUT: Drop anything not allowed: "
|
|
||||||
add action=fasttrack-connection chain=forward connection-state=\
|
|
||||||
established,related hw-offload=yes log-prefix="FastTrack Connection: "
|
|
||||||
add action=accept chain=forward connection-state=established,related \
|
|
||||||
log-prefix="Allow established, related: "
|
|
||||||
add action=drop chain=forward connection-state=invalid log-prefix=\
|
|
||||||
"Drop invalid:"
|
|
||||||
add action=accept chain=forward dst-address-list=subnet3 log-prefix=\
|
|
||||||
"Allow SN2 -> SN3: " src-address-list=subnet2
|
|
||||||
add action=accept chain=forward dst-address-list=subnet3 log-prefix=\
|
|
||||||
"Allow SN2526 -> SN3: " src-address-list=subnet2526
|
|
||||||
add action=accept chain=forward dst-address-list=subnet3 log-prefix=\
|
|
||||||
"Allow SN2525 -> SN3: " src-address-list=subnet2525
|
|
||||||
add action=accept chain=forward in-interface=wireguard_clients log-prefix=\
|
|
||||||
"Allow WG-Clients-> Ether2: " out-interface=ether2 src-address-list=\
|
|
||||||
subnet2527
|
|
||||||
add action=drop chain=forward disabled=yes log=yes log-prefix=\
|
|
||||||
"FORWARD: Drop anything not allowed: "
|
|
||||||
/ip firewall nat
|
|
||||||
add action=masquerade chain=srcnat log-prefix="NAT: Alles von SN2" \
|
|
||||||
out-interface=!wireguard_s2s_hex
|
|
||||||
/ip service
|
|
||||||
set telnet disabled=yes
|
|
||||||
set ftp disabled=yes
|
|
||||||
set www disabled=yes
|
|
||||||
set ssh address=192.168.2.0/24,192.168.3.0/24,10.25.26.0/24
|
|
||||||
set api disabled=yes
|
|
||||||
set winbox address=192.168.2.0/24,192.168.3.0/24,10.25.26.0/24
|
|
||||||
set api-ssl disabled=yes
|
|
||||||
/ip ssh
|
|
||||||
set strong-crypto=yes
|
|
||||||
/routing ospf interface-template
|
|
||||||
add area=ospf-area-1 disabled=no interfaces=wireguard_s2s_hex networks=\
|
|
||||||
10.25.26.0/30 type=ptmp
|
|
||||||
/routing ospf static-neighbor
|
|
||||||
add address=10.25.26.1%wireguard_s2s_hex area=ospf-area-1 disabled=no
|
|
||||||
/snmp
|
|
||||||
set contact="mgrote <michael.grote@posteo.de>" location="S\FCdstra\DFe" \
|
|
||||||
trap-community=librenms-v3 trap-generators=temp-exception,interfaces \
|
|
||||||
trap-version=3
|
|
||||||
/system clock
|
|
||||||
set time-zone-name=Europe/Berlin
|
|
||||||
/system identity
|
|
||||||
set name=hex
|
|
||||||
/system logging
|
|
||||||
add disabled=yes topics=ospf
|
|
||||||
/system note
|
|
||||||
set show-at-login=no
|
|
||||||
/system ntp client
|
|
||||||
set enabled=yes
|
|
||||||
/system ntp client servers
|
|
||||||
add address=0.de.pool.ntp.org
|
|
||||||
/system routerboard settings
|
|
||||||
set silent-boot=yes
|
|
||||||
/system watchdog
|
|
||||||
set automatic-supout=no ping-timeout=5m watch-address=10.25.26.1
|
|
||||||
/tool bandwidth-server
|
|
||||||
set enabled=no
|
|
||||||
/tool mac-server
|
|
||||||
set allowed-interface-list=none
|
|
||||||
/tool mac-server mac-winbox
|
|
||||||
set allowed-interface-list=winbox-access
|
|
||||||
/tool mac-server ping
|
|
||||||
set enabled=no
|
|
||||||
/tool netwatch
|
|
||||||
add disabled=no down-script="# set variables\r\
|
|
||||||
\n:local wginterface wireguard_s2s_hex\r\
|
|
||||||
\n# Valid characters in variable names are letters and digits. If variable\
|
|
||||||
\_name contains any other character, then variable name should be put in d\
|
|
||||||
ouble quotes.\r\
|
|
||||||
\n\r\
|
|
||||||
\n:log error \"wireguard-tunnel down: \$wginterface\"\r\
|
|
||||||
\n/interface/wireguard/disable \$wginterface\r\
|
|
||||||
\n:delay 20s\r\
|
|
||||||
\n/interface/wireguard/enable \$wginterface\r\
|
|
||||||
\n:log info \"Restart wireguard-tunnel: \$wginterface\"\r\
|
|
||||||
\nping 192.168.2.1\r\
|
|
||||||
\n" host=192.168.2.1 interval=30s timeout=1s type=simple
|
|
||||||
File diff suppressed because it is too large
Load diff
39
x
39
x
|
|
@ -4,25 +4,6 @@
|
||||||
devices="rb5009.grote.lan,/home/mg/oxidized-selfmade/neu
|
devices="rb5009.grote.lan,/home/mg/oxidized-selfmade/neu
|
||||||
hex.grote.lan,/ssh/keys/hex"
|
hex.grote.lan,/ssh/keys/hex"
|
||||||
GIT_REPO_PATH=/home/mg/oxidized-selfmade
|
GIT_REPO_PATH=/home/mg/oxidized-selfmade
|
||||||
|
|
||||||
|
|
||||||
# Save the current value of IFS to restore later
|
|
||||||
OLD_IFS=$IFS
|
|
||||||
|
|
||||||
# Set the IFS to a comma to split the values
|
|
||||||
IFS=','
|
|
||||||
|
|
||||||
# Loop through the lines in the variable
|
|
||||||
while read -r fqdn path; do
|
|
||||||
# Print the variables (you can perform any actions you need here)
|
|
||||||
fqdn=$(echo $fqdn | tr -d "[:space:]")
|
|
||||||
|
|
||||||
ssh -n -i ${path} ${fqdn} "/export show-sensitive" > config_${fqdn}.rsc
|
|
||||||
done <<< "$devices"
|
|
||||||
|
|
||||||
# Restore the original IFS value
|
|
||||||
IFS=$OLD_IFS
|
|
||||||
|
|
||||||
if [ -d "$GIT_REPO_PATH" ]; then
|
if [ -d "$GIT_REPO_PATH" ]; then
|
||||||
cd "$GIT_REPO_PATH"
|
cd "$GIT_REPO_PATH"
|
||||||
if [ -d ".git" ]; then
|
if [ -d ".git" ]; then
|
||||||
|
|
@ -37,3 +18,23 @@ IFS=$OLD_IFS
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Save the current value of IFS to restore later
|
||||||
|
OLD_IFS=$IFS
|
||||||
|
|
||||||
|
# Set the IFS to a comma to split the values
|
||||||
|
IFS=','
|
||||||
|
|
||||||
|
# Loop through the lines in the variable
|
||||||
|
while read -r fqdn path; do
|
||||||
|
# Print the variables (you can perform any actions you need here)
|
||||||
|
fqdn=$(echo $fqdn | tr -d "[:space:]")
|
||||||
|
|
||||||
|
ssh -n -i ${path} ${fqdn} "/export show-sensitive" > config_${fqdn}.rsc
|
||||||
|
git add config_${fqdn}.rsc
|
||||||
|
git commit -m update config_${fqdn}
|
||||||
|
done <<< "$devices"
|
||||||
|
|
||||||
|
# Restore the original IFS value
|
||||||
|
IFS=$OLD_IFS
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue