/ip firewall filter
add chain=forward action=fasttrack-connection connection-state=established,related \
comment="fasttrack established/related"
add chain=forward action=accept connection-state=established,related \
comment="accept established/related"
## Reglas de enrutamiento
##
#
# Regla para enrutar el 4.2.2.1 por un gateway especifico, en este ejemplo el
189.73.1.1
#--------------------------------------------------------------------------------------------
/ip route
add distance=1 dst-address=4.2.2.1/32 gateway=189.73.1.1 scope=10
add distance=2 dst-address=4.2.2.1/32 blackhole scope=10
#
# Regla para enrutar el 4.2.2.2 por un gateway especifico, en este ejemplo el
200.76.2.1
#
add distance=1 dst-address=4.2.2.2/32 gateway=200.76.2.1 scope=10
add distance=2 dst-address=4.2.2.2/32 blackhole scope=10
#
#
# Reglas de Ruta por defecto con Failover
#
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=4.2.2.1 targetscope=11
add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=4.2.2.2 targetscope=11
#
# Ultimas reglas... por si hay una "falsa caida", para que te mantengas con
Internet
#
add check-gateway=ping distance=3 dst-address=0.0.0.0/0 gateway=189.73.1.1
add check-gateway=ping distance=4 dst-address=0.0.0.0/0 gateway=200.76.2.1
## Reglas para monitoreo
##
/tool netwatch
add host=4.2.2.1 interval=30s \
down-script=":log error \"Internet 1 - DOWN\"" \
up-script=":log warning \"Internet 1 - UP\""
add host=4.2.2.2 interval=30s \
down-script=":log error \"Internet 2 - DOWN\"" \
up-script=":log warning \"Internet 2 - UP\""
/ip firewall mangleadd action=change-ttl chain=postrouting comment="Bloqueo_Bluetooth" \
dst-address=192.168.5.1/24 new-ttl=set:1
##Parametros globales
:global OutInterface "ether1"
## Muestra mensaje de confirmacion
:global Msg "Reglas de Contenido Correctamente aplicadas"
##Bloqueo Redes Sociales
/ip firewall layer7-protocol
add name=Bloqueos regexp="^.*(facebook.com|twitter.com|instagram.com|hi5.com|t\
agged.com|snapchat.com|match.com|pinterest.com|badoo.com|Instagram.com).*\
\$"
##Bloqueo Youtube, youtube movil
add name=Youtube_Adicional regexp="^.+(youtube.com|www.youtube.com|m.youtube.c\
om|ytimg.com|s.ytimg.com|ytimg.l.google.com|googlevideo.com|youtu.be).*\$"
/ip firewall filter
add action=drop chain=forward comment="Bloqueos General" layer7-protocol=\
Bloqueos out-interface=$OutInterface place-before=1
add action=drop chain=forward comment="Bloqueo Youtube - Streaming" \
layer7-protocol=Youtube_Adicional out-interface=$OutInterface place-before=2
##Imprime El mensaje en el log
:log info $Msg-------------------------------------------------------------------------------
https://github.com/jsalonl/Mikrotik-Scripts/tree/masterhttps://github.com/jsalonl/Mikrotik-Scripts/blob/master/Bloqueo_Sociales.rsc
https://github.com/wifinigel/MikrotikScripting
https://www.mikrotikscripting.com/downloads/
https://www.mikrotikscripting.com/downloads/mikrotik_scripting.zip
:local ipPing ("8.8.8.8")
:local pingip
:set pingip [/ping $ipPing count=10]
:if ($pingip = 1) do={
:log info ("90% lost")
/interface ethernet disable ether2
} else={
/interface ethernet enable ether2
}
/system scheduler
add interval=3m name=schedule1 on-event=ping_isp policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup
/system script
add dont-require-permissions=no name=modifica_pcc owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
global PRUEBA\r\
\n:global isp\r\
\n:global ispactivos\r\
\n:global ispinactivos\r\
\n:global codigolinea\r\
\n:global residuo\r\
\nset ispinactivos 0\r\
\nset isp 0\r\
\nset codigolinea 4 \r\
\nset isp 0\r\
\nset residuo 0\r\
\n\r\
\n:for 1 from=1 to=5 do={\r\
\nset codigolinea (codigolinea+1)\r\
\nset isp (isp+1)\r\
\n\r\
\n:if ([/ping www.baidu.com interval=1 count=1 interface=\"ether\$isp_ISP\
\$isp\" routing-table=\"to_ISP\$isp\"] =0) do={\r\
\n/ip firewall mangle set number=\"\$codigolinea\" disabled=yes \r\
\nset PRUEBA \"desactivando reglas\"\r\
\n} else={\r\
\n/ip firewall mangle set number=\$codigolinea disabled=no per-connection-\
classifier=\"both-addresses:\$ispactivos/\$residuo\"\r\
\nset residuo (residuo+1)\r\
\nset PRUEBA \"ACTIVANDO\"\r\
\n}\r\
\n}"
/system script
add dont-require-permissions=no name=ping_isp owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
global PRUEBA\r\
\n:global isp\r\
\n:global ispactivos\r\
\n:global ispinactivos\r\
\n:global pingactualizado\r\
\nset ispactivos 0\r\
\nset ispinactivos 0\r\
\nset isp 0\r\
\n\r\
\n:for 1 from=1 to=5 do={\r\
\nset isp (isp+1)\r\
\n:if ([/ping www.baidu.com interval=1 count=4 interface=\"ether\$isp_ISP\
\$isp\" routing-table=\"to_ISP\$isp\"] =0) do={\r\
\nset ispinactivos (ispinactivos+1)\r\
\n} else={\r\
\nset ispactivos (ispactivos+1)\r\
\n} \r\
\n}\r\
\n: if (\$pingactualizado =\$ispactivos) do={\r\
\n\r\
\n#\r\
\nset PRUEBA \"no modificar firewall\"\r\
\n} else={\r\
\nset pingactualizado \$ispactivos\r\
\nset PRUEBA \"modificar firewall\"\r\
\nsystem script run modifica_pcc\r\
\n}"
Fuente: https://youtu.be/71OkzVzbFyw
/system script
add dont-require-permissions=no name=gps owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
local serverURL \"https://www.gpsmap.am/server/api/api_...\"\r\
\n:local fakeImei \"555555555555555\"\r\
\n:local SIMslot \"0\"\r\
\n:local button \"0\"\r\
\n\r\
\n:global isDebug\r\
\n\r\
\n\r\
\n# :put \$isDebug - check current state\r\
\n# :set \$isDebug \"terminal\" - log to terminal\r\
\n# :set \$isDebug \"off\" - logging off\r\
\n\r\
\n# Current Debug status\r\
\n:set \$isDebug \"off\"\r\
\n\r\
\n\r\
\n\r\
\n:local gpsDateTime\r\
\n:local lat\r\
\n:local lon\r\
\n:local alt\r\
\n:local gpsSpeed\r\
\n:local bearing\r\
\n:local gpsValid\r\
\n:local sats\r\
\n:local hdop\r\
\n:local DateTime\r\
\n:local outputURL\r\
\n\r\
\n\r\
\n#Check and set coordinate format and get data from GPS\r\
\n:if ( [/system gps get coordinate-format ] != \"dd\") do={/system gps se\
t coordinate-format=dd}\r\
\n\r\
\n\r\
\n/system gps monitor once do={\r\
\n:set \$gpsDateTime \$(\"date-and-time\")\r\
\n:set \$lat [:pick \$(\"latitude\") 0 7]\r\
\n:set \$lon [:pick \$(\"longitude\") 0 8]\r\
\n:set \$alt \$(\"altitude\")\r\
\n:set \$gpsSpeed \$(\"speed\")\r\
\n:set \$bearing \$(\"true-bearing\")\r\
\n:set \$gpsValid \$(\"valid\")\r\
\n:set \$sats \$(\"satellites\")\r\
\n:set \$hdop \$(\"horizontal-dilution\")}\r\
\n\r\
\n:set \$alt [:pick \$alt 0 [:find \$alt \".\"]]\r\
\n:set \$gpsSpeed ([:pick \$gpsSpeed 0 [:find \$gpsSpeed \".\"]].\".0\")\r\
\n:set \$bearing ([:pick \$bearing 0 [:find \$bearing \".\"]].\".0\")\r\
\n\r\
\n# Reformating date and time.\r\
\n:local day [ :pick \$gpsDateTime 4 6 ]\r\
\n:local month [ :pick \$gpsDateTime 0 3 ]\r\
\n:local year [ :pick \$gpsDateTime 7 11 ]\r\
\n:local time [ :pick \$gpsDateTime 12 19]\r\
\n:local DateTime \"\$year-\$month-\$day \$time\"\r\
\n\r\
\n:set \$outputURL (\"\$serverURL\?imei=\$fakeImei&dt=\$DateTime&lat=\$lat\
&lng=\$lon&altitude=\$alt&angle=\$bearing&speed=\$gpsSpeed&loc_valid=1\")\
\r\
\n\r\
\n:if (\$isDebug = \"terminal\") do={\r\
\n:put \$gpsDateTime\r\
\n:put \$DateTime\r\
\n:put \$lat\r\
\n:put \$lon\r\
\n:put \$alt\r\
\n:put \$gpsSpeed\r\
\n:put \$bearing\r\
\n:put \$gpsValid\r\
\n:put \$sats\r\
\n:put \$hdop\r\
\n:put \$serverURL\r\
\n:put \$fakeImei\r\
\n:put \$battVoltage\r\
\n:put \$SIMslot\r\
\n:put \$button\r\
\n:put \$outputURL\r\
\n}\r\
\n\r\
\n/tool fetch mode=http url=\"\$outputURL\" output=none"
fuente:
https://www.gpsmap.am/server/Mikrotik-GPS-Script.txt
/ip firewall mangle
add action=mark-connection chain=prerouting comment="HTTP CON" connection-state=new new-connection-mark=http-con port=\
80,443,8080,8181 protocol=tcp
add action=mark-packet chain=forward comment=HTTP connection-mark=http-con new-packet-mark=http passthrough=no
add action=mark-packet chain=forward comment="OTHER INTERNET" connection-mark=no-mark new-packet-mark=other-internet passthrough=no
/queue tree
add limit-at=90M max-limit=90M name="Total download" parent=bridge1 priority=1 queue=default
add limit-at=20M max-limit=20M name="Total upload" parent=ether1 priority=1 queue=default
add limit-at=20M max-limit=70M name=HTTP_D packet-mark=http parent="Total download" priority=3 queue=default
add limit-at=1M max-limit=15M name=HTTP_U packet-mark=http parent="Total upload" priority=3 queue=default
/queue simple
add limit-at=5M/35M max-limit=5M/35M name=5MB_down_1MB_up queue=PCQ_upload_1mb/PCQ_download_5mb target=\
192.168.10.0/24 total-queue=default
=========================================
Fuente: https://medium.com/@emerino/mikrotik-qos-plan-queue-trees-simple-queues-pcq-2dbc831b39e
/ip firewall address-list
add address=192.168.0.0/16 list=PRIVATE_NETWORKS
add address=10.0.0.0/8 list=PRIVATE_NETWORKS
add address=172.16.0.0/16 list=PRIVATE_NETWORKS
add address=172.17.0.0/16 list=PRIVATE_NETWORKS
add address=172.18.0.0/16 list=PRIVATE_NETWORKS
add address=172.19.0.0/16 list=PRIVATE_NETWORKS
add address=172.20.0.0/16 list=PRIVATE_NETWORKS
add address=172.21.0.0/16 list=PRIVATE_NETWORKS
add address=172.22.0.0/16 list=PRIVATE_NETWORKS
add address=172.23.0.0/16 list=PRIVATE_NETWORKS
add address=172.24.0.0/16 list=PRIVATE_NETWORKS
add address=172.25.0.0/16 list=PRIVATE_NETWORKS
add address=172.26.0.0/16 list=PRIVATE_NETWORKS
add address=172.27.0.0/16 list=PRIVATE_NETWORKS
add address=172.28.0.0/16 list=PRIVATE_NETWORKS
add address=172.29.0.0/16 list=PRIVATE_NETWORKS
add address=172.31.0.0/16 list=PRIVATE_NETWORKS
/queue simple
add max-limit=100M/100M name=ether1 target=ether1 time=\
23h30m-8h10m,sun,mon,tue,wed,thu,fri,sat
add max-limit=100M/100M name=TRAFICO_INTERNO packet-marks=TRAFICO_INTERNO \
target=””
/ip firewall mangle
add action=mark-packet chain=prerouting dst-address-list=PRIVATE_NETWORKS new-packet-mark=TRAFICO_INTERNO passthrough=yes src-address-list=PRIVATE_NETWORKS
:local queueName "Client- $leaseActMAC";
:if ($leaseBound = "1") do={
/queue simple add name=$queueName target=($leaseActIP . "/32") max-limit=1M/2M comment=[/ip dhcp-server lease get [find where active-mac-address=$leaseActMAC && active-address=$leaseActIP] host-name];
} else={
/queue simple remove $queueName
}
/interface/bridge/add name=dockers
/ip/address/add address=172.20.0.254/24 interface=dockers
/interface/veth/add name=veth53 address=172.20.0.53/24 gateway=172.20.0.254
/interface/bridge/port add bridge=dockers interface=veth53
/container/config/set registry-url=https://registry-1.docker.io tmpdir=disk1/pull
/container/envs/add name=unbound_envs key=TZ value="Asia/Jerusalem"
/container/add dns=172.20.0.254 remote-image=elicro/unbound:latest interface=veth53 root-dir=disk1/unbound envlist=unbound_envs start-on-boot=yes
Fuente:
https://github.com/elico/unbound-container
/ip firewall filter
add action=add-src-to-address-list address-list=block-ddos \
address-list-timeout=1d chain=input comment="=============================\
=====Inicio controle DDoS==============" connection-limit=32,32 \
disabled=no protocol=tcp
add action=tarpit chain=input connection-limit=3,32 disabled=no protocol=tcp \
src-address-list=block-ddos
add action=jump chain=forward comment="SYN Flood protect" connection-state=\
new disabled=no jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=accept chain=SYN-Protect connection-state=new disabled=no limit=\
400,5 protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect comment=\
"=================Fin Control DDoS=============================" \
:local queueName "Usuario del DHCP $leaseActMAC";
:if ($leaseBound = "1") do={
/queue simple add name=$queueName target=($leaseActIP . "/32") limit-at=5000k/10024k max-limit=10M/20M comment=[/ip dhcp-server lease get [find where active-mac-address=$leaseActMAC && active-address=$leaseActIP] host-name];
} else={
/queue simple remove $queueName
}
/tool fetch host="freedns.afraid.org" url="https://freedns.afraid.org/dynamic/update.php?CaMbiAr ClAvE.."
Fuente: https://forum.mikrotik.com/t/simple-dyndns-freedns-afraid-org-update-script/108821
/tool fetch mode=http url="http://api.ipify.org" src-path="" dst-path=/dyn.html
:local currentIP [/file get dyn.html contents]
:log warning "Public IP Detected $currentIP"
######################################################
:global ddnsuser "USER"
:global ddnspass "PASSWORD"
:global ddnshost "DOMINIO"
:global ipddns [:resolve $ddnshost];
:log warning "Current DNS $ipddns"
/file/remove dyn.html
:if ($ipddns != $currentIP) do={
:log warning ("Updating IP = $currentIP")
:global str "/nic/update?username=$ddnsuser&password=$ddnspass&hostname=$ddnshost&myip=$currentIP"
/tool fetch address=api.dynu.com src-path=$str mode=https dst-path=("/Dynu.".$ddnshost)
:delay 1
:global str [/file find name="Dynu.$ddnshost"];
/file remove $str
:global ipddns $currentIP
:log info "DynuDDNS: IP updated to $currentIP!"
} else={
:log info "No Need to change, IP Already Updated";
} }