## 说明
# 01. 将内网网段 172.16.1.0/24 和 RouterOS IPv4 地址 172.16.1.1 根据实际情况修改。
# 02. 系统 DNS 服务器已设置为知名公共 DNS 服务器。
# 03. 本脚本将使用 172.16.1.1 作为内网设备 DNSv4 服务器。
# 04. 新系统管理员账号 用户名、密码 需要修改，账户添加完成后，用新管理员账户执行后续命令条目。
# 05. 防火墙已默认启用 fasttrack-connection 。
# 06. QoS 使用了 Fq-CoDel 算法的 Interface Queue 。
# 07. 系统日志邮件的 发件箱、收件箱、SMTP密码 需要根据实际情况修改。
# 08. DHCPv4 中 MAC 地址绑定静态 IP ，具体参数需要根据实际情况修改。
# 09. E50UG 使用 USB 存储设备作为附加硬盘，硬盘格式化过程中会忽略后续命令，需要等待格式化完成后再执行后续命令条目。


## 第一部分 - 配置网口
/interface
set [ find name=lo ] comment="defconf: local Loopback"

/interface ethernet
set [ find default-name=ether1 ] comment="defconf: local WAN"
set [ find default-name=ether2 ] comment="defconf: local LAN"
set [ find default-name=ether3 ] comment="defconf: local LAN"
set [ find default-name=ether4 ] comment="defconf: local LAN"
set [ find default-name=ether5 ] comment="defconf: local LAN"

/interface bridge
add name=bridge1 comment="defconf: local Bridge" auto-mac=yes

/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5

/ip address
add interface=bridge1 comment="defconf: local LAN IPv4" address=172.16.1.1/24 network=172.16.1.0

/ip dhcp-client
remove numbers=[ find where interface ~ "ether1" ]
add interface=ether1 comment="defconf: DHCPv4 for WAN" use-peer-dns=yes use-peer-ntp=no

/interface list
add name=WAN comment="defconf: WAN list"
add name=LAN comment="defconf: LAN list"

/interface list member
add list=WAN comment="defconf: WAN member" interface=ether1
add list=LAN comment="defconf: LAN member" interface=bridge1
## 第一部分完成


## 第二部分 - DNS & DHCP & 静态 IPv4 地址绑定
/ip dns
set allow-remote-requests=yes cache-max-ttl=6h cache-size=24576 max-udp-packet-size=1232 max-concurrent-queries=150

/ip dns forwarders
add name=domestic-dns comment="defconf: public DNS resolvers" verify-doh-cert=no dns-servers=223.5.5.5,119.29.29.29

/ip dns static
add comment="defconf: FWD mikrotik domains" match-subdomain=yes type=FWD forward-to=domestic-dns name=mikrotik.com

/ip dns static
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=alt
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=bind
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=example
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=home.arpa
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=internal
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=invalid
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=lan
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=local
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=localhost
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=onion
add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=test

/ip pool
add name=dhcpv4-pool1 comment="defconf: local LAN DHCPv4 pool" ranges=172.16.1.100-172.16.1.200

/ip dhcp-server
add name=dhcpv4-server1 comment="defconf: local LAN DHCPv4 server" address-pool=dhcpv4-pool1 interface=bridge1 lease-time=1d bootp-support=none

/ip dhcp-server network
add address=172.16.1.0/24 comment="defconf: local LAN DHCPv4 network" gateway=172.16.1.1 netmask=24 domain="fox.internal" dns-server=172.16.1.1

/ip dhcp-server lease
add address=172.16.1.10 comment="<your-device-name1>" lease-time=2d mac-address=AA:BB:CC:00:00:10 server=dhcpv4-server1
## 第二部分完成


## 第三部分 - IPv4 高级防火墙
##       Filter 规则 10 条 + 虚拟规则 1 条
##          NAT 规则  3 条
##       Mangle 规则  1 条 + 虚拟规则 3 条
##          Raw 规则 34 条 + 虚拟规则 1 条
## Address-list 规则 20 条
##    Blackhole 规则 13 条
/ip firewall address-list

add address=172.16.1.0/24 comment="defconf: local LAN IPv4 subnet" list=local_subnet_ipv4

add address=0.0.0.0/8 comment="defconf: RFC6890 - this network" list=no_forward_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890 - link local" list=no_forward_ipv4
add address=224.0.0.0/4 comment="defconf: RFC5771 - multicast" list=no_forward_ipv4
add address=255.255.255.255/32 comment="defconf: RFC6890 - limited broadcast" list=no_forward_ipv4

add address=127.0.0.0/8 comment="defconf: RFC6890 - Loopback" list=bad_ipv4
add address=192.0.0.0/24 comment="defconf: RFC6890 - reserved" list=bad_ipv4
add address=192.0.2.0/24 comment="defconf: RFC6890 - TEST-NET-1" list=bad_ipv4
add address=198.51.100.0/24 comment="defconf: RFC6890 - TEST-NET-2" list=bad_ipv4
add address=203.0.113.0/24 comment="defconf: RFC6890 - TEST-NET-3" list=bad_ipv4
add address=240.0.0.0/4 comment="defconf: RFC6890 - reserved" list=bad_ipv4

add address=0.0.0.0/8 comment="defconf: RFC6890 - this network" list=not_global_ipv4
add address=100.64.0.0/10 comment="defconf: RFC6890 - shared address" list=not_global_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890 - link local" list=not_global_ipv4
add address=192.0.0.0/29 comment="defconf: RFC6890 - DS-Lite" list=not_global_ipv4
add address=198.18.0.0/15 comment="defconf: RFC6890 - benchmarking" list=not_global_ipv4
add address=255.255.255.255/32 comment="defconf: RFC6890 - limited broadcast" list=not_global_ipv4

add address=224.0.0.0/4 comment="defconf: RFC5771 - multicast" list=bad_src_ipv4
add address=255.255.255.255/32 comment="defconf: RFC6890 - limited broadcast" list=bad_src_ipv4
add address=0.0.0.0/8 comment="defconf: RFC6890 - this network" list=bad_dst_ipv4


/ip firewall filter

add action=accept chain=input comment="defconf: accept ICMP after RAW" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=input comment="defconf: drop all not from LAN" in-interface-list=!LAN

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat in-interface-list=WAN log=yes log-prefix="[wan-not-dnat]"
add action=drop chain=forward comment="defconf: drop bad forward IPs" src-address-list=no_forward_ipv4
add action=drop chain=forward comment="defconf: drop bad forward IPs" dst-address-list=no_forward_ipv4


/ip firewall nat

add action=masquerade chain=srcnat comment="defconf: masquerade IPv4" out-interface-list=WAN

add action=redirect chain=dstnat comment="lanconf: redirect DNS query (UDP)" dst-port=53 in-interface-list=LAN protocol=udp to-ports=53
add action=redirect chain=dstnat comment="lanconf: redirect DNS query (TCP)" dst-port=53 in-interface-list=LAN protocol=tcp to-ports=53


/ip firewall mangle

add action=change-mss chain=forward comment="defconf: fix IPv4 mss for WAN" new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn


/ip firewall raw

add action=accept chain=prerouting comment="defconf: enable for transparent firewall" disabled=yes

add action=accept chain=prerouting comment="defconf: accept local Loopback" in-interface=lo

add action=accept chain=prerouting comment="defconf: accept DHCPv4 discover" dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=udp src-address=0.0.0.0 src-port=68

add action=drop chain=prerouting comment="defconf: drop bogon IPs" src-address-list=bad_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IPs" dst-address-list=bad_ipv4
add action=drop chain=prerouting comment="defconf: drop bad SRC IPv4" src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="defconf: drop bad DST IPv4" dst-address-list=bad_dst_ipv4

add action=drop chain=prerouting comment="defconf: drop non global from WAN" in-interface-list=WAN src-address-list=not_global_ipv4
add action=drop chain=prerouting comment="defconf: drop forward to local LAN from WAN" in-interface-list=WAN dst-address-list=local_subnet_ipv4 log=yes log-prefix="[wan-to-lan]"

add action=drop chain=prerouting comment="defconf: drop if not from default IPv4 range" in-interface-list=LAN src-address-list=!local_subnet_ipv4

add action=drop chain=prerouting comment="defconf: drop UDP port 0" port=0 protocol=udp log=yes log-prefix="[udp-port-0]"

add action=jump chain=prerouting comment="defconf: jump to TCP chain" jump-target=bad-tcp protocol=tcp
add action=jump chain=prerouting comment="defconf: jump to ICMP chain" jump-target=icmp4 protocol=icmp

add action=accept chain=prerouting comment="defconf: accept everything else from LAN" in-interface-list=LAN
add action=accept chain=prerouting comment="defconf: accept everything else from WAN" in-interface-list=WAN

add action=accept chain=prerouting comment="defconf: accept inter-interface router traffic" src-address-type=local

add action=drop chain=prerouting comment="defconf: drop the rest"

add action=drop chain=bad-tcp comment="defconf: drop TCP port 0" port=0 protocol=tcp log=yes log-prefix="[tcp-port-0]"
add action=drop chain=bad-tcp comment="defconf: TCP flag filter" protocol=tcp tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=bad-tcp comment="defconf: drop flags fin,syn" protocol=tcp tcp-flags=fin,syn
add action=drop chain=bad-tcp comment="defconf: drop flags fin,rst" protocol=tcp tcp-flags=fin,rst
add action=drop chain=bad-tcp comment="defconf: drop flags fin,!ack" protocol=tcp tcp-flags=fin,!ack
add action=drop chain=bad-tcp comment="defconf: drop flags fin,urg" protocol=tcp tcp-flags=fin,urg
add action=drop chain=bad-tcp comment="defconf: drop flags syn,rst" protocol=tcp tcp-flags=syn,rst
add action=drop chain=bad-tcp comment="defconf: drop flags rst,urg" protocol=tcp tcp-flags=rst,urg

add action=accept chain=icmp4 comment="defconf: rfc4884 echo reply" icmp-options=0:0 protocol=icmp
add action=accept chain=icmp4 comment="defconf: rfc4884 host unreachable" icmp-options=3:1 protocol=icmp
add action=accept chain=icmp4 comment="defconf: rfc4884 port unreachable" icmp-options=3:3 protocol=icmp
add action=accept chain=icmp4 comment="defconf: rfc4884 fragmentation needed" icmp-options=3:4 protocol=icmp
add action=accept chain=icmp4 comment="defconf: rfc4884 echo request" icmp-options=8:0 protocol=icmp
add action=accept chain=icmp4 comment="defconf: rfc4884 time exceeded" icmp-options=11:0-255 protocol=icmp

add action=accept chain=icmp4 comment="defconf: rfc4884 net unreachable only LAN" icmp-options=3:0 in-interface-list=LAN protocol=icmp
add action=accept chain=icmp4 comment="defconf: rfc4884 protocol unreachable only LAN" icmp-options=3:2 in-interface-list=LAN protocol=icmp

add action=drop chain=icmp4 comment="defconf: drop all other ICMP" protocol=icmp


/ip firewall connection tracking

set tcp-syn-sent-timeout=120s
set tcp-syn-received-timeout=60s
set tcp-established-timeout=7440s
set tcp-fin-wait-timeout=120s
set tcp-close-wait-timeout=60s
set tcp-last-ack-timeout=30s
set tcp-time-wait-timeout=120s
set tcp-close-timeout=10s
set tcp-max-retrans-timeout=300s
set tcp-unacked-timeout=300s
set udp-timeout=30s
set udp-stream-timeout=120s
set icmp-timeout=30s
set generic-timeout=600s


/ip route

add blackhole comment="defconf: RFC6890 - this network" disabled=no dst-address=0.0.0.0/8
add blackhole comment="defconf: RFC6890 - private networks" disabled=no dst-address=10.0.0.0/8
add blackhole comment="defconf: RFC6890 - shared address" disabled=no dst-address=100.64.0.0/10
add blackhole comment="defconf: RFC6890 - private networks" disabled=no dst-address=172.16.0.0/12
add blackhole comment="defconf: RFC6890 - reserved" disabled=no dst-address=192.0.0.0/24
add blackhole comment="defconf: RFC6890 - DS-Lite" disabled=no dst-address=192.0.0.0/29
add blackhole comment="defconf: RFC6890 - TEST-NET-1" disabled=no dst-address=192.0.2.0/24
add blackhole comment="defconf: RFC6890 - 6to4 relay" disabled=no dst-address=192.88.99.0/24
add blackhole comment="defconf: RFC6890 - private networks" disabled=no dst-address=192.168.0.0/16
add blackhole comment="defconf: RFC6890 - benchmarking" disabled=no dst-address=198.18.0.0/15
add blackhole comment="defconf: RFC6890 - TEST-NET-2" disabled=no dst-address=198.51.100.0/24
add blackhole comment="defconf: RFC6890 - TEST-NET-3" disabled=no dst-address=203.0.113.0/24
add blackhole comment="defconf: RFC6890 - reserved" disabled=no dst-address=240.0.0.0/4
## 第三部分完成


## 第四部分 - QoS 流控
/queue type
add name=fq-codel-iface kind=fq-codel fq-codel-limit=1024 fq-codel-memlimit=8M fq-codel-interval=80ms fq-codel-target=4ms

/queue interface
set ether1 queue=fq-codel-iface
set ether2 queue=fq-codel-iface
set ether3 queue=fq-codel-iface
set ether4 queue=fq-codel-iface
set ether5 queue=fq-codel-iface
## 第四部分完成


## 第五部分 - 系统参数调整
/system identity
set name=FoxRouter

/system clock
set time-zone-name=Asia/Shanghai

/system ntp client servers
add address=ntp.aliyun.com
add address=ntp.tencent.com
add address=cn.pool.ntp.org

/system ntp client
set enabled=yes

/ipv6 settings
set disable-ipv6=yes

/ip service
set telnet address=172.16.1.0/24 disabled=yes
set ftp address=172.16.1.0/24 disabled=yes
set www address=172.16.1.0/24
set ssh address=172.16.1.0/24
set www-ssl address=172.16.1.0/24
set api address=172.16.1.0/24 disabled=yes
set winbox address=172.16.1.0/24
set api-ssl address=172.16.1.0/24 disabled=yes

/ip settings
set max-neighbor-entries=2048 rp-filter=loose tcp-syncookies=yes

/ip neighbor discovery-settings
set discover-interface-list=none

/ip proxy
set enabled=no

/ip socks
set enabled=no

/ip upnp
set enabled=no

/ip cloud
set back-to-home-vpn=revoked-and-disabled

/ip cloud
set ddns-enabled=auto ddns-update-interval=none update-time=no

/ip ssh
set strong-crypto=yes

/ip smb
set enabled=no interfaces=bridge1

/ip smb users
set numbers=[ find where name ~ "guest" ] disabled=yes

/ip smb shares
set numbers=[ find where name ~ "pub" ] disabled=yes

/disk settings
set auto-smb-sharing=no auto-media-sharing=no auto-media-interface=none

/tool mac-server
set allowed-interface-list=none

/tool mac-server mac-winbox
set allowed-interface-list=none

/tool mac-server ping
set enabled=no

/tool bandwidth-server
set enabled=no

/user group
set read policy=read,winbox,web,!local,!telnet,!ssh,!ftp,!reboot,!write,!policy,!test,!password,!sniff,!sensitive,!api,!romon,!rest-api

/user
add name="<your-ros-user-name>" password="<your-ros-user-password>" group=full address=172.16.1.0/24 comment="defconf: system admin user"
set admin group=read address=172.16.1.0/24 comment="defconf: system default user"
## 第五部分完成


## 第六部分 - 定时任务
/tool e-mail
set server="<smtp.xxx.com>" port=465 tls=yes certificate-verification=yes from="<your-email-x@xxx.com>" user="<your-email-x@xxx.com>" password="<your-smtp-password>"

/system scheduler
add comment="sysconf: system log email" interval=45m name=system-log-timer on-event="/system script run email-log-worker" policy=read,write,policy,test start-time=00:00:00
add comment="sysconf: system resource email" interval=6h name=system-res-timer on-event="/system script run email-res-worker" policy=read,write,policy,test start-time=00:05:00
add comment="sysconf: system auto upgrade" interval=1d name=system-upgrade-timer on-event="/system script run sys-upgrade-worker" policy=reboot,read,write,policy start-time=02:55:00
add comment="dhcpconf: disable dhcpv4-client1" interval=1d name=disable-dhcpv4-timer on-event="/ip dhcp-client disable numbers=[find where interface ~ \"ether1\"]" policy=write start-time=04:00:00
add comment="dhcpconf: enable dhcpv4-client1" interval=1d name=enable-dhcpv4-timer on-event="/ip dhcp-client enable numbers=[find where interface ~ \"ether1\"]" policy=write start-time=04:00:10

/system script
add comment="sysconf: system log email" dont-require-permissions=no name=email-log-worker policy=read,write,policy,test source=""
add comment="sysconf: system resource email" dont-require-permissions=no name=email-res-worker policy=read,write,policy,test source=""
add comment="sysconf: system auto upgrade" dont-require-permissions=no name=sys-upgrade-worker policy=reboot,read,write,policy source=""
## 第六部分完成


## 第七部分 - 设置系统日志
## 格式化过程缓慢需要等待
/disk
format usb1 mbr-partition-table=no file-system=ext4 label=logdrive ## Waiting

/system logging action
add disk-file-count=100 disk-file-name=usb1/offline-log name=syslog target=disk

/system logging
add action=syslog topics=critical
add action=syslog topics=error
add action=syslog topics=warning
add action=syslog topics=system
add action=syslog topics=script
add action=syslog topics=firewall
add action=syslog topics=interface

/console clear-history
## 第七部分完成


## 第八部分
# 1.设置系统邮件和自动升级脚本内容。
# 2.检查系统账户权限。
# 3.备份系统。
# 4.重启系统。
## 第八部分完成