## 说明 # 01. 将内网网段 172.16.1.0/24 和 RouterOS IPv4 地址 172.16.1.1 根据实际情况修改。 # 02. 系统 DNS 服务器已设置为知名公共 DNS 服务器。 # 03. 本脚本将使用 172.16.1.1 作为内网设备 DNSv4 服务器。 # 04. 新系统管理员账号 用户名、密码 需要修改，账户添加完成后，用新管理员账户执行后续命令条目。 # 05. 防火墙已默认启用 fasttrack-connection 。 # 06. 系统日志邮件的 发件箱、收件箱、SMTP密码 需要根据实际情况修改。 # 07. DHCPv4 中 MAC 地址绑定静态 IP ，具体参数需要根据实际情况修改。 # 08. E50UG 使用 USB 存储设备作为附加硬盘，硬盘格式化过程中会忽略后续命令，需要等待格式化完成后再执行后续命令条目。 ## 第一部分 - 配置网口 /interface set [ find name=lo ] comment="defconf: local Loopback" /interface ethernet set [ find default-name=ether1 ] comment="defconf: local WAN" set [ find default-name=ether2 ] comment="defconf: local LAN" set [ find default-name=ether3 ] comment="defconf: local LAN" set [ find default-name=ether4 ] comment="defconf: local LAN" set [ find default-name=ether5 ] comment="defconf: local LAN" /interface bridge add name=bridge1 comment="defconf: local Bridge" auto-mac=yes /interface bridge port add bridge=bridge1 interface=ether2 add bridge=bridge1 interface=ether3 add bridge=bridge1 interface=ether4 add bridge=bridge1 interface=ether5 /ip address add interface=bridge1 comment="defconf: local LAN IPv4" address=172.16.1.1/24 network=172.16.1.0 /ip dhcp-client remove numbers=[ find where interface ~ "ether1" ] add interface=ether1 comment="defconf: DHCPv4 for WAN" use-peer-dns=yes use-peer-ntp=no /interface list add name=WAN comment="defconf: WAN list" add name=LAN comment="defconf: LAN list" /interface list member add list=WAN comment="defconf: WAN member" interface=ether1 add list=LAN comment="defconf: LAN member" interface=bridge1 ## 第一部分完成 ## 第二部分 - DNS & DHCP & 静态 IPv4 地址绑定 /ip dns set allow-remote-requests=yes cache-max-ttl=6h cache-size=24576 max-udp-packet-size=1232 max-concurrent-queries=150 /ip dns forwarders add name=domestic-dns comment="defconf: public DNS resolvers" verify-doh-cert=no dns-servers=223.5.5.5,119.29.29.29 /ip dns static add comment="defconf: FWD mikrotik domains" match-subdomain=yes type=FWD forward-to=domestic-dns name=mikrotik.com /ip dns static add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=alt add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=bind add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=example add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=home.arpa add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=internal add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=invalid add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=lan add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=local add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=localhost add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=onion add comment="defconf: suppress special-use domains" match-subdomain=yes type=NXDOMAIN name=test /ip pool add name=dhcpv4-pool1 comment="defconf: local LAN DHCPv4 pool" ranges=172.16.1.100-172.16.1.200 /ip dhcp-server add name=dhcpv4-server1 comment="defconf: local LAN DHCPv4 server" address-pool=dhcpv4-pool1 interface=bridge1 lease-time=1d bootp-support=none /ip dhcp-server network add address=172.16.1.0/24 comment="defconf: local LAN DHCPv4 network" gateway=172.16.1.1 netmask=24 domain="fox.internal" dns-server=172.16.1.1 /ip dhcp-server lease add address=172.16.1.10 comment="" lease-time=2d mac-address=AA:BB:CC:00:00:10 server=dhcpv4-server1 ## 第二部分完成 ## 第三部分 - IPv4 初级防火墙 ## Filter 规则 8 条 + 虚拟规则 1 条 ## NAT 规则 3 条 ## Mangle 规则 1 条 + 虚拟规则 3 条 ## Address-list 规则 1 条 ## Blackhole 规则 13 条 /ip firewall address-list add address=172.16.1.0/24 comment="defconf: local LAN IPv4 subnet" list=local_subnet_ipv4 /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp add action=drop chain=input comment="defconf: drop all not from LAN" in-interface-list=!LAN add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat in-interface-list=WAN log=yes log-prefix="[wan-not-dnat]" /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade IPv4" out-interface-list=WAN add action=redirect chain=dstnat comment="lanconf: redirect DNS query (UDP)" dst-port=53 in-interface-list=LAN protocol=udp to-ports=53 add action=redirect chain=dstnat comment="lanconf: redirect DNS query (TCP)" dst-port=53 in-interface-list=LAN protocol=tcp to-ports=53 /ip firewall mangle add action=change-mss chain=forward comment="defconf: fix IPv4 mss for WAN" new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn /ip firewall connection tracking set tcp-syn-sent-timeout=120s set tcp-syn-received-timeout=60s set tcp-established-timeout=7440s set tcp-fin-wait-timeout=120s set tcp-close-wait-timeout=60s set tcp-last-ack-timeout=30s set tcp-time-wait-timeout=120s set tcp-close-timeout=10s set tcp-max-retrans-timeout=300s set tcp-unacked-timeout=300s set udp-timeout=30s set udp-stream-timeout=120s set icmp-timeout=30s set generic-timeout=600s /ip route add blackhole comment="defconf: RFC6890 - this network" disabled=no dst-address=0.0.0.0/8 add blackhole comment="defconf: RFC6890 - private networks" disabled=no dst-address=10.0.0.0/8 add blackhole comment="defconf: RFC6890 - shared address" disabled=no dst-address=100.64.0.0/10 add blackhole comment="defconf: RFC6890 - private networks" disabled=no dst-address=172.16.0.0/12 add blackhole comment="defconf: RFC6890 - reserved" disabled=no dst-address=192.0.0.0/24 add blackhole comment="defconf: RFC6890 - DS-Lite" disabled=no dst-address=192.0.0.0/29 add blackhole comment="defconf: RFC6890 - TEST-NET-1" disabled=no dst-address=192.0.2.0/24 add blackhole comment="defconf: RFC6890 - 6to4 relay" disabled=no dst-address=192.88.99.0/24 add blackhole comment="defconf: RFC6890 - private networks" disabled=no dst-address=192.168.0.0/16 add blackhole comment="defconf: RFC6890 - benchmarking" disabled=no dst-address=198.18.0.0/15 add blackhole comment="defconf: RFC6890 - TEST-NET-2" disabled=no dst-address=198.51.100.0/24 add blackhole comment="defconf: RFC6890 - TEST-NET-3" disabled=no dst-address=203.0.113.0/24 add blackhole comment="defconf: RFC6890 - reserved" disabled=no dst-address=240.0.0.0/4 ## 第三部分完成 ## 第四部分 - 系统参数调整 /system identity set name=FoxRouter /system clock set time-zone-name=Asia/Shanghai /system ntp client servers add address=ntp.aliyun.com add address=ntp.tencent.com add address=cn.pool.ntp.org /system ntp client set enabled=yes /ipv6 settings set disable-ipv6=yes /ip service set telnet address=172.16.1.0/24 disabled=yes set ftp address=172.16.1.0/24 disabled=yes set www address=172.16.1.0/24 set ssh address=172.16.1.0/24 set www-ssl address=172.16.1.0/24 set api address=172.16.1.0/24 disabled=yes set winbox address=172.16.1.0/24 set api-ssl address=172.16.1.0/24 disabled=yes /ip settings set max-neighbor-entries=2048 rp-filter=loose tcp-syncookies=yes /ip neighbor discovery-settings set discover-interface-list=none /ip proxy set enabled=no /ip socks set enabled=no /ip upnp set enabled=no /ip cloud set back-to-home-vpn=revoked-and-disabled /ip cloud set ddns-enabled=auto ddns-update-interval=none update-time=no /ip ssh set strong-crypto=yes /ip smb set enabled=no interfaces=bridge1 /ip smb users set numbers=[ find where name ~ "guest" ] disabled=yes /ip smb shares set numbers=[ find where name ~ "pub" ] disabled=yes /disk settings set auto-smb-sharing=no auto-media-sharing=no auto-media-interface=none /tool mac-server set allowed-interface-list=none /tool mac-server mac-winbox set allowed-interface-list=none /tool mac-server ping set enabled=no /tool bandwidth-server set enabled=no /user group set read policy=read,winbox,web,!local,!telnet,!ssh,!ftp,!reboot,!write,!policy,!test,!password,!sniff,!sensitive,!api,!romon,!rest-api /user add name="" password="" group=full address=172.16.1.0/24 comment="defconf: system admin user" set admin group=read address=172.16.1.0/24 comment="defconf: system default user" ## 第四部分完成 ## 第五部分 - 定时任务 /system scheduler add comment="sysconf: system auto upgrade" interval=1d name=system-upgrade-timer on-event="/system script run sys-upgrade-worker" policy=reboot,read,write,policy start-time=02:55:00 add comment="dhcpconf: disable dhcpv4-client1" interval=1d name=disable-dhcpv4-timer on-event="/ip dhcp-client disable numbers=[find where interface ~ \"ether1\"]" policy=write start-time=04:00:00 add comment="dhcpconf: enable dhcpv4-client1" interval=1d name=enable-dhcpv4-timer on-event="/ip dhcp-client enable numbers=[find where interface ~ \"ether1\"]" policy=write start-time=04:00:10 /system script add comment="sysconf: system auto upgrade" dont-require-permissions=no name=sys-upgrade-worker policy=reboot,read,write,policy source="" ## 第五部分完成 ## 第六部分 - 设置系统日志 ## 格式化过程缓慢需要等待 /disk format usb1 mbr-partition-table=no file-system=ext4 label=logdrive ## Waiting /system logging action add disk-file-count=100 disk-file-name=usb1/offline-log name=syslog target=disk /system logging add action=syslog topics=critical add action=syslog topics=error add action=syslog topics=warning add action=syslog topics=system add action=syslog topics=script add action=syslog topics=firewall add action=syslog topics=interface /console clear-history ## 第六部分完成 ## 第七部分 # 1.设置系统邮件和自动升级脚本内容。 # 2.检查系统账户权限。 # 3.备份系统。 # 4.重启系统。 ## 第七部分完成