Voor mijn (glasvezel)verbinding met Freedom gebruik ik een eigen router van het merk MikroTik meet daarop hun eigen RouterOS. Het configureren wat lastiger dan met een Fritz!Box maar met wat uitzoekwerk is het wel te doen. Hierbij deel ik mijn configuratie in de hoop anderen op weg te helpen en er wellicht zelf ook iets aan te hebben mocht iemand verbeteringen hierop hebben.
Deze config is voor een exemplaar met 6 poorten, waarvan er één een SFP poort is waarin ik een geschikte module heb geschoven. Op ether1 kun je eventueel ook een conventionele koperkabel gebruiken. De ether2 en ether3 poorten zijn voor het interne netwerk, de ether4 of ether5 poort voor de TV ontvanger. Ik heb de IPTV box dus niet opgenomen in hetzelfde subnet als de rest van het interne netwerk (192.168.1.0/24) maar een eigen subnet (192.168.10.0/24) gegeven op een aparte poort.
Ik ga uit van een default configuratie.
Hopelijk heb ik alles goed gekopieerd/geplakt en niet te veel wegge-edit…
Interfaces
/interface ethernet
set [ find default-name=sfp1 ] \
advertise=100M-half,100M-full,1000M-half,1000M-full \
auto-negotiation=no \
comment="WAN port (VLANS 4 & 6, SFP)" \
l2mtu=1598 \
loop-protect=off \
mtu=1508 \
name=ether0 \
rx-flow-control=auto \
tx-flow-control=auto
set [ find default-name=ether1 ] \
comment="WAN port (VLANS 4 & 6)" \
loop-protect=off \
mtu=1508
set [ find default-name=ether2 ] comment=DMZ
set [ find default-name=ether3 ] comment=DMZ
set [ find default-name=ether4 ] comment=IPTV
set [ find default-name=ether5 ] comment=IPTV
/interface vlan
add interface=bridge-WAN \
mtu=1500 \
name=vlan1.4 \
vlan-id=4
add interface=bridge-WAN \
mtu=1508 \
name=vlan1.6 \
vlan-id=6
/ppp profile
set *0 \
change-tcp-mss=no \
only-one=yes \
use-compression=yes \
use-upnp=no
/interface pppoe-client
add add-default-route=yes \
allow=pap \
disabled=no \
interface=vlan1.6 \
keepalive-timeout=20 \
max-mru=1500 \
max-mtu=1500 \
name=PPPoE \
service-name="Freedom Internet" \
use-peer-dns=yes \
user=WANrouter1@freedom.nl \
password=1234
/interface bridge
add arp=proxy-arp \
auto-mac=no \
igmp-snooping=yes \
mtu=1500 \
name=bridge-DMZ \
protocol-mode=none
add igmp-snooping=yes \
mtu=1500 \
name=bridge-IPTV \
protocol-mode=none
add mtu=1508 \
name=bridge-WAN \
protocol-mode=none
/interface bridge port
add bridge=bridge-DMZ interface=ether2
add bridge=bridge-DMZ interface=ether3
add bridge=bridge-IPTV interface=ether5
add bridge=bridge-IPTV interface=ether4
add bridge=bridge-WAN interface=ether1
add bridge=bridge-WAN interface=ether0
/interface list
add name=DMZ
add name=WAN
add name="WAN (IPTV)"
add name="LAN (IPTV)"
/interface list member
add interface=bridge-DMZ list=DMZ
add interface=PPPoE list=WAN
add interface=vlan1.4 list="WAN (IPTV)"
add interface=bridge-IPTV list="LAN (IPTV)"
IP instellingen:
/ip address
add address=192.168.1.254/24 interface=bridge-DMZ network=192.168.1.0
add address=192.168.10.1/24 interface=bridge-IPTV network=192.168.10.0
De DHCP instellingen:
/ip pool
add name=DMZ-dyn-pool \
ranges=192.168.1.64/26
add name=IPTV-dyn-pool \
ranges=192.168.10.64/26
/ip dhcp-client option
add code=60 \
name=option60-vendorclass \
value="'IPTV_RG'"
/ip dhcp-server option
add code=60 \
name=option60-vendorclass \
value="'IPTV_RG'"
add code=28 \
name=option28-broadcast \
value="'192.168.1.255'"
add code=28 \
name=option28-broadcast-10 \
value="'192.168.10.255'"
/ip dhcp-server option sets
add name=IPTV \
options=option60-vendorclass,option28-broadcast-10
add name=DMZ \
options=option28-broadcast
/ip dhcp-server
add add-arp=yes \
address-pool=DMZ-dyn-pool \
bootp-support=none \
dhcp-option-set=DMZ \
disabled=no \
interface=bridge-DMZ \
name=dhcp-dmz
add add-arp=yes \
address-pool=IPTV-dyn-pool \
bootp-support=none \
client-mac-limit=16 \
dhcp-option-set=IPTV \
disabled=no \
interface=bridge-IPTV \
lease-time=1h \
name=dhcp-iptv
/ip dhcp-server network
add address=192.168.1.0/24 \
comment=DMZ \
dns-server=192.168.1.53 \
domain=dmz.internal \
gateway=192.168.1.254 \
netmask=24
add address=192.168.10.0/24 \
comment=IPTV \
dhcp-option-set=IPTV \
dns-server=192.168.1.53 \
domain=iptv.internal \
gateway=192.168.10.1 \
netmask=24
Dit is de DHCP static lease voor de IPTV box (IP adres 192.168.10.126, het MAC adres hier is het MAC adres van jouw Amino; deze moet je hier aanpassen):
/ip dhcp-server lease
add address=192.168.10.126 \
client-id=1:5c:f:0:1:2:3 \
mac-address=5C:0F:00:01:02:03 \
server=dhcp-iptv
Dit is voor IPTV DHCP uit VLAN 4:
/ip dhcp-client
add comment="DHCP on VLAN4 of WAN interface for IPTV, auto-add IP address to an address list for reverse NAT"
dhcp-options=clientid,clientid_duid,hostname \
disabled=no \
interface=vlan1.4 \
use-peer-dns=no \
use-peer-ntp=no \
script=":local addrlist \"iptv_dhcp_obtained\"\
\n:local count [/ip firewall address-list print count-only where list=\$\"addrlist\"]\
\n:if (\$bound=1) do={ \
\n :if (\$count = 0) do={\
\n /ip firewall address-list add address=\$\"lease-address\" comment=\"Auto-added on new lease\" list=\$\"addrlist\"\
\n } else={\
\n :if (\$count = 1) do={\
\n /ip firewall address-list set [ /ip firewall address-list find list=\$\"addrlist\" ] address=\$\"lease-address\"\
\n } else={\
\n :error \"Multiple addresses in address list: \$addrlist\"\
\n }\
\n }\
\n}"
Firewal IPv4
/ip firewall address-list
add address=185.41.48.0/24 \
list=for_iptv_wan
add address=185.24.175.0/24 \
list=for_iptv_wan
add address=185.24.175.210 \
list=contain_iptv_ip
add address=192.168.10.126 \
list=contain_iptv_ip
add address=10.10.24.29 \
comment="Auto-added on new lease" \
list=iptv_dhcp_obtained
/ip firewall filter
add action=accept \
chain=input \
comment="Accept all connections to IPTV ports" \
in-interface=bridge-IPTV
add action=accept \
chain=input \
comment="Accept unicast connections to vlan1.4" \
in-interface=vlan1.4 \
src-address-type=unicast
add action=accept \
chain=input \
comment="Accept connections from LAN and DMZ to DMZ" \
in-interface=bridge-DMZ \
src-address=192.168.0.0/16
add action=accept \
chain=input \
comment="defconf: accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop \
chain=input \
comment="Drop invalid connections" \
connection-state=invalid \
log=yes \
log-prefix="drop invalid"
add action=drop \
chain=input \
comment="Drop all other connections to WAN ports" \
in-interface-list=WAN \
log=yes \
log-prefix="drop WAN"
add action=drop \
chain=input \
comment="Drop all remaining connections, just to be sure"\
log=yes\
log-prefix=\
"drop remaining"
add action=accept \
chain=forward \
comment="Forward unicast for IPTV" \
out-interface=bridge-IPTV \
src-address-type=unicast
add action=accept \
chain=forward \
in-interface=vlan1.4 \
out-interface=bridge-IPTV
add action=fasttrack-connection \
chain=forward \
comment="defconf: fasttrack" \
connection-state=established,related
add action=accept \
chain=forward \
comment="RTSP marked" \
packet-mark=rtsp
add action=accept \
chain=forward \
comment="defconf: accept established,related, untracked" \
connection-state=established,related,untracked
add action=accept \
chain=forward \
in-interface-list=!WAN \
log-prefix="ping forward" \
protocol=icmp
add action=accept \
chain=forward \
comment="Forward connections to multicast group" \
protocol=igmp
add action=accept \
chain=forward \
comment="Forward DMZ -> WAN" \
in-interface-list=DMZ \
out-interface-list=WAN
add action=accept \
chain=forward \
dst-port=80 \
in-interface-list=WAN \
out-interface-list=DMZ \
protocol=tcp
add action=accept \
chain=forward \
dst-port=443 \
in-interface-list=WAN \
out-interface-list=DMZ \
protocol=tcp
add action=accept \
chain=forward \
comment="Outgoing connections" \
in-interface=bridge-IPTV \
protocol=udp
add action=accept \
chain=forward \
in-interface=bridge-IPTV \
out-interface=PPPoE
add action=accept \
chain=forward \
in-interface=bridge-IPTV \
out-interface=vlan1.4
add action=drop \
chain=forward \
comment="defconf: drop invalid" \
connection-state=invalid \
log=yes \
log-prefix="drop invalid"
add action=drop \
chain=forward \
comment="Drop all the rest from IPTV zone" \
in-interface=vlan1.4
add action=drop \
chain=forward \
comment="defconf: drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat \
connection-state=new \
in-interface-list=WAN
add action=drop \
chain=forward \
comment="Drop all the rest, to be sure" \
log=yes \
log-prefix="drop remaining"
/ip firewall mangle
add action=change-mss \
chain=forward \
comment="Change MSS for PPPoE out - for testing" \
disabled=yes \
new-mss=1428 \
out-interface=PPPoE \
passthrough=yes \
protocol=tcp \
tcp-flags=syn \
tcp-mss=1429-65535
add action=mark-connection \
chain=forward \
comment="RTSP connection marking" \
connection-mark=no-mark \
layer7-protocol=rtsp \
new-connection-mark=rtsp_conn \
passthrough=yes
add action=mark-connection \
chain=forward \
comment="RTSP connection marking (RTSP over HTTP)" \
connection-mark=no-mark \
layer7-protocol=rtsp_http \
new-connection-mark=rtsp_conn \
passthrough=yes
add action=mark-packet \
chain=prerouting \
comment="RTSP - Connection based packet marking" \
connection-mark=rtsp_conn \
new-packet-mark=rtsp \
passthrough=no
NAT rules IPv4 (vervang 45.1.2.3 door jouw eigen public IP adres, 192.168.10.126 is de IPTV box)
/ip firewall nat
add action=masquerade \
chain=srcnat \
comment="Masquerade for IPTV (no static IP)" \
out-interface=vlan1.4
add action=dst-nat \
chain=dstnat \
comment="Any to-address (from VLAN4) -> IPTV box" \
dst-address-list=iptv_dhcp_obtained \
in-interface=vlan1.4 \
to-addresses=192.168.10.126
add action=src-nat \
chain=srcnat \
comment="Masquerade replaced by source-NAT (preferred for static WAN-IP)" \
out-interface=PPPoE \
to-addresses=45.1.2.3
add action=dst-nat \
chain=dstnat \
dst-address=45.1.2.3 \
dst-port=80 \
in-interface=PPPoE \
protocol=tcp \
src-address=!192.168.0.0/16 \
to-addresses=192.168.1.6 \
to-ports=80
add action=dst-nat \
chain=dstnat \
dst-address=45.1.2.3 \
dst-port=443 \
in-interface=PPPoE \
protocol=tcp \
src-address=!192.168.0.0/16 \
to-addresses=192.168.1.6 \
to-ports=443
add action=dst-nat \
chain=dstnat \
dst-address=45.1.2.3 \
in-interface=PPPoE \
src-address=185.24.172.21 \
to-addresses=192.168.10.126
add action=dst-nat \
chain=dstnat \
dst-address=45.1.2.3 \
dst-port=!53 \
in-interface=PPPoE \
log=yes \
log-prefix=UDP_destNAT \
protocol=udp \
to-addresses=192.168.10.126
IPv6 (vergeet niet jouw eigen IPv6 adressen en prefix hier in te vullen; 2a10:3781:abcd:: is bogus en bedoeld als voorbeeld):
/ipv6 address
add address=2a10:3781:abcd:1::254 \
interface=bridge-DMZ
add address=2a10:3781:abcd:10::254 \
interface=bridge-IPTV
/ipv6 dhcp-client
add add-default-route=yes \
interface=PPPoE \
pool-name=global_pool \
request=prefix \
use-peer-dns=no
/ipv6 firewall filter
add action=add-src-to-address-list \
address-list=ipv6_in_use \
address-list-timeout=1m \
chain=forward comment="Note actively used IPv6 addresses for 1 minute" \
dst-address=!2a10:3781:abcd::/48 \
src-address=2a10:3781:abcd::/48
add action=add-dst-to-address-list \
address-list=ipv6_addresses_contacted \
address-list-timeout=1m \
chain=forward \
dst-address=!2a10:3781:abcd::/48 \
src-address=2a10:3781:abcd::/48
add action=accept \
chain=input \
comment="Accept ping6" \
in-interface-list=WAN \
protocol=icmpv6
add action=accept \
chain=input \
in-interface=bridge-DMZ
add action=accept \
chain=forward \
in-interface=PPPoE \
out-interface=bridge-IPTV
add action=accept \
chain=forward \
in-interface=bridge-DMZ \
out-interface=PPPoE
add action=accept \
chain=forward \
comment="Forward related connections" \
connection-state=related \
in-interface-list=WAN
add action=accept \
chain=forward \
comment="Forward established connections" \
connection-state=established \
in-interface-list=WAN
add action=accept \
chain=forward \
dst-address-list=ipv6_in_use \
src-address-list=ipv6_addresses_contacted
add action=passthrough \
chain=forward \
in-interface-list=WAN \
log=yes \
src-address-list=!ipv6_addresses_contacted
add action=drop \
chain=forward \
comment="Drop traffic not destined for a used address" \
dst-address-list=!ipv6_in_use \
in-interface-list=WAN \
log=yes \
log-prefix=\
drop_to_unused_ipv6-addr
add action=reject \
chain=forward \
in-interface-list=WAN \
reject-with=icmp-no-route
/ipv6 firewall mangle
add action=change-mss \
disabled=yes \
chain=forward \
comment="Change MSS for PPPoE out - for testing" \
new-mss=clamp-to-pmtu \
out-interface=PPPoE \
passthrough=yes \
protocol=tcp \
tcp-flags=syn
Voor IPTV is IGMP proxy nodig:
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=0.0.0.0/0 \
interface=vlan1.4 \
threshold=0 \
upstream=yes
add interface=bridge-IPTV \
threshold=0
