RouterOS CPU效能監控發送即時告警

CPU效能監控發送即時告警，DeviceAverageLoadThreshold設定為CPU平均用量超過40%，送出Slack告警通知

/system scheduler

add interval=5m name=CPUOverloadCheck on-event=":local ScriptName \"CPUOverloadCheck\";\r\

    \n:local ScriptRunning [system script job find where script=\$ScriptName];\r\

    \n:if (\$ScriptRunning) do={\r\

    \n    :log info \"The script \$ScriptName cannot be run, the script is already running (Change the NumberOfMeasurements to redu\

    ce the script)\";\r\

    \n} else={\r\

    \n    /system script run \$ScriptName;\r\

    \n}" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup

(繼續閱讀...)

RouterOS SCP備份Script

 #For SCP Backup
/system backup save name=full
:local strid (:put ([/system identity get name] . ".backup"));
:put $strid;
/tool fetch upload=yes url="sftp://10.77.21.41/home/autobackup/ROS-Backup/$strid" user=autobackup password=dafsdfXX13X src-path=full.backup src-address=10.33.41.26

(繼續閱讀...)

Block Visitors by Country Using Firewall

利用下面這個網站，產出所需的國別即可達成效果，可選擇產出CIDR
http://www.ip2location.com/free/visitor-blocker
如果是RouterOS的用戶，則可以用下面另一個網站，順便同時產生ACL語法
http://mikrotikconfig.com/

(繼續閱讀...)

RouterOS Port Knocking

RouterOS Port Knocking 類似Linux中的Fail2Ban的功能，設定方式如下
/ip firewall filter
add action=add-src-to-address-list address-list=drop_scan_ip address-list-timeout=52w1d chain=input comment=ip_scan protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment=drop_scan_ip src-address-list=drop_scan_ip
add action=drop chain=input dst-port=21,22,23,8291 protocol=tcp src-address-list=login_error_ip
add action=add-src-to-address-list address-list=login_error_ip address-list-timeout=1d chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp src-address-list=ros_service_login5
add action=add-src-to-address-list address-list=ros_service_login5 address-list-timeout=1d30s chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp src-address-list=ros_service_login4
add action=add-src-to-address-list address-list=ros_service_login4 address-list-timeout=30s chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp src-address-list=ros_service_login3
add action=add-src-to-address-list address-list=ros_service_login3 address-list-timeout=30s chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp src-address-list=ros_service_login2
add action=add-src-to-address-list address-list=ros_service_login2 address-list-timeout=30s chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp src-address-list=ros_service_login1
add action=add-src-to-address-list address-list=ros_service_login1 address-list-timeout=30s chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp src-address-list=!Lan_ip
(繼續閱讀...)

BGP Commands

(繼續閱讀...)

IPv6 LAB 進階實作

Mikrotik_RouterOS設定

[admin@Mikrotik_RouterOS] > /export 

/interface ethernet

set [ find default-name=ether1 ] name=ether1_MGMT speed=1Gbps

set [ find default-name=ether2 ] name=ether2_WAN

set [ find default-name=ether3 ] name=ether3_LAN

/ip address

add address=192.168.88.30/24 interface=ether1_MGMT network=192.168.88.0

add address=192.168.98.254/24 interface=ether3_LAN network=192.168.98.0

/ipv6 address

add address=2001:b034:700:480::254/80 advertise=no interface=ether3_LAN

add address=2001:b034:700:400::1:1/112 advertise=no interface=ether2_WAN

/ipv6 route

add check-gateway=ping distance=1 dst-address=2001:b034:700:480::/64 gateway=2001:b034:700:480::253

/system identity

set name=Mikrotik_RouterOS

(繼續閱讀...)

RouterOS自動ftp上傳config備份檔

在RouterOS中加入以下Script檔(ftpbackup)，並設定排程每日備份
#產生.backup與.rsc備份檔
/system backup save name=[/system identity get name] dont-encrypt=yes
delay 3
/export file=[/system identity get name]
delay 3
#指定遠端ftp目錄存檔路徑
:local filersc "/BACKUP/RouterOS-Backup/$[/system identity get name].rsc"
:local filebackup "/BACKUP/RouterOS-Backup/$[/system identity get name].backup"
:put $filersc;
:put $filebackup;
#設定帳密登入ftp後，上傳config檔至ftp主機
/tool fetch address=192.168.99.15 src-path=([/system identity get name].".rsc") mode=ftp user=ftpadmin password=xxxx upload=yes dst-path=($filersc)
/tool fetch address=192.168.99.15 src-path=([/system identity get name].".backup") mode=ftp user=ftpadmin password=xxxx upload=yes dst-path=($filebackup)
(繼續閱讀...)

RouterOS Cheat Sheet

(繼續閱讀...)

RouterOS Wake on Lan

RouterOS有工具可以support Wake on Lan，輸入下方指令紅色字為要喚醒電腦的mac位址
/tool wol interface=bridge-local mac=24:DE:80:9D:18:A8
也可將它寫成Script方便日後執行

(繼續閱讀...)

RouteOS當SSH Tunnel Server翻牆

利用command line輸入下面指令，啟用ssh server forwarding功能
 /ip ssh set forwarding-enabled=yes
另外ssh 連線登入功能也要打開，如下圖

啟用後，再到瀏覽器中去設定proxy後，便可成功連回家中的RouterOSr翻牆
proxy設定方式可參考這裡 (繼續閱讀...)

RouterOS更改MAC address

有時需要更換Wan端口的MAC address來取得ISP配發的新DHCP IP
設定如下
[admin@MikroTik] > /interface ethernet
[admin@MikroTik] /interface ethernet> set ether1-gateway mac-address=50:41:52:23:54:15

(繼續閱讀...)

自動備份RouterOS設定檔並發信到指定信箱

前置作業要先設定好Email發信的功能，可參考這裡
Step 1：寫支Script命名為Email-Backup，讓它將備份檔自動傳送指定的Email信箱
#Email-Backup Script
/export file=export
/tool e-mail send to="xxx@gmail.com" subject=([/system identity get name]. export) body="$[/system clock get date] $[/system clock get time] configurationfile" file=export.rsc
:log info "Backup e-mail sent."; }

(繼續閱讀...)

RouterOS定時發送Log到email信箱

因為家中不會特別架一台Log Server給Routerboard丟log，變通的方法就是利用Script的方式讓存在記憶體中的log資料，定期發送到指定的Email信箱，需要查閱先前的log時，就去查看Email信件就好了
Step 1：先設定好Email發信的功能，這邊利用ISP線路的SMTP做Relay，所以不用設定帳密

(繼續閱讀...)

新玩具RouterOS RB751U

在網路上買了一台Routerboard來玩，感覺相當超值，不過設定比較複雜一點，有空再來寫一下使用心得
http://routerboard.com/RB751U-2HnD

來張疊疊樂，舊的AP準備要換掉了

簡單的包裝

用內建的軟體測了一下速度，左邊是RB751，右邊是軟路由RouterOS，速度還不錯，可以跑到快100M/s

(繼續閱讀...)