oxidized 0.31.0 → 0.32.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ruby.yml +2 -3
  3. data/.rubocop.yml +1 -2
  4. data/.rubocop_todo.yml +6 -6
  5. data/CHANGELOG.md +32 -0
  6. data/Dockerfile +5 -2
  7. data/Rakefile +28 -0
  8. data/docs/Configuration.md +14 -2
  9. data/docs/Creating-Models.md +52 -22
  10. data/docs/DeviceSimulation.md +184 -0
  11. data/docs/Hooks.md +5 -5
  12. data/docs/Issues.md +15 -9
  13. data/docs/Model-Notes/APC_AOS.md +29 -16
  14. data/docs/Model-Notes/FSOS.md +1 -0
  15. data/docs/ModelUnitTests.md +186 -0
  16. data/docs/Supported-OS-Types.md +3 -2
  17. data/examples/podman-compose/Makefile +1 -2
  18. data/{examples/device-simulation → extra}/device2yaml.rb +32 -12
  19. data/extra/gitdiff-msteams.sh +32 -5
  20. data/extra/nagios_check_failing_nodes.rb +1 -1
  21. data/extra/rest_client.rb +1 -1
  22. data/lib/oxidized/config.rb +1 -1
  23. data/lib/oxidized/input/ssh.rb +13 -5
  24. data/lib/oxidized/model/aos7.rb +2 -0
  25. data/lib/oxidized/model/aosw.rb +1 -1
  26. data/lib/oxidized/model/apc_aos.rb +1 -1
  27. data/lib/oxidized/model/arubainstant.rb +1 -1
  28. data/lib/oxidized/model/asa.rb +2 -1
  29. data/lib/oxidized/model/asyncos.rb +1 -1
  30. data/lib/oxidized/model/cumulus.rb +16 -2
  31. data/lib/oxidized/model/enterprise_sonic.rb +46 -0
  32. data/lib/oxidized/model/fsos.rb +5 -1
  33. data/lib/oxidized/model/garderos.rb +4 -4
  34. data/lib/oxidized/model/junos.rb +1 -1
  35. data/lib/oxidized/model/kornfeldos.rb +33 -0
  36. data/lib/oxidized/model/model.rb +2 -2
  37. data/lib/oxidized/model/sonicos.rb +8 -2
  38. data/lib/oxidized/model/tplink.rb +1 -0
  39. data/lib/oxidized/model/xos.rb +1 -1
  40. data/lib/oxidized/source/source.rb +32 -2
  41. data/lib/oxidized/version.rb +2 -2
  42. data/oxidized.gemspec +7 -6
  43. metadata +33 -35
  44. data/examples/device-simulation/README.md +0 -173
  45. data/examples/device-simulation/cmdsets/aoscx +0 -9
  46. data/examples/device-simulation/cmdsets/arubainstant +0 -5
  47. data/examples/device-simulation/cmdsets/asa +0 -7
  48. data/examples/device-simulation/cmdsets/ios +0 -7
  49. data/examples/device-simulation/cmdsets/nxos +0 -5
  50. data/examples/device-simulation/cmdsets/routeros +0 -5
  51. data/examples/device-simulation/cmdsets/srosmd +0 -11
  52. data/examples/device-simulation/yaml/aoscx_R0X25A-6410_FL.10.10.1100.yaml +0 -2281
  53. data/examples/device-simulation/yaml/aoscx_R8N85A-C6000-48G-CL4_PL.10.08.1010.yaml +0 -451
  54. data/examples/device-simulation/yaml/arubainstant_IAP515_8.10.0.6_VWLC.yaml +0 -213
  55. data/examples/device-simulation/yaml/asa_5512_9.12-4-67_single-context.yaml +0 -531
  56. data/examples/device-simulation/yaml/asr920_16.8.1b.yaml +0 -1122
  57. data/examples/device-simulation/yaml/garderos_R7709_003_006_068.yaml +0 -101
  58. data/examples/device-simulation/yaml/iosxe_C9200L-24P-4G_17.09.04a.yaml +0 -514
  59. data/examples/device-simulation/yaml/iosxe_C9800-L-F-K9_17.06.05.yaml +0 -417
  60. data/examples/device-simulation/yaml/riverbed_915.yaml +0 -123
  61. data/examples/device-simulation/yaml/routeros_CHR_7.10.1.yaml +0 -145
  62. data/examples/device-simulation/yaml/routeros_CHR_7.16.yaml +0 -79
  63. data/examples/device-simulation/yaml/routeros_L009UiGS_7.15.2.yaml +0 -353
data/examples/device-simulation/yaml/routeros_CHR_7.16.yaml DELETED
@@ -1,79 +0,0 @@
1
- ---
2
- init_prompt:
3
- commands:
4
- /system resource print: |-
5
- \x20 uptime: 32m36s
6
- version: 7.16 (stable)
7
- build-time: 2024-09-20 13:00:27
8
- factory-software: 7.1
9
- free-memory: 165.6MiB
10
- total-memory: 384.0MiB
11
- cpu: QEMU
12
- cpu-count: 1
13
- cpu-frequency: 2999MHz
14
- cpu-load: 2%
15
- free-hdd-space: 71.2MiB
16
- total-hdd-space: 89.2MiB
17
- write-sect-since-reboot: 584
18
- write-sect-total: 584
19
- architecture-name: x86_64
20
- board-name: CHR QEMU Standard PC (i440FX + PIIX, 1996)
21
- platform: MikroTik
22
-
23
- /system package update print: |-
24
- \x20 channel: stable
25
- installed-version: 7.16
26
-
27
- /system history print without-paging: |-
28
-
29
- /export show-sensitive: |-
30
- # 2024-11-16 06:25:32 by RouterOS 7.16
31
- # software id =\x20
32
- #
33
- /interface ethernet
34
- set [ find default-name=ether1 ] disable-running-check=no
35
- set [ find default-name=ether2 ] disable-running-check=no
36
- set [ find default-name=ether3 ] disable-running-check=no
37
- set [ find default-name=ether4 ] disable-running-check=no
38
- set [ find default-name=ether5 ] disable-running-check=no
39
- set [ find default-name=ether6 ] disable-running-check=no
40
- set [ find default-name=ether7 ] disable-running-check=no
41
- set [ find default-name=ether8 ] disable-running-check=no
42
- /port
43
- set 0 name=serial0
44
- /ip address
45
- add address=10.0.2.100/24 interface=ether1 network=10.0.2.0
46
- /ip dhcp-client
47
- add interface=ether1
48
- /system note
49
- set show-at-login=no
50
- quit: |-
51
- interrupted
52
- oxidized_output: |
53
- # version: 7.16 (stable)
54
- # factory-software: 7.1
55
- # total-memory: 384.0MiB
56
- # cpu: QEMU
57
- # cpu-count: 1
58
- # total-hdd-space: 89.2MiB
59
- # architecture-name: x86_64
60
- # board-name: CHR QEMU Standard PC (i440FX + PIIX, 1996)
61
- # platform: MikroTik# installed-version: 7.16# software id =\x20
62
- #
63
- /interface ethernet
64
- set [ find default-name=ether1 ] disable-running-check=no
65
- set [ find default-name=ether2 ] disable-running-check=no
66
- set [ find default-name=ether3 ] disable-running-check=no
67
- set [ find default-name=ether4 ] disable-running-check=no
68
- set [ find default-name=ether5 ] disable-running-check=no
69
- set [ find default-name=ether6 ] disable-running-check=no
70
- set [ find default-name=ether7 ] disable-running-check=no
71
- set [ find default-name=ether8 ] disable-running-check=no
72
- /port
73
- set 0 name=serial0
74
- /ip address
75
- add address=10.0.2.100/24 interface=ether1 network=10.0.2.0
76
- /ip dhcp-client
77
- add interface=ether1
78
- /system note
79
- set show-at-login=no
data/examples/device-simulation/yaml/routeros_L009UiGS_7.15.2.yaml DELETED
@@ -1,353 +0,0 @@
1
- ---
2
- init_prompt:
3
- commands:
4
- /system resource print: |-
5
- \x20 uptime: 14w1d19h55m4s
6
- \x20 version: 7.15.2 (stable)
7
- \x20 build-time: 2024-06-26 11:42:37
8
- \x20 factory-software: 7.12
9
- \x20 free-memory: 432.4MiB
10
- \x20 total-memory: 512.0MiB
11
- \x20 cpu: ARM
12
- \x20 cpu-count: 2
13
- \x20 cpu-frequency: 800MHz
14
- \x20 cpu-load: 0%
15
- \x20 free-hdd-space: 103.8MiB
16
- \x20 total-hdd-space: 128.0MiB
17
- \x20 write-sect-since-reboot: 361943
18
- \x20 write-sect-total: 669893
19
- \x20 bad-blocks: 0%
20
- \x20 architecture-name: arm
21
- \x20 board-name: L009UiGS
22
- \x20 platform: MikroTik
23
-
24
- /system package update print: |-
25
- \x20 channel: stable
26
- \x20 installed-version: 7.15.2
27
- \x20 latest-version: 7.15.3
28
- \x20 status: New version is available
29
-
30
- /system history print without-paging: |-
31
- Flags: U - UNDOABLE
32
- Columns: ACTION, BY, POLICY, TIME
33
- \x20 ACTION BY POLICY TIME \x20
34
- U bridge port changed user write 2024-07-31 09:33:47
35
- U bridge port changed user write 2024-07-31 09:32:52
36
- U bridge port changed user write 2024-07-31 09:32:50
37
- U detect-internet settings changed user write 2024-07-31 09:28:59
38
-
39
- /export show-sensitive: |-
40
- # 2024-10-25 12:09:43 by RouterOS 7.15.2
41
- # software id = A0AA-AAA0
42
- #
43
- # model = L009UiGS
44
- # serial number = AA111AAAAAA
45
- /interface bridge
46
- add admin-mac=00:00:5E:00:53:00 auto-mac=no comment=defconf name=bridge \\
47
- \x20 port-cost-mode=short
48
- /interface vlan
49
- add interface=ether1 name=vlan6 vlan-id=6
50
- /interface pppoe-client
51
- add add-default-route=yes disabled=no interface=vlan6 name=pppoe-out1 \\
52
- \x20 password=password use-peer-dns=yes user=user
53
- /interface list
54
- add comment=defconf name=WAN
55
- add comment=defconf name=LAN
56
- /interface wireless security-profiles
57
- set [ find default=yes ] supplicant-identity=MikroTik
58
- /ip pool
59
- add name=default-dhcp ranges=192.0.2.0-192.0.2.254
60
- /ip dhcp-server
61
- add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
62
- /port
63
- set 0 name=serial0
64
- /snmp community
65
- add addresses=0.0.0.0/0 name=community security=authorized
66
- /interface bridge port
67
- add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \\
68
- \x20 path-cost=10
69
- add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \\
70
- \x20 path-cost=10
71
- add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \\
72
- \x20 path-cost=10
73
- add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \\
74
- \x20 path-cost=10
75
- add bridge=bridge comment=defconf interface=ether6 internal-path-cost=10 \\
76
- \x20 path-cost=10
77
- add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10 \\
78
- \x20 path-cost=10
79
- add bridge=bridge comment=defconf interface=ether8 internal-path-cost=10 \\
80
- \x20 path-cost=10
81
- add bridge=bridge comment=defconf interface=sfp1 internal-path-cost=10 \\
82
- \x20 path-cost=10
83
- /ip firewall connection tracking
84
- set udp-timeout=10s
85
- /ip neighbor discovery-settings
86
- set discover-interface-list=LAN
87
- /ip settings
88
- set max-neighbor-entries=14336
89
- /ipv6 settings
90
- set max-neighbor-entries=7168
91
- /interface list member
92
- add comment=defconf interface=bridge list=LAN
93
- add comment=defconf interface=ether1 list=WAN
94
- add interface=pppoe-out1 list=WAN
95
- /ip address
96
- add address=192.0.2.1/24 comment=defconf interface=bridge network=\\
97
- \x20 192.0.2.0
98
- /ip dhcp-client
99
- add comment=defconf interface=ether1
100
- /ip dhcp-server network
101
- add address=192.0.2.0/24 comment=defconf dns-server=192.0.2.1 gateway=\\
102
- \x20 192.0.2.1
103
- /ip dns
104
- set allow-remote-requests=yes
105
- /ip dns static
106
- add address=192.0.2.1 comment=defconf name=router.lan
107
- /ip firewall address-list
108
- add address=198.51.100.1 list=\"office\"
109
- add address=198.51.100.2 list=\"nms\"
110
- /ip firewall filter
111
- add action=accept chain=input comment=\\
112
- \x20 \"defconf: accept established,related,untracked\" connection-state=\\
113
- \x20 established,related,untracked
114
- add action=drop chain=input comment=\"defconf: drop invalid\" connection-state=\\
115
- \x20 invalid
116
- add action=accept chain=input comment=\"defconf: accept ICMP\" protocol=icmp
117
- add action=accept chain=input comment=\"Remote MGTM\" in-interface-list=WAN \\
118
- \x20 src-address-list=\"office\"
119
- add action=accept chain=input in-interface-list=WAN src-address-list=\\
120
- \x20 \"nms\"
121
- add action=accept chain=input comment=\\
122
- \x20 \"defconf: accept to local loopback (for CAPsMAN)\" dst-address=127.0.0.1
123
- add action=drop chain=input comment=\"defconf: drop all not coming from LAN\" \\
124
- \x20 in-interface-list=!LAN
125
- add action=accept chain=forward comment=\"defconf: accept in ipsec policy\" \\
126
- \x20 ipsec-policy=in,ipsec
127
- add action=accept chain=forward comment=\"defconf: accept out ipsec policy\" \\
128
- \x20 ipsec-policy=out,ipsec
129
- add action=fasttrack-connection chain=forward comment=\"defconf: fasttrack\" \\
130
- \x20 connection-state=established,related hw-offload=yes
131
- add action=accept chain=forward comment=\\
132
- \x20 \"defconf: accept established,related, untracked\" connection-state=\\
133
- \x20 established,related,untracked
134
- add action=drop chain=forward comment=\"defconf: drop invalid\" \\
135
- \x20 connection-state=invalid
136
- add action=drop chain=forward comment=\\
137
- \x20 \"defconf: drop all from WAN not DSTNATed\" connection-nat-state=!dstnat \\
138
- \x20 connection-state=new in-interface-list=WAN
139
- /ip firewall nat
140
- add action=masquerade chain=srcnat comment=\"defconf: masquerade\" \\
141
- \x20 ipsec-policy=out,none out-interface-list=WAN
142
- /ipv6 firewall address-list
143
- add address=::/128 comment=\"defconf: unspecified address\" list=bad_ipv6
144
- add address=::1/128 comment=\"defconf: lo\" list=bad_ipv6
145
- add address=fec0::/10 comment=\"defconf: site-local\" list=bad_ipv6
146
- add address=::ffff:0.0.0.0/96 comment=\"defconf: ipv4-mapped\" list=bad_ipv6
147
- add address=::/96 comment=\"defconf: ipv4 compat\" list=bad_ipv6
148
- add address=100::/64 comment=\"defconf: discard only \" list=bad_ipv6
149
- add address=2001:db8::/32 comment=\"defconf: documentation\" list=bad_ipv6
150
- add address=2001:10::/28 comment=\"defconf: ORCHID\" list=bad_ipv6
151
- add address=3ffe::/16 comment=\"defconf: 6bone\" list=bad_ipv6
152
- /ipv6 firewall filter
153
- add action=accept chain=input comment=\\
154
- \x20 \"defconf: accept established,related,untracked\" connection-state=\\
155
- \x20 established,related,untracked
156
- add action=drop chain=input comment=\"defconf: drop invalid\" connection-state=\\
157
- \x20 invalid
158
- add action=accept chain=input comment=\"defconf: accept ICMPv6\" protocol=\\
159
- \x20 icmpv6
160
- add action=accept chain=input comment=\"defconf: accept UDP traceroute\" port=\\
161
- \x20 33434-33534 protocol=udp
162
- add action=accept chain=input comment=\\
163
- \x20 \"defconf: accept DHCPv6-Client prefix delegation.\" dst-port=546 protocol=\\
164
- \x20 udp src-address=fe80::/10
165
- add action=accept chain=input comment=\"defconf: accept IKE\" dst-port=500,4500 \\
166
- \x20 protocol=udp
167
- add action=accept chain=input comment=\"defconf: accept ipsec AH\" protocol=\\
168
- \x20 ipsec-ah
169
- add action=accept chain=input comment=\"defconf: accept ipsec ESP\" protocol=\\
170
- \x20 ipsec-esp
171
- add action=accept chain=input comment=\\
172
- \x20 \"defconf: accept all that matches ipsec policy\" ipsec-policy=in,ipsec
173
- add action=drop chain=input comment=\\
174
- \x20 \"defconf: drop everything else not coming from LAN\" in-interface-list=\\
175
- \x20 !LAN
176
- add action=accept chain=forward comment=\\
177
- \x20 \"defconf: accept established,related,untracked\" connection-state=\\
178
- \x20 established,related,untracked
179
- add action=drop chain=forward comment=\"defconf: drop invalid\" \\
180
- \x20 connection-state=invalid
181
- add action=drop chain=forward comment=\\
182
- \x20 \"defconf: drop packets with bad src ipv6\" src-address-list=bad_ipv6
183
- add action=drop chain=forward comment=\\
184
- \x20 \"defconf: drop packets with bad dst ipv6\" dst-address-list=bad_ipv6
185
- add action=drop chain=forward comment=\"defconf: rfc4890 drop hop-limit=1\" \\
186
- \x20 hop-limit=equal:1 protocol=icmpv6
187
- add action=accept chain=forward comment=\"defconf: accept ICMPv6\" protocol=\\
188
- \x20 icmpv6
189
- add action=accept chain=forward comment=\"defconf: accept HIP\" protocol=139
190
- add action=accept chain=forward comment=\"defconf: accept IKE\" dst-port=\\
191
- \x20 500,4500 protocol=udp
192
- add action=accept chain=forward comment=\"defconf: accept ipsec AH\" protocol=\\
193
- \x20 ipsec-ah
194
- add action=accept chain=forward comment=\"defconf: accept ipsec ESP\" protocol=\\
195
- \x20 ipsec-esp
196
- add action=accept chain=forward comment=\\
197
- \x20 \"defconf: accept all that matches ipsec policy\" ipsec-policy=in,ipsec
198
- add action=drop chain=forward comment=\\
199
- \x20 \"defconf: drop everything else not coming from LAN\" in-interface-list=\\
200
- \x20 !LAN
201
- /snmp
202
- set contact=user enabled=yes location=\"Riga, LATIVA\" \\
203
- \x20 trap-community=community
204
- /system clock
205
- set time-zone-name=Europe/Riga
206
- /system identity
207
- set name=router
208
- /system note
209
- set show-at-login=no
210
- /system routerboard settings
211
- set enter-setup-on=delete-key
212
- /tool mac-server
213
- set allowed-interface-list=LAN
214
- /tool mac-server mac-winbox
215
- set allowed-interface-list=LAN
216
- quit: |-
217
- interrupted
218
- oxidized_output: |
219
- # version: 7.15.2 (stable)
220
- # factory-software: 7.12
221
- # total-memory: 512.0MiB
222
- # cpu: ARM
223
- # cpu-count: 2
224
- # total-hdd-space: 128.0MiB
225
- # architecture-name: arm
226
- # board-name: L009UiGS
227
- # platform: MikroTik# installed-version: 7.15.2
228
- # Flags: U - UNDOABLE
229
- # Columns: ACTION, BY, POLICY, TIME
230
- # ACTION BY POLICY TIME \x20
231
- # U bridge port changed user write 2024-07-31 09:33:47
232
- # U bridge port changed user write 2024-07-31 09:32:52
233
- # U bridge port changed user write 2024-07-31 09:32:50
234
- # U detect-internet settings changed user write 2024-07-31 09:28:59# software id = A0AA-AAA0
235
- #
236
- # model = L009UiGS
237
- # serial number = AA111AAAAAA
238
- /interface bridge
239
- add admin-mac=00:00:5E:00:53:00 auto-mac=no comment=defconf name=bridge port-cost-mode=short
240
- /interface vlan
241
- add interface=ether1 name=vlan6 vlan-id=6
242
- /interface pppoe-client
243
- add add-default-route=yes disabled=no interface=vlan6 name=pppoe-out1 password=password use-peer-dns=yes user=user
244
- /interface list
245
- add comment=defconf name=WAN
246
- add comment=defconf name=LAN
247
- /interface wireless security-profiles
248
- set [ find default=yes ] supplicant-identity=MikroTik
249
- /ip pool
250
- add name=default-dhcp ranges=192.0.2.0-192.0.2.254
251
- /ip dhcp-server
252
- add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
253
- /port
254
- set 0 name=serial0
255
- /snmp community
256
- add addresses=0.0.0.0/0 name=community security=authorized
257
- /interface bridge port
258
- add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 path-cost=10
259
- add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 path-cost=10
260
- add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 path-cost=10
261
- add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 path-cost=10
262
- add bridge=bridge comment=defconf interface=ether6 internal-path-cost=10 path-cost=10
263
- add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10 path-cost=10
264
- add bridge=bridge comment=defconf interface=ether8 internal-path-cost=10 path-cost=10
265
- add bridge=bridge comment=defconf interface=sfp1 internal-path-cost=10 path-cost=10
266
- /ip firewall connection tracking
267
- set udp-timeout=10s
268
- /ip neighbor discovery-settings
269
- set discover-interface-list=LAN
270
- /ip settings
271
- set max-neighbor-entries=14336
272
- /ipv6 settings
273
- set max-neighbor-entries=7168
274
- /interface list member
275
- add comment=defconf interface=bridge list=LAN
276
- add comment=defconf interface=ether1 list=WAN
277
- add interface=pppoe-out1 list=WAN
278
- /ip address
279
- add address=192.0.2.1/24 comment=defconf interface=bridge network=192.0.2.0
280
- /ip dhcp-client
281
- add comment=defconf interface=ether1
282
- /ip dhcp-server network
283
- add address=192.0.2.0/24 comment=defconf dns-server=192.0.2.1 gateway=192.0.2.1
284
- /ip dns
285
- set allow-remote-requests=yes
286
- /ip dns static
287
- add address=192.0.2.1 comment=defconf name=router.lan
288
- /ip firewall address-list
289
- add address=198.51.100.1 list=\"office\"
290
- add address=198.51.100.2 list=\"nms\"
291
- /ip firewall filter
292
- add action=accept chain=input comment=\"defconf: accept established,related,untracked\" connection-state=established,related,untracked
293
- add action=drop chain=input comment=\"defconf: drop invalid\" connection-state=invalid
294
- add action=accept chain=input comment=\"defconf: accept ICMP\" protocol=icmp
295
- add action=accept chain=input comment=\"Remote MGTM\" in-interface-list=WAN src-address-list=\"office\"
296
- add action=accept chain=input in-interface-list=WAN src-address-list=\"nms\"
297
- add action=accept chain=input comment=\"defconf: accept to local loopback (for CAPsMAN)\" dst-address=127.0.0.1
298
- add action=drop chain=input comment=\"defconf: drop all not coming from LAN\" in-interface-list=!LAN
299
- add action=accept chain=forward comment=\"defconf: accept in ipsec policy\" ipsec-policy=in,ipsec
300
- add action=accept chain=forward comment=\"defconf: accept out ipsec policy\" ipsec-policy=out,ipsec
301
- add action=fasttrack-connection chain=forward comment=\"defconf: fasttrack\" connection-state=established,related hw-offload=yes
302
- add action=accept chain=forward comment=\"defconf: accept established,related, untracked\" connection-state=established,related,untracked
303
- add action=drop chain=forward comment=\"defconf: drop invalid\" connection-state=invalid
304
- add action=drop chain=forward comment=\"defconf: drop all from WAN not DSTNATed\" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
305
- /ip firewall nat
306
- add action=masquerade chain=srcnat comment=\"defconf: masquerade\" ipsec-policy=out,none out-interface-list=WAN
307
- /ipv6 firewall address-list
308
- add address=::/128 comment=\"defconf: unspecified address\" list=bad_ipv6
309
- add address=::1/128 comment=\"defconf: lo\" list=bad_ipv6
310
- add address=fec0::/10 comment=\"defconf: site-local\" list=bad_ipv6
311
- add address=::ffff:0.0.0.0/96 comment=\"defconf: ipv4-mapped\" list=bad_ipv6
312
- add address=::/96 comment=\"defconf: ipv4 compat\" list=bad_ipv6
313
- add address=100::/64 comment=\"defconf: discard only \" list=bad_ipv6
314
- add address=2001:db8::/32 comment=\"defconf: documentation\" list=bad_ipv6
315
- add address=2001:10::/28 comment=\"defconf: ORCHID\" list=bad_ipv6
316
- add address=3ffe::/16 comment=\"defconf: 6bone\" list=bad_ipv6
317
- /ipv6 firewall filter
318
- add action=accept chain=input comment=\"defconf: accept established,related,untracked\" connection-state=established,related,untracked
319
- add action=drop chain=input comment=\"defconf: drop invalid\" connection-state=invalid
320
- add action=accept chain=input comment=\"defconf: accept ICMPv6\" protocol=icmpv6
321
- add action=accept chain=input comment=\"defconf: accept UDP traceroute\" port=33434-33534 protocol=udp
322
- add action=accept chain=input comment=\"defconf: accept DHCPv6-Client prefix delegation.\" dst-port=546 protocol=udp src-address=fe80::/10
323
- add action=accept chain=input comment=\"defconf: accept IKE\" dst-port=500,4500 protocol=udp
324
- add action=accept chain=input comment=\"defconf: accept ipsec AH\" protocol=ipsec-ah
325
- add action=accept chain=input comment=\"defconf: accept ipsec ESP\" protocol=ipsec-esp
326
- add action=accept chain=input comment=\"defconf: accept all that matches ipsec policy\" ipsec-policy=in,ipsec
327
- add action=drop chain=input comment=\"defconf: drop everything else not coming from LAN\" in-interface-list=!LAN
328
- add action=accept chain=forward comment=\"defconf: accept established,related,untracked\" connection-state=established,related,untracked
329
- add action=drop chain=forward comment=\"defconf: drop invalid\" connection-state=invalid
330
- add action=drop chain=forward comment=\"defconf: drop packets with bad src ipv6\" src-address-list=bad_ipv6
331
- add action=drop chain=forward comment=\"defconf: drop packets with bad dst ipv6\" dst-address-list=bad_ipv6
332
- add action=drop chain=forward comment=\"defconf: rfc4890 drop hop-limit=1\" hop-limit=equal:1 protocol=icmpv6
333
- add action=accept chain=forward comment=\"defconf: accept ICMPv6\" protocol=icmpv6
334
- add action=accept chain=forward comment=\"defconf: accept HIP\" protocol=139
335
- add action=accept chain=forward comment=\"defconf: accept IKE\" dst-port=500,4500 protocol=udp
336
- add action=accept chain=forward comment=\"defconf: accept ipsec AH\" protocol=ipsec-ah
337
- add action=accept chain=forward comment=\"defconf: accept ipsec ESP\" protocol=ipsec-esp
338
- add action=accept chain=forward comment=\"defconf: accept all that matches ipsec policy\" ipsec-policy=in,ipsec
339
- add action=drop chain=forward comment=\"defconf: drop everything else not coming from LAN\" in-interface-list=!LAN
340
- /snmp
341
- set contact=user enabled=yes location=\"Riga, LATIVA\" trap-community=community
342
- /system clock
343
- set time-zone-name=Europe/Riga
344
- /system identity
345
- set name=router
346
- /system note
347
- set show-at-login=no
348
- /system routerboard settings
349
- set enter-setup-on=delete-key
350
- /tool mac-server
351
- set allowed-interface-list=LAN
352
- /tool mac-server mac-winbox
353
- set allowed-interface-list=LAN