oxidized 0.31.0 → 0.32.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (65) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ruby.yml +2 -9
  3. data/.rubocop.yml +8 -7
  4. data/.rubocop_todo.yml +6 -6
  5. data/CHANGELOG.md +40 -0
  6. data/Dockerfile +5 -2
  7. data/Rakefile +28 -0
  8. data/docs/Configuration.md +14 -2
  9. data/docs/Creating-Models.md +52 -22
  10. data/docs/DeviceSimulation.md +184 -0
  11. data/docs/Hooks.md +5 -5
  12. data/docs/Issues.md +15 -9
  13. data/docs/Model-Notes/APC_AOS.md +29 -16
  14. data/docs/Model-Notes/FSOS.md +1 -0
  15. data/docs/ModelUnitTests.md +186 -0
  16. data/docs/Release.md +18 -2
  17. data/docs/Supported-OS-Types.md +3 -2
  18. data/examples/podman-compose/Makefile +1 -2
  19. data/{examples/device-simulation → extra}/device2yaml.rb +32 -12
  20. data/extra/gitdiff-msteams.sh +32 -5
  21. data/extra/nagios_check_failing_nodes.rb +1 -1
  22. data/extra/rest_client.rb +1 -1
  23. data/lib/oxidized/config.rb +1 -1
  24. data/lib/oxidized/input/ssh.rb +13 -5
  25. data/lib/oxidized/model/aos7.rb +2 -0
  26. data/lib/oxidized/model/aosw.rb +1 -1
  27. data/lib/oxidized/model/apc_aos.rb +1 -1
  28. data/lib/oxidized/model/arubainstant.rb +1 -1
  29. data/lib/oxidized/model/asa.rb +2 -1
  30. data/lib/oxidized/model/asyncos.rb +1 -1
  31. data/lib/oxidized/model/cumulus.rb +16 -2
  32. data/lib/oxidized/model/enterprise_sonic.rb +46 -0
  33. data/lib/oxidized/model/fsos.rb +5 -1
  34. data/lib/oxidized/model/garderos.rb +4 -4
  35. data/lib/oxidized/model/junos.rb +1 -1
  36. data/lib/oxidized/model/kornfeldos.rb +33 -0
  37. data/lib/oxidized/model/model.rb +2 -2
  38. data/lib/oxidized/model/powerconnect.rb +1 -1
  39. data/lib/oxidized/model/sonicos.rb +8 -2
  40. data/lib/oxidized/model/tplink.rb +1 -0
  41. data/lib/oxidized/model/xos.rb +1 -1
  42. data/lib/oxidized/source/source.rb +32 -2
  43. data/lib/oxidized/version.rb +2 -2
  44. data/oxidized.gemspec +21 -11
  45. metadata +47 -71
  46. data/examples/device-simulation/README.md +0 -173
  47. data/examples/device-simulation/cmdsets/aoscx +0 -9
  48. data/examples/device-simulation/cmdsets/arubainstant +0 -5
  49. data/examples/device-simulation/cmdsets/asa +0 -7
  50. data/examples/device-simulation/cmdsets/ios +0 -7
  51. data/examples/device-simulation/cmdsets/nxos +0 -5
  52. data/examples/device-simulation/cmdsets/routeros +0 -5
  53. data/examples/device-simulation/cmdsets/srosmd +0 -11
  54. data/examples/device-simulation/yaml/aoscx_R0X25A-6410_FL.10.10.1100.yaml +0 -2281
  55. data/examples/device-simulation/yaml/aoscx_R8N85A-C6000-48G-CL4_PL.10.08.1010.yaml +0 -451
  56. data/examples/device-simulation/yaml/arubainstant_IAP515_8.10.0.6_VWLC.yaml +0 -213
  57. data/examples/device-simulation/yaml/asa_5512_9.12-4-67_single-context.yaml +0 -531
  58. data/examples/device-simulation/yaml/asr920_16.8.1b.yaml +0 -1122
  59. data/examples/device-simulation/yaml/garderos_R7709_003_006_068.yaml +0 -101
  60. data/examples/device-simulation/yaml/iosxe_C9200L-24P-4G_17.09.04a.yaml +0 -514
  61. data/examples/device-simulation/yaml/iosxe_C9800-L-F-K9_17.06.05.yaml +0 -417
  62. data/examples/device-simulation/yaml/riverbed_915.yaml +0 -123
  63. data/examples/device-simulation/yaml/routeros_CHR_7.10.1.yaml +0 -145
  64. data/examples/device-simulation/yaml/routeros_CHR_7.16.yaml +0 -79
  65. data/examples/device-simulation/yaml/routeros_L009UiGS_7.15.2.yaml +0 -353
data/examples/device-simulation/yaml/routeros_CHR_7.16.yaml DELETED
@@ -1,79 +0,0 @@
1
- ---
2
- init_prompt:
3
- commands:
4
- /system resource print: |-
5
- \x20 uptime: 32m36s
6
- version: 7.16 (stable)
7
- build-time: 2024-09-20 13:00:27
8
- factory-software: 7.1
9
- free-memory: 165.6MiB
10
- total-memory: 384.0MiB
11
- cpu: QEMU
12
- cpu-count: 1
13
- cpu-frequency: 2999MHz
14
- cpu-load: 2%
15
- free-hdd-space: 71.2MiB
16
- total-hdd-space: 89.2MiB
17
- write-sect-since-reboot: 584
18
- write-sect-total: 584
19
- architecture-name: x86_64
20
- board-name: CHR QEMU Standard PC (i440FX + PIIX, 1996)
21
- platform: MikroTik
22
-
23
- /system package update print: |-
24
- \x20 channel: stable
25
- installed-version: 7.16
26
-
27
- /system history print without-paging: |-
28
-
29
- /export show-sensitive: |-
30
- # 2024-11-16 06:25:32 by RouterOS 7.16
31
- # software id =\x20
32
- #
33
- /interface ethernet
34
- set [ find default-name=ether1 ] disable-running-check=no
35
- set [ find default-name=ether2 ] disable-running-check=no
36
- set [ find default-name=ether3 ] disable-running-check=no
37
- set [ find default-name=ether4 ] disable-running-check=no
38
- set [ find default-name=ether5 ] disable-running-check=no
39
- set [ find default-name=ether6 ] disable-running-check=no
40
- set [ find default-name=ether7 ] disable-running-check=no
41
- set [ find default-name=ether8 ] disable-running-check=no
42
- /port
43
- set 0 name=serial0
44
- /ip address
45
- add address=10.0.2.100/24 interface=ether1 network=10.0.2.0
46
- /ip dhcp-client
47
- add interface=ether1
48
- /system note
49
- set show-at-login=no
50
- quit: |-
51
- interrupted
52
- oxidized_output: |
53
- # version: 7.16 (stable)
54
- # factory-software: 7.1
55
- # total-memory: 384.0MiB
56
- # cpu: QEMU
57
- # cpu-count: 1
58
- # total-hdd-space: 89.2MiB
59
- # architecture-name: x86_64
60
- # board-name: CHR QEMU Standard PC (i440FX + PIIX, 1996)
61
- # platform: MikroTik# installed-version: 7.16# software id =\x20
62
- #
63
- /interface ethernet
64
- set [ find default-name=ether1 ] disable-running-check=no
65
- set [ find default-name=ether2 ] disable-running-check=no
66
- set [ find default-name=ether3 ] disable-running-check=no
67
- set [ find default-name=ether4 ] disable-running-check=no
68
- set [ find default-name=ether5 ] disable-running-check=no
69
- set [ find default-name=ether6 ] disable-running-check=no
70
- set [ find default-name=ether7 ] disable-running-check=no
71
- set [ find default-name=ether8 ] disable-running-check=no
72
- /port
73
- set 0 name=serial0
74
- /ip address
75
- add address=10.0.2.100/24 interface=ether1 network=10.0.2.0
76
- /ip dhcp-client
77
- add interface=ether1
78
- /system note
79
- set show-at-login=no
data/examples/device-simulation/yaml/routeros_L009UiGS_7.15.2.yaml DELETED
@@ -1,353 +0,0 @@
1
- ---
2
- init_prompt:
3
- commands:
4
- /system resource print: |-
5
- \x20 uptime: 14w1d19h55m4s
6
- \x20 version: 7.15.2 (stable)
7
- \x20 build-time: 2024-06-26 11:42:37
8
- \x20 factory-software: 7.12
9
- \x20 free-memory: 432.4MiB
10
- \x20 total-memory: 512.0MiB
11
- \x20 cpu: ARM
12
- \x20 cpu-count: 2
13
- \x20 cpu-frequency: 800MHz
14
- \x20 cpu-load: 0%
15
- \x20 free-hdd-space: 103.8MiB
16
- \x20 total-hdd-space: 128.0MiB
17
- \x20 write-sect-since-reboot: 361943
18
- \x20 write-sect-total: 669893
19
- \x20 bad-blocks: 0%
20
- \x20 architecture-name: arm
21
- \x20 board-name: L009UiGS
22
- \x20 platform: MikroTik
23
-
24
- /system package update print: |-
25
- \x20 channel: stable
26
- \x20 installed-version: 7.15.2
27
- \x20 latest-version: 7.15.3
28
- \x20 status: New version is available
29
-
30
- /system history print without-paging: |-
31
- Flags: U - UNDOABLE
32
- Columns: ACTION, BY, POLICY, TIME
33
- \x20 ACTION BY POLICY TIME \x20
34
- U bridge port changed user write 2024-07-31 09:33:47
35
- U bridge port changed user write 2024-07-31 09:32:52
36
- U bridge port changed user write 2024-07-31 09:32:50
37
- U detect-internet settings changed user write 2024-07-31 09:28:59
38
-
39
- /export show-sensitive: |-
40
- # 2024-10-25 12:09:43 by RouterOS 7.15.2
41
- # software id = A0AA-AAA0
42
- #
43
- # model = L009UiGS
44
- # serial number = AA111AAAAAA
45
- /interface bridge
46
- add admin-mac=00:00:5E:00:53:00 auto-mac=no comment=defconf name=bridge \\
47
- \x20 port-cost-mode=short
48
- /interface vlan
49
- add interface=ether1 name=vlan6 vlan-id=6
50
- /interface pppoe-client
51
- add add-default-route=yes disabled=no interface=vlan6 name=pppoe-out1 \\
52
- \x20 password=password use-peer-dns=yes user=user
53
- /interface list
54
- add comment=defconf name=WAN
55
- add comment=defconf name=LAN
56
- /interface wireless security-profiles
57
- set [ find default=yes ] supplicant-identity=MikroTik
58
- /ip pool
59
- add name=default-dhcp ranges=192.0.2.0-192.0.2.254
60
- /ip dhcp-server
61
- add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
62
- /port
63
- set 0 name=serial0
64
- /snmp community
65
- add addresses=0.0.0.0/0 name=community security=authorized
66
- /interface bridge port
67
- add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \\
68
- \x20 path-cost=10
69
- add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \\
70
- \x20 path-cost=10
71
- add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \\
72
- \x20 path-cost=10
73
- add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \\
74
- \x20 path-cost=10
75
- add bridge=bridge comment=defconf interface=ether6 internal-path-cost=10 \\
76
- \x20 path-cost=10
77
- add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10 \\
78
- \x20 path-cost=10
79
- add bridge=bridge comment=defconf interface=ether8 internal-path-cost=10 \\
80
- \x20 path-cost=10
81
- add bridge=bridge comment=defconf interface=sfp1 internal-path-cost=10 \\
82
- \x20 path-cost=10
83
- /ip firewall connection tracking
84
- set udp-timeout=10s
85
- /ip neighbor discovery-settings
86
- set discover-interface-list=LAN
87
- /ip settings
88
- set max-neighbor-entries=14336
89
- /ipv6 settings
90
- set max-neighbor-entries=7168
91
- /interface list member
92
- add comment=defconf interface=bridge list=LAN
93
- add comment=defconf interface=ether1 list=WAN
94
- add interface=pppoe-out1 list=WAN
95
- /ip address
96
- add address=192.0.2.1/24 comment=defconf interface=bridge network=\\
97
- \x20 192.0.2.0
98
- /ip dhcp-client
99
- add comment=defconf interface=ether1
100
- /ip dhcp-server network
101
- add address=192.0.2.0/24 comment=defconf dns-server=192.0.2.1 gateway=\\
102
- \x20 192.0.2.1
103
- /ip dns
104
- set allow-remote-requests=yes
105
- /ip dns static
106
- add address=192.0.2.1 comment=defconf name=router.lan
107
- /ip firewall address-list
108
- add address=198.51.100.1 list=\"office\"
109
- add address=198.51.100.2 list=\"nms\"
110
- /ip firewall filter
111
- add action=accept chain=input comment=\\
112
- \x20 \"defconf: accept established,related,untracked\" connection-state=\\
113
- \x20 established,related,untracked
114
- add action=drop chain=input comment=\"defconf: drop invalid\" connection-state=\\
115
- \x20 invalid
116
- add action=accept chain=input comment=\"defconf: accept ICMP\" protocol=icmp
117
- add action=accept chain=input comment=\"Remote MGTM\" in-interface-list=WAN \\
118
- \x20 src-address-list=\"office\"
119
- add action=accept chain=input in-interface-list=WAN src-address-list=\\
120
- \x20 \"nms\"
121
- add action=accept chain=input comment=\\
122
- \x20 \"defconf: accept to local loopback (for CAPsMAN)\" dst-address=127.0.0.1
123
- add action=drop chain=input comment=\"defconf: drop all not coming from LAN\" \\
124
- \x20 in-interface-list=!LAN
125
- add action=accept chain=forward comment=\"defconf: accept in ipsec policy\" \\
126
- \x20 ipsec-policy=in,ipsec
127
- add action=accept chain=forward comment=\"defconf: accept out ipsec policy\" \\
128
- \x20 ipsec-policy=out,ipsec
129
- add action=fasttrack-connection chain=forward comment=\"defconf: fasttrack\" \\
130
- \x20 connection-state=established,related hw-offload=yes
131
- add action=accept chain=forward comment=\\
132
- \x20 \"defconf: accept established,related, untracked\" connection-state=\\
133
- \x20 established,related,untracked
134
- add action=drop chain=forward comment=\"defconf: drop invalid\" \\
135
- \x20 connection-state=invalid
136
- add action=drop chain=forward comment=\\
137
- \x20 \"defconf: drop all from WAN not DSTNATed\" connection-nat-state=!dstnat \\
138
- \x20 connection-state=new in-interface-list=WAN
139
- /ip firewall nat
140
- add action=masquerade chain=srcnat comment=\"defconf: masquerade\" \\
141
- \x20 ipsec-policy=out,none out-interface-list=WAN
142
- /ipv6 firewall address-list
143
- add address=::/128 comment=\"defconf: unspecified address\" list=bad_ipv6
144
- add address=::1/128 comment=\"defconf: lo\" list=bad_ipv6
145
- add address=fec0::/10 comment=\"defconf: site-local\" list=bad_ipv6
146
- add address=::ffff:0.0.0.0/96 comment=\"defconf: ipv4-mapped\" list=bad_ipv6
147
- add address=::/96 comment=\"defconf: ipv4 compat\" list=bad_ipv6
148
- add address=100::/64 comment=\"defconf: discard only \" list=bad_ipv6
149
- add address=2001:db8::/32 comment=\"defconf: documentation\" list=bad_ipv6
150
- add address=2001:10::/28 comment=\"defconf: ORCHID\" list=bad_ipv6
151
- add address=3ffe::/16 comment=\"defconf: 6bone\" list=bad_ipv6
152
- /ipv6 firewall filter
153
- add action=accept chain=input comment=\\
154
- \x20 \"defconf: accept established,related,untracked\" connection-state=\\
155
- \x20 established,related,untracked
156
- add action=drop chain=input comment=\"defconf: drop invalid\" connection-state=\\
157
- \x20 invalid
158
- add action=accept chain=input comment=\"defconf: accept ICMPv6\" protocol=\\
159
- \x20 icmpv6
160
- add action=accept chain=input comment=\"defconf: accept UDP traceroute\" port=\\
161
- \x20 33434-33534 protocol=udp
162
- add action=accept chain=input comment=\\
163
- \x20 \"defconf: accept DHCPv6-Client prefix delegation.\" dst-port=546 protocol=\\
164
- \x20 udp src-address=fe80::/10
165
- add action=accept chain=input comment=\"defconf: accept IKE\" dst-port=500,4500 \\
166
- \x20 protocol=udp
167
- add action=accept chain=input comment=\"defconf: accept ipsec AH\" protocol=\\
168
- \x20 ipsec-ah
169
- add action=accept chain=input comment=\"defconf: accept ipsec ESP\" protocol=\\
170
- \x20 ipsec-esp
171
- add action=accept chain=input comment=\\
172
- \x20 \"defconf: accept all that matches ipsec policy\" ipsec-policy=in,ipsec
173
- add action=drop chain=input comment=\\
174
- \x20 \"defconf: drop everything else not coming from LAN\" in-interface-list=\\
175
- \x20 !LAN
176
- add action=accept chain=forward comment=\\
177
- \x20 \"defconf: accept established,related,untracked\" connection-state=\\
178
- \x20 established,related,untracked
179
- add action=drop chain=forward comment=\"defconf: drop invalid\" \\
180
- \x20 connection-state=invalid
181
- add action=drop chain=forward comment=\\
182
- \x20 \"defconf: drop packets with bad src ipv6\" src-address-list=bad_ipv6
183
- add action=drop chain=forward comment=\\
184
- \x20 \"defconf: drop packets with bad dst ipv6\" dst-address-list=bad_ipv6
185
- add action=drop chain=forward comment=\"defconf: rfc4890 drop hop-limit=1\" \\
186
- \x20 hop-limit=equal:1 protocol=icmpv6
187
- add action=accept chain=forward comment=\"defconf: accept ICMPv6\" protocol=\\
188
- \x20 icmpv6
189
- add action=accept chain=forward comment=\"defconf: accept HIP\" protocol=139
190
- add action=accept chain=forward comment=\"defconf: accept IKE\" dst-port=\\
191
- \x20 500,4500 protocol=udp
192
- add action=accept chain=forward comment=\"defconf: accept ipsec AH\" protocol=\\
193
- \x20 ipsec-ah
194
- add action=accept chain=forward comment=\"defconf: accept ipsec ESP\" protocol=\\
195
- \x20 ipsec-esp
196
- add action=accept chain=forward comment=\\
197
- \x20 \"defconf: accept all that matches ipsec policy\" ipsec-policy=in,ipsec
198
- add action=drop chain=forward comment=\\
199
- \x20 \"defconf: drop everything else not coming from LAN\" in-interface-list=\\
200
- \x20 !LAN
201
- /snmp
202
- set contact=user enabled=yes location=\"Riga, LATIVA\" \\
203
- \x20 trap-community=community
204
- /system clock
205
- set time-zone-name=Europe/Riga
206
- /system identity
207
- set name=router
208
- /system note
209
- set show-at-login=no
210
- /system routerboard settings
211
- set enter-setup-on=delete-key
212
- /tool mac-server
213
- set allowed-interface-list=LAN
214
- /tool mac-server mac-winbox
215
- set allowed-interface-list=LAN
216
- quit: |-
217
- interrupted
218
- oxidized_output: |
219
- # version: 7.15.2 (stable)
220
- # factory-software: 7.12
221
- # total-memory: 512.0MiB
222
- # cpu: ARM
223
- # cpu-count: 2
224
- # total-hdd-space: 128.0MiB
225
- # architecture-name: arm
226
- # board-name: L009UiGS
227
- # platform: MikroTik# installed-version: 7.15.2
228
- # Flags: U - UNDOABLE
229
- # Columns: ACTION, BY, POLICY, TIME
230
- # ACTION BY POLICY TIME \x20
231
- # U bridge port changed user write 2024-07-31 09:33:47
232
- # U bridge port changed user write 2024-07-31 09:32:52
233
- # U bridge port changed user write 2024-07-31 09:32:50
234
- # U detect-internet settings changed user write 2024-07-31 09:28:59# software id = A0AA-AAA0
235
- #
236
- # model = L009UiGS
237
- # serial number = AA111AAAAAA
238
- /interface bridge
239
- add admin-mac=00:00:5E:00:53:00 auto-mac=no comment=defconf name=bridge port-cost-mode=short
240
- /interface vlan
241
- add interface=ether1 name=vlan6 vlan-id=6
242
- /interface pppoe-client
243
- add add-default-route=yes disabled=no interface=vlan6 name=pppoe-out1 password=password use-peer-dns=yes user=user
244
- /interface list
245
- add comment=defconf name=WAN
246
- add comment=defconf name=LAN
247
- /interface wireless security-profiles
248
- set [ find default=yes ] supplicant-identity=MikroTik
249
- /ip pool
250
- add name=default-dhcp ranges=192.0.2.0-192.0.2.254
251
- /ip dhcp-server
252
- add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
253
- /port
254
- set 0 name=serial0
255
- /snmp community
256
- add addresses=0.0.0.0/0 name=community security=authorized
257
- /interface bridge port
258
- add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 path-cost=10
259
- add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 path-cost=10
260
- add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 path-cost=10
261
- add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 path-cost=10
262
- add bridge=bridge comment=defconf interface=ether6 internal-path-cost=10 path-cost=10
263
- add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10 path-cost=10
264
- add bridge=bridge comment=defconf interface=ether8 internal-path-cost=10 path-cost=10
265
- add bridge=bridge comment=defconf interface=sfp1 internal-path-cost=10 path-cost=10
266
- /ip firewall connection tracking
267
- set udp-timeout=10s
268
- /ip neighbor discovery-settings
269
- set discover-interface-list=LAN
270
- /ip settings
271
- set max-neighbor-entries=14336
272
- /ipv6 settings
273
- set max-neighbor-entries=7168
274
- /interface list member
275
- add comment=defconf interface=bridge list=LAN
276
- add comment=defconf interface=ether1 list=WAN
277
- add interface=pppoe-out1 list=WAN
278
- /ip address
279
- add address=192.0.2.1/24 comment=defconf interface=bridge network=192.0.2.0
280
- /ip dhcp-client
281
- add comment=defconf interface=ether1
282
- /ip dhcp-server network
283
- add address=192.0.2.0/24 comment=defconf dns-server=192.0.2.1 gateway=192.0.2.1
284
- /ip dns
285
- set allow-remote-requests=yes
286
- /ip dns static
287
- add address=192.0.2.1 comment=defconf name=router.lan
288
- /ip firewall address-list
289
- add address=198.51.100.1 list=\"office\"
290
- add address=198.51.100.2 list=\"nms\"
291
- /ip firewall filter
292
- add action=accept chain=input comment=\"defconf: accept established,related,untracked\" connection-state=established,related,untracked
293
- add action=drop chain=input comment=\"defconf: drop invalid\" connection-state=invalid
294
- add action=accept chain=input comment=\"defconf: accept ICMP\" protocol=icmp
295
- add action=accept chain=input comment=\"Remote MGTM\" in-interface-list=WAN src-address-list=\"office\"
296
- add action=accept chain=input in-interface-list=WAN src-address-list=\"nms\"
297
- add action=accept chain=input comment=\"defconf: accept to local loopback (for CAPsMAN)\" dst-address=127.0.0.1
298
- add action=drop chain=input comment=\"defconf: drop all not coming from LAN\" in-interface-list=!LAN
299
- add action=accept chain=forward comment=\"defconf: accept in ipsec policy\" ipsec-policy=in,ipsec
300
- add action=accept chain=forward comment=\"defconf: accept out ipsec policy\" ipsec-policy=out,ipsec
301
- add action=fasttrack-connection chain=forward comment=\"defconf: fasttrack\" connection-state=established,related hw-offload=yes
302
- add action=accept chain=forward comment=\"defconf: accept established,related, untracked\" connection-state=established,related,untracked
303
- add action=drop chain=forward comment=\"defconf: drop invalid\" connection-state=invalid
304
- add action=drop chain=forward comment=\"defconf: drop all from WAN not DSTNATed\" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
305
- /ip firewall nat
306
- add action=masquerade chain=srcnat comment=\"defconf: masquerade\" ipsec-policy=out,none out-interface-list=WAN
307
- /ipv6 firewall address-list
308
- add address=::/128 comment=\"defconf: unspecified address\" list=bad_ipv6
309
- add address=::1/128 comment=\"defconf: lo\" list=bad_ipv6
310
- add address=fec0::/10 comment=\"defconf: site-local\" list=bad_ipv6
311
- add address=::ffff:0.0.0.0/96 comment=\"defconf: ipv4-mapped\" list=bad_ipv6
312
- add address=::/96 comment=\"defconf: ipv4 compat\" list=bad_ipv6
313
- add address=100::/64 comment=\"defconf: discard only \" list=bad_ipv6
314
- add address=2001:db8::/32 comment=\"defconf: documentation\" list=bad_ipv6
315
- add address=2001:10::/28 comment=\"defconf: ORCHID\" list=bad_ipv6
316
- add address=3ffe::/16 comment=\"defconf: 6bone\" list=bad_ipv6
317
- /ipv6 firewall filter
318
- add action=accept chain=input comment=\"defconf: accept established,related,untracked\" connection-state=established,related,untracked
319
- add action=drop chain=input comment=\"defconf: drop invalid\" connection-state=invalid
320
- add action=accept chain=input comment=\"defconf: accept ICMPv6\" protocol=icmpv6
321
- add action=accept chain=input comment=\"defconf: accept UDP traceroute\" port=33434-33534 protocol=udp
322
- add action=accept chain=input comment=\"defconf: accept DHCPv6-Client prefix delegation.\" dst-port=546 protocol=udp src-address=fe80::/10
323
- add action=accept chain=input comment=\"defconf: accept IKE\" dst-port=500,4500 protocol=udp
324
- add action=accept chain=input comment=\"defconf: accept ipsec AH\" protocol=ipsec-ah
325
- add action=accept chain=input comment=\"defconf: accept ipsec ESP\" protocol=ipsec-esp
326
- add action=accept chain=input comment=\"defconf: accept all that matches ipsec policy\" ipsec-policy=in,ipsec
327
- add action=drop chain=input comment=\"defconf: drop everything else not coming from LAN\" in-interface-list=!LAN
328
- add action=accept chain=forward comment=\"defconf: accept established,related,untracked\" connection-state=established,related,untracked
329
- add action=drop chain=forward comment=\"defconf: drop invalid\" connection-state=invalid
330
- add action=drop chain=forward comment=\"defconf: drop packets with bad src ipv6\" src-address-list=bad_ipv6
331
- add action=drop chain=forward comment=\"defconf: drop packets with bad dst ipv6\" dst-address-list=bad_ipv6
332
- add action=drop chain=forward comment=\"defconf: rfc4890 drop hop-limit=1\" hop-limit=equal:1 protocol=icmpv6
333
- add action=accept chain=forward comment=\"defconf: accept ICMPv6\" protocol=icmpv6
334
- add action=accept chain=forward comment=\"defconf: accept HIP\" protocol=139
335
- add action=accept chain=forward comment=\"defconf: accept IKE\" dst-port=500,4500 protocol=udp
336
- add action=accept chain=forward comment=\"defconf: accept ipsec AH\" protocol=ipsec-ah
337
- add action=accept chain=forward comment=\"defconf: accept ipsec ESP\" protocol=ipsec-esp
338
- add action=accept chain=forward comment=\"defconf: accept all that matches ipsec policy\" ipsec-policy=in,ipsec
339
- add action=drop chain=forward comment=\"defconf: drop everything else not coming from LAN\" in-interface-list=!LAN
340
- /snmp
341
- set contact=user enabled=yes location=\"Riga, LATIVA\" trap-community=community
342
- /system clock
343
- set time-zone-name=Europe/Riga
344
- /system identity
345
- set name=router
346
- /system note
347
- set show-at-login=no
348
- /system routerboard settings
349
- set enter-setup-on=delete-key
350
- /tool mac-server
351
- set allowed-interface-list=LAN
352
- /tool mac-server mac-winbox
353
- set allowed-interface-list=LAN