Mikrotik QoS Config Script

  1. ##################################################################################################
  2. ##################################################################################################
  3. ##                                                                                                
  4. ##     MikroTik EasyConfig Script v 1.2
  5. ##                                                                                                
  6. ##################################################################################################
  7. ##################################################################################################
  8.  
  9. ##################################################################################################
  10. ##################################################################################################
  11. ##
  12. ##     The purpose of this script is make the initial configuration of a MikroTik router more
  13. ##     simple. This script is tailored to the needs of VOIP providers. It includes a queue tree
  14. ##     to prioritize VOIP and a nested script that runs every 5 minutes to identify IP phones
  15. ##     based off their MAC addresses. 
  16. ##
  17. ##     I hope you find this script useful!
  18. ##     - Rick Guyton
  19. ##     me@rguyton.com
  20. ##     
  21. ##     I'm releasing this script under the MIT license. I'd love to do more projects like this
  22. ##     for the community. But, the family has to eat and all. So, if you find this useful, I'd
  23. ##     appreciate it if you would make a donation in what ever amount you feel this script
  24. ##     is worth to you or your company. But, none is required. Oh, and please let me know how
  25. ##     many routers you end up using this on if you can. Mainly for bragging rights. :) Thanks!
  26. ##
  27. ##     BTC: 1DCkRRhSUDWLgWnhYEfUuvqsy9qV8A6gL9
  28. ##     Paypal: me@rguyton.com
  29. ##
  30. ##################################################################################################
  31. ##################################################################################################
  32.  
  33. ##################################################################################################
  34. ##################################################################################################
  35. ##
  36. ##     The MIT License (MIT)
  37. ##     
  38. ##     Copyright (c) 2016 Richard F Guyton III
  39. ##     
  40. ##     Permission is hereby granted, free of charge, to any person obtaining a copy of this
  41. ##     software and associated documentation files (the "Software"), to deal in the Software
  42. ##     and associated documentation files (the "Software"), to deal in the Software without
  43. ##     restriction, including without limitation the rights to use, copy, modify, merge,
  44. ##     publish, distribute, sublicense, and/or sell copies of the Software, and to permit
  45. ##     persons to whom the Software is furnished to do so, subject to the following conditions:
  46. ##     
  47. ##     The above copyright notice and this permission notice shall be included in all copies or
  48. ##     substantial portions of the Software.
  49. ##     
  50. ##     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
  51. ##     INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  52. ##     PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
  53. ##     FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
  54. ##     OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  55. ##     DEALINGS IN THE SOFTWARE.
  56. ##
  57. ##################################################################################################
  58. ##################################################################################################
  59.  
  60. ##################################################################################################
  61. ##################################################################################################
  62. ##                                                                                                
  63. ##     VERY IMPORTANT
  64. ##     
  65. ##     DO NOT USE THE FOLLOWING CHARACTERS WHILE SETTING YOUR
  66. ##     VARIABLES BELOW OR YOUR SCRIPT WILL FAIL:
  67. ##
  68. ##     - Dollar Sign Character
  69. ##     - Double Quote Character
  70. ##     - Backslash Character
  71. ##     - Question Mark Character
  72. ##
  73. ##     If you cannot avoid using one of these symbols, please reference the document below 
  74. ##     so see how they can be used safely.
  75. ##
  76. ##     http://wiki.mikrotik.com/wiki/Manual:Scripting#Constant_Escape_Sequences
  77. ##                                                                                                
  78. ##################################################################################################
  79. ##################################################################################################
  80.  
  81. ##################################################################################################
  82. ##################################################################################################
  83. ##                                                                                                
  84. ##     Don't run this script without changing these variables!
  85. ##                                                                                                
  86. ##################################################################################################
  87. ##################################################################################################
  88.  
  89. ## Router admin password
  90. ## Please put password in quotes below
  91. :global AdminPassword "ChangeMe!ChangeMe!!!!!$[/system routerboard get serial-number ]"
  92.  
  93. ## WiFi WAP/WPA2 PSK (if WiFi interfaces are found)
  94. ## Please put password in quotes below
  95. :global WiFiPSK "ChangeMe!!!ChangeMe!$[/system routerboard get serial-number ]"
  96.  
  97. ## Max Upload (Set this to 85%-95% of your ISP's promised upload speed)
  98. :global MaxUP 1M
  99.  
  100. ## Max Download (Set this to 85%-95% of your ISP's promised download speed)
  101. :global MaxDOWN 10M
  102.  
  103. ##################################################################################################
  104. ##################################################################################################
  105. ##                                                                                                
  106. ##     Commonly Modified Variables
  107. ##                                                                                                
  108. ##################################################################################################
  109. ##################################################################################################
  110.  
  111. ## IP of the router's LAN interface
  112. ## example for a 192.168.1.0/24 network: 192.168.1.1 or 192.168.1.254
  113. :global LANRouterIP 192.168.1.1
  114.  
  115. ## The network IP of your LAN. This will be x.x.x.0 in a /24 (255.255.255.0) network.
  116. ## example for a 192.168.1.0/24 network: 192.168.1.0
  117. :global LANNetwork 192.168.1.0
  118.  
  119. ## Subnet mask bits (no /)
  120. ## example for a 255.255.255.0 aka /24 network: 24
  121. :global LANNetMask 24
  122.  
  123. ## First IP given out by DHCP server
  124. ## example for a 192.168.1.0/24 network: 192.168.1.100
  125. :global DHCPStart 192.168.1.100
  126.  
  127. ## Max IP given out by DHCP server
  128. ## example for a 192.168.1.0/24 network: 192.168.1.200
  129. :global DHCPEnd 192.168.1.200
  130.  
  131. ## DNS servers assigned by DHCP. (use a comma to seperate values)
  132. ## Defaults are google DNS, Open DNS, Verisign DNS
  133. :global DHCPDnsServers 8.8.8.8,208.67.222.222,64.6.64.6
  134.  
  135. ## Wifi 2GHz SSID
  136. :global WiFiSSID2ghz "Mikrotik$[:pick [/system routerboard get serial-number ] {[:len [/system routerboard get serial-number ]] - 4} [:len [/system routerboard get serial-number ]] ]"
  137.  
  138. ## Wifi 5GHz SSID
  139. :global WiFiSSID5ghz "Mikrotik$[:pick [/system routerboard get serial-number ] {[:len [/system routerboard get serial-number ]] - 4} [:len [/system routerboard get serial-number ]] ]_5Ghz"
  140.  
  141. ##################################################################################################
  142. ##################################################################################################
  143. ##                                                                                                
  144. ##     Rarly Modified Variables
  145. ##                                                                                                
  146. ##################################################################################################
  147. ##################################################################################################
  148.  
  149. ## Should the script enable the DHCP server
  150. ## If so, make this variable "true" (without the quotes). Otherwise, please set it to "false" (without the quotes)
  151. :global DHCPEnabled true
  152.  
  153. ## Should the script attempt to detect and configure wireless interfaces on this box
  154. ## If so, make this variable "true" (without the quotes). Otherwise, please set it to "false" (without the quotes)
  155. :global AttemptWifiConfig true
  156.  
  157. ## Should the script set the master port of each interface to LANInf (excluding WANInf)
  158. ## Said another way, would we make the remaining ports act like a switch as many SOHO routers do
  159. ## Again, with the true or false thing
  160. :global MasterPortConfig true
  161.  
  162. ## WAN Interface
  163. :global WANInf ether1
  164.  
  165. ## LAN Interface
  166. :global LANInf ether2
  167.  
  168. ## The band to use for 2ghz Wifi
  169. :global 2ghzband 2ghz-b/g/n
  170.  
  171. ## The band to use for 5ghz Wifi
  172. :global 5ghzband 5ghz-a/n/ac
  173.  
  174. ##################################################################################################
  175. ##################################################################################################
  176. ##################################################################################################
  177. ##################################################################################################
  178. ####                                                                                                
  179. ####     If you make a modification below and it works well for you, please let me know!
  180. ####     Don't make modifications below for production equipt unless you have tested thoroughly!
  181. ####                                                                                                
  182. ##################################################################################################
  183. ##################################################################################################
  184. ##################################################################################################
  185. ##################################################################################################
  186.  
  187. ##     Set $WANInf (set above) to WAN, $LANInf (set above) to LAN and assign all other ports as slaves to $LANInf
  188. /interface ethernet
  189. set [ find default-name=$WANInf ] comment=WAN
  190. set [ find default-name=$LANInf ] comment=LAN
  191.  
  192. ## If $MasterPortConfig is true, take all remaining interfaces on the same switch as $LANInf and make them slaves of $LANInf
  193. :if ($MasterPortConfig) do={
  194.      ## Find the switch for the LANInf
  195.      :global LanInfSwitch [/interface ethernet switch port get [/interface ethernet switch port find name=$LANInf] switch]
  196.  
  197.      ## For all ports on the same switch as LANInf, excluding the LANInf itself, the WANInf and any CPU interfaces
  198.      ## assign them to slaves to the LANInf
  199.      :foreach p in [/interface ethernet switch port find (!(name=$LANInf) && !(name=$WANInf) && !( name~"cpu")) && switch=$LanInfSwitch ] do={
  200.           set [ find default-name=[/interface ethernet switch port get $p name] ] master-port=$LANInf
  201.      }
  202. }
  203.  
  204. :if ($DHCPEnabled) do={
  205.      ##     Setup DHCP Pool
  206.     /ip pool
  207.     add name=LAN_DHCP_POOL ranges="$DHCPStart-$DHCPEnd"
  208.  
  209.     ##     Setup DHCP Server
  210.     /ip dhcp-server
  211.      add address-pool=LAN_DHCP_POOL disabled=no interface=$LANInf name=LAN_DHCP
  212.      /ip dhcp-server network
  213.      add address="$LANNetwork/$LANNetMask" dns-server=$DHCPDnsServers gateway=$LANRouterIP netmask=$LANNetMask
  214. }
  215.  
  216. ##     Setup DHCP client on $WANInf (WAN)
  217. /ip dhcp-client
  218. add add-default-route=yes dhcp-options=hostname,clientid disabled=no interface=$WANInf
  219.  
  220. ##     Setup LAN router ip on $LANInf
  221. ##     We'll use the DHCPInf to bind to the correct interface incase this is a WiFi system
  222. /ip address
  223. add address="$LANRouterIP/$LANNetMask" comment="Internal LAN" interface=$LANInf network=$LANNetwork
  224.  
  225. ##     Setup NAT masquerade for LAN
  226.  
  227. /ip firewall nat add chain=srcnat out-interface=$WANInf action=masquerade comment="Masquerade"
  228.  
  229. ##     Setup default firewall rules
  230.  
  231. /ip firewall {
  232. filter add chain=input action=accept protocol=icmp comment="Accept ICMP"
  233. filter add chain=input action=accept connection-state=established,related comment="Accept Established/Related Input"
  234. filter add chain=input action=drop in-interface=$WANInf comment="Drop WAN Traffic"
  235. filter add chain=forward action=accept connection-state=established,related comment="Accept Established/Related Fwd"
  236. filter add chain=forward action=drop connection-state=invalid comment="Drop Invalid FWD"
  237. filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=$WANInf comment="Drop all FWD from WAN that is not DSTNATed"
  238. }
  239.  
  240. ##     Disable remote access stuff
  241.  
  242. /ip neighbor discovery set [find name="$WANInf"] discover=no
  243. /tool mac-server disable [find];
  244. /tool mac-server mac-winbox disable [find];
  245. :foreach k in=[/interface find where !(slave=yes  || name~"$WANInf")] do={
  246. :local tmpName [/interface get $k name];
  247. /tool mac-server add interface=$tmpName disabled=no;
  248. /tool mac-server mac-winbox add interface=$tmpName disabled=no;
  249. }
  250.  
  251. /ip firewall mangle
  252. add action=mark-packet chain=forward comment="EXEMPT - Internal Net Traffic" dst-address-list="Local LANs" new-packet-mark=EXEMPT src-address-list="Local LANs"
  253. add action=mark-connection chain=forward new-connection-mark=EXEMPT-Internal packet-mark=EXEMPT passthrough=no
  254. add action=mark-packet chain=forward comment="PRIO1_DNL - DNS" in-interface=ether1 new-packet-mark=PRIO1-DNL port=53 protocol=udp
  255. add action=mark-connection chain=forward new-connection-mark=PRIO1-DNS packet-mark=PRIO1-DNL passthrough=no
  256. add action=mark-packet chain=forward comment="PRIO1_UPL - DNS" new-packet-mark=PRIO1_UPL port=53 protocol=udp
  257. add action=mark-connection chain=forward new-connection-mark=PRIO1-DNS packet-mark=PRIO1_UPL passthrough=no
  258. add action=mark-packet chain=forward comment="PRIO1_DNL - ICMP" in-interface=ether1 new-packet-mark=PRIO1-DNL protocol=icmp
  259. add action=mark-connection chain=forward new-connection-mark=PRIO1-ICMP packet-mark=PRIO1-DNL passthrough=no
  260. add action=mark-packet chain=forward comment="PRIO1_UPL - ICMP" new-packet-mark=PRIO1_UPL protocol=icmp
  261. add action=mark-connection chain=forward new-connection-mark=PRIO1-ICMP packet-mark=PRIO1_UPL passthrough=no
  262. add action=mark-packet chain=forward comment="PRIO1_UPL - SYN" in-interface=ether1 new-packet-mark=PRIO1-UPL packet-size=0-123 protocol=tcp tcp-flags=syn passthrough=no
  263. add action=mark-packet chain=forward comment="PRIO1_DNL - SYN" new-packet-mark=PRIO1-DNL packet-size=0-123 protocol=tcp tcp-flags=syn passthrough=no
  264. add action=mark-packet chain=forward comment="PRIO1_UPL - ACK" in-interface=ether1 new-packet-mark=PRIO1-UPL packet-size=0-123 protocol=tcp tcp-flags=ack passthrough=no
  265. add action=mark-packet chain=forward comment="PRIO1_DNL - ACK" new-packet-mark=PRIO1-DNL packet-size=0-123 protocol=tcp tcp-flags=ack passthrough=no
  266. add action=mark-packet chain=forward comment="PRIO1_UPL - RST" in-interface=ether1 new-packet-mark=PRIO1-UPL packet-size=0-123 protocol=tcp tcp-flags=rst passthrough=no
  267. add action=mark-packet chain=forward comment="PRIO1_DNL - RST" new-packet-mark=PRIO1-DNL packet-size=0-123 protocol=tcp tcp-flags=rst passthrough=no
  268. add action=mark-packet chain=forward comment="PRIO1_UPL - FIN" in-interface=ether1 new-packet-mark=PRIO1-UPL packet-size=0-123 protocol=tcp tcp-flags=fin passthrough=no
  269. add action=mark-packet chain=forward comment="PRIO1_DNL - FIN" new-packet-mark=PRIO1-DNL packet-size=0-123 protocol=tcp tcp-flags=fin passthrough=no
  270. add action=mark-packet chain=forward comment="PRIO2_UPL - VOIP_Phones" new-packet-mark=PRIO2_UPL src-address-list=VOIP_Phones
  271. add action=mark-connection chain=forward new-connection-mark=PRIO2-VOIPPHONES packet-mark=PRIO2_UPL passthrough=no
  272. add action=mark-packet chain=forward comment="PRIO2_DNL - VOIP_Phones" dst-address-list=VOIP_Phones new-packet-mark=PRIO2-DNL
  273. add action=mark-connection chain=forward new-connection-mark=PRIO2-VOIPPHONES packet-mark=PRIO2-DNL passthrough=no
  274. add action=mark-packet chain=forward comment="This is unidentified traffic download traffic. Marked as PRIO5-DNL" in-interface=ether1 new-packet-mark=PRIO5-DNL
  275. add action=mark-connection chain=forward new-connection-mark=PRIO5-unidentified packet-mark=PRIO5-DNL passthrough=no
  276. add action=mark-packet chain=forward comment="This is unidentified traffic upload traffic. Marked as PRIO5-UPL" new-packet-mark=PRIO5_UPL out-interface=ether1
  277. add action=mark-connection chain=forward new-connection-mark=PRIO5-unidentified packet-mark=PRIO5_UPL passthrough=no
  278.  
  279.  
  280. ##     Create Queue Trees (setup prio for traffic classes)
  281.  
  282. /queue type
  283. add kind=sfq name=UPL
  284. add kind=sfq name=DNL
  285.  
  286. /queue tree
  287. add max-limit=$MaxDOWN name=DNL_Queue_Max parent=global queue=DNL
  288. add max-limit=$MaxUP name=UPL_Queue_Max parent=global queue=UPL
  289. add name=PRIO1_UPL packet-mark=PRIO1_UPL parent=UPL_Queue_Max priority=1 queue=UPL
  290. add name=PRIO2_UPL packet-mark=PRIO2_UPL parent=UPL_Queue_Max priority=2 queue=UPL
  291. add name=PRIO3_UPL packet-mark=PRIO3_UPL parent=UPL_Queue_Max priority=3 queue=UPL
  292. add name=PRIO4_UPL packet-mark=PRIO4_UPL parent=UPL_Queue_Max priority=4 queue=UPL
  293. add name=PRIO5_UPL packet-mark=PRIO5_UPL parent=UPL_Queue_Max priority=5 queue=UPL
  294. add name=PRIO6_UPL packet-mark=PRIO6_UPL parent=UPL_Queue_Max priority=6 queue=UPL
  295. add name=PRIO7_UPL packet-mark=PRIO7_UPL parent=UPL_Queue_Max priority=7 queue=UPL
  296. add name=PRIO8_UPL packet-mark=PRIO8_UPL parent=UPL_Queue_Max queue=UPL
  297. add name=PRIO1_DNL packet-mark=PRIO1-DNL parent=DNL_Queue_Max priority=1 queue=DNL
  298. add name=PRIO2_DNL packet-mark=PRIO2-DNL parent=DNL_Queue_Max priority=2 queue=DNL
  299. add name=PRIO3_DNL packet-mark=PRIO3-DNL parent=DNL_Queue_Max priority=3 queue=DNL
  300. add name=PRIO4_DNL packet-mark=PRIO4-DNL parent=DNL_Queue_Max priority=4 queue=DNL
  301. add name=PRIO5_DNL packet-mark=PRIO5-DNL parent=DNL_Queue_Max priority=5 queue=DNL
  302. add name=PRIO6_DNL packet-mark=PRIO6-DNL parent=DNL_Queue_Max priority=6 queue=DNL
  303. add name=PRIO7_DNL packet-mark=PRIO7-DNL parent=DNL_Queue_Max priority=7 queue=DNL
  304. add name=PRIO8_DNL packet-mark=PRIO8-DNL parent=DNL_Queue_Max queue=DNL
  305.  
  306. ##     Install, run & schedule helper scripts
  307.  
  308. /system script
  309. add name=VOIP_PHONES policy=read,write source="########################################################################################\
  310.     ##########\r\
  311.     \n##                                                                                                \r\
  312.     \n##     VOIP Phone Identification and Listing Script                                               \r\
  313.     \n##                                                                                                \r\
  314.     \n##################################################################################################\r\
  315.     \n##################################################################################################\r\
  316.     \n##                                                                                                \r\
  317.     \n##     The purpose of this script is to create a list of VOIP phones on the network to use for    \r\
  318.     \n##     prioritization. The script identifies phones based on the first 6 characters (8 including  \r\
  319.     \n##     the colons) of devices in the ARP table. This allows us to identify device regardless the  \r\
  320.     \n##     protocols being used or method of addressing (DHCP or static). It also prevents           \r\
  321.     \n##     re-configuration that may need to be done if the VOIP service IPs change.                  \r\
  322.     \n##                                                                                                \r\
  323.     \n##     However, there are two potential issues with this approach. First, is MAC spoofing. If an  \r\
  324.     \n##     end user were to spoof their MAC with one matching a pattern in this script, they could    \r\
  325.     \n##     get inappropriate prioritization. Secondly, manufactures that produce multiple types of    \r\
  326.     \n##     devices. For example, if you were to prioritize the Cisco/Linksys MACs, you could          \r\
  327.     \n##     inadvertently prioritize any PC with a Linksys NIC as well as Cisco/Linksys phones. It is  \r\
  328.     \n##     possible that these manufacturers use separate ranges for different types of devices, but  \r\
  329.     \n##     we have not been able to confirm this. If you have any information on this, I\92d greatly    \r\
  330.     \n##     appreciate feedback.                                                                       \r\
  331.     \n##                                                                                                \r\
  332.     \n##     I hope you find this script useful!                                                        \r\
  333.     \n##     - Rick Guyton                                                                              \r\
  334.     \n##     me@rguyton.com                                                                             \r\
  335.     \n##                                                                                                \r\
  336.     \n##################################################################################################\r\
  337.     \n\r\
  338.     \n##################################################################################################\r\
  339.     \n##                                                                                                \r\
  340.     \n##     Here we setup a function to ID MAC prefixes we are interested in.                          \r\
  341.     \n##                                                                                                \r\
  342.     \n##################################################################################################\r\
  343.     \n\r\
  344.     \n:global IsMACInteresting do={\r\
  345.     \n###### Add new prefixes here !!!\r\
  346.     \n###### 00:15:65 & 80:5E:C0 are for Yealink\r\
  347.     \n###### 64:16:7F & 00:04:F2 are for Polycom\r\
  348.     \n###### 00:0B:82 is for Grandstream\r\
  349.     \n     :local InterestingPrefixes {\"00:15:65\";\"80:5E:C0\";\"64:16:7F\";\"00:04:F2\"; \"00:0B:82\"}\r\
  350.     \n\r\
  351.     \n###### I don't want to strip out the first 8 characters of the MAC every time.\r\
  352.     \n###### Lets do it once and set a local\r\
  353.     \n     :local MyMACPrefix [:pick \$fullmac 0 8]\r\
  354.     \n     :local MACFlagged false\r\
  355.     \n     :foreach Prefix in=\$InterestingPrefixes do={\r\
  356.     \n          :if (\$MyMACPrefix = \$Prefix) do={ :set \$MACFlagged true }\r\
  357.     \n     }\r\
  358.     \n     :return \$MACFlagged\r\
  359.     \n}\r\
  360.     \n\r\
  361.  
  362.     \n##################################################################################################\r\
  363.     \n##                                                                                                \r\
  364.     \n##     Here we check all of the existing list entries and make sure they are still valid.         \r\
  365.     \n##                                                                                                \r\
  366.     \n##################################################################################################\r\
  367.     \n\r\
  368.     \n:foreach ListItem in=[ /ip firewall address-list find list=VOIP_Phones] do={\r\
  369.     \n###### Gets the IP of this list entry and sets a local var\r\
  370.     \n/ip firewall address-list\r\
  371.     \n:local MyIP [get \$ListItem address]\r\
  372.     \n###### Well, first lets make sure there's still an ARP entry at all for this IP\r\
  373.     \n:if ([:len [/ip arp find address=\$MyIP]] = 0) do={\r\
  374.     \n###### If there's no ARP entry, rip it out of the list\r\
  375.     \n          /ip firewall address-list remove [/ip firewall address-list find list=VOIP_Phones address=\$MyIP]\r\
  376.     \n     } else={\r\
  377.     \n###### Ok, lets make sure that the ARP table still has a MAC we are interested in\r\
  378.     \n     /ip arp\r\
  379.     \n     :if ([\$IsMACInteresting fullmac=[get [/ip arp find address=\$MyIP] mac-address]] = false) do={\r\
  380.     \n###### Delete if the MAC isn't an interesting one anymore...\r\
  381.     \n               /ip firewall address-list remove [/ip firewall address-list find list=VOIP_Phones address=\$MyIP]\r\
  382.     \n          }\r\
  383.     \n     }\r\
  384.     \n}\r\
  385.     \n\r\
  386.     \n##################################################################################################\r\
  387.     \n##                                                                                                \r\
  388.     \n##     Now that we've verified all items already in the list, lets see if there are any more      \r\
  389.     \n##     devices in the ARP table that we should add.                                               \r\
  390.     \n##                                                                                                \r\
  391.     \n##################################################################################################\r\
  392.     \n\r\
  393.     \n/ip arp\r\
  394.     \n:foreach ArpEntry in=[ /ip arp find ] do={\r\
  395.     \n###### Gets the IP address for this ARP entry\r\
  396.     \n     :local MyIP [get \$ArpEntry address]\r\
  397.     \n###### Checks to see if the IP for this ARP entry is already in our list\r\
  398.     \n     :if ([:len [/ip firewall address-list find list=VOIP_Phones address=\$MyIP]] = 0) do={\r\
  399.     \n###### Guess not, lets see if we want to add it. Does the MAC prefix for this entry intrest us\?  \r\
  400.     \n          :if ([\$IsMACInteresting fullmac=[get \$ArpEntry mac-address]]) do={\r\
  401.     \n###### Yep, ok, add it!\r\
  402.     \n               /ip firewall address-list add list=VOIP_Phones address=\$MyIP  \r\
  403.     \n          }\r\
  404.     \n     }\r\
  405.     \n}"
  406.  
  407. /system scheduler
  408. add interval=5m name=VOIP_Phones_Sched on-event="/system script run VOIP_PHONES" policy=read,write start-date=jan/01/2016 start-time=18:31:44
  409.  
  410. /system script run VOIP_PHONES
  411.  
  412. ## Set Admin Password
  413. /user set admin password=$AdminPassword
  414.  
  415. ##################################################################################################
  416. ##################################################################################################
  417. ##
  418. ##     WiFi Config
  419. ##
  420. ##################################################################################################
  421. ##################################################################################################
  422.  
  423.  
  424. :if ($AttemptWifiConfig) do={
  425.      ## Detect WiFi interfaces. If none are found after a minute, log and quit
  426.      :local TimeTracker 0;
  427.      :local abort false;
  428.      :while ([:len [/interface find type="wlan"]] = 0 && ($TimeTracker < 60)) do={
  429.  
  430.           :delay 5s
  431.           :set $TimeTracker ($TimeTracker + 5)
  432.      }
  433.      :if ([:len [/interface find type="wlan"]] = 0) do={
  434. /system script
  435. add name=WiFiConf owner=admin policy=read,write source=":put \"NoWifi\""
  436. } else={
  437. /system script
  438. add name=WiFiConf owner=admin policy=read,write source="/interface wireless security-profiles\r\
  439.     \nadd authentication-types=wpa-psk,wpa2-psk eap-methods=\"\" management-protection=allowed mode=dynamic-keys name=AutoSec supplicant-identity=\"\" wpa-pre-shared-key=$WiFiPSK wpa2-pre-shared-key=$WiFiPSK\r\
  440.     \n\r\
  441.     \n/interface wireless\r\
  442.     \nset [ /interface wireless find band~\"2ghz\" ] band=$2ghzband disabled=no distance=indoors frequency=auto mode=ap-bridge security-profile=AutoSec ssid=$WiFiSSID2ghz wireless-protocol=802.11\r\
  443.     \nset [ /interface wireless find band~\"5ghz\" ] band=$5ghzband disabled=no distance=indoors frequency=auto mode=ap-bridge security-profile=AutoSec ssid=$WiFiSSID5ghz wireless-protocol=802.11\r\
  444.     \n\r\
  445.     \n/interface bridge\r\
  446.     \nadd auto-mac=no admin-mac=[/interface ethernet get [find default-name=$LANInf] mac-address ] comment=WiFi-LAN-Bridge protocol-mode=rstp name=bridge\r\
  447.     \n\r\
  448.     \n## If DHCP Server is configured, and WiFi is being configured as well, change the binding from the LAN inferface to the bridge\r\
  449.     \n:if ($DHCPEnabled) do={\r\
  450.     \n     /ip dhcp-server\r\
  451.     \n     set LAN_DHCP interface=bridge\r\
  452.     \n}\r\
  453.     \n\r\
  454.     \n/ip address set [/ip address find network=$LANNetwork] interface=bridge\r\
  455.     \n\r\
  456.     \n/interface bridge port\r\
  457.     \n:foreach i in=[/interface find type=\"wlan\"] do={/interface bridge port add bridge=bridge interface=\$i}\r\
  458.     \nadd bridge=bridge interface=$LANInf"
  459.      }
  460. /system script run WiFiConf
  461. /system script remove WiFiConf
  462. }
  • MIKROTIK
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

Mikrotik Dynamic DNS Update Script for No-IP DNS

This script was designed to utilize the No-IP Update API which offers direct access to No-IP's...

Manual:The Dude v6/The Dude server on hEX RB750Gr3

Overview New hEX (RB750Gr3) unit is ideal for small to medium size The Dude server...

Mikrotik Find Voip Devices and Add to Address List Script

add interval=5m name=VOIP_Phones_Sched on-event="/system script run VOIP_PHONES"...