二.ROS基础配置
本文有最新配置,但尚未更新至此博客.有空了会更新上来,见谅.
第一步 准备工作
请确认宽带是桥接接入,并且已经获得宽带账号密码.
默认为三网接入(CM光猫接入ether3 & CT光猫接入ether4 & CU光猫接入ether5)
默认为没有交换机的配置,ROS端ether1与OSS端eth0连接,ether2与eth1连接
默认命令都是在WinBox中Terminal执行
最好不要更改任何comment,尤其是以Auto开头的,大部分脚本靠comment来修改相关选项
本文几乎所有设置都是基于命令行(因为内容实在太多了,UI界面操作需要截图修图,工作量太大),其中绝大部分设置都可以通过WinBox界面直接设置,若理解命令含义,可自行使用WinBox UI设置
命令含义可参考:RouterOS中文手册
更多ROS相关教程可参考YuS大神的网站
第二步 设置网桥
新增网桥,将ether1加入,因为有可能涉及到ROS容器的网络问题,还是将ether1加入网桥,否则在使用HomeAssistant等容器时,有可能因为跨网段的一些问题,即使容器网段与主网段能够通信也无法添加AppleTV等设备.后续如果需要使用容器,将容器使用的veth添加进网桥即可.
/interface bridge
add comment=LAN name=bridge1
/interface bridge port
add bridge=bridge1 comment="Bridge member" interface=ether1
第三步 设置拨号
先设置,不打开,因为还没有设置防火墙,此时联网有风险,后续所有关于WAN口的设置,除特别提到,均为有什么设置什么,如下方设置拨号,只有电信一条宽带,则只设置电信即可,其他不用设置,要带上"/"开头的一行,后续均是如此
/interface pppoe-client
add add-default-route=yes comment="PPPoE Client" default-route-distance=3 disabled=yes interface=\
ether3 name=pppoe-out-cm user="移动宽带账号" password="移动宽带密码"
add add-default-route=yes comment="PPPoE Client" default-route-distance=1 disabled=yes interface=\
ether4 name=pppoe-out-ct user="电信宽带账号" password="电信宽带密码"
add add-default-route=yes comment="PPPoE Client" default-route-distance=2 disabled=yes interface=\
ether5 name=pppoe-out-cu user="联通宽带账号" password="联通宽带密码"
若只设置电信:
/interface pppoe-client
add add-default-route=yes comment="PPPoE Client" default-route-distance=1 disabled=yes interface=\
ether4 name=pppoe-out-ct user="电信宽带账号" password="电信宽带密码"
第四步 设置网卡列表
设置网卡列表,方便在防火墙中进行相关设置,其中ONU用于访问光猫页面
/interface list
add comment="WAN list" name=WAN
add comment="LAN list" name=LAN
add comment="ONU list" name=ONU
/interface list member
add comment="WAN member" interface=pppoe-out-cm list=WAN
add comment="WAN member" interface=pppoe-out-ct list=WAN
add comment="WAN member" interface=pppoe-out-cu list=WAN
add comment="ONU member" interface=ether3 list=ONU
add comment="ONU member" interface=ether4 list=ONU
add comment="ONU member" interface=ether5 list=ONU
add comment="LAN member" interface=ether2 list=LAN
add comment="LAN member" interface=bridge1 list=LAN
第五步 设置IPv4地址
假设CM光猫地址为10.0.0.1,CT光猫地址为10.10.10.1,CU光猫地址为10.100.100.1
/ip address
add address=10.0.0.2/24 comment="IPv4 to ONU" interface=ether3 network=10.0.0.0
add address=10.10.10.2/24 comment="IPv4 to ONU" interface=ether4 network=10.10.10.0
add address=10.100.100.2/24 comment="IPv4 to ONU" interface=ether5 network=10.100.100.0
add address=192.168.10.1/24 comment="Local LAN" interface=ether2 network=192.168.10.0
add address=192.168.1.1/24 comment="Local LAN" interface=bridge1 network=192.168.1.0
第六步 设置IPv4 DHCP Server
添加DHCP服务器设置及DHCP Option,租期可适当延长,因为还未部署PaoPaoDNS,暂时将DNS服务器设置为223.5.5.5
/ip pool
add comment="Local LAN DHCPv4 Pool" name=dhcpv4-pool1 ranges=192.168.1.101-192.168.1.200
/ip dhcp-server
add address-pool=dhcpv4-pool1 bootp-support=none comment="Local LAN DHCPv4 Server" interface=bridge1 \
lease-time=1d name=dhcpv4-server
/ip dhcp-server network
add address=192.168.1.0/24 comment="Local LAN DHCPv4 Network" dns-server=223.5.5.5 gateway=\
192.168.1.1 netmask=24
/ip dhcp-server option
add code=6 comment="DNS Option" name=DNS value="'223.5.5.5'"
add code=3 comment="Gateway Option" name=Gateway value="'192.168.1.1'"
/ip dhcp-server option sets
add name=Proxy options=DNS,Gateway
按以下方法添加想要进行透明代理的设备
/ip dhcp-server lease
add address=设备静态IP comment="设备名称" dhcp-option-set=Proxy lease-time=2d mac-address=\
"设备MAC地址" server=dhcpv4-server
第七步 设置 DNS
暂时设置为阿里DNS
/ip dns
set allow-remote-requests=yes cache-max-ttl=0s cache-size=20480KiB max-concurrent-queries=150 \
max-udp-packet-size=1232 servers=223.5.5.5,2400:3200::1 verify-doh-cert=yes
第八步 设置IPv4 防火墙(请严格按照顺序,否则有可能出问题)
添加地址列表
/ip firewall address-list
add address=10.10.10.1 comment="Local ONU IPv4" list=local_onu_ipv4
add address=192.168.1.0/24 comment="Local LAN IPv4 subnet" list=local_subnet_ipv4
add address=0.0.0.0/8 comment="RFC6890 - this network" list=no_forward_ipv4
add address=169.254.0.0/16 comment="RFC6890 - link local" list=no_forward_ipv4
add address=224.0.0.0/4 comment="RFC5771 - multicast" list=no_forward_ipv4
add address=255.255.255.255 comment="RFC6890 - limited broadcast" list=no_forward_ipv4
add address=127.0.0.0/8 comment="RFC6890 - Loopback" list=bad_ipv4
add address=192.0.0.0/24 comment="RFC6890 - reserved" list=bad_ipv4
add address=192.0.2.0/24 comment="RFC6890 - TEST-NET-1" list=bad_ipv4
add address=198.51.100.0/24 comment="RFC6890 - TEST-NET-2" list=bad_ipv4
add address=203.0.113.0/24 comment="RFC6890 - TEST-NET-3" list=bad_ipv4
add address=240.0.0.0/4 comment="RFC6890 - reserved" list=bad_ipv4
add address=0.0.0.0/8 comment="RFC6890 - this network" list=not_global_ipv4
add address=10.0.0.0/8 comment="RFC6890 - private networks" list=not_global_ipv4
add address=100.64.0.0/10 comment="RFC6890 - shared address" list=not_global_ipv4
add address=169.254.0.0/16 comment="RFC6890 - link local" list=not_global_ipv4
add address=172.16.0.0/12 comment="RFC6890 - private networks" list=not_global_ipv4
add address=192.0.0.0/29 comment="RFC6890 - DS-Lite" list=not_global_ipv4
add address=192.168.0.0/16 comment="RFC6890 - private networks" list=not_global_ipv4
add address=198.18.0.0/15 comment="RFC6890 - benchmarking" list=not_global_ipv4
add address=255.255.255.255 comment="RFC6890 - limited broadcast" list=not_global_ipv4
add address=224.0.0.0/4 comment="RFC5771 - multicast" list=bad_src_ipv4
add address=255.255.255.255 comment="RFC6890 - limited broadcast" list=bad_src_ipv4
add address=0.0.0.0/8 comment="RFC6890 - this network" list=bad_dst_ipv4
add address=10.100.100.1 comment="Local ONU IPv4" list=local_onu_ipv4
add address=10.0.0.1 comment="Local ONU IPv4" list=local_onu_ipv4
add address=192.168.10.0/24 list=local_subnet_ipv4
add address=223.5.5.5 list=netwatch_ipv4
add address=119.29.29.29 list=netwatch_ipv4
add address=114.114.114.114 list=netwatch_ipv4
添加Filter规则,具体有什么用途可以看一下ZacGuo大佬的视频:
IPv4
IPv6
/ip firewall filter
add action=accept chain=input comment="Accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="Drop invalid" connection-state=invalid
add action=accept chain=input comment="Accept ICMP LAN" in-interface-list=LAN protocol=icmp
add action=drop chain=input comment="Drop ICMP WAN" in-interface-list=WAN protocol=icmp
add action=drop chain=input comment="Drop All not from LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment=fasttrack connection-state=established,related
add action=accept chain=forward comment="Accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=drop chain=forward comment="Drop All from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="Drop All from ONU not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=ONU
add action=drop chain=forward comment="Drop bad forward IPs" src-address-list=no_forward_ipv4
add action=drop chain=forward comment="Drop bad forward IPs" dst-address-list=no_forward_ipv4
添加NAT规则
/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade IPv4" out-interface-list=WAN
add action=masquerade chain=srcnat comment="Access to ONU" dst-address-list=local_onu_ipv4 \
out-interface-list=ONU src-address-list=local_subnet_ipv4
add action=masquerade chain=srcnat comment="Masquerade to Bypass" dst-address-list=\
!local_subnet_ipv4 out-interface=ether2
添加Mangle规则,设置源进源出SISO,标记packet用于简单QoS,原理可以看ZacGuo大佬的视频:
SISO
单WAN不需要SISO,只需要设置 comment为"RouteTable for BGP"/"Fix IPv4 MSS for WAN"/"Queue Settings"/"Force ROS Output to Proxy"的代码
/routing table
add comment="RouteTable for SISO" disabled=no fib name=rt-cm
add comment="RouteTable for SISO" disabled=no fib name=rt-ct
add comment="RouteTable for SISO" disabled=no fib name=rt-cu
add comment="RouteTable for Netwatch" disabled=no fib name=rt-nw
add comment="RouteTable for BGP" disabled=no fib name=bgp-else
add comment="RouteTable for BGP" disabled=no fib name=bgp-proxy
/ip route
add comment="Routes for SISO" disabled=no distance=9 dst-address=0.0.0.0/0 gateway=pppoe-out-cm routing-table=\
rt-cm scope=30 target-scope=10
add comment="Routes for SISO" disabled=no distance=11 dst-address=0.0.0.0/0 gateway=pppoe-out-ct routing-table=\
rt-ct scope=30 target-scope=10
add comment="Routes for SISO" disabled=no distance=10 dst-address=0.0.0.0/0 gateway=pppoe-out-cu routing-table=\
rt-cu scope=30 target-scope=10
/ip firewall mangle
add action=change-mss chain=forward comment="Fix IPv4 MSS for WAN" new-mss=clamp-to-pmtu protocol=\
tcp tcp-flags=syn
add action=accept chain=prerouting comment="Access to ONU" dst-address-list=local_onu_ipv4 \
src-address-list=local_subnet_ipv4
add action=mark-connection chain=prerouting comment="SISO Settings" connection-mark=no-mark \
connection-state=new in-interface=pppoe-out-cm new-connection-mark=cm-v4
add action=mark-connection chain=prerouting comment="SISO Settings" connection-mark=no-mark \
connection-state=new in-interface=pppoe-out-ct new-connection-mark=ct-v4
add action=mark-connection chain=prerouting comment="SISO Settings" connection-mark=no-mark \
connection-state=new in-interface=pppoe-out-cu new-connection-mark=cu-v4
add action=mark-packet chain=prerouting comment="Queue Settings" in-interface=pppoe-out-cm \
new-packet-mark=cm
add action=mark-packet chain=prerouting comment="Queue Settings" in-interface=pppoe-out-ct \
new-packet-mark=ct
add action=mark-packet chain=prerouting comment="Queue Settings" in-interface=pppoe-out-cu \
new-packet-mark=cu
add action=mark-routing chain=prerouting comment="Route Settings" connection-mark=cm-v4 \
dst-address-type=!local in-interface-list=LAN new-routing-mark=rt-cm passthrough=no
add action=mark-routing chain=prerouting comment="Route Settings" connection-mark=ct-v4 \
dst-address-type=!local in-interface-list=LAN new-routing-mark=rt-ct passthrough=no
add action=mark-routing chain=prerouting comment="Route Settings" connection-mark=cu-v4 \
dst-address-type=!local in-interface-list=LAN new-routing-mark=rt-cu passthrough=no
add action=mark-routing chain=output comment="Force ROS Output to Proxy" dst-address-type=!local \
new-routing-mark=bgp-proxy out-interface-list=WAN passthrough=no
add action=mark-routing chain=output comment="Route Settings" connection-mark=cm-v4 \
dst-address-type=!local new-routing-mark=rt-cm passthrough=no
add action=mark-routing chain=output comment="Route Settings" connection-mark=ct-v4 \
dst-address-type=!local new-routing-mark=rt-ct passthrough=no
add action=mark-routing chain=output comment="Route Settings" connection-mark=cu-v4 \
dst-address-type=!local new-routing-mark=rt-cu passthrough=no
add action=mark-connection chain=postrouting comment="NW Monitor" disabled=yes dst-address-list=\
netwatch_ipv4 new-connection-mark=nwcm out-interface=pppoe-out-cm
add action=mark-connection chain=postrouting comment="NW Monitor" disabled=yes dst-address-list=\
netwatch_ipv4 new-connection-mark=nwct out-interface=pppoe-out-ct
add action=mark-connection chain=postrouting comment="NW Monitor" disabled=yes dst-address-list=\
netwatch_ipv4 new-connection-mark=nwcu out-interface=pppoe-out-cu
添加Raw规则,这部分仁者见仁,因为我这性能极度过剩,所以加上了一些,特别在意性能损耗可以不设置,并删除对应address-list
/ip firewall raw
add action=drop chain=prerouting comment="Drop Bogon IPs" src-address-list=bad_ipv4
add action=drop chain=prerouting comment="Drop Bogon IPs" dst-address-list=bad_ipv4
add action=drop chain=prerouting comment="Drop Bad SRC IPv4" src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="Drop Bad DST IPv4" dst-address-list=bad_dst_ipv4
add action=drop chain=prerouting comment="Drop Non-global from WAN" in-interface-list=WAN \
src-address-list=not_global_ipv4
完成所有IPv4防火墙设置后执行:
/interface pppoe-client enable [find name~"pppoe"]
这时应该就有网络了
第九步 设置Queue及简单QoS
这一步需要自己测试,比较繁琐,若不需要QoS,跳过这一步并执行:
/ip firewall mangle remove [find comment="Queue Settings"]
若需要简单QoS(并没有根据流量类型进行QoS,只进行了简单QoS)
新建一个终端,根据当地运营商实际带宽,修改"max-limit",由于各地宽带下行余量不同,比如我这里2000M电信可以跑到2250M,2000M联通可以跑3000M,所以可以在当前带宽基础上适当增加"max-limit",如宽带为电信1000M下行50M上行,则修改对应"max-limit"为1250M和50M,如需更精确,单位可以改成k,具体自行换算:
/queue type
add cake-diffserv=diffserv4 cake-flowmode=dual-dsthost cake-memlimit=32.0MiB cake-mpu=84 cake-nat=yes cake-overhead=\
38 cake-overhead-scheme=ethernet cake-rtt=60ms kind=cake name=cake-rx
add cake-ack-filter=filter cake-diffserv=diffserv4 cake-flowmode=dual-srchost cake-memlimit=32.0MiB cake-mpu=84 \
cake-nat=yes cake-overhead=38 cake-overhead-scheme=ethernet cake-rtt=60ms kind=cake name=cake-tx
/queue tree
add bucket-size=0.05 comment="Download Queue with CAKE" max-limit=1000M name=cake-download-cm packet-mark=cm \
parent=bridge1 queue=cake-rx
add bucket-size=0.05 comment="Download Queue with CAKE" max-limit=1000M name=cake-download-ct packet-mark=ct \
parent=bridge1 queue=cake-rx
add bucket-size=0.05 comment="Download Queue with CAKE" max-limit=1000M name=cake-download-cu packet-mark=cu \
parent=bridge1 queue=cake-rx
add bucket-size=0.03 comment="Upload Queue with CAKE" max-limit=50M name=cake-upload-cm packet-mark=no-mark \
parent=pppoe-out-cm queue=cake-tx
add bucket-size=0.03 comment="Upload Queue with CAKE" max-limit=50M name=cake-upload-ct packet-mark=no-mark \
parent=pppoe-out-ct queue=cake-tx
add bucket-size=0.03 comment="Upload Queue with CAKE" max-limit=50M name=cake-upload-cu packet-mark=no-mark \
parent=pppoe-out-cu queue=cake-tx
1.1新建另一个终端,ping 223.5.5.5,观察延迟变化,单WAN直接ping即可:
/ping 223.5.5.5
1.2多WAN则直接关闭非当前调试的pppoe client,如测试移动,则禁用电信联通,其实设置路由也可以,但是有点麻烦,不如这样干脆点,测试其他同理,只要保证只打开了当前测试的pppoe client即可:
/interface pppoe-client disable pppoe-out-ct
/interface pppoe-client disable pppoe-out-cu
/ping 223.5.5.5
2.打开对应运营商测速网站:
移动:暂且不知道,因为我这没有移动网络,有知道的佬可以评论区说一下,可自选常用测速网站,但一定要跑满带宽才行,所以运营商的测速网站是最好的
电信:电信测速
联通:联通测速
3.一直跑测速,观察下载和上传时另一个终端ping值的变化,通过以下命令修改阈值"max-limit",直到测速时,另一个终端ping值不再波动:
/queue tree set [find name=cake-download-cm] max-limit=
/queue tree set [find name=cake-upload-cm] max-limit=
重复以上步骤,直到所有运营商设置完毕即可.
第十步 设置 IPv6 Client
注意:本文使用的IPv6设置为除ROS和OSS外所有设备均不会被分配到公网IPv6,如需从外网访问局域网设备,需通过Nginx反代(后面会设置)
目前各地已逐渐放开IPv6前缀为/60,即可为多个网卡分配前缀,但本文仍以/64为标准
打开IPv6,并重启设备:
/ipv6 settings set disable-ipv6=no
/system reboot
重启后,设置:
其中包含脚本:在前缀更新时,自动修改需要修改的前缀位置
/ipv6 dhcp-client
add add-default-route=yes comment="DHCPv6 Client" interface=pppoe-out-cm \
pool-name="IPv6 Public Pool CM" pool-prefix-length=64 request=prefix \
script="# ================= \E9\85\8D\E7\BD\AE\E5\8C\BA\E5\9F\9F ========\
=========\
\n:local iFace \"pppoe-out-cm\"\
\n:local ispTag \"CM\"\
\n:local lanInterface \"ether2\"\
\n# ===========================================\
\n\
\n# \E5\BB\B6\E6\97\B6\E7\AD\89\E5\BE\85 DHCPv6 Client \E8\8E\B7\E5\8F\96\
\E5\9C\B0\E5\9D\80\E5\92\8C Pool \E7\94\9F\E6\88\90\
\n:delay 5s\
\n\
\n:local poolName (\"IPv6 Public Pool \" . \$ispTag)\
\n:local cmtAddrList (\"Auto Generated \" . \$ispTag)\
\n:local cmtRoute (\"Auto Generate \" . \$ispTag . \" GUA Prefix\")\
\n:local cmtNat (\"Auto Generated \" . \$ispTag . \" SNAT\")\
\n\
\n# \E8\8E\B7\E5\8F\96\E5\88\86\E9\85\8D\E5\88\B0\E7\9A\84 Prefix \E5\B9\
\B6\E5\BC\BA\E5\88\B6\E8\BD\AC\E6\8D\A2\E4\B8\BA\E5\AD\97\E7\AC\A6\E4\B8\
\B2\
\n:local dhcpPrefix [/ipv6 dhcp-client get [find interface=\$iFace] prefi\
x]\
\n:local IPADDR [:tostr \$dhcpPrefix]\
\n\
\n:if ([:len \$IPADDR] = 0) do={ \
\n :error \"No prefix found for \$iFace\" \
\n}\
\n\
\n# \E6\8F\90\E5\8F\96\E7\BA\AF Prefix (\E5\A4\84\E7\90\86\E8\BF\94\E5\9B\
\9E\E5\80\BC\E4\B8\AD\E5\8F\AF\E8\83\BD\E9\99\84\E5\B8\A6\E7\9A\84\E6\97\
\B6\E9\97\B4\E6\88\B3\E6\88\96\E9\80\97\E5\8F\B7)\
\n:local IPPREFIX \"\"\
\n:local commaPos [:find \$IPADDR \",\"]\
\n:if ([:len \$commaPos] > 0) do={\
\n :set IPPREFIX [:pick \$IPADDR 0 \$commaPos]\
\n} else={\
\n :set IPPREFIX \$IPADDR\
\n}\
\n\
\n# \E5\A3\B0\E6\98\8E\E5\85\A8\E5\B1\80\E5\8F\98\E9\87\8F\E7\94\A8\E4\BA\
\8E\E6\AF\94\E5\AF\B9 (\E5\A6\82\E6\9E\9C\E5\A4\8D\E5\88\B6\E7\BB\99 CT20\
00/CU2000\EF\BC\8C\E8\AF\B7\E8\AE\B0\E5\BE\97\E6\9B\B4\E6\94\B9\E8\BF\99\
\E4\B8\AA\E5\8F\98\E9\87\8F\E5\90\8D\EF\BC\8C\E5\A6\82 LastPrefixCT2)\
\n:global LastPrefixCM\
\n\
\n:if (\$IPPREFIX != \$LastPrefixCM) do={\
\n :set LastPrefixCM \$IPPREFIX\
\n :log info \"[\$iFace] Prefix changed to \$IPPREFIX. Starting update\
s...\"\
\n\
\n :if ([:len \$IPPREFIX] > 0) do={\
\n # 1. \E8\8E\B7\E5\8F\96 LAN \E5\8F\A3\E7\9A\84 IPv6 \E5\9C\B0\
\E5\9D\80\EF\BC\8C\E5\B9\B6\E6\88\AA\E5\8F\96\E5\89\8D\E7\BC\80\E9\83\A8\
\E5\88\86\
\n :local lanaddress [:tostr [/ipv6 address get [find interface=\$\
lanInterface from-pool=\$poolName] address]]\
\n :set lanaddress [:pick \$lanaddress 0 [:find \$lanaddress \"/\"\
]]\
\n \
\n # 2. \E6\9B\B4\E6\96\B0 IPv6 Address List\
\n /ipv6/firewall/address-list/remove [find list=\"local_ipv6\" co\
mment=\$cmtAddrList]\
\n /ipv6/firewall/address-list/add list=\"local_ipv6\" address=\$I\
PPREFIX comment=\$cmtAddrList\
\n\
\n # 3. \E6\9B\B4\E6\96\B0 Routing Rule (\E5\8A\A8\E6\80\81\E7\BD\
\AE\E9\A1\B6\E5\88\A4\E6\96\AD)\
\n /routing/rule/remove [find comment=\$cmtRoute]\
\n :local ruleIds [/routing/rule/find]\
\n :if ([:len \$ruleIds] > 0) do={\
\n /routing/rule/add comment=\$cmtRoute dst-address=\$IPPREFIX\
\_action=lookup table=main place-before=[:pick \$ruleIds 0]\
\n } else={\
\n /routing/rule/add comment=\$cmtRoute dst-address=\$IPPREFIX\
\_action=lookup table=main\
\n }\
\n\
\n # 4. \E6\9B\B4\E6\96\B0 IPv6 NAT (\E5\8A\A8\E6\80\81\E7\BD\AE\
\E9\A1\B6\E5\88\A4\E6\96\AD)\
\n /ipv6/firewall/nat/remove [find comment=\$cmtNat]\
\n :local natIds [/ipv6/firewall/nat/find]\
\n :if ([:len \$natIds] > 0) do={\
\n /ipv6/firewall/nat/add action=src-nat chain=srcnat comment=\
\$cmtNat to-address=\$lanaddress out-interface=\$iFace dst-address-list=!\
local_ipv6 dst-address-type=!local place-before=[:pick \$natIds 0]\
\n } else={\
\n /ipv6/firewall/nat/add action=src-nat chain=srcnat comment=\
\$cmtNat to-address=\$lanaddress out-interface=\$iFace dst-address-list=!\
local_ipv6 dst-address-type=!local\
\n }\
\n \
\n :log info \"[\$iFace] IPv6 rules updated successfully.\"\
\n }\
\n} else={\
\n :log debug \"[\$iFace] Prefix unchanged (\$IPPREFIX). No action tak\
en.\"\
\n}" use-peer-dns=no disabled=yes
add add-default-route=yes comment="DHCPv6 Client" interface=pppoe-out-ct \
pool-name="IPv6 Public Pool CT" pool-prefix-length=64 request=prefix \
script="# ================= \E9\85\8D\E7\BD\AE\E5\8C\BA\E5\9F\9F ========\
=========\
\n:local iFace \"pppoe-out-ct\"\
\n:local ispTag \"CT\"\
\n:local lanInterface \"ether2\"\
\n# ===========================================\
\n\
\n# \E5\BB\B6\E6\97\B6\E7\AD\89\E5\BE\85 DHCPv6 Client \E8\8E\B7\E5\8F\96\
\E5\9C\B0\E5\9D\80\E5\92\8C Pool \E7\94\9F\E6\88\90\
\n:delay 5s\
\n\
\n:local poolName (\"IPv6 Public Pool \" . \$ispTag)\
\n:local cmtAddrList (\"Auto Generated \" . \$ispTag)\
\n:local cmtRoute (\"Auto Generate \" . \$ispTag . \" GUA Prefix\")\
\n:local cmtNat (\"Auto Generated \" . \$ispTag . \" SNAT\")\
\n\
\n# \E8\8E\B7\E5\8F\96\E5\88\86\E9\85\8D\E5\88\B0\E7\9A\84 Prefix \E5\B9\
\B6\E5\BC\BA\E5\88\B6\E8\BD\AC\E6\8D\A2\E4\B8\BA\E5\AD\97\E7\AC\A6\E4\B8\
\B2\
\n:local dhcpPrefix [/ipv6 dhcp-client get [find interface=\$iFace] prefi\
x]\
\n:local IPADDR [:tostr \$dhcpPrefix]\
\n\
\n:if ([:len \$IPADDR] = 0) do={ \
\n :error \"No prefix found for \$iFace\" \
\n}\
\n\
\n# \E6\8F\90\E5\8F\96\E7\BA\AF Prefix (\E5\A4\84\E7\90\86\E8\BF\94\E5\9B\
\9E\E5\80\BC\E4\B8\AD\E5\8F\AF\E8\83\BD\E9\99\84\E5\B8\A6\E7\9A\84\E6\97\
\B6\E9\97\B4\E6\88\B3\E6\88\96\E9\80\97\E5\8F\B7)\
\n:local IPPREFIX \"\"\
\n:local commaPos [:find \$IPADDR \",\"]\
\n:if ([:len \$commaPos] > 0) do={\
\n :set IPPREFIX [:pick \$IPADDR 0 \$commaPos]\
\n} else={\
\n :set IPPREFIX \$IPADDR\
\n}\
\n\
\n# \E5\A3\B0\E6\98\8E\E5\85\A8\E5\B1\80\E5\8F\98\E9\87\8F\E7\94\A8\E4\BA\
\8E\E6\AF\94\E5\AF\B9 (\E5\A6\82\E6\9E\9C\E5\A4\8D\E5\88\B6\E7\BB\99 CT20\
00/CU2000\EF\BC\8C\E8\AF\B7\E8\AE\B0\E5\BE\97\E6\9B\B4\E6\94\B9\E8\BF\99\
\E4\B8\AA\E5\8F\98\E9\87\8F\E5\90\8D\EF\BC\8C\E5\A6\82 LastPrefixCT2)\
\n:global LastPrefixCM\
\n\
\n:if (\$IPPREFIX != \$LastPrefixCM) do={\
\n :set LastPrefixCM \$IPPREFIX\
\n :log info \"[\$iFace] Prefix changed to \$IPPREFIX. Starting update\
s...\"\
\n\
\n :if ([:len \$IPPREFIX] > 0) do={\
\n # 1. \E8\8E\B7\E5\8F\96 LAN \E5\8F\A3\E7\9A\84 IPv6 \E5\9C\B0\
\E5\9D\80\EF\BC\8C\E5\B9\B6\E6\88\AA\E5\8F\96\E5\89\8D\E7\BC\80\E9\83\A8\
\E5\88\86\
\n :local lanaddress [:tostr [/ipv6 address get [find interface=\$\
lanInterface from-pool=\$poolName] address]]\
\n :set lanaddress [:pick \$lanaddress 0 [:find \$lanaddress \"/\"\
]]\
\n \
\n # 2. \E6\9B\B4\E6\96\B0 IPv6 Address List\
\n /ipv6/firewall/address-list/remove [find list=\"local_ipv6\" co\
mment=\$cmtAddrList]\
\n /ipv6/firewall/address-list/add list=\"local_ipv6\" address=\$I\
PPREFIX comment=\$cmtAddrList\
\n\
\n # 3. \E6\9B\B4\E6\96\B0 Routing Rule (\E5\8A\A8\E6\80\81\E7\BD\
\AE\E9\A1\B6\E5\88\A4\E6\96\AD)\
\n /routing/rule/remove [find comment=\$cmtRoute]\
\n :local ruleIds [/routing/rule/find]\
\n :if ([:len \$ruleIds] > 0) do={\
\n /routing/rule/add comment=\$cmtRoute dst-address=\$IPPREFIX\
\_action=lookup table=main place-before=[:pick \$ruleIds 0]\
\n } else={\
\n /routing/rule/add comment=\$cmtRoute dst-address=\$IPPREFIX\
\_action=lookup table=main\
\n }\
\n\
\n # 4. \E6\9B\B4\E6\96\B0 IPv6 NAT (\E5\8A\A8\E6\80\81\E7\BD\AE\
\E9\A1\B6\E5\88\A4\E6\96\AD)\
\n /ipv6/firewall/nat/remove [find comment=\$cmtNat]\
\n :local natIds [/ipv6/firewall/nat/find]\
\n :if ([:len \$natIds] > 0) do={\
\n /ipv6/firewall/nat/add action=src-nat chain=srcnat comment=\
\$cmtNat to-address=\$lanaddress out-interface=\$iFace dst-address-list=!\
local_ipv6 dst-address-type=!local place-before=[:pick \$natIds 0]\
\n } else={\
\n /ipv6/firewall/nat/add action=src-nat chain=srcnat comment=\
\$cmtNat to-address=\$lanaddress out-interface=\$iFace dst-address-list=!\
local_ipv6 dst-address-type=!local\
\n }\
\n \
\n :log info \"[\$iFace] IPv6 rules updated successfully.\"\
\n }\
\n} else={\
\n :log debug \"[\$iFace] Prefix unchanged (\$IPPREFIX). No action tak\
en.\"\
\n}" use-peer-dns=no disabled=yes
add add-default-route=yes comment="DHCPv6 Client" interface=pppoe-out-cu \
pool-name="IPv6 Public Pool CU" pool-prefix-length=64 request=prefix \
script="# ================= \E9\85\8D\E7\BD\AE\E5\8C\BA\E5\9F\9F ========\
=========\
\n:local iFace \"pppoe-out-cu\"\
\n:local ispTag \"CU\"\
\n:local lanInterface \"ether2\"\
\n# ===========================================\
\n\
\n# \E5\BB\B6\E6\97\B6\E7\AD\89\E5\BE\85 DHCPv6 Client \E8\8E\B7\E5\8F\96\
\E5\9C\B0\E5\9D\80\E5\92\8C Pool \E7\94\9F\E6\88\90\
\n:delay 5s\
\n\
\n:local poolName (\"IPv6 Public Pool \" . \$ispTag)\
\n:local cmtAddrList (\"Auto Generated \" . \$ispTag)\
\n:local cmtRoute (\"Auto Generate \" . \$ispTag . \" GUA Prefix\")\
\n:local cmtNat (\"Auto Generated \" . \$ispTag . \" SNAT\")\
\n\
\n# \E8\8E\B7\E5\8F\96\E5\88\86\E9\85\8D\E5\88\B0\E7\9A\84 Prefix \E5\B9\
\B6\E5\BC\BA\E5\88\B6\E8\BD\AC\E6\8D\A2\E4\B8\BA\E5\AD\97\E7\AC\A6\E4\B8\
\B2\
\n:local dhcpPrefix [/ipv6 dhcp-client get [find interface=\$iFace] prefi\
x]\
\n:local IPADDR [:tostr \$dhcpPrefix]\
\n\
\n:if ([:len \$IPADDR] = 0) do={ \
\n :error \"No prefix found for \$iFace\" \
\n}\
\n\
\n# \E6\8F\90\E5\8F\96\E7\BA\AF Prefix (\E5\A4\84\E7\90\86\E8\BF\94\E5\9B\
\9E\E5\80\BC\E4\B8\AD\E5\8F\AF\E8\83\BD\E9\99\84\E5\B8\A6\E7\9A\84\E6\97\
\B6\E9\97\B4\E6\88\B3\E6\88\96\E9\80\97\E5\8F\B7)\
\n:local IPPREFIX \"\"\
\n:local commaPos [:find \$IPADDR \",\"]\
\n:if ([:len \$commaPos] > 0) do={\
\n :set IPPREFIX [:pick \$IPADDR 0 \$commaPos]\
\n} else={\
\n :set IPPREFIX \$IPADDR\
\n}\
\n\
\n# \E5\A3\B0\E6\98\8E\E5\85\A8\E5\B1\80\E5\8F\98\E9\87\8F\E7\94\A8\E4\BA\
\8E\E6\AF\94\E5\AF\B9 (\E5\A6\82\E6\9E\9C\E5\A4\8D\E5\88\B6\E7\BB\99 CT20\
00/CU2000\EF\BC\8C\E8\AF\B7\E8\AE\B0\E5\BE\97\E6\9B\B4\E6\94\B9\E8\BF\99\
\E4\B8\AA\E5\8F\98\E9\87\8F\E5\90\8D\EF\BC\8C\E5\A6\82 LastPrefixCT2)\
\n:global LastPrefixCM\
\n\
\n:if (\$IPPREFIX != \$LastPrefixCM) do={\
\n :set LastPrefixCM \$IPPREFIX\
\n :log info \"[\$iFace] Prefix changed to \$IPPREFIX. Starting update\
s...\"\
\n\
\n :if ([:len \$IPPREFIX] > 0) do={\
\n # 1. \E8\8E\B7\E5\8F\96 LAN \E5\8F\A3\E7\9A\84 IPv6 \E5\9C\B0\
\E5\9D\80\EF\BC\8C\E5\B9\B6\E6\88\AA\E5\8F\96\E5\89\8D\E7\BC\80\E9\83\A8\
\E5\88\86\
\n :local lanaddress [:tostr [/ipv6 address get [find interface=\$\
lanInterface from-pool=\$poolName] address]]\
\n :set lanaddress [:pick \$lanaddress 0 [:find \$lanaddress \"/\"\
]]\
\n \
\n # 2. \E6\9B\B4\E6\96\B0 IPv6 Address List\
\n /ipv6/firewall/address-list/remove [find list=\"local_ipv6\" co\
mment=\$cmtAddrList]\
\n /ipv6/firewall/address-list/add list=\"local_ipv6\" address=\$I\
PPREFIX comment=\$cmtAddrList\
\n\
\n # 3. \E6\9B\B4\E6\96\B0 Routing Rule (\E5\8A\A8\E6\80\81\E7\BD\
\AE\E9\A1\B6\E5\88\A4\E6\96\AD)\
\n /routing/rule/remove [find comment=\$cmtRoute]\
\n :local ruleIds [/routing/rule/find]\
\n :if ([:len \$ruleIds] > 0) do={\
\n /routing/rule/add comment=\$cmtRoute dst-address=\$IPPREFIX\
\_action=lookup table=main place-before=[:pick \$ruleIds 0]\
\n } else={\
\n /routing/rule/add comment=\$cmtRoute dst-address=\$IPPREFIX\
\_action=lookup table=main\
\n }\
\n\
\n # 4. \E6\9B\B4\E6\96\B0 IPv6 NAT (\E5\8A\A8\E6\80\81\E7\BD\AE\
\E9\A1\B6\E5\88\A4\E6\96\AD)\
\n /ipv6/firewall/nat/remove [find comment=\$cmtNat]\
\n :local natIds [/ipv6/firewall/nat/find]\
\n :if ([:len \$natIds] > 0) do={\
\n /ipv6/firewall/nat/add action=src-nat chain=srcnat comment=\
\$cmtNat to-address=\$lanaddress out-interface=\$iFace dst-address-list=!\
local_ipv6 dst-address-type=!local place-before=[:pick \$natIds 0]\
\n } else={\
\n /ipv6/firewall/nat/add action=src-nat chain=srcnat comment=\
\$cmtNat to-address=\$lanaddress out-interface=\$iFace dst-address-list=!\
local_ipv6 dst-address-type=!local\
\n }\
\n \
\n :log info \"[\$iFace] IPv6 rules updated successfully.\"\
\n }\
\n} else={\
\n :log debug \"[\$iFace] Prefix unchanged (\$IPPREFIX). No action tak\
en.\"\
\n}" use-peer-dns=no disabled=yes
第十一步 设置IPv6地址
为ether2分配GUA地址并广播,这样保证局域网内只有OSS能被分配到GUA地址
/ipv6 address
add comment="GUA CM" eui-64=yes from-pool="IPv6 Public Pool CM" interface=ether2
add comment="GUA CT" eui-64=yes from-pool="IPv6 Public Pool CT" interface=ether2
add comment="GUA CU" eui-64=yes from-pool="IPv6 Public Pool CU" interface=ether2
add address=fd00:192:168:10::1/64 comment="Local LAN" interface=ether2
add address=fd00:192:168:1::1/64 comment="Local LAN" interface=bridge1
第十二步 设置IPv6 ND
暂时将dns设置为2400:3200::1并广播
/ipv6 nd
set [ find default=yes ] advertise-dns=yes disabled=yes
add advertise-dns=yes dns=2400:3200::1 interface=bridge1 ra-interval=20s-1m
add advertise-dns=yes dns=2400:3200::1 interface=ether2 ra-interval=20s-1m
/ipv6 nd prefix default
set preferred-lifetime=1h30m valid-lifetime=3h
第十三步 设置IPv6防火墙
设置Address List:
/ipv6 firewall address-list
add address=::1/128 comment="RFC6890 - Loopback" list=bad_ipv6
add address=::/128 comment="RFC6890 - unspecified" list=bad_ipv6
add address=100::/64 comment="RFC6890 - discard-only" list=bad_ipv6
add address=::/96 comment="RFC4291 - IPv4 compatible" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="RFC6890 - IPv4 mapped" list=bad_ipv6
add address=2001::/23 comment="RFC6890 - reserved" list=bad_ipv6
add address=2001:db8::/32 comment="RFC6890 - documentation" list=bad_ipv6
add address=2001:10::/28 comment="RFC4843 - ORCHID" list=bad_ipv6
add address=2001:20::/28 comment="RFC7343 - ORCHIDv2" list=bad_ipv6
add address=fec0::/10 comment="RFC3879 - site local" list=bad_ipv6
add address=fe80::/10 list=local_ipv6
add address=fd00:192:168:1::/64 list=local_ipv6
add address=ff00::/8 list=local_ipv6
add address=fd00:192:168:10::/64 list=local_ipv6
add address=2402:4e00::/128 list=netwatch_ipv6
add address=2402:4e00:1::/128 list=netwatch_ipv6
add address=2400:3200::1/128 list=netwatch_ipv6
设置Filter:
/ipv6 firewall filter
add action=accept chain=input comment="Allow WireGuard Input" dst-port=13231 protocol=udp
add action=accept chain=input comment="Accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="Drop invalid" connection-state=invalid
add action=accept chain=input comment="Accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="Accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="Accept DHCPv6-Client prefix delegation" dst-address=fe80::/10 dst-port=546 \
log=yes log-prefix="[ipv6-pd]" protocol=udp src-port=547
add action=drop chain=input comment="Drop everything else not from LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment=Fasttrack connection-state=established,related
add action=accept chain=forward comment="Accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=drop chain=forward comment="Drop Packets with bad src IPs" src-address-list=bad_ipv6
add action=drop chain=forward comment="Drop Packets with bad dst IPs" dst-address-list=bad_ipv6
add action=accept chain=forward comment="Accept ICMPv6" protocol=icmpv6
add action=drop chain=forward comment="RFC4890 Drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="Accept Reverse Proxy" dst-address-list=local_ipv6 dst-port=443 \
in-interface-list=WAN protocol=tcp
add action=drop chain=forward comment="Drop everything else not from LAN" in-interface-list=!LAN
设置NAT:
/ipv6 firewall nat
add action=masquerade chain=srcnat comment="Masquerade to Bypass" dst-address-list=!local_ipv6 out-interface=ether2
设置Mangle,单WAN不需要SISO,只需要设置 comment为"Fix IPv6 MSS for WAN"/"Queue Settings"/"Force ROS Output to Proxy"的代码
/ipv6 route
add comment="Routes for SISO" disabled=no distance=9 dst-address=::/0 gateway=pppoe-out-ct pref-src="" \
routing-table=rt-ct scope=30 target-scope=10
add comment="Routes for SISO" disabled=no distance=11 dst-address=::/0 gateway=pppoe-out-cm pref-src="" \
routing-table=rt-cm scope=30 target-scope=10
add comment="Routes for SISO" disabled=no distance=10 dst-address=::/0 gateway=pppoe-out-cu pref-src="" \
routing-table=rt-cu scope=30 target-scope=10
/ipv6 firewall mangle
add action=change-mss chain=forward comment="Fix IPv6 MSS for WAN" new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
add action=mark-connection chain=prerouting comment="SISO Settings" connection-mark=no-mark connection-state=new \
in-interface=pppoe-out-cm new-connection-mark=cm-v6
add action=mark-connection chain=prerouting comment="SISO Settings" connection-mark=no-mark connection-state=new \
in-interface=pppoe-out-ct new-connection-mark=ct-v6
add action=mark-connection chain=prerouting comment="SISO Settings" connection-mark=no-mark connection-state=new \
in-interface=pppoe-out-cu new-connection-mark=cu-v6
add action=mark-packet chain=prerouting comment="Queue Settings" in-interface=pppoe-out-cm new-packet-mark=\
cm
add action=mark-packet chain=prerouting comment="Queue Settings" in-interface=pppoe-out-ct new-packet-mark=\
ct
add action=mark-packet chain=prerouting comment="Queue Settings" in-interface=pppoe-out-cu new-packet-mark=\
cu
add action=mark-routing chain=prerouting comment="Route Settings" connection-mark=cm-v6 dst-address-type=!local \
in-interface-list=LAN new-routing-mark=rt-cm passthrough=no
add action=mark-routing chain=prerouting comment="Route Settings" connection-mark=ct-v6 dst-address-type=!local \
in-interface-list=LAN new-routing-mark=rt-ct passthrough=no
add action=mark-routing chain=prerouting comment="Route Settings" connection-mark=cu-v6 dst-address-type=!local \
in-interface-list=LAN new-routing-mark=rt-cu passthrough=no
add action=mark-routing chain=output comment="Force ROS Output to Proxy" dst-address-list=!local_ipv6 \
dst-address-type=!local new-routing-mark=bgp-proxy out-interface-list=WAN passthrough=no
add action=mark-routing chain=output comment="Route Settings" connection-mark=cm-v6 dst-address-type=!local \
new-routing-mark=rt-cm passthrough=no
add action=mark-routing chain=output comment="Route Settings" connection-mark=ct-v6 dst-address-type=!local \
new-routing-mark=rt-ct passthrough=no
add action=mark-routing chain=output comment="Route Settings" connection-mark=cu-v6 dst-address-type=!local \
new-routing-mark=rt-cu passthrough=no
add action=mark-connection chain=postrouting comment="NW Monitor" disabled=yes dst-address-list=netwatch_ipv6 \
new-connection-mark=nwcm out-interface=pppoe-out-cm
add action=mark-connection chain=postrouting comment="NW Monitor" disabled=yes dst-address-list=netwatch_ipv6 \
new-connection-mark=nwcu out-interface=pppoe-out-cu
add action=mark-connection chain=postrouting comment="NW Monitor" disabled=yes dst-address-list=netwatch_ipv6 \
new-connection-mark=nwct out-interface=pppoe-out-ct
第十四步 设置路由
设置路由规则,多WAN:
/routing rule
add action=lookup comment="Rules for Subnet" disabled=no dst-address=fd00:192:168:1::/64 table=main
add action=lookup comment="Rules for Subnet" disabled=no dst-address=fd00:192:168:10::/64 table=main
add action=lookup-only-in-table comment="Rules for Netwatch" disabled=no dst-address=223.5.5.5/32 table=rt-nw
add action=lookup-only-in-table comment="Rules for Netwatch" disabled=no dst-address=2402:4e00::/128 table=rt-nw
add action=lookup-only-in-table comment="Rules for Netwatch" disabled=no dst-address=2402:4e00:1::/128 table=rt-nw
add action=lookup-only-in-table comment="Rules for Netwatch" disabled=no dst-address=2400:3200::1/128 table=rt-nw
add action=lookup-only-in-table comment="Rules for Netwatch" disabled=no dst-address=119.29.29.29/32 table=rt-nw
add action=lookup-only-in-table comment="Rules for Netwatch" disabled=no dst-address=114.114.114.114/32 table=rt-nw
add action=lookup comment="Rules for Subnet" disabled=no dst-address=192.168.1.0/24 table=main
add action=lookup comment="Rules for Subnet" disabled=no dst-address=192.168.10.0/24 table=main
add action=lookup comment="Rules for Subnet" disabled=no dst-address=fe80::/10 table=main
add action=lookup comment="Rules for Proxy" disabled=no src-address=你想要代理的设备IP或网段 table=bgp-proxy
add action=lookup comment="Rules for Proxy" disabled=no src-address=你想要代理的设备IP或网段 table=bgp-proxy
add action=lookup comment="Rules for Else" disabled=no src-address=0.0.0.0/0 table=bgp-else
add action=lookup comment="Rules for Else" disabled=no src-address=::/0 table=bgp-else
单WAN:
/routing rule
add action=lookup comment="Rules for Subnet" disabled=no dst-address=fd00:192:168:1::/64 table=main
add action=lookup comment="Rules for Subnet" disabled=no dst-address=fd00:192:168:10::/64 table=main
add action=lookup comment="Rules for Subnet" disabled=no dst-address=192.168.1.0/24 table=main
add action=lookup comment="Rules for Subnet" disabled=no dst-address=192.168.10.0/24 table=main
add action=lookup comment="Rules for Subnet" disabled=no dst-address=fe80::/10 table=main
add action=lookup comment="Rules for Proxy" disabled=no src-address=你想要代理的设备IP或网段 table=bgp-proxy
add action=lookup comment="Rules for Proxy" disabled=no src-address=你想要代理的设备IP或网段 table=bgp-proxy
add action=lookup comment="Rules for Else" disabled=no src-address=0.0.0.0/0 table=bgp-else
add action=lookup comment="Rules for Else" disabled=no src-address=::/0 table=bgp-else
设置IPv4路由,多WAN:
/ip route
add comment="Virtual Next Hop CMV4" disabled=no distance=1 dst-address=10.255.255.1/32 gateway=pppoe-out-cm \
routing-table=main scope=10 target-scope=9
add comment="Virtual Next Hop CTV4" disabled=no distance=1 dst-address=10.255.255.2/32 gateway=pppoe-out-ct \
routing-table=main scope=10 target-scope=9
add comment="Virtual Next Hop CUV4" disabled=no distance=1 dst-address=10.255.255.3/32 gateway=pppoe-out-cu \
routing-table=main scope=10 target-scope=9
add comment=NW_CHECK disabled=no distance=1 dst-address=223.5.5.5/32 gateway=pppoe-out-cu routing-table=rt-nw \
scope=30 target-scope=12
add comment=NW_CHECK disabled=no distance=1 dst-address=119.29.29.29/32 gateway=pppoe-out-ct routing-table=\
rt-nw scope=30 target-scope=12
add comment=NW_CHECK disabled=no distance=1 dst-address=114.114.114.114/32 gateway=pppoe-out-cm routing-table=\
rt-nw scope=30 target-scope=12
add comment=BGP_ELSECN disabled=no distance=21 dst-address=0.0.0.0/0 gateway=10.255.255.3 routing-table=bgp-else \
scope=30 target-scope=12
add comment=BGP_ELSECN disabled=no distance=21 dst-address=0.0.0.0/0 gateway=10.255.255.2 routing-table=bgp-proxy \
scope=30 target-scope=12
add comment=BGP_FAKEIP disabled=no distance=1 dst-address=198.18.0.0/15 gateway=192.168.10.2 routing-table=bgp-proxy \
scope=30 target-scope=10
单WAN:
/ip route
add comment=BGP_ELSECN disabled=no distance=21 dst-address=0.0.0.0/0 gateway=10.255.255.3 routing-table=bgp-else \
scope=30 target-scope=12
add comment=BGP_ELSECN disabled=no distance=21 dst-address=0.0.0.0/0 gateway=10.255.255.2 routing-table=bgp-proxy \
scope=30 target-scope=12
add comment=BGP_FAKEIP disabled=no distance=1 dst-address=198.18.0.0/15 gateway=192.168.1.2 routing-table=bgp-proxy \
scope=30 target-scope=10
设置IPv6路由,多WAN:
/ipv6 route
add comment="Virtual Next Hop CMV6" disabled=no distance=1 dst-address=fdff::1/128 gateway=pppoe-out-cm \
pref-src="" routing-table=main scope=10 target-scope=9
add comment="Virtual Next Hop CTV6" disabled=no distance=1 dst-address=fdff::2/128 gateway=pppoe-out-ct \
pref-src="" routing-table=main scope=10 target-scope=9
add comment="Virtual Next Hop CUV6" disabled=no distance=1 dst-address=fdff::3/128 gateway=pppoe-out-cu \
pref-src="" routing-table=main scope=10 target-scope=9
add comment=NW_CHECK disabled=no distance=1 dst-address=2400:3200::1/128 gateway=pppoe-out-cu pref-src="" \
routing-table=rt-nw scope=30 target-scope=10
add comment=NW_CHECK disabled=no distance=1 dst-address=2402:4e00::/128 gateway=pppoe-out-cm pref-src="" \
routing-table=rt-nw scope=30 target-scope=10
add comment=NW_CHECK disabled=no distance=1 dst-address=2402:4e00:1::/128 gateway=pppoe-out-ct pref-src="" \
routing-table=rt-nw scope=30 target-scope=10
add comment=BGP_ELSECN disabled=no distance=21 dst-address=::/0 gateway=fdff::1 pref-src="" routing-table=bgp-proxy \
scope=30 target-scope=10
add comment=BGP_ELSECN disabled=no distance=21 dst-address=::/0 gateway=fdff::3 pref-src="" routing-table=bgp-else \
scope=30 target-scope=10
单WAN:
/ipv6 route
add comment=BGP_FAKEIP disabled=no distance=1 dst-address=fd00:198:18::/48 gateway=fd00:192:168:1::2 \
pref-src="" routing-table=bgp-proxy scope=30 target-scope=10
add comment=BGP_ELSECN disabled=no distance=21 dst-address=::/0 gateway=fdff::1 pref-src="" routing-table=bgp-proxy \
scope=30 target-scope=10
add comment=BGP_ELSECN disabled=no distance=21 dst-address=::/0 gateway=fdff::3 pref-src="" routing-table=bgp-else \
scope=30 target-scope=10
打开IPv6 Client:
/ipv6 dhcp-client set [find interface~"pppoe"] disabled=no
第十五步 设置Netwatch故障切换
单WAN没有备线,无需设置
每44s,会从三线V4V6发起DNS解析请求,若正常返回,则netwatch状态为up,若失败,则netwatch状态为down
若为down则会切换备线,直至所有线路全部失效
若优先级更高的线路恢复,则会恢复为当前优先级最高的可用线路
可以自行修改脚本切换备线优先级,但需要一点点代码基础
/tool netwatch
add disabled=no dns-server=2402:4e00:: down-script="" host=www.baidu.com interval=44s name=\
check_pppoe-out-cm_v6 record-type=AAAA src-address=fd00:192:168:1::1 startup-delay=2m test-script="# --- CM V6\
\_(Main: CM -> Bak1: CT -> Bak2: CU) ---\
\n:local strCom \"Virtual Next Hop CMV6\"\
\n:local mainGw \"pppoe-out-cm\"\
\n:local bakGw1 \"pppoe-out-ct\"\
\n:local bakGw2 \"pppoe-out-cu\"\
\n\
\n:local bakGw1status [/tool netwatch get [find name=\"check_pppoe-out-ct_v6\"] status]\
\n:local bakGw2status [/tool netwatch get [find name=\"check_pppoe-out-cu_v6\"] status]\
\n:local currentGw [/ipv6 route get [find comment=\$strCom] gateway]\
\n\
\nif (\$status = \"up\") do={\
\n if (\$currentGw = \$mainGw) do={\
\n :log info \"CMV6 \E8\BF\9E\E6\8E\A5\E6\AD\A3\E5\B8\B8 (Main)\"\
\n } else={\
\n :log warning \"CMV6 \E6\81\A2\E5\A4\8D\E8\BF\9E\E6\8E\A5, \E6\AD\A3\E5\9C\A8\E5\88\87\E6\8D\A2\E5\
\9B\9E\E4\B8\BB\E7\BA\BF\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$mainGw\
\n }\
\n} else={\
\n if (\$currentGw = \$bakGw1) do={\
\n if (\$bakGw1status != \"up\") do={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CMV6: Bak1 (CT) \E4\B8\AD\E6\96\AD, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2 (CU\
2000)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CMV6: Bak1 \E4\B8\AD\E6\96\AD\E4\B8\94 Bak2 \E4\B8\8D\E5\8F\AF\E7\94\A8!\
\" }\
\n } else={ :log info \"CMV6: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak1 (CT), \E7\8A\B6\E6\80\81\
\E6\AD\A3\E5\B8\B8\" }\
\n } else={\
\n if (\$currentGw = \$bakGw2) do={\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CMV6: Bak1 (CT) \E5\B7\B2\E6\81\A2\E5\A4\8D, \E4\BB\8E Bak2 \E5\88\87\E5\
\9B\9E Bak1\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status != \"up\") do={ :log error \"CMV6: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 \
Bak2 \E4\BD\86\E6\A3\80\E6\B5\8B\E5\88\B0\E5\85\B6\E5\B7\B2\E4\B8\AD\E6\96\AD!\" } else={ :log info \"CMV6: \
\E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak2 (CU), \E7\8A\B6\E6\80\81\E6\AD\A3\E5\B8\B8\" }\
\n }\
\n } else={\
\n :log warning \"CMV6: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD, \E5\87\86\E5\A4\87\E5\88\87\E6\8D\A2\
\E5\A4\87\E7\BA\BF\"\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CMV6: \E5\88\87\E6\8D\A2\E8\87\B3 Bak1 (CT)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CMV6: Bak1 \E4\B8\8D\E5\8F\AF\E7\94\A8, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2\
\_(CU)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CMV6: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD\E4\B8\94\E6\89\80\E6\9C\89\
\E5\A4\87\E7\BA\BF\E5\9D\87\E4\B8\8D\E5\8F\AF\E7\94\A8!\" }\
\n }\
\n }\
\n }\
\n}" timeout=1s type=dns up-script=""
add disabled=no dns-server=2402:4e00:1:: down-script="" host=www.qq.com interval=44s name=check_pppoe-out-ct_v6 \
record-type=AAAA src-address=fd00:192:168:1::1 startup-delay=2m test-script="# --- CT V6 (Main: CT -> Bak1: CT\
1000 -> Bak2: CU) ---\
\n:local strCom \"Virtual Next Hop CTV6\"\
\n:local mainGw \"pppoe-out-ct\"\
\n:local bakGw1 \"pppoe-out-cm\"\
\n:local bakGw2 \"pppoe-out-cu\"\
\n\
\n:local bakGw1status [/tool netwatch get [find name=\"check_pppoe-out-cm_v6\"] status]\
\n:local bakGw2status [/tool netwatch get [find name=\"check_pppoe-out-cu_v6\"] status]\
\n:local currentGw [/ipv6 route get [find comment=\$strCom] gateway]\
\n\
\nif (\$status = \"up\") do={\
\n if (\$currentGw = \$mainGw) do={\
\n :log info \"CTV6 \E8\BF\9E\E6\8E\A5\E6\AD\A3\E5\B8\B8 (Main)\"\
\n } else={\
\n :log warning \"CTV6 \E6\81\A2\E5\A4\8D\E8\BF\9E\E6\8E\A5, \E6\AD\A3\E5\9C\A8\E5\88\87\E6\8D\A2\E5\
\9B\9E\E4\B8\BB\E7\BA\BF\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$mainGw\
\n }\
\n} else={\
\n if (\$currentGw = \$bakGw1) do={\
\n if (\$bakGw1status != \"up\") do={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CTV6: Bak1 (CM) \E4\B8\AD\E6\96\AD, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2 (CU\
2000)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CTV6: Bak1 \E4\B8\AD\E6\96\AD\E4\B8\94 Bak2 \E4\B8\8D\E5\8F\AF\E7\94\A8!\
\" }\
\n } else={ :log info \"CTV6: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak1 (CM), \E7\8A\B6\E6\80\81\
\E6\AD\A3\E5\B8\B8\" }\
\n } else={\
\n if (\$currentGw = \$bakGw2) do={\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CTV6: Bak1 (CM) \E5\B7\B2\E6\81\A2\E5\A4\8D, \E4\BB\8E Bak2 \E5\88\87\E5\
\9B\9E Bak1\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status != \"up\") do={ :log error \"CTV6: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 \
Bak2 \E4\BD\86\E6\A3\80\E6\B5\8B\E5\88\B0\E5\85\B6\E5\B7\B2\E4\B8\AD\E6\96\AD!\" } else={ :log info \"CTV6: \
\E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak2 (CU), \E7\8A\B6\E6\80\81\E6\AD\A3\E5\B8\B8\" }\
\n }\
\n } else={\
\n :log warning \"CTV6: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD, \E5\87\86\E5\A4\87\E5\88\87\E6\8D\A2\
\E5\A4\87\E7\BA\BF\"\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CTV6: \E5\88\87\E6\8D\A2\E8\87\B3 Bak1 (CM)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CTV6: Bak1 \E4\B8\8D\E5\8F\AF\E7\94\A8, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2\
\_(CU)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CTV6: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD\E4\B8\94\E6\89\80\E6\9C\89\
\E5\A4\87\E7\BA\BF\E5\9D\87\E4\B8\8D\E5\8F\AF\E7\94\A8!\" }\
\n }\
\n }\
\n }\
\n}" timeout=1s type=dns up-script=""
add disabled=no dns-server=2400:3200::1 down-script="" host=www.aliyun.com interval=44s name=\
check_pppoe-out-cu_v6 record-type=AAAA src-address=fd00:192:168:1::1 startup-delay=2m test-script="# --- CU V6\
\_(Main: CU -> Bak1: CT -> Bak2: CM) ---\
\n:local strCom \"Virtual Next Hop CUV6\"\
\n:local mainGw \"pppoe-out-cu\"\
\n:local bakGw1 \"pppoe-out-ct\"\
\n:local bakGw2 \"pppoe-out-cm\"\
\n\
\n:local bakGw1status [/tool netwatch get [find name=\"check_pppoe-out-ct_v6\"] status]\
\n:local bakGw2status [/tool netwatch get [find name=\"check_pppoe-out-cm_v6\"] status]\
\n:local currentGw [/ipv6 route get [find comment=\$strCom] gateway]\
\n\
\nif (\$status = \"up\") do={\
\n if (\$currentGw = \$mainGw) do={\
\n :log info \"CUV6 \E8\BF\9E\E6\8E\A5\E6\AD\A3\E5\B8\B8 (Main)\"\
\n } else={\
\n :log warning \"CUV6 \E6\81\A2\E5\A4\8D\E8\BF\9E\E6\8E\A5, \E6\AD\A3\E5\9C\A8\E5\88\87\E6\8D\A2\E5\
\9B\9E\E4\B8\BB\E7\BA\BF\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$mainGw\
\n }\
\n} else={\
\n if (\$currentGw = \$bakGw1) do={\
\n if (\$bakGw1status != \"up\") do={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CUV6: Bak1 (CT) \E4\B8\AD\E6\96\AD, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2 (CT\
1000)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CUV6: Bak1 \E4\B8\AD\E6\96\AD\E4\B8\94 Bak2 \E4\B8\8D\E5\8F\AF\E7\94\A8!\
\" }\
\n } else={ :log info \"CUV6: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak1 (CT), \E7\8A\B6\E6\80\81\
\E6\AD\A3\E5\B8\B8\" }\
\n } else={\
\n if (\$currentGw = \$bakGw2) do={\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CUV6: Bak1 (CT) \E5\B7\B2\E6\81\A2\E5\A4\8D, \E4\BB\8E Bak2 \E5\88\87\E5\
\9B\9E Bak1\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status != \"up\") do={ :log error \"CUV6: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 \
Bak2 \E4\BD\86\E6\A3\80\E6\B5\8B\E5\88\B0\E5\85\B6\E5\B7\B2\E4\B8\AD\E6\96\AD!\" } else={ :log info \"CUV6: \
\E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak2 (CM), \E7\8A\B6\E6\80\81\E6\AD\A3\E5\B8\B8\" }\
\n }\
\n } else={\
\n :log warning \"CUV6: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD, \E5\87\86\E5\A4\87\E5\88\87\E6\8D\A2\
\E5\A4\87\E7\BA\BF\"\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CUV6: \E5\88\87\E6\8D\A2\E8\87\B3 Bak1 (CT)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CUV6: Bak1 \E4\B8\8D\E5\8F\AF\E7\94\A8, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2\
\_(CM)\"\
\n /ipv6 route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CUV6: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD\E4\B8\94\E6\89\80\E6\9C\89\
\E5\A4\87\E7\BA\BF\E5\9D\87\E4\B8\8D\E5\8F\AF\E7\94\A8!\" }\
\n }\
\n }\
\n }\
\n}" timeout=1s type=dns up-script=""
add disabled=no dns-server=223.5.5.5 down-script="" host=www.aliyun.com interval=44s name=check_pppoe-out-cu_v4 \
record-type=A src-address=192.168.1.1 startup-delay=2m test-script="# --- CU V4 (Main: CU -> Bak1: CT \
-> Bak2: CM) ---\
\n:local strCom \"Virtual Next Hop CUV4\"\
\n:local mainGw \"pppoe-out-cu\"\
\n:local bakGw1 \"pppoe-out-ct\"\
\n:local bakGw2 \"pppoe-out-cm\"\
\n\
\n:local bakGw1status [/tool netwatch get [find name=\"check_pppoe-out-ct_v4\"] status]\
\n:local bakGw2status [/tool netwatch get [find name=\"check_pppoe-out-cm_v4\"] status]\
\n:local currentGw [/ip route get [find comment=\$strCom] gateway]\
\n\
\nif (\$status = \"up\") do={\
\n if (\$currentGw = \$mainGw) do={\
\n :log info \"CUV4 \E8\BF\9E\E6\8E\A5\E6\AD\A3\E5\B8\B8 (Main)\"\
\n } else={\
\n :log warning \"CUV4 \E6\81\A2\E5\A4\8D\E8\BF\9E\E6\8E\A5, \E6\AD\A3\E5\9C\A8\E5\88\87\E6\8D\A2\E5\
\9B\9E\E4\B8\BB\E7\BA\BF\"\
\n /ip route set [find comment=\$strCom] gateway=\$mainGw\
\n }\
\n} else={\
\n if (\$currentGw = \$bakGw1) do={\
\n if (\$bakGw1status != \"up\") do={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CUV4: Bak1 (CT) \E4\B8\AD\E6\96\AD, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2 (CT\
1000)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CUV4: Bak1 \E4\B8\AD\E6\96\AD\E4\B8\94 Bak2 \E4\B8\8D\E5\8F\AF\E7\94\A8!\
\" }\
\n } else={ :log info \"CUV4: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak1 (CT), \E7\8A\B6\E6\80\81\
\E6\AD\A3\E5\B8\B8\" }\
\n } else={\
\n if (\$currentGw = \$bakGw2) do={\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CUV4: Bak1 (CT) \E5\B7\B2\E6\81\A2\E5\A4\8D, \E4\BB\8E Bak2 \E5\88\87\E5\
\9B\9E Bak1\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status != \"up\") do={ :log error \"CUV4: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 \
Bak2 \E4\BD\86\E6\A3\80\E6\B5\8B\E5\88\B0\E5\85\B6\E5\B7\B2\E4\B8\AD\E6\96\AD!\" } else={ :log info \"CUV4: \
\E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak2 (CM), \E7\8A\B6\E6\80\81\E6\AD\A3\E5\B8\B8\" }\
\n }\
\n } else={\
\n :log warning \"CUV4: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD, \E5\87\86\E5\A4\87\E5\88\87\E6\8D\A2\
\E5\A4\87\E7\BA\BF\"\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CUV4: \E5\88\87\E6\8D\A2\E8\87\B3 Bak1 (CT)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CUV4: Bak1 \E4\B8\8D\E5\8F\AF\E7\94\A8, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2\
\_(CM)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CUV4: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD\E4\B8\94\E6\89\80\E6\9C\89\
\E5\A4\87\E7\BA\BF\E5\9D\87\E4\B8\8D\E5\8F\AF\E7\94\A8!\" }\
\n }\
\n }\
\n }\
\n}" timeout=1s type=dns up-script=""
add disabled=no dns-server=119.29.29.29 down-script="" host=www.qq.com interval=44s name=check_pppoe-out-ct_v4 \
record-type=A src-address=192.168.1.1 startup-delay=2m test-script="# --- CT V4 (Main: CT -> Bak1: CM \
-> Bak2: CU) ---\
\n:local strCom \"Virtual Next Hop CTV4\"\
\n:local mainGw \"pppoe-out-ct\"\
\n:local bakGw1 \"pppoe-out-cm\"\
\n:local bakGw2 \"pppoe-out-cu\"\
\n\
\n:local bakGw1status [/tool netwatch get [find name=\"check_pppoe-out-cm_v4\"] status]\
\n:local bakGw2status [/tool netwatch get [find name=\"check_pppoe-out-cu_v4\"] status]\
\n:local currentGw [/ip route get [find comment=\$strCom] gateway]\
\n\
\nif (\$status = \"up\") do={\
\n if (\$currentGw = \$mainGw) do={\
\n :log info \"CTV4 \E8\BF\9E\E6\8E\A5\E6\AD\A3\E5\B8\B8 (Main)\"\
\n } else={\
\n :log warning \"CTV4 \E6\81\A2\E5\A4\8D\E8\BF\9E\E6\8E\A5, \E6\AD\A3\E5\9C\A8\E5\88\87\E6\8D\A2\E5\
\9B\9E\E4\B8\BB\E7\BA\BF\"\
\n /ip route set [find comment=\$strCom] gateway=\$mainGw\
\n }\
\n} else={\
\n if (\$currentGw = \$bakGw1) do={\
\n if (\$bakGw1status != \"up\") do={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CTV4: Bak1 (CM) \E4\B8\AD\E6\96\AD, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2 (CU\
2000)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CTV4: Bak1 \E4\B8\AD\E6\96\AD\E4\B8\94 Bak2 \E4\B8\8D\E5\8F\AF\E7\94\A8!\
\" }\
\n } else={ :log info \"CTV4: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak1 (CM), \E7\8A\B6\E6\80\81\
\E6\AD\A3\E5\B8\B8\" }\
\n } else={\
\n if (\$currentGw = \$bakGw2) do={\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CTV4: Bak1 (CM) \E5\B7\B2\E6\81\A2\E5\A4\8D, \E4\BB\8E Bak2 \E5\88\87\E5\
\9B\9E Bak1\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status != \"up\") do={ :log error \"CTV4: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 \
Bak2 \E4\BD\86\E6\A3\80\E6\B5\8B\E5\88\B0\E5\85\B6\E5\B7\B2\E4\B8\AD\E6\96\AD!\" } else={ :log info \"CTV4: \
\E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak2 (CU), \E7\8A\B6\E6\80\81\E6\AD\A3\E5\B8\B8\" }\
\n }\
\n } else={\
\n :log warning \"CTV4: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD, \E5\87\86\E5\A4\87\E5\88\87\E6\8D\A2\
\E5\A4\87\E7\BA\BF\"\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CTV4: \E5\88\87\E6\8D\A2\E8\87\B3 Bak1 (CM)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CTV4: Bak1 \E4\B8\8D\E5\8F\AF\E7\94\A8, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2\
\_(CU)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CTV4: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD\E4\B8\94\E6\89\80\E6\9C\89\
\E5\A4\87\E7\BA\BF\E5\9D\87\E4\B8\8D\E5\8F\AF\E7\94\A8!\" }\
\n }\
\n }\
\n }\
\n}" timeout=1s type=dns up-script=""
add disabled=no dns-server=114.114.114.114 down-script="" host=www.baidu.com interval=44s name=\
check_pppoe-out-cm_v4 record-type=A src-address=192.168.1.1 startup-delay=2m test-script="# --- CM V4 (Mai\
n: CM -> Bak1: CT -> Bak2: CU) ---\
\n:local strCom \"Virtual Next Hop CMV4\"\
\n:local mainGw \"pppoe-out-cm\"\
\n:local bakGw1 \"pppoe-out-ct\"\
\n:local bakGw2 \"pppoe-out-cu\"\
\n\
\n:local bakGw1status [/tool netwatch get [find name=\"check_pppoe-out-ct_v4\"] status]\
\n:local bakGw2status [/tool netwatch get [find name=\"check_pppoe-out-cu_v4\"] status]\
\n:local currentGw [/ip route get [find comment=\$strCom] gateway]\
\n\
\nif (\$status = \"up\") do={\
\n if (\$currentGw = \$mainGw) do={\
\n :log info \"CMV4 \E8\BF\9E\E6\8E\A5\E6\AD\A3\E5\B8\B8 (Main)\"\
\n } else={\
\n :log warning \"CMV4 \E6\81\A2\E5\A4\8D\E8\BF\9E\E6\8E\A5, \E6\AD\A3\E5\9C\A8\E5\88\87\E6\8D\A2\E5\
\9B\9E\E4\B8\BB\E7\BA\BF\"\
\n /ip route set [find comment=\$strCom] gateway=\$mainGw\
\n }\
\n} else={\
\n if (\$currentGw = \$bakGw1) do={\
\n if (\$bakGw1status != \"up\") do={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CMV4: Bak1 (CT) \E4\B8\AD\E6\96\AD, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2 (CU\
2000)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CMV4: Bak1 \E4\B8\AD\E6\96\AD\E4\B8\94 Bak2 \E4\B8\8D\E5\8F\AF\E7\94\A8!\
\" }\
\n } else={ :log info \"CMV4: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak1 (CT), \E7\8A\B6\E6\80\81\
\E6\AD\A3\E5\B8\B8\" }\
\n } else={\
\n if (\$currentGw = \$bakGw2) do={\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CMV4: Bak1 (CT) \E5\B7\B2\E6\81\A2\E5\A4\8D, \E4\BB\8E Bak2 \E5\88\87\E5\
\9B\9E Bak1\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status != \"up\") do={ :log error \"CMV4: \E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 \
Bak2 \E4\BD\86\E6\A3\80\E6\B5\8B\E5\88\B0\E5\85\B6\E5\B7\B2\E4\B8\AD\E6\96\AD!\" } else={ :log info \"CMV4: \
\E6\AD\A3\E5\9C\A8\E4\BD\BF\E7\94\A8 Bak2 (CU), \E7\8A\B6\E6\80\81\E6\AD\A3\E5\B8\B8\" }\
\n }\
\n } else={\
\n :log warning \"CMV4: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD, \E5\87\86\E5\A4\87\E5\88\87\E6\8D\A2\
\E5\A4\87\E7\BA\BF\"\
\n if (\$bakGw1status = \"up\") do={\
\n :log warning \"CMV4: \E5\88\87\E6\8D\A2\E8\87\B3 Bak1 (CT)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw1\
\n } else={\
\n if (\$bakGw2status = \"up\") do={\
\n :log warning \"CMV4: Bak1 \E4\B8\8D\E5\8F\AF\E7\94\A8, \E5\88\87\E6\8D\A2\E8\87\B3 Bak2\
\_(CU)\"\
\n /ip route set [find comment=\$strCom] gateway=\$bakGw2\
\n } else={ :log error \"CMV4: \E4\B8\BB\E7\BA\BF\E4\B8\AD\E6\96\AD\E4\B8\94\E6\89\80\E6\9C\89\
\E5\A4\87\E7\BA\BF\E5\9D\87\E4\B8\8D\E5\8F\AF\E7\94\A8!\" }\
\n }\
\n }\
\n }\
\n}" timeout=1s type=dns up-script=""
至此,RouterOS基础设置部分就全部完成了,因为我这没有cm的网络,只有两条ct一条cu,所以在替换时可能有些地方有所遗漏,大家可以积极指出,若发一条命令里既有ct又有cm,大概率就是没换全导致的,可以自行先替换一下等我后续修改.