# routerboard: yes # model: RB4011iGS+ # serial-number: B8F50BD25787 # firmware-type: al2 # factory-firmware: 6.44.5 # current-firmware: 7.19.4 # upgrade-firmware: 7.19.4 # # channel: stable # installed-version: 7.19.4 # # Flags: U - UNDOABLE # Columns: ACTION, BY, POLICY, TIME # ACTION BY POLICY TIME # U script removed marcos write 2025-09-24 08:54:43 # U script removed marcos write 2025-09-24 08:54:40 # U changed script settings marcos write 2025-09-22 16:51:01 # U changed script settings marcos write 2025-09-13 17:32:30 # U changed script settings marcos write 2025-09-11 11:39:42 # U changed script settings marcos write 2025-09-05 15:03:53 # U script removed marcos write 2025-09-05 15:03:47 # # 2025-10-01 06:16:09 by RouterOS 7.19.4 # software id = SEU3-HDQX # # model = RB4011iGS+ # serial number = B8F50BD25787 /interface bridge add dhcp-snooping=yes fast-forward=no igmp-snooping=yes igmp-version=3 mld-version=2 multicast-querier=yes name=bridge_LAN port-cost-mode=short add name=bridge_vlan40 port-cost-mode=short add name=bridge_vlan50 port-cost-mode=short add fast-forward=no igmp-snooping=yes igmp-version=3 mld-version=2 multicast-querier=yes name=bridge_vlan99 port-cost-mode=short add fast-forward=no name=bridge_vlan109 port-cost-mode=short add name=bridge_vlan152 /interface ethernet set [ find default-name=ether1 ] comment="MGMT - UNTAGGED VLAN99" mac-address=C4:AD:34:97:B8:34 set [ find default-name=ether2 ] mac-address=C4:AD:34:97:B8:35 set [ find default-name=ether3 ] mac-address=C4:AD:34:97:B8:36 set [ find default-name=ether4 ] mac-address=C4:AD:34:97:B8:37 set [ find default-name=ether5 ] mac-address=C4:AD:34:97:B8:38 set [ find default-name=ether6 ] comment="Epoint1 - UP" mac-address=C4:AD:34:97:B8:39 set [ find default-name=ether7 ] comment="Servicio casa/negocio - Ciber Cafe" mac-address=C4:AD:34:97:B8:3A set [ find default-name=ether8 ] comment="Servicio casa/negocio" mac-address=C4:AD:34:97:B8:3B set [ find default-name=ether9 ] comment="Sensor de Linea (TP-Link) - 172.22.4.71" mac-address=C4:AD:34:97:B8:3C set [ find default-name=ether10 ] comment="Servicio casa/negocio" mac-address=C4:AD:34:97:B8:3D set [ find default-name=sfp-sfpplus1 ] comment=TRUNK_MAIN mac-address=C4:AD:34:97:B8:3E /interface vlan add interface=sfp-sfpplus1 name=vlan40 vlan-id=40 add interface=sfp-sfpplus1 name=vlan50-BRS_Nodo vlan-id=50 add interface=sfp-sfpplus1 name=vlan99 vlan-id=99 add interface=sfp-sfpplus1 name=vlan109_IN_CiberC vlan-id=109 add interface=ether7 name=vlan109_OUT_CiberC vlan-id=109 add interface=sfp-sfpplus1 name=vlan152_IN_PueblaAF vlan-id=152 add interface=ether6 name=vlan_40 vlan-id=40 add interface=ether6 name=vlan_50-BRS_Nodo vlan-id=50 add interface=ether6 name=vlan_99 vlan-id=99 add interface=ether6 name="vlan_109_por backup" vlan-id=109 add interface=ether6 name=vlan_152_OUT_PueblaAF vlan-id=152 /interface list add name=MGMT /interface lte apn set [ find default=yes ] ip-type=ipv4 use-network-apn=no /ip smb users set [ find default=yes ] disabled=yes /port set 0 name=serial0 set 1 name=serial1 /routing bgp template set default disabled=no output.network=bgp-networks /routing ospf instance add disabled=no name=default-v2 add disabled=no name=default-v3 version=3 /routing ospf area add disabled=yes instance=default-v2 name=backbone-v2 add disabled=yes instance=default-v3 name=backbone-v3 /snmp community add addresses=192.168.200.253/32,192.168.200.155/32 authentication-protocol=SHA1 encryption-protocol=AES name=pnet /system logging action add disk-file-count=5 disk-file-name=Critical name=CriticalLogs target=disk add disk-file-count=5 disk-file-name=Error name=ErrorLogs target=disk add disk-file-count=5 disk-file-name=Info name=InfoLogs target=disk add disk-file-count=5 disk-file-name=Interfaces name=InterfacesLogs target=disk add disk-file-count=5 disk-file-name=Warning name=WarningLogs target=disk add name=DudeLogs remote=192.168.200.253 remote-log-format=syslog syslog-facility=local6 target=remote add name=GrafanaLogs remote=192.168.200.168 remote-port=1514 target=remote add name=GrafanaLogsAlert remote=192.168.200.168 remote-log-format=syslog remote-port=1514 src-address=10.99.0.62 syslog-facility=local6 target=remote add name=GrafanaLogsInfo remote=192.168.200.168 remote-log-format=syslog remote-port=1514 src-address=10.99.0.62 syslog-facility=local7 target=remote /user group add name=dude policy="local,reboot,read,write,test,winbox,web,!telnet,!ssh,!ftp,!policy,!password,!sniff,!sensitive,!api,!romon,!rest-api" add name=oxidized policy="ssh,read,!local,!telnet,!ftp,!reboot,!write,!policy,!test,!winbox,!password,!web,!sniff,!sensitive,!api,!romon,!rest-api" add name=pnet policy="local,telnet,ssh,ftp,reboot,read,write,test,winbox,password,web,sniff,sensitive,api,romon,rest-api,!policy" /interface bridge filter add action=drop chain=forward in-interface=ether6 out-interface=ether8 add action=drop chain=forward in-interface=ether6 out-interface=ether9 add action=drop chain=forward in-interface=ether6 out-interface=ether10 add action=drop chain=forward in-interface=ether8 out-interface=ether6 add action=drop chain=forward in-interface=ether8 out-interface=ether9 add action=drop chain=forward in-interface=ether8 out-interface=ether10 add action=drop chain=forward in-interface=ether9 out-interface=ether6 add action=drop chain=forward in-interface=ether9 out-interface=ether8 add action=drop chain=forward in-interface=ether9 out-interface=ether10 add action=drop chain=forward in-interface=ether10 out-interface=ether6 add action=drop chain=forward in-interface=ether10 out-interface=ether8 add action=drop chain=forward in-interface=ether10 out-interface=ether9 /interface bridge port add bridge=bridge_LAN ingress-filtering=no interface=ether6 internal-path-cost=10 path-cost=10 add bridge=bridge_LAN ingress-filtering=no interface=ether8 internal-path-cost=10 path-cost=10 add bridge=bridge_LAN ingress-filtering=no interface=ether9 internal-path-cost=10 path-cost=10 add bridge=bridge_LAN ingress-filtering=no interface=ether10 internal-path-cost=10 path-cost=10 add bridge=bridge_vlan109 ingress-filtering=no interface="vlan_109_por backup" internal-path-cost=10 path-cost=10 add bridge=bridge_vlan109 ingress-filtering=no interface=vlan109_OUT_CiberC internal-path-cost=10 path-cost=10 add bridge=bridge_vlan40 ingress-filtering=no interface=vlan_40 internal-path-cost=10 path-cost=10 add bridge=bridge_vlan99 ingress-filtering=no interface=ether1 internal-path-cost=10 path-cost=10 add bridge=bridge_vlan109 ingress-filtering=no interface=vlan109_IN_CiberC internal-path-cost=10 path-cost=10 add bridge=bridge_vlan40 ingress-filtering=no interface=vlan40 internal-path-cost=10 path-cost=10 add bridge=bridge_vlan99 ingress-filtering=no interface=vlan99 internal-path-cost=10 path-cost=10 add bridge=bridge_vlan99 ingress-filtering=no interface=vlan_99 internal-path-cost=10 path-cost=10 add bridge=bridge_vlan50 ingress-filtering=no interface=vlan50-BRS_Nodo internal-path-cost=10 path-cost=10 add bridge=bridge_vlan50 ingress-filtering=no interface=vlan_50-BRS_Nodo internal-path-cost=10 path-cost=10 add bridge=bridge_vlan152 interface=vlan152_IN_PueblaAF add bridge=bridge_vlan152 interface=vlan_152_OUT_PueblaAF /ip neighbor discovery-settings set discover-interface-list=MGMT /interface list member add interface=bridge_vlan99 list=MGMT add interface=ether9 list=MGMT /interface ovpn-server server add auth=sha1,md5 mac-address=FE:4E:07:24:EC:03 name=ovpn-server1 /ip address add address=172.22.4.1/24 interface=bridge_LAN network=172.22.4.0 add address=10.10.0.22/29 interface=bridge_vlan40 network=10.10.0.16 add address=10.99.0.62/24 comment=MGMT interface=bridge_vlan99 network=10.99.0.0 /ip dhcp-relay add dhcp-server=10.10.0.17 disabled=no interface=bridge_LAN local-address=172.22.4.1 name=Relay_SR /ip dns set servers=8.8.8.8,2001:4860:4860::8888,1.1.1.1,2606:4700:4700::1111 /ip firewall address-list add address=172.22.17.0/24 comment=VQZ list=nodos-privadas add address=172.22.16.0/24 comment=MLK list=nodos-privadas add address=172.22.0.0/24 comment=R60 list=nodos-privadas add address=172.22.8.0/23 comment=R50 list=nodos-privadas add address=172.22.6.0/23 comment=SB list=nodos-privadas add address=172.22.1.0/24 comment=MEC-CMP list=nodos-privadas add address=172.22.2.0/23 comment=FLB list=nodos-privadas add address=172.22.10.0/24 comment=RDM list=nodos-privadas add address=172.22.11.0/24 comment=FO list=nodos-privadas add address=172.22.12.0/24 comment=PEDREGAL list=nodos-privadas add address=172.22.13.0/24 comment=3RA list=nodos-privadas add address=172.22.14.0/24 comment=BNT list=nodos-privadas add address=172.22.18.0/24 comment=CBL list=nodos-privadas add address=172.22.19.0/24 comment=ISG list=nodos-privadas /ip firewall filter add action=drop chain=input comment="Drop Invalid connections" connection-state=invalid add action=accept chain=input comment="Allow Established/Related/Untracked connections" connection-state=established,related,untracked add action=accept chain=input comment="Allow UDP" protocol=udp add action=accept chain=input comment="Allow ICMP" protocol=icmp add action=accept chain=input comment=Oxidized dst-port=22 in-interface=bridge_vlan99 protocol=tcp add action=accept chain=input comment="Allow Winbox" dst-port=3380,8240,8291 protocol=tcp add action=accept chain=input comment="BW test" dst-port=2000 protocol=tcp add action=jump chain=input comment="synflood policy3" disabled=yes jump-target=syn-flood protocol=tcp tcp-flags=syn add action=accept chain=syn-flood disabled=yes limit=100,5:packet add action=drop chain=syn-flood disabled=yes add action=log chain=input comment="Log everything else" disabled=yes log-prefix="DROP INPUT" add action=drop chain=input comment="Drop everything else" add action=drop chain=forward comment="Drop para trafico dirigido a las redes PRIVADAS de los NODOS (Address Lists)" dst-address-list=nodos-privadas src-address=172.22.4.0/24 add action=jump chain=forward comment="SYN Flood protect" connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn add action=accept chain=SYN-Protect connection-state=new limit=400,5:packet protocol=tcp tcp-flags=syn add action=drop chain=SYN-Protect connection-state=new protocol=tcp tcp-flags=syn /ip firewall raw add action=drop chain=prerouting comment="BCP38 - SR" in-interface=bridge_LAN src-address=!172.22.4.0/24 /ip firewall service-port set ftp disabled=yes set tftp disabled=yes set h323 disabled=yes set sip disabled=yes set pptp disabled=yes set udplite disabled=yes set dccp disabled=yes set sctp disabled=yes /ip ipsec profile set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5 /ip route add disabled=no distance=10 dst-address=0.0.0.0/0 gateway=10.10.0.17 add comment=RED_VPN disabled=no dst-address=10.100.0.0/24 gateway=10.99.0.1 add comment=RED_NOC disabled=no distance=1 dst-address=192.168.200.0/24 gateway=10.99.0.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10 add comment=Red_VPN-WireGuard disabled=no distance=1 dst-address=10.100.2.0/24 gateway=10.99.0.1 routing-table=main scope=30 suppress-hw-offload=no target-scope=10 /ip service set ftp disabled=yes set ssh address=192.168.200.155/32 set telnet disabled=yes set www disabled=yes set api disabled=yes set api-ssl disabled=yes /ip smb shares set [ find default=yes ] directory=/pub /ipv6 nd set [ find default=yes ] advertise-dns=no /routing bfd configuration add disabled=no /snmp set contact=pnet@puntonetinternet.com enabled=yes location="Nodo SR" trap-community=pnet trap-generators=interfaces trap-interfaces=bridge_vlan99 trap-version=2 /system clock set time-zone-name=America/Argentina/Mendoza /system identity set name="SR_Nodo (RB4011iGS+)" /system logging set 1 action=ErrorLogs set 2 action=WarningLogs set 3 action=CriticalLogs add action=GrafanaLogsAlert topics=interface,info add action=GrafanaLogsAlert topics=account,info add action=DudeLogs topics=info add action=GrafanaLogsAlert topics=script,info add action=GrafanaLogsAlert topics=system,info /system ntp client set enabled=yes /system ntp client servers add address=192.168.200.1 /system resource irq rps set sfp-sfpplus1 disabled=no /system routerboard settings set auto-upgrade=yes /system scheduler add interval=2w1d name="Envio de backups por correo" on-event=backup_mail policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=2023-04-01 start-time=04:00:00 add interval=10m name=Monitor_power on-event=voltmon policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup add disabled=yes interval=4w2d name="Package upgrade" on-event="system package update install" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2019-04-18 start-time=05:05:00 add disabled=yes interval=4w2d name="Routerboard upgrade" on-event=":global Var1\r\n:global Var2\r\n:set Var1 \"\$[/system package get system version]\"\r\n:set Var2 \"\$[/system routerboard get current-firmware]\"\r\n:if (\$Var1>\$Var2) do={/system routerboard upgrade;\r\n/system reboot;\r\n}" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2019-04-18 start-time=05:10:00 add name=Reinicio-1 on-event="/system reboot" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2025-08-26 start-time=05:00:00 add disabled=yes interval=30s name=InterfaceState on-event=InterfaceState policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup add name=Reinicio-2 on-event="/system reboot" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2025-08-26 start-time=05:10:00 add disabled=yes interval=10m name=Monitor_power_test on-event=voltmon policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup /system script add dont-require-permissions=no name=backup_mail owner=marcos policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":log info \"backup beginning now\"\r\n:global backupfile ([/system identity get name] . \"-\" . [/system clock\_get time])\r\n/system backup save name=\$backupfile\r\n:log info \"backup pausing for 10s\"\r\n:delay 10s\r\n:log info \"backup being emailed\"\r\n/tool e-mail send to=puntonetinet@gmail.com subject=([/system identity get name] . \\ \" Backup\") from=\"MKT SR Core \"\_file=\$backupfile \r\n:log info \"backup finished\"" add dont-require-permissions=no name=voltmon owner=marcos policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/system health\r\n:local tempSystem [:tonum ([get [find where name=temperature]]->\"value\")]\r\n:local voltSystem ([get [find where name=voltage]]->\"value\")\r\n:local tempMax 60\r\n:local voltMin 25\r\n\r\n# Check Temperature\r\n:if (\$tempSystem >= \$tempMax) do={\r\n :log error \"HIGH Temperature: \$tempSystem\\C2\\BA\\43\"\r\n /tool e-mail send to=pozziandres@gmail.com cc=emi.puntonet@gmail.com\_subject=\"HIGH Temperature: \$tempSystem\\C2\\BA\\43\"\r\n} else={\r\n :log info \"Temperature OK: \$tempSystem\\BA\\43\"\r\n}\r\n\r\n# Check Voltage\r\n:if (\$voltSystem <= \$voltMin) do={\r\n # Enviar log\r\n #:log error \"LOW Voltage: \$voltSystem V\"\r\n # Enviar mail\r\n /tool e-mail send to=pozziandres@gmail.com cc=emi.puntonet@gmail.com subject=\"LOW Voltage: \$voltSystem V - Nodo: \$nodo\"\r\n # Enviar Telegram\r\n :local URL (\"https://api.telegram.org/bot8336052960:AAF-Iekdc8EbAD3nfpxiJSj6eQgKWnsxfIU/sendMessage\?chat_id=-373797011&text=LOW Voltage: \$voltSystem V - Nodo_SR\");\r\n /tool fetch url=\$URL keep-result=no;\r\n} else={\r\n # Enviar log\r\n :log info \"Voltage OK: \$voltSystem V\"\r\n}" /tool e-mail set from="SR_NODO " port=465 server=mail.puntonetinternet.com tls=yes user=noc@puntonetinternet.com /tool graphing interface add interface=vlan_40 /tool netwatch add comment=SR_EsteAC disabled=yes down-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core \" subject=\"SR_EsteAC - Nodo SR - 172.22.4.45 is DOWN\" body=\" \"" host=172.22.4.45 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT\_SR Core \" subject=\"SR_EsteAC - Nodo SR - 172.22.4.45 is UP\" body=\"\"" add comment="Sensor de Linea (TP-Link) " disabled=no down-script="/tool e-mail\_send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com,axelboliva2016@gmail.com,ignaciolucero578@gmail.com from=\"MKT SR Core\_\" subject=\"CORTE DE ENERGIA EN NODO SR\" body=\" \"" host=172.22.4.71 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com,axelboliva2016@gmail.com,ignaciolucero578@gmail.com from=\"MKT SR Core \"\_subject=\"ENERGIA RESTABLECIDA EN NODO SR\" body=\"\"" add comment=SR_OesteAC disabled=yes down-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core \" subject=\"SR_OesteAC - Nodo SR - 172.22.4.34 is DOWN\" body=\" \"" host=172.22.4.34 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT\_SR Core \" subject=\"SR_OesteAC - Nodo SR - 172.22.4.34 is UP\" body=\" \"" add comment=SR_OesteAC_Bajo disabled=yes down-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core \" subject=\"SR_OesteAC_Bajo - Nodo SR\_- 172.22.4.38 is DOWN\" body=\" \"" host=172.22.4.38 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core \" subject=\"SR_OesteAC_Bajo - Nodo SR - 172.22.4.38 is UP\" body=\" \"" add comment=SR_AMO disabled=yes down-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core\_\" subject=\"SR_AMO - Nodo SR - 172.22.4.48 is\_DOWN\" body=\" \"" host=172.22.4.48 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT\_SR Core \" subject=\"SR_AMO - Nodo SR - 172.22.4.48 is UP\" body=\"\"" add comment=SR_SurAC disabled=yes down-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core \" subject=\"SR_SurAC - Nodo SR - 172.22.4.51\_is DOWN\" body=\" \"" host=172.22.4.51 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT\_SR Core \" subject=\"SR_SurAC - Nodo SR - 172.22.4.51 is UP\" body=\"\"" add comment=SR_NorOesteAC_Jardin disabled=yes down-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core \" subject=\"SR_NorOesteAC_Jardin\_- Nodo SR - 172.22.4.52 is DOWN\" body=\" \"" host=172.22.4.52 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core \" subject=\"SR_NorOesteAC_Jardin - Nodo SR - 172.22.4.52 is UP\" body=\"\"" add comment=SR_SurOeste disabled=yes down-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR\_Core \" subject=\"SR_SurOeste - Nodo SR - 172.22.4.61 is DOWN\" body=\" \"" host=172.22.4.61 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT\_SR Core \" subject=\"SR_SurOeste - Nodo SR - 172.22.4.61 is UP\" body=\"\"" add comment=SR_NorteAC disabled=yes down-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT SR Core \" subject=\"SR_NorteAC - Nodo SR - 172.22.4.62 is DOWN\" body=\" \"" host=172.22.4.62 http-codes="" interval=3m test-script="" timeout=3m type=simple up-script="/tool e-mail send to=pozziandres@gmail.com cc=mjbenegas@gmail.com,emi.puntonet@gmail.com from=\"MKT\_SR Core \" subject=\"SR_NorteAC - Nodo SR - 172.22.4.62 is UP\" body=\"\""