This is a basic PPPoE with VLAN10 Fibre configuration script for MikroTik Routers running the latest RouterOS V7.


The script assumes you have a blank Routerboard, if your device has existing configuration you should run this command before loading the script:


# Warning, this will erase all configuration and require connection via MAC Address in WinBox

/system/reset-configuration no-defaults=yes


Simply copy and paste the full script below (include the #) into the MikroTik terminal. This script will configure Ether1 as the WAN port with VLAN10 + PPPoE Client, and Ether2 as the LAN port. Additional ports can be added to the bridge at the end of the script.


Note the PPPoE credentials are set for a Spark connection, so be sure to update the user and password to match your provider.


# Start of fibre configuration script

/interface bridge

add name=bridge1

/interface vlan

add interface=ether1 name=vlan10 vlan-id=10

/interface pppoe-client

add add-default-route=yes disabled=no interface=vlan10 name=pppoe-out1 \

    use-peer-dns=yes user=user@spark.co.nz password=password

/interface list

add name=WAN

add name=LAN

/ip pool

add name=dhcp_pool0 ranges=192.168.88.25-192.168.88.250

/ip dhcp-server

add address-pool=dhcp_pool0 interface=bridge1 lease-time=1h name=dhcp1

/interface list member

add interface=pppoe-out1 list=WAN

add interface=bridge1 list=LAN

/ip address

add address=192.168.88.1/24 interface=bridge1 network=192.168.88.0

/ip dhcp-server network

add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1

/ip dns

set allow-remote-requests=yes

/ip firewall filter

add action=accept chain=input comment="accept established,related,untracked" \

    connection-state=established,related,untracked

add action=drop chain=input comment="drop invalid" connection-state=invalid

add action=accept chain=input comment="accept ICMP" protocol=icmp

add action=accept chain=input comment=\

    "accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1

add action=drop chain=input comment="drop all not coming from LAN" \

    in-interface-list=!LAN

add action=accept chain=forward comment="accept in ipsec policy" \

    ipsec-policy=in,ipsec

add action=accept chain=forward comment="accept out ipsec policy" \

    ipsec-policy=out,ipsec

add action=fasttrack-connection chain=forward comment=fasttrack \

    connection-state=established,related hw-offload=yes

add action=accept chain=forward comment=\

    "accept established,related, untracked" connection-state=\

    established,related,untracked

add action=drop chain=forward comment="drop invalid" connection-state=invalid

add action=drop chain=forward comment="drop all from WAN not DSTNATed" \

    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

/ip firewall nat

add action=masquerade chain=srcnat comment=masquerade ipsec-policy=out,none \

    out-interface-list=WAN

# Remember to add additional ports to the bridge as needed

/interface bridge port

add bridge=bridge1 interface=ether2

# End of fibre configuration script


Optional IPV6 Firewall configuration:


# Start of IPV6 Firewall Script

/ipv6 firewall address-list

add address=::/128 comment="unspecified address" list=bad_ipv6

add address=::1/128 comment=lo list=bad_ipv6

add address=fec0::/10 comment=site-local list=bad_ipv6

add address=::ffff:0.0.0.0/96 comment=ipv4-mapped list=bad_ipv6

add address=::/96 comment="ipv4 compat" list=bad_ipv6

add address=100::/64 comment="discard only " list=bad_ipv6

add address=2001:db8::/32 comment=documentation list=bad_ipv6

add address=2001:10::/28 comment=ORCHID list=bad_ipv6

add address=3ffe::/16 comment=6bone list=bad_ipv6

/ipv6 firewall filter

add action=accept chain=input comment="accept established,related,untracked" \

    connection-state=established,related,untracked

add action=drop chain=input comment="drop invalid" connection-state=invalid

add action=accept chain=input comment="accept ICMPv6" protocol=icmpv6

add action=accept chain=input comment="accept UDP traceroute" port=\

    33434-33534 protocol=udp

add action=accept chain=input comment=\

    "accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp \

    src-address=fe80::/10

add action=accept chain=input comment="accept IKE" dst-port=500,4500 \

    protocol=udp

add action=accept chain=input comment="accept ipsec AH" protocol=ipsec-ah

add action=accept chain=input comment="accept ipsec ESP" protocol=ipsec-esp

add action=accept chain=input comment="accept all that matches ipsec policy" \

    ipsec-policy=in,ipsec

add action=drop chain=input comment=\

    "drop everything else not coming from LAN" in-interface-list=!LAN

add action=accept chain=forward comment=\

    "accept established,related,untracked" connection-state=\

    established,related,untracked

add action=drop chain=forward comment="drop invalid" connection-state=invalid

add action=drop chain=forward comment="drop packets with bad src ipv6" \

    src-address-list=bad_ipv6

add action=drop chain=forward comment="drop packets with bad dst ipv6" \

    dst-address-list=bad_ipv6

add action=drop chain=forward comment="rfc4890 drop hop-limit=1" hop-limit=\

    equal:1 protocol=icmpv6

add action=accept chain=forward comment="accept ICMPv6" protocol=icmpv6

add action=accept chain=forward comment="accept HIP" protocol=139

add action=accept chain=forward comment="accept IKE" dst-port=500,4500 \

    protocol=udp

add action=accept chain=forward comment="accept ipsec AH" protocol=ipsec-ah

add action=accept chain=forward comment="accept ipsec ESP" protocol=ipsec-esp

add action=accept chain=forward comment=\

    "accept all that matches ipsec policy" ipsec-policy=in,ipsec

add action=drop chain=forward comment=\

    "drop everything else not coming from LAN" in-interface-list=!LAN