General • ipv6 ND and vlan leaks

3: wlp0s20f3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000    link/ether f6:95:79:87:a3:cd brd ff:ff:ff:ff:ff:ff permaddr 30:89:4a:e0:21:5d    inet 192.168.10.63/24 brd 192.168.10.255 scope global dynamic noprefixroute wlp0s20f3       valid_lft 82336sec preferred_lft 82336sec    inet6 2a01:XXX:XX:b6b1:XXXX:XXXX:XXXX:XXXX/64 scope global dynamic noprefixroute        valid_lft 43157sec preferred_lft 1757sec    inet6 2a01:XXX:XX:b6b2:XXXX:XXXX:XXXX:XXXX/64 scope global dynamic noprefixroute 

# 2025-03-31 13:57:43 by RouterOS 7.18.2# software id = VL6J-0M77## model = RB4011iGS+# serial number = B8F30BFFDC65/interface bridgeadd admin-mac=C4:AD:34:73:D7:A1 auto-mac=no comment=bridge-lan frame-types=admit-only-vlan-tagged igmp-snooping=yes name=bridge vlan-filtering=yes/interface ethernetset [ find default-name=ether1 ] comment=Freeboxset [ find default-name=ether2 ] comment=tacset [ find default-name=ether3 ] comment=Mgmtset [ find default-name=ether4 ] comment="Local Interface 192.168.4.1/24"set [ find default-name=ether5 ] comment=Trunkset [ find default-name=ether6 ] comment="Trunk (qnap) 1/2"set [ find default-name=ether7 ] comment="Trunk (qnap) 2/2"set [ find default-name=ether8 ] comment=Lanset [ find default-name=ether9 ] comment="Trunk (hp2915) 1/2"set [ find default-name=ether10 ] comment="Trunk (hp2915) 2/2"/interface wireguardadd listen-port=13231 mtu=1420 name=wg0/interface vlanadd interface=sfp-sfpplus1 name=vlan-internet vlan-id=666add interface=bridge name=vlan10-lan vlan-id=10add interface=bridge name=vlan20-iot vlan-id=20add interface=bridge name=vlan30-cctv vlan-id=30add interface=bridge name=vlan40-srv vlan-id=40add interface=bridge name=vlan50-guest vlan-id=50add interface=bridge name=vlan99-mgmt vlan-id=99/interface bondingadd comment=hp2915 mode=802.3ad name=hp2915 slaves=ether9,ether10 transmit-hash-policy=layer-3-and-4add comment=qnap mode=802.3ad name=qnap slaves=ether6,ether7 transmit-hash-policy=layer-3-and-4/interface listadd comment=defconf name=WANadd comment=defconf name=LANadd name=VLANadd name=MGMT/ip pooladd name=dhcp-mgmt ranges=192.168.99.10-192.168.99.254add name=dhcp-lan ranges=192.168.10.50-192.168.10.99add name=dhcp-iot ranges=192.168.20.50-192.168.20.99add name=dhcp-guest ranges=192.168.50.50-192.168.50.99add name=dhcp-cctv ranges=192.168.30.50-192.168.30.99add name=dhcp-srv ranges=192.168.40.50-192.168.40.99/ip dhcp-serveradd address-pool=dhcp-lan interface=vlan10-lan lease-script=lease-script lease-time=1d name=dhcp-lanadd address-pool=dhcp-iot interface=vlan20-iot lease-script=lease-script lease-time=1d name=dhcp-iotadd address-pool=dhcp-guest interface=vlan50-guest lease-script=lease-script lease-time=1d name=dhcp-guestadd address-pool=dhcp-mgmt interface=vlan99-mgmt lease-script=lease-script lease-time=1d name=dhcp-mgmtadd address-pool=dhcp-cctv interface=vlan30-cctv lease-script=lease-script lease-time=1d name=dhcp-cctvadd address-pool=dhcp-srv interface=vlan40-srv lease-script=lease-script lease-time=1d name=dhcp-srv/ipv6 pooladd name=lan-ipv6 prefix=2a01:XXX:XX:b6b1::/64 prefix-length=64/portset 0 name=serial0set 1 name=serial1/system logging actionadd name=logserver remote=192.168.40.50 remote-log-format=syslog remote-port=10514 syslog-facility=local6 syslog-severity=emergency target=remote/disk settingsset auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes/interface bridge portadd bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=10add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=99add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether5 pvid=100add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether8 pvid=10add bridge=bridge comment="qnap trunk" frame-types=admit-only-untagged-and-priority-tagged interface=qnap pvid=10add bridge=bridge comment="hp2915 trunk" frame-types=admit-only-vlan-tagged interface=hp2915 pvid=100add bridge=bridge comment=sfp frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 pvid=100/ip neighbor discovery-settingsset discover-interface-list=MGMT/ipv6 settingsset accept-router-advertisements=no/interface bridge vlanadd bridge=bridge comment=main-vlan tagged=bridge,ether5,hp2915 untagged=ether2,ether8,qnap vlan-ids=10add bridge=bridge comment=mgmt-vlan tagged=bridge,ether5,qnap,hp2915,sfp-sfpplus1 untagged=ether3 vlan-ids=99add bridge=bridge comment=guest-vlan tagged=bridge,ether5,hp2915,ether2,qnap vlan-ids=50add bridge=bridge comment=iot-vlan tagged=bridge,ether5,hp2915,qnap,ether2 vlan-ids=20add bridge=bridge comment=cctv-vlan tagged=bridge,hp2915 vlan-ids=30add bridge=bridge comment=srv-vlan tagged=bridge,hp2915 vlan-ids=40/interface list memberadd comment=defconf interface=ether1 list=WANadd interface=ether4 list=LANadd interface=vlan10-lan list=LANadd interface=vlan10-lan list=VLANadd interface=vlan20-iot list=VLANadd interface=vlan50-guest list=VLANadd interface=vlan99-mgmt list=MGMTadd interface=vlan10-lan list=MGMTadd interface=vlan99-mgmt list=VLANadd interface=wg0 list=VLANadd interface=vlan30-cctv list=VLANadd interface=vlan40-srv list=VLANadd interface=vlan-internet list=WAN/interface wireguard peersadd allowed-address=10.10.10.0/30,192.168.88.0/24 interface=wg0 name=tic-et-tac-fw public-key="*******"/ip addressadd address=192.168.4.1/24 interface=ether4 network=192.168.4.0add address=192.168.10.254/24 comment=vlan10-lan interface=vlan10-lan network=192.168.10.0add address=192.168.20.254/24 comment=vlan20-iot interface=vlan20-iot network=192.168.20.0add address=192.168.50.254/24 comment=vlan50-guest interface=vlan50-guest network=192.168.50.0add address=192.168.99.254/24 comment=vlan99-mgmt interface=vlan99-mgmt network=192.168.99.0add address=10.10.10.1/30 interface=wg0 network=10.10.10.0add address=192.168.30.254/24 comment=vlan30-cctv interface=vlan30-cctv network=192.168.30.0add address=192.168.40.254/24 comment=vlan40-srv interface=vlan40-srv network=192.168.40.0/ip cloudset ddns-enabled=yes ddns-update-interval=10m/ip dhcp-clientadd comment=defconf interface=ether1 use-peer-dns=no use-peer-ntp=noadd disabled=yes interface=vlan-internet use-peer-dns=no/ip dhcp-server networkadd address=10.0.10.0/24 dns-server=10.0.10.254 gateway=10.0.10.254 netmask=24add address=192.168.10.0/24 dns-server=192.168.10.200,192.168.10.201 domain=mk.lan gateway=192.168.10.254 netmask=24add address=192.168.20.0/24 dns-server=192.168.10.200,192.168.10.201 domain=iot.mk.lan gateway=192.168.20.254 netmask=24add address=192.168.30.0/24 dns-server=192.168.10.200,192.168.10.201 domain=cctv.mk.lan gateway=192.168.30.254 netmask=24add address=192.168.40.0/24 dns-server=192.168.10.200,192.168.10.201 domain=srv.mk.lan gateway=192.168.40.254 netmask=24add address=192.168.50.0/24 dns-server=8.8.8.8,9.9.9.9 domain=guest.mk.lan gateway=192.168.50.254 netmask=24add address=192.168.99.0/24 dns-server=192.168.99.254 domain=mgmt.mk.lan gateway=192.168.99.254 netmask=24/ip dnsset allow-remote-requests=yes cache-size=81920KiB doh-max-concurrent-queries=100 doh-max-server-connections=10 doh-timeout=6s mdns-repeat-ifaces=vlan10-lan,vlan20-iot servers=9.9.9.9,149.112.112.112/ip dns adlistadd ssl-verify=no url=https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt/ip dns staticadd address=192.168.10.1 comment="redirect for local plex" regexp=*.plex.direct type=A/ip firewall address-listadd address=192.168.20.74 list=SonosDevicesadd address=192.168.20.75 list=SonosDevicesadd address=192.168.99.10 comment="Proxmox servers" list=pveadd address=192.168.10.200 list=dnsadd address=192.168.10.201 list=dnsadd address=192.168.40.50 list=dns/ip firewall filteradd action=drop chain=input comment="crowdsec input drop rules" in-interface=ether1 src-address-list=crowdsecadd action=drop chain=forward comment="crowdsec forward drop rules" in-interface=ether1 src-address-list=crowdsecadd action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yesadd action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yesadd action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untrackedadd action=drop chain=input comment="defconf: drop invalid" connection-state=invalidadd action=accept chain=input comment="allow wireguard" dst-port=13231 protocol=udpadd action=accept chain=input comment="Allow main-vlan/MGMT access to all router services" in-interface-list=MGMTadd action=accept chain=input comment="Allow VLAN DHCP" dst-port=67 in-interface-list=VLAN protocol=udpadd action=accept chain=input comment="Allow VLAN DNS UDP" dst-port=53 in-interface-list=VLAN protocol=udpadd action=accept chain=input comment="Allow VLAN DNS TCP" dst-port=53 in-interface-list=VLAN protocol=tcpadd action=accept chain=input comment="Allow VLAN ICMP Ping" in-interface-list=VLAN protocol=icmpadd action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1add action=accept chain=input comment="Allow srv01-srv to mikrotik" in-interface=vlan40-srv src-address=192.168.40.50add action=accept chain=input comment="Allow Radius from wg" dst-port=1812-1813 in-interface=wg0 protocol=udpadd action=drop chain=input comment="Drop all other traffic" log-prefix=FWadd action=drop chain=forward comment="Block Internet access" log=yes out-interface=ether1 src-address-list=no-internetadd action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsecadd action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsecadd action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yesadd action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untrackedadd action=accept chain=forward comment="VLAN Internet Access Only" connection-state=new in-interface-list=VLAN out-interface-list=WANadd action=accept chain=forward comment="VLAN Allow LAN to MGMT" connection-state=new in-interface=vlan10-lan out-interface=vlan99-mgmtadd action=accept chain=forward comment="VLAN Allow LAN to IOT" connection-state=new in-interface=vlan10-lan out-interface=vlan20-iotadd action=accept chain=forward comment="VLAN Allow LAN to Guest" connection-state=new in-interface=vlan10-lan out-interface=vlan50-guestadd action=accept chain=forward comment="VLAN Allow LAN to SRV" connection-state=new in-interface=vlan10-lan out-interface=vlan40-srvadd action=accept chain=forward comment="VLAN Allow LAN to CCTV" connection-state=new in-interface=vlan10-lan out-interface=vlan30-cctvadd action=accept chain=forward comment="Allow Syslog to vector (openobserver)" dst-address=192.168.40.50 dst-port=10514 in-interface=vlan99-mgmt out-interface=vlan40-srv protocol=udpadd action=accept chain=forward comment="Allow Proxmox Datacenter Manager to Proxmox servers" dst-address-list=pve in-interface=vlan40-srv out-interface=vlan99-mgmt src-address=192.168.40.51add action=accept chain=forward comment="Allow Komo.do agent" dst-port=8120 in-interface=vlan40-srv out-interface-list=VLAN protocol=tcp src-address=192.168.40.50add action=accept chain=forward comment="Allow srv01-cctv to NAS" dst-address=192.168.10.1 dst-port=445 in-interface=vlan30-cctv out-interface=vlan10-lan protocol=tcp src-address=192.168.30.50add action=accept chain=forward comment="Allow srv01-cctv to HA" dst-address=192.168.10.100 dst-port=1883 in-interface=vlan30-cctv out-interface=vlan10-lan protocol=tcp src-address=192.168.30.50add action=accept chain=forward comment="Allow Espresence to ha (mqtt)" dst-address=192.168.10.100 dst-port=1883 in-interface=vlan20-iot out-interface=vlan10-lan protocol=tcp src-address=192.168.20.80add action=accept chain=forward comment="Allow pve to srv01-srv" dst-address=192.168.40.50 dst-port=80,443 in-interface=vlan99-mgmt out-interface=vlan40-srv protocol=tcp src-address-list=pveadd action=accept chain=forward comment="Allow srv01-srv to pve" dst-address-list=pve dst-port=8006 in-interface=vlan40-srv out-interface=vlan99-mgmt protocol=tcp src-address=192.168.40.50add action=accept chain=forward comment="Allow srv02-srv to nas" dst-address=192.168.10.1 dst-port=445 in-interface=vlan40-srv out-interface=vlan10-lan protocol=tcp src-address=192.168.40.53add action=accept chain=forward comment="Allow from pve to nas" dst-address=192.168.10.1 dst-port=445 in-interface=vlan40-srv out-interface=vlan10-lan protocol=tcp src-address-list=pveadd action=accept chain=forward comment="Allow from pbs-srv to nas" dst-address=192.168.10.1 dst-port=445 in-interface=vlan40-srv out-interface=vlan10-lan protocol=tcp src-address=192.168.40.52add action=accept chain=forward comment="Allow pve to pbs" dst-address=192.168.40.52 dst-port=8007 in-interface=vlan99-mgmt out-interface=vlan40-srv protocol=tcp src-address-list=pveadd action=accept chain=forward comment="PBX to HA" dst-address=192.168.10.100 in-interface=vlan40-srv out-interface=vlan10-lan src-address=192.168.40.56add action=accept chain=forward comment="Allow Ecowitt to HA" dst-address=192.168.10.100 dst-port=80 in-interface=vlan20-iot out-interface=vlan10-lan protocol=tcp src-address=192.168.20.67add action=accept chain=forward comment="Allow Vlan-iot to HA" dst-address=192.168.10.100 dst-port=80 in-interface=vlan20-iot out-interface=vlan10-lan protocol=tcpadd action=accept chain=forward comment="Allow SRV01-SRV to all vlan" in-interface=vlan40-srv out-interface-list=VLAN src-address=192.168.40.50add action=accept chain=forward comment="Allow Zabbix to srv01-srv" dst-address=192.168.40.50 dst-port=10051 in-interface-list=VLAN out-interface=vlan99-mgmt protocol=tcpadd action=accept chain=forward comment="Allow Sonos to HA" dst-address=192.168.10.100 dst-port=1400 in-interface=vlan20-iot out-interface=vlan10-lan protocol=tcp src-address-list=SonosDevicesadd action=accept chain=forward comment="Allow srv02-srv to plex" dst-address=192.168.10.1 dst-port=32400 in-interface=vlan40-srv out-interface=vlan10-lan protocol=tcp src-address=192.168.40.53add action=accept chain=forward comment="Allow VLANS to DNS udp" dst-address-list=dns dst-port=53 in-interface-list=VLAN protocol=udpadd action=accept chain=forward comment="Allow VLANS to DNS TCP" dst-address-list=dns dst-port=53 in-interface-list=VLAN protocol=tcpadd action=accept chain=forward comment="Allow Port Forwarding - DSTNAT - enable if need server" connection-nat-state=dstnat connection-state=new in-interface-list=WANadd action=drop chain=forward comment="defconf: drop invalid" connection-state=invalidadd action=drop chain=forward comment="Drop all other traffic"/ip firewall natadd action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yesadd action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yesadd action=redirect chain=dstnat comment=internetprotection disabled=yes dst-port=53 protocol=udp to-ports=53add action=redirect chain=dstnat comment=internetprotection disabled=yes dst-port=53 protocol=tcp to-ports=53add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WANadd action=masquerade chain=srcnat comment="masquerade Allow V-IOT (needed for HA - xiaomi_miio)" ipsec-policy=out,none out-interface=vlan20-iotadd action=dst-nat chain=dstnat comment="Allow Plex" dst-port=32400 in-interface=ether1 protocol=tcp to-addresses=192.168.10.1 to-ports=32400add action=dst-nat chain=dstnat comment="Allow Urbackup" dst-port=55415 in-interface=ether1 protocol=tcp to-addresses=192.168.10.1 to-ports=55415add action=dst-nat chain=dstnat comment="Allow saltmaster" disabled=yes dst-port=4505 in-interface=ether1 protocol=tcp to-addresses=192.168.10.118 to-ports=4505add action=dst-nat chain=dstnat comment="Allow saltmaster" disabled=yes dst-port=4506 in-interface=ether1 protocol=tcp to-addresses=192.168.10.118 to-ports=4506/ip ipsec profileset [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5/ip kid-controladd fri=0s-1d mon=0s-1d name=Monitor sat=0s-1d sun=0s-1d thu=0s-1d tue=0s-1d wed=0s-1d/ipv6 routeadd disabled=no distance=1 dst-address=::/0 gateway=fe80::3a07:16ff:fe0b:d9d%ether1 routing-table=main scope=30 target-scope=10/ip serviceset telnet disabled=yesset ftp disabled=yesset www address=192.168.0.0/16set ssh address=192.168.0.0/16set www-ssl certificate=webfigset api address=192.168.0.0/16set winbox address=192.168.0.0/16set api-ssl disabled=yes/ip traffic-flowset enabled=yes interfaces=ether1,bridge/ip traffic-flow targetadd dst-address=162.159.65.1 version=5add dst-address=192.168.40.50 version=ipfix/ipv6 addressadd address=2a01:XXX:XX:b6b1::254 interface=vlan10-lanadd address=2a01:XXX:XX:b6b2::254 interface=vlan20-iot/ipv6 firewall address-listadd address=::/128 comment="defconf: unspecified address" list=bad_ipv6add address=::1/128 comment="defconf: lo" list=bad_ipv6add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6add address=100::/64 comment="defconf: discard only " list=bad_ipv6add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6/ipv6 firewall filteradd action=drop chain=input comment="crowdsec input drop rules" in-interface=ether1 src-address-list=crowdsecadd action=drop chain=forward comment="crowdsec forward drop rules" in-interface=ether1 src-address-list=crowdsecadd action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untrackedadd action=drop chain=input comment="defconf: drop invalid" connection-state=invalidadd action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udpadd action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udpadd action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ahadd action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-espadd action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsecadd action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LANadd action=fasttrack-connection chain=forward comment="defconf: fasttrack6" connection-state=established,relatedadd action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untrackedadd action=drop chain=forward comment="defconf: drop invalid" connection-state=invalidadd action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6add action=accept chain=forward comment="defconf: accept HIP" protocol=139add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udpadd action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ahadd action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-espadd action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsecadd action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN/ipv6 ndset [ find default=yes ] advertise-dns=no hop-limit=64 interface=vlan10-lan managed-address-configuration=yes ra-interval=20s-1madd advertise-dns=no hop-limit=64 interface=vlan20-iot ra-interval=20s-1m/ipv6 nd prefix defaultset preferred-lifetime=30m valid-lifetime=12h/routing igmp-proxy interfaceadd interface=vlan10-lan upstream=yesadd interface=vlan20-iot/system clockset time-zone-name=Europe/Paris/system identityset name=cas-fw/system loggingadd action=logserver topics=criticaladd action=logserver topics=erroradd action=logserver topics=infoadd action=logserver topics=warning/system noteset show-at-login=no/system ntp clientset enabled=yes/system ntp serverset enabled=yes multicast=yes/system ntp client serversadd address=time.cloudflare.com/system routerboard settingsset auto-upgrade=yes/tool graphing interfaceadd interface=ether1 store-on-disk=noadd interface=vlan10-lan store-on-disk=noadd interface=vlan20-iot store-on-disk=noadd interface=vlan50-guest store-on-disk=noadd interface=vlan99-mgmt store-on-disk=no/tool graphing resourceadd store-on-disk=no/tool mac-serverset allowed-interface-list=MGMT/tool mac-server mac-winboxset allowed-interface-list=MGMT