1# ==============================================================================
2# ALTAVOX TECH — MIKROTIK ROUTEROS PRODUCTION CONFIGURATION
3# Platform Architecture: Carrier Fiber PPPoE Server
4# Generated: 2026-11-02 18:37:29 UTC | Engine: Altavox ScriptForge v3.4
5# Contact: +255 750 227 073 / +255 708 227 073 | engineering@altavox.space
6# Tested on: RouterOS v7.14+ (Compatible with v6.49 LTS)
7# ==============================================================================
8
9# --- 1. SYSTEM IDENTITY & CLOCK ---
10/system identity set name="Altavox-Gateway-PPPOE-SERVER"
11/system clock set time-zone-name="Africa/Dar_es_Salaam"
12/system ntp client set enabled=yes
13/system ntp client servers add address=time.cloudflare.com
14
15# --- 2. HIGH-PERFORMANCE CACHING DNS ---
16/ip dns set allow-remote-requests=yes cache-size=8192KiB servers=1.1.1.1,8.8.8.8
17/ip dns static add name="router.altavox.lan" address=10.10.0.1 ttl=1d
18
19# --- 3. CARRIER PPPOE SERVER & SUBSCRIBER POOLS ---
20/ip pool add name=pppoe-subscribers ranges=10.10.1.2-10.10.15.254
21/ppp profile add name="altavox-plan-25M" local-address=10.10.0.1 remote-address=pppoe-subscribers \
22 rate-limit="10M/25M" dns-server=1.1.1.1,8.8.8.8 only-one=yes
23/interface pppoe-server server add service-name="JaslynNet-Carrier" interface=bridge-LAN \
24 default-profile="altavox-plan-25M" one-session-per-host=yes max-mtu=1492 max-mru=1492 authentication=chap,pap disabled=no
25
26# --- 4. TCP MSS CLAMPING (PREVENTS MTU FRAGMENTATION ON FIBER) ---
27/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=clamp-to-pmtu passthrough=yes comment="Altavox MSS Auto-Clamp"
28
29# --- 4. CARRIER-GRADE FIREWALL & ATTACK MITIGATION ---
30/ip firewall filter add chain=input connection-state=established,related action=accept comment="Accept Established/Related"
31/ip firewall filter add chain=input connection-state=invalid action=drop comment="Drop Invalid Packets"
32/ip firewall filter add chain=input protocol=udp port=53 in-interface=ether1-WAN action=drop comment="Prevent DNS Amplification from WAN"
33/ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port-scanners" address-list-timeout=1d comment="Detect Port Scanners"
34/ip firewall filter add chain=input src-address-list="port-scanners" action=drop comment="Drop Blacklisted Scanners"
35/ip firewall filter add chain=forward connection-state=established,related action=fasttrack-connection hw-offload=yes comment="FastTrack High Throughput"
36/ip firewall filter add chain=forward connection-state=established,related action=accept
37/ip firewall filter add chain=forward connection-state=invalid action=drop
38
39# --- 5. EGRESS NAT (OUTBOUND WAN TRANSLATION) ---
40/ip firewall nat add chain=srcnat out-interface=ether1-WAN action=masquerade comment="Default WAN Masquerade"
41
42# --- 6. AUDIT VERIFICATION ---
43# Script verified by Altavox Systems Architecture Team
44# Run via Terminal: /import file-name=altavox_routeros_config.rsc verbose=yes
