RouterOS跨境网络SD-WAN实战：从零搭建多分支智能组网

# === 基础初始化（所有节点均执行）===
/system identity set name=[用户自定义名称]
/system clock set time-zone-name=Asia/Shanghai
/system ntp client set enabled=yes server-dns-names=ntp.aliyun.com,time.cloudflare.com

# DNS 配置（关键：跨境场景建议用国际DNS避免污染）
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes

# 关闭不必要的服务以减小攻击面
/ip service set telnet disabled=yes ftp disabled=yes api disabled=no
/ip service set www-ssl certificate=none disabled=no port=443

# 基础防火墙：允许ICMP + 允许已建立连接 + 丢弃WAN端其他入站
/ip firewall filter add chain=input protocol=icmp action=accept comment="Allow ICMP"
/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=input in-interface=ether1 action=drop comment="Drop WAN unsolicited"

# 1. 创建WireGuard接口
/interface wireguard add name=wg-sdwan listen-port=13231 private-key=auto

# 2. 查看自动生成的公钥（后续Spoke需要）
/interface wireguard peers print
# 记下 public-key，例如：yKJ...XYZ=

# 3. 分配隧道IP
/ip address add address=10.255.1.1/24 interface=wg-sdwan

# 4. 添加各Spoke的Peer条目
/interface wireguard peers add interface=wg-sdwan \
  public-key="SpokeA的公钥" allowed-address=10.255.1.2/32,10.10.2.0/24 \
  persistent-keepalive=25s comment="Spoke-A-TOKYO"

/interface wireguard peers add interface=wg-sdwan \
  public-key="SpokeB的公钥" allowed-address=10.255.1.3/32,10.10.3.0/24 \
  persistent-keepalive=25s comment="Spoke-B-SINGAPORE"

# 1. 创建WireGuard接口
/interface wireguard add name=wg-to-hub private-key=auto

# 2. 添加Hub Peer
/interface wireguard peers add interface=wg-to-hub \
  endpoint-address=203.0.113.10 endpoint-port=13231 \
  public-key="Hub的公钥" allowed-address=10.255.1.0/24,10.10.1.0/24 \
  persistent-keepalive=25s comment="Hub-SHANGHAI"

# 3. 分配隧道IP
/ip address add address=10.255.1.2/24 interface=wg-to-hub

# 查看Handshake是否成功（正常应看到 "last handshake" 在30秒内）
/interface wireguard peers print

# 进入BGP配置模式
/routing bgp template set default as=65001 router-id=10.255.1.1

# 宣告总部子网
/routing bgp connection add name=SpokeA \
  remote.address=10.255.1.2 remote.as=65001 \
  template=default listen=yes

/routing bgp connection add name=SpokeB \
  remote.address=10.255.1.3 remote.as=65001 \
  template=default listen=yes

/routing bgp template set default as=65001 router-id=10.255.1.2

/routing bgp connection add name=Hub \
  remote.address=10.255.1.1 remote.as=65001 \
  template=default listen=yes

# === Hub端：发布总部子网 ===
/routing bgp network add network=10.10.1.0/24

# === Spoke-A端：发布东京子网 ===
/routing bgp network add network=10.10.2.0/24

# === Spoke-B端：发布新加坡子网 ===
/routing bgp network add network=10.10.3.0/24

# 验证BGP邻居与路由表
/routing bgp session print
/ip route print where bgp

# 监控Hub隧道IP可达性
/tool netwatch add host=10.255.1.1 interval=5s timeout=2s \
  down-script="
    :log warning \"WG Tunnnel to Hub DOWN — switching to backup\";
    /ip route set [find gateway=10.255.1.1] disabled=yes;
    /ip route set [find comment=backup-route] disabled=no;
  " \
  up-script="
    :log info \"WG Tunnnel to Hub restored\";
    /ip route set [find gateway=10.255.1.1] disabled=no;
    /ip route set [find comment=backup-route] disabled=yes;
  " comment="SDWAN-Hub-Monitor"

# 在/queue type中启用BBR-like策略（通过TBF+SFQ模拟）
/queue type add name=sdwan-bbr kind=fq-codel fq-codel-interval=50ms

# 应用至WAN出口
/queue simple add name=crossborder-qos target=ether1 queue=sdwan-bbr/sdwan-bbr

import requests
import json

NODES = [
    {"name": "Hub-SH", "ip": "203.0.113.10", "token": "xxx"},
    {"name": "Spoke-TK", "ip": "198.51.100.20", "token": "yyy"},
    {"name": "Spoke-SG", "ip": "192.0.2.30", "token": "zzz"},
]

def check_wg_handshake(node):
    """检查WireGuard隧道握手状态"""
    url = f"https://{node['ip']}/rest/interface/wireguard/peers"
    headers = {"Authorization": f"Bearer {node['token']}"}
    resp = requests.get(url, headers=headers, verify=False, timeout=10)
    peers = resp.json()
    for p in peers:
        if "last-handshake" in p:
            print(f"[{node['name']}] peer {p.get('comment','?')}: "
                  f"last handshake {p['last-handshake']}s ago")
    return True

if __name__ == "__main__":
    for n in NODES:
        try:
            check_wg_handshake(n)
        except Exception as e:
            print(f"[{n['name']}] ERROR: {e}")

# === Hub主设备 ===
/interface vrrp add interface=bridge name=vrrp-gw vrid=10 priority=200
/ip address add address=10.10.1.254/24 interface=vrrp-gw

# === Hub备设备 ===
/interface vrrp add interface=bridge name=vrrp-gw vrid=10 priority=100
/ip address add address=10.10.1.254/24 interface=vrrp-gw