Add RouterOS initial setup script with firewall and security config

[gpas45]

Summary

Add a comprehensive RouterOS initial setup script (initial-setup.rsc) that provides a secure baseline configuration for RouterOS deployments. This script includes interface management, firewall rules, port knocking authentication, DNS configuration, and service hardening.

Key Changes

• Interface Management: Defines interface lists for WAN, LAN, Site-to-Site tunnels, and VPN clients with placeholder assignments for customization per deployment
• Firewall Rules: Implements a stateful firewall with:
  • Connection state tracking (established, related, invalid)
  • ICMP filtering with selective type allowance
  • Port knocking sequence (1234 → 2345 → 3456 → 12345) for SSH/management access
  • Intrusion detection with rate limiting and blacklist support
  • Segmented forwarding rules between interface lists
• NAT Configuration: Source NAT masquerading for LAN-to-Internet traffic
• DNS & Services: Configures DNS resolver, disables unnecessary services (telnet, FTP, www, API), and restricts neighbor discovery
• Security Hardening: Disables IPv6, bandwidth test server, and restricts MAC-server access
• System Configuration: Sets NTP client/server, RouterBOARD firmware auto-upgrade scheduler, and logging filters
• OSPF Routing Filters: Restricts OSPF route advertisements to RFC1918 private address ranges

Notable Implementation Details

• Script is designed as a template with CHANGE_ME placeholders and commented examples for per-deployment customization
• Per-provider settings (addresses, routes, DHCP) are intentionally excluded for flexibility across different uplinks
• Port knocking uses address lists with 1-minute timeouts to enforce the sequence
• Intrusion detection uses dst-limit to rate-limit new connections and automatically blacklist offenders
• Management access is restricted to authenticated sources via port knocking before allowing SSH/Winbox/API access
• Comprehensive inline documentation explains each section's purpose and configuration options

https://claude.ai/code/session_015PYMYtCPwvUpUqkfFD5UL6