/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related
/ip firewall filter add chain=forward action=accept connection-state=established,related

# jan/05/2017 12:54:54 by RouterOS 6.38
# software id = TTGC-0AJH
#
/interface bridge
add admin-mac=6C:3B:6B:19:AA:D9 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] advertise=1000M-half,1000M-full name=WAN \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether3 ] mac-address=6C:3B:6B:19:AA:D8 name=WANNEW
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] disabled=yes master-port=ether2-master
set [ find default-name=sfp1 ] disabled=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
    country=ukraine disabled=no distance=indoors frequency=auto mode=ap-bridge \
    ssid=MT-2 tx-power=10 tx-power-mode=all-rates-fixed wireless-protocol=\
    802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee \
    country=ukraine disabled=no distance=indoors frequency=auto mode=ap-bridge \
    ssid=MT-5 tx-power=10 tx-power-mode=all-rates-fixed wireless-protocol=\
    802.11
/ip neighbor discovery
set WAN discover=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    mode=dynamic-keys wpa-pre-shared-key=1234567890q wpa2-pre-shared-key=\
    1234567890q
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add add-arp=yes address-pool=dhcp authoritative=yes disabled=no interface=\
    bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip address
add address=192.168.1.1/24 comment=defconf interface=ether2-master network=\
    192.168.1.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=WANNEW
/ip dhcp-server lease
add address=192.168.1.11 always-broadcast=yes client-id=1:74:4:2b:e3:d0:ff \
    comment="Vibe P1" mac-address=74:04:2B:E3:D0:FF server=defconf
add address=192.168.1.111 comment="EXSI 6" mac-address=68:05:CA:46:48:B8 \
    server=defconf
add address=192.168.1.112 comment=WinServ mac-address=00:0C:29:F7:A1:E4 server=\
    defconf
add address=192.168.1.113 comment=CentOS7 mac-address=00:0C:29:FF:78:E7 server=\
    defconf
add address=192.168.1.10 client-id=1:8:ed:b9:28:eb:ab comment=Notebook \
    mac-address=08:ED:B9:28:EB:AB server=defconf
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.1.1 name=router
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related" \
    connection-state=established,related
add action=fasttrack-connection chain=forward connection-state=\
    established,related
add action=accept chain=forward connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=\
    WANNEW
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface=WANNEW
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=\
    WANNEW
add action=netmap chain=dstnat comment=web dst-port=80 in-interface=WANNEW \
    protocol=tcp to-addresses=192.168.1.1 to-ports=80
add action=netmap chain=dstnat comment=1c dst-port=90 in-interface=WANNEW \
    protocol=tcp to-addresses=192.168.1.112 to-ports=80
add action=netmap chain=dstnat comment=RDP dst-port=10 in-interface=WANNEW \
    protocol=tcp to-addresses=192.168.1.112 to-ports=3389
add action=netmap chain=dstnat comment=MyChat dst-port=2004 in-interface=WANNEW \
    protocol=tcp to-addresses=192.168.1.112 to-ports=2004
add action=netmap chain=dstnat dst-port=81 in-interface=WANNEW protocol=tcp \
    to-addresses=192.168.1.112 to-ports=81
add action=netmap chain=dstnat comment=IPSmanager dst-port=21 in-interface=\
    WANNEW protocol=tcp to-addresses=192.168.1.113 to-ports=1500
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Kiev
/system package update
set channel=release-candidate
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge