.
# 2024-02-25 20:31:19 by RouterOS 7.13.5
# software id = 12HD-ZLNH
#
# model = RB2011UiAS-2HnD
# serial number = XXXXXXXXXXXX
/interface bridge
add admin-mac=XXXXX arp=proxy-arp auto-mac=no name=bridge-local \
port-cost-mode=short
add disabled=yes name=bridge2
/interface ethernet
set [ find default-name=ether1 ] advertise="10M-baseT-half,10M-baseT-full,100M\
-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full,2.5G-baseT,5G-base\
T,10G-baseT" name=ether1-gateway
set [ find default-name=ether6 ] name=ether6-master-local
set [ find default-name=ether7 ] name=ether7-slave-local
set [ find default-name=ether8 ] name=ether8-slave-local
set [ find default-name=ether9 ] name=ether9-slave-local
set [ find default-name=ether10 ] name=ether10-slave-local poe-out=off
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
country=greece disabled=no distance=indoors frequency=auto mode=ap-bridge \
ssid=XXXXX station-roaming=enabled wireless-protocol=802.11
/interface wireguard
add listen-port=XXXXX mtu=1420 name=wireguard1
/interface pppoe-client
add add-default-route=yes default-route-distance=0 interface=ether1-gateway \
keepalive-timeout=60 name=pppoe-out1 use-peer-dns=yes
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
add name=WAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
profile1 supplicant-identity=""
add name=wlan1-profile supplicant-identity=MikroTik
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-256,aes-192,aes-128
/ip ipsec proposal
set [ find default=yes ] auth-algorithms="" disabled=yes pfs-group=none
/ip pool
add name=dhcp_pool1 ranges=192.168.10.40-192.168.10.50
add name=dhcp_pool2 ranges=192.168.20.2-192.168.20.254
add name=pool3 ranges=192.168.20.20-192.168.20.30
/ip dhcp-server
add add-arp=yes address-pool=dhcp_pool1 authoritative=after-2sec-delay \
interface=bridge-local lease-time=1h59m59s name=dhcp1
add add-arp=yes address-pool=pool3 authoritative=after-10sec-delay disabled=\
yes interface=bridge2 name=dhcp2
/port
set 0 name=serial0
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
add disabled=no name=default-v3 version=3
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
add disabled=yes instance=default-v3 name=backbone-v3
/routing table
add fib name=""
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/user group
add name=ssh policy="ssh,ftp,reboot,read,web,rest-api,!local,!telnet,!write,!p\
olicy,!test,!winbox,!password,!sniff,!sensitive,!api,!romon"
/interface bridge port
add bridge=bridge-local hw=no ingress-filtering=no interface=ether2 \
internal-path-cost=10 path-cost=10
add bridge=bridge-local hw=no ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10
add bridge=bridge-local hw=no ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge-local hw=no ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10
add bridge=bridge-local hw=no ingress-filtering=no interface=sfp1 \
internal-path-cost=10 path-cost=10
add bridge=bridge-local ingress-filtering=no interface=wlan1 \
internal-path-cost=10 path-cost=10
add bridge=bridge-local disabled=yes ingress-filtering=no interface=\
ether1-gateway internal-path-cost=10 path-cost=10
add bridge=bridge-local interface=ether6-master-local
add bridge=bridge-local interface=ether7-slave-local
add bridge=bridge-local interface=ether8-slave-local
add bridge=bridge-local interface=ether9-slave-local
add bridge=bridge-local interface=ether10-slave-local
/ip neighbor discovery-settings
set discover-interface-list=mac-winbox
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set max-neighbor-entries=8192
/interface l2tp-server server
set allow-fast-path=yes authentication=mschap1,mschap2 default-profile=\
default max-mru=1460 max-mtu=1460 use-ipsec=required
/interface list member
add interface=ether2 list=mactel
add interface=ether3 list=mactel
add interface=ether4 list=mactel
add interface=ether5 list=mactel
add interface=ether6-master-local list=mactel
add interface=ether7-slave-local list=mactel
add interface=ether8-slave-local list=mactel
add interface=ether9-slave-local list=mactel
add interface=sfp1 list=mactel
add interface=wlan1 list=mactel
add interface=bridge-local list=mactel
add interface=bridge-local list=mac-winbox
add disabled=yes interface=pppoe-out1 list=WAN
add interface=ether1-gateway list=WAN
add interface=wireguard1 list=mactel
add interface=ether10-slave-local list=mactel
/interface ovpn-server server
set auth=sha1 certificate=*2 cipher=aes256-cbc require-client-certificate=yes
/interface wireguard peers
add allowed-address=0.0.0.0/0 comment=P10 interface=wireguard1 public-key=\
"XXXXXXXXXXXXXXXXXXXXXXXXXXX"
add allowed-address=172.30.30.2/32,192.168.188.0/24,10.0.10.0/24 \
endpoint-address=XXXXXXXXXXXXXXXXXXX endpoint-port=XXXXXXXXXX \
interface=wireguard1 persistent-keepalive=24s public-key=\
"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
/interface wireless access-list
add comment=Inspiron mac-address=60:57:18:5D:15:4C
/ip address
add address=192.168.10.1/24 interface=ether2 network=192.168.10.0
add address=172.30.30.1/24 interface=wireguard1 network=172.30.30.0
add address=192.168.20.1/24 disabled=yes interface=bridge2 network=\
192.168.20.0
/ip arp
add address=192.168.10.14 interface=bridge-local mac-address=\
CA:EE:E5:43:8A:5B
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment="default configuration" disabled=yes interface=sfp1 use-peer-dns=\
no
add interface=ether1-gateway
/ip dhcp-server lease
add address=192.168.10.4 comment=inspiron mac-address=60:57:18:5D:15:4C \
server=dhcp1 use-src-mac=yes
add address=192.168.10.40 client-id=\
ff:f8:ce:1b:a1:0:2:0:0:ab:11:f2:7e:6d:b3:d6:34:71:3a mac-address=\
6C:CF:39:00:2C:99 server=dhcp1
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.10.1 \
netmask=24
add address=192.168.20.0/24 gateway=192.168.20.1
/ip dns
set allow-remote-requests=yes max-concurrent-queries=50 \
max-concurrent-tcp-sessions=50 servers=192.168.200.1,1.1.1.1
/ip dns static
add address=192.168.10.4 disabled=yes name=*.vtuner.com
/ip firewall filter
add action=accept chain=input comment="allow WireGuard traffic" src-address=\
172.30.30.0/24
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment=wireguard dst-port=XXXXX protocol=udp
add action=accept chain=input comment=ssh dst-port=XXXXX protocol=tcp
add action=accept chain=input comment="wg Mtik XXXXX" dst-port=XXXXX \
in-interface=ether1-gateway protocol=udp
add action=accept chain=input dst-port=XXXXXX in-interface=ether1-gateway \
protocol=udp
add action=accept chain=forward dst-address=192.168.188.0/24 src-address=\
192.168.10.0/24
add action=accept chain=forward dst-address=192.168.10.0/24 src-address=\
192.168.188.0/24
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid in-interface=ether1-gateway log=yes
add action=drop chain=forward comment="Block internet for camera" disabled=\
yes src-address=192.168.10.13
add action=drop chain=forward comment=\
"Block internet for dehumidifier" disabled=yes src-address=\
192.168.10.43
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input in-interface-list=!mac-winbox
/ip firewall mangle
add action=fasttrack-connection chain=forward dst-address=192.168.10.0/24 \
src-address=XXXXXXX
add action=fasttrack-connection chain=forward dst-address=192.168.10.0/24 \
src-address=XXXXXXX
add action=fasttrack-connection chain=prerouting dst-address=XXXXXXX \
src-address=192.168.10.0/24
add action=fasttrack-connection chain=prerouting dst-address=XXXXXXX \
src-address=192.168.10.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
out-interface=ether1-gateway out-interface-list=WAN
add action=masquerade chain=srcnat comment=test out-interface=wireguard1
add action=masquerade chain=srcnat disabled=yes dst-address=10.0.0.0/8
add action=dst-nat chain=dstnat comment=ssh dst-port=XXXXX in-interface=\
ether1-gateway protocol=tcp to-addresses=192.168.10.1 to-ports=XXXXX
add action=dst-nat chain=dstnat comment="Rustdesk TCP" dst-port=21115-21119 \
in-interface=ether1-gateway protocol=tcp to-addresses=192.168.10.5 \
to-ports=21115-21119
add action=dst-nat chain=dstnat comment="Rustdesk TCP local" dst-port=\
21115-21119 in-interface=bridge-local protocol=tcp to-addresses=\
192.168.10.5 to-ports=21115-21119
add action=dst-nat chain=dstnat comment="Rustdesk udp" dst-port=21116 \
in-interface=ether1-gateway protocol=udp to-addresses=192.168.10.5 \
to-ports=21116
add action=dst-nat chain=dstnat comment="Rustdesk udp local" dst-port=21116 \
in-interface=bridge-local protocol=udp to-addresses=192.168.10.5 \
to-ports=21116
add action=dst-nat chain=dstnat dst-port=51413 in-interface=ether1-gateway \
protocol=tcp to-addresses=192.168.10.5 to-ports=51413
add action=dst-nat chain=dstnat dst-port=38588 in-interface=ether1-gateway \
protocol=tcp to-addresses=192.168.10.7 to-ports=XXXXX
add action=dst-nat chain=dstnat dst-port=58538 in-interface=ether1-gateway \
protocol=tcp to-addresses=192.168.10.5 to-ports=XXXXX
add action=dst-nat chain=dstnat dst-port=554 in-interface=all-ethernet \
protocol=tcp src-address=192.168.10.0/24 to-addresses=10.0.0.200 \
to-ports=554
add action=dst-nat chain=dstnat comment="wg brix" dst-port=XXXXX \
in-interface=ether1-gateway protocol=udp to-addresses=192.168.10.5 \
to-ports=XXXXX
add action=dst-nat chain=dstnat comment="wg from work brix" dst-port=53 \
in-interface=ether1-gateway protocol=udp to-addresses=192.168.10.5 \
to-ports=XXXXX
add action=dst-nat chain=dstnat comment="wg from work brix" dst-port=51820 \
in-interface=ether1-gateway protocol=udp to-addresses=192.168.10.5 \
to-ports=XXXXX
/ip firewall service-port
set sip ports=5078,5079
/ip ipsec policy
set 0 disabled=yes dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/ip proxy
set enabled=yes max-cache-size=none parent-proxy=0.0.0.0 src-address=0.0.0.0
/ip route
add disabled=no dst-address=192.168.100.1/32 gateway=192.168.10.5 \
routing-table=main suppress-hw-offload=no
add disabled=no distance=1 dst-address=10.200.200.0/24 gateway=192.168.10.5 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add disabled=no distance=1 dst-address=10.0.0.0/24 gateway=192.168.10.5 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add dst-address=192.168.188.0/24 gateway=wireguard1
add disabled=no distance=1 dst-address=10.0.10.0/24 gateway=wireguard1 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add disabled=no distance=1 dst-address=10.10.0.0/24 gateway=192.168.10.5 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
/ipv6 route
add disabled=no dst-address=2000::/3 gateway=2001:470:1f14:116::1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.10.0/24,10.200.200.0/24
set ssh address=0.0.0.0/0 port=XXXXX
set www-ssl address=192.168.10.0/24
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set forwarding-enabled=both
/ip traffic-flow
set interfaces=ether2
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=ether1-gateway type=internal
/ipv6 firewall filter
add action=accept chain=input
/ipv6 nd
add interface=bridge-local managed-address-configuration=yes \
other-configuration=yes
/ipv6 nd prefix
add autonomous=no interface=bridge-local
/lcd
set enabled=no touch-screen=disabled
/lcd interface pages
set 0 interfaces="sfp1,ether1-gateway,ether2,ether3,ether4,ether5,ether6-maste\
r-local,ether7-slave-local,ether8-slave-local,ether9-slave-local,ether10-s\
lave-local"
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Athens
/system logging
add topics=account
add topics=ssh,info
add topics=account
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=194.116.168.41
add address=1.gr.pool.ntp.org
/system scheduler
add interval=1h name=Duckdns_updater on-event=Duckdns_updater policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2017-09-19 start-time=00:46:51
/system script
add dont-require-permissions=no name=Duckdns_updater owner=admin policy=\
read,write,policy,test source="# RouterOS v6.x DuckDns update script\r\
\n\r\
\n# Set your DuckDns subdomain and token\r\
\n:global duckDnsSubdomain \"XXXXX\"\r\
\n:global duckDnsToken \"XXXXX\"\r\
\n\r\
\n# Set your (WAN) interface\r\
\n:global duckDnsInterface \"ether1-gateway\"\r\
\n\r\
\n# Do not edit below\r\
\n:global duckDnsHost \"\$duckDnsSubdomain.duckdns.org\"\r\
\n:global duckDnsIP [:resolve \$duckDnsHost];\r\
\n:global duckDnsNewIP [:resolve myip.opendns.com server=208.67.XXXXX2.XXXXX2]\r\
\n\r\
\n:if ([ :typeof \$duckDnsNewIP ] = nil ) do={\r\
\n :log info (\"DuckDNS: No ip address on \$duckDnsInterface\")\r\
\n} else={\r\
\n :for i from=( [:len \$duckDnsNewIP] - 1) to=0 do={\r\
\n :if ( [:pick \$duckDnsNewIP \$i] = \"/\") do={\r\
\n :set duckDnsNewIP [:pick \$duckDnsNewIP 0 \$i];\r\
\n }\r\
\n }\r\
\n\r\
\n :if (\$duckDnsIP != \$duckDnsNewIP) do={\r\
\n :log info (\"DuckDNS: Old IP: \$duckDnsIP -> New IP: \$duckDnsNe\
wIP\")\r\
\n :local str \"https://www.duckdns.org/update\?domains=\$duckDnsSu\
bdomain&token=\$duckDnsToken&ip=\$duckDnsNewIP\"\r\
\n /tool fetch url=\$str mode=https dst-path=\"/DuckDNS.\$duckDnsHo\
st\"\r\
\n :delay 1\r\
\n :local str [/file find name=\"DuckDNS.\$duckDnsHost\"];\r\
\n /file remove \$str\r\
\n :local duckDnsIP \$duckDnsNewIP\r\
\n :log info \"DuckDNS: IP updated to \$duckDnsNewIP\"\r\
\n } else={\r\
\n :log info \"DuckDNS: dont need changes\";\r\
\n }\r\
\n}"
/system watchdog
set ping-start-after-boot=15m ping-timeout=1m30s watch-address=192.168.200.1
/tool bandwidth-server
set enabled=no
/tool e-mail
set from=<Mikrotik> port=587 server=smtp.gmail.com tls=starttls user=\
XXXXX@gmail.com
/tool mac-server
set allowed-interface-list=mac-winbox
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
/tool mac-server ping
set enabled=no
/tool netwatch
add disabled=no down-script="#/tool e-mail send to=XXXXX@gmail.com subjec\
t=\"Host Teltonika Down from mikrotik\" body=\"Host Teltonika Down\"\r\
\n\r\
\n:local botId \"XXXXX\"\r\
\n:local chatId \"XXXXX\"\r\
\n:local site [/system identity get value-name=name]\r\
\n\r\
\n/tool fetch url=\"https://api.telegram.org/bot\$botId/sendMessage\?chat_\
id=\$chatId&text=Host Teltonika Down from \$site\" output=user\r\
\n#keep-result=no" host=10.0.10.1 http-codes="" interval=2m packet-count=\
5 test-script="" thr-loss-percent=80% timeout=6s type=simple up-script="#/\
tool e-mail send to=XXXXX@gmail.com subject=\"Host Teltonika UP from \
mikrotik\" body=\"Host Teltonika up\"\r\
\n:local botId \"XXXXX\"\r\
\n:local chatId \"XXXXX\"\r\
\n:local site [/system identity get value-name=name]\r\
\n\r\
\n/tool fetch url=\"https://api.telegram.org/bot\$botId/sendMessage\?chat_\
id=\$chatId&text=Host Teltonika Up from \$site\" output=user\r\
\n#keep-result=no"
/tool romon
set enabled=yes id=00:00:00:00:00:01
/tool romon port
add disabled=no forbid=yes interface=ether1-gateway
add disabled=no interface=ether7-slave-local
/tool sniffer
set filter-interface=all filter-ip-address=192.168.10.160/32 memory-limit=\
1000KiB streaming-server=192.168.10.4
