Yes, the RouterBOARD firmware is aligned with RouterOS.
Below the configuration:
# 2026-05-15 23:04:35 by RouterOS 7.22.3
# software id = ***
#
# model = S53UG+5HaxD2HaxD&FG621-EA
# serial number = ***
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX arp-timeout=1h auto-mac=no dhcp-snooping=yes \
igmp-snooping=yes name=bridge1 vlan-filtering=yes
/interface wireguard
add listen-port=51820 mtu=1420 name=wg1
/interface vlan
add interface=ether1 name=vlan1036 vlan-id=1036
add comment=lan1 interface=bridge1 name=vlan2090 vlan-id=2090
add comment=iot1 interface=bridge1 name=vlan2091 vlan-id=2091
add comment=srv1 interface=bridge1 name=vlan2092 vlan-id=2092
/interface pppoe-client
add comment=wan1 disabled=no interface=vlan1036 name=pppoe-out1 user=\
***
/interface ethernet switch
set 0 cpu-flow-control=yes
/interface list
add comment="wan2 [lte]" name=wan2
add comment=lan1 name=lan1
add name=vpn1
add comment="wan1 [vdsl]" name=wan1
add comment="wan [all]" include=wan1,wan2 name=wan
add name=wan1-mgmt
add name=iot1
add name=srv1
/interface lte apn
add add-default-route=no apn=mobile.vodafone.it comment=vodafone name=\
vodafone use-peer-dns=no
/interface lte
set [ find default-name=lte1 ] allow-roaming=no apn-profiles=vodafone band="" \
comment=wan2
/interface wifi channel
add band=5ghz-ax comment=wifi:channel:5g deprioritize-unii-3-4=yes disabled=\
no frequency=5180-5640 name=wifi:channel1 reselect-time=\
04:00:00..04:30:00 skip-dfs-channels=10min-cac width=20/40/80mhz
add band=2ghz-ax comment=wifi:channel:2g disabled=no frequency=2412,2437,2462 \
name=wifi:channel2 reselect-time=04:00:00..04:30:00 skip-dfs-channels=\
disabled width=20mhz
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk comment=wifi:myhome-wifi disabled=\
no name=wifi:sec1 wps=disable
add authentication-types=wpa2-psk beacon-protection=disabled comment=\
wifi:myhome-iot-wifi disable-pmkid=yes disabled=no group-key-update=1d \
management-protection=disabled name=wifi:sec2 wps=disable
/interface wifi configuration
add comment=wifi:myhome-wifi country=Italy datapath.vlan-id=2090 disabled=no \
installation=indoor mode=ap name=wifi:config1 security=wifi:sec1 ssid=\
myhome-wifi
add comment=wifi:myhome-iot-wifi datapath.vlan-id=2091 disabled=no hide-ssid=\
yes installation=indoor mode=ap name=wifi:config2 security=wifi:sec2 \
ssid=myhome-iot-wifi
/interface wifi
set [ find default-name=wifi1 ] channel=wifi:channel1 comment=\
wifi:5g:myhome-wifi configuration=wifi:config1 configuration.mode=ap \
disabled=no
set [ find default-name=wifi2 ] channel=wifi:channel2 comment=\
wifi:2g:myhome-wifi configuration=wifi:config1 configuration.mode=ap \
disabled=no security.ft=yes .ft-over-ds=yes
add channel=wifi:channel2 comment=wifi:2g:myhome-iot-wifi configuration=\
wifi:config2 configuration.mode=ap disabled=no mac-address=\
XX:XX:XX:XX:XX:XX master-interface=wifi2 name=wifi4
/ip pool
add comment=pool:dhcp:vlan2091 name=pool2 ranges=10.36.91.150-10.36.91.199
add comment=pool:dhcp:vlan2090 name=pool1 ranges=10.36.90.150-10.36.90.199
/ip dhcp-server
add address-pool=pool2 bootp-support=none comment=dhcp:vlan2091 interface=\
vlan2091 lease-time=1w name=dhcp2
add address-pool=pool1 bootp-support=none comment=dhcp:vlan2090 interface=\
vlan2090 lease-time=1d name=dhcp1
/queue type
add fq-codel-ecn=no kind=fq-codel name=fq-codel-ethernet-default
/queue interface
set ether1 queue=fq-codel-ethernet-default
set ether2 queue=fq-codel-ethernet-default
set ether3 queue=fq-codel-ethernet-default
set ether4 queue=fq-codel-ethernet-default
set ether5 queue=fq-codel-ethernet-default
/disk
set usb1 media-interface=*2000000
add media-interface=bridge1 parent=usb1 partition-number=1 partition-offset=\
1048576 partition-size=62006493184 type=partition
/disk settings
set auto-media-interface=bridge1
/ip smb
set enabled=no
/interface bridge port
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
interface=ether2 pvid=2090
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
interface=ether3 pvid=2091
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
interface=ether4 pvid=2092
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=wifi1
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=wifi2
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=wifi4
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=ether5
/ip settings
set tcp-syncookies=yes
/ipv6 settings
set forward=no
/interface bridge vlan
add bridge=bridge1 tagged=ether5,wifi1,wifi2,wifi4 vlan-ids=2091
add bridge=bridge1 tagged=ether5 vlan-ids=2092
add bridge=bridge1 tagged=ether5,wifi1,wifi2 vlan-ids=2090
/interface list member
add interface=lte1 list=wan2
add interface=pppoe-out1 list=wan1
add interface=wg1 list=vpn1
add interface=ether1 list=wan1-mgmt
add interface=vlan2091 list=iot1
add interface=vlan2092 list=srv1
add interface=vlan2090 list=lan1
/ip address
add address=10.36.80.2/30 comment=wan1-mgmt interface=ether1 network=\
10.36.80.0
add address=10.36.81.0/24 comment=wg1 interface=wg1 network=10.36.81.0
add address=10.36.91.1/24 comment=iot1 interface=vlan2091 network=10.36.91.0
add address=10.36.90.1/24 comment=lan1 interface=vlan2090 network=10.36.90.0
add address=10.36.92.1/24 comment=srv1 interface=vlan2092 network=10.36.92.0
/ip cloud
set ddns-enabled=yes update-time=no
/ip dhcp-server config
set accounting=no
/ip dhcp-server network
add address=10.36.90.0/24 comment=dhcp:vlan2090 dns-server=10.36.90.1 \
gateway=10.36.90.1 netmask=24 ntp-server=10.36.90.1
add address=10.36.91.0/24 comment=dhcp:vlan2091 dns-server=10.36.90.1 \
gateway=10.36.91.1 netmask=24 ntp-server=10.36.90.1
/ip dns
set allow-remote-requests=yes mdns-repeat-ifaces=vlan2090,vlan2091 servers=\
8.8.8.8,1.1.1.1 use-doh-server=https://cloudflare-dns.com/dns-query \
verify-doh-cert=yes
/ip firewall filter
add action=accept chain=input comment=\
"input:accept:conn-state=established/related/untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="input:drop:conn-state=invalid" \
connection-state=invalid log=yes log-prefix=drop:invalid
add action=accept chain=input comment=\
"input:accept:sinft=lan1,daddr=10.36.90.1,proto=tcp,dport=22,80" \
dst-address=10.36.90.1 dst-port=22,80 in-interface-list=lan1 log=yes \
log-prefix=accept:lan1-http protocol=tcp
add action=accept chain=input comment=\
"input:accept:sintf=vpn1,daddr=10.36.90.1,proto=tcp,dport=22,80" \
dst-address=10.36.90.1 dst-port=22,80 in-interface-list=vpn1 log=yes \
log-prefix=accept:vpn1-http protocol=tcp
add action=accept chain=input comment=\
"input:accept:sintf=wan1,proto=udp,dport=51820,comment=wireguard" \
dst-port=51820 in-interface-list=wan1 log=yes log-prefix=\
accept:wan-wireguard protocol=udp
add action=accept chain=input comment="input:accept:sintf=!wan,proto=icmp" \
in-interface-list=!wan protocol=icmp
add action=accept chain=input comment=\
"input:accept:sintf=!wan,proto=udp,dport=53" dst-port=53 \
in-interface-list=!wan log-prefix=input-dns protocol=udp
add action=accept chain=input comment=\
"input:accept:sintf=!wan,proto=udp,dport=123" dst-port=123 \
in-interface-list=!wan log-prefix=input:ntp protocol=udp
add action=accept chain=input comment="input:accept:sintf=!wan,daddr=255.255.2\
55.255,proto=udp,sport=68,dport=67" dst-address=255.255.255.255 dst-port=\
67 in-interface-list=!wan protocol=udp src-port=68
add action=accept chain=input comment="input:accept:daddr=127.0.0.1" \
dst-address=127.0.0.1
add action=drop chain=input comment=input:drop log=yes log-prefix=\
drop:default
add action=fasttrack-connection chain=forward comment=\
"forward:fasttrack-connection:conn-state=established/related" \
connection-state=established,related
add action=accept chain=forward comment=\
"forward:accept:conn-state=established/related/untracked" \
connection-state=established,related,untracked
add action=drop chain=forward comment="forward:drop:conn-state=invalid" \
connection-state=invalid log=yes log-prefix=drop:invalid
add action=drop chain=forward comment=\
"forward:drop:conn-state=new,nat-state=!dstnat,sintf=wan" \
connection-nat-state=!dstnat connection-state=new in-interface-list=wan \
log=yes log-prefix=drop:wan-not-dstnated
add action=accept chain=forward comment=\
"forward:accept:sintf=lan1,dintf=iot1" in-interface-list=lan1 log-prefix=\
lan1-to-iot1 out-interface-list=iot1
add action=accept chain=forward comment=\
"forward:accept:sinft=lan1,dintf=srv1" in-interface-list=lan1 \
out-interface-list=srv1
add action=accept chain=forward comment=\
"forward:accept:sintf=lan1,dintf=wan1_mgmt" in-interface-list=lan1 \
out-interface-list=wan1-mgmt
add action=accept chain=forward comment="forward:accept:sintf=lan1,dintf=wan" \
in-interface-list=lan1 log=yes log-prefix=accept:lan1-wan \
out-interface-list=wan
add action=accept chain=forward comment="forward:accept:sintf=iot1,dintf=wan" \
in-interface-list=iot1 log=yes log-prefix=accept:iot1-wan \
out-interface-list=wan
add action=accept chain=forward comment="forward:accept:sintf=srv1,dintf=wan" \
in-interface-list=srv1 log=yes log-prefix=accept:srv1-wan \
out-interface-list=wan
add action=accept chain=forward comment=\
"forward:accept:sintf=vpn1,saddr=10.36.81.0/24,dintf=lan1" \
in-interface-list=vpn1 out-interface-list=lan1 src-address=10.36.81.0/24
add action=accept chain=forward comment=\
"forward:accept:sintf=vpn1,saddr=10.36.81.0/24,dintf=iot1" \
in-interface-list=vpn1 out-interface-list=iot1 src-address=10.36.81.0/24
add action=accept chain=forward comment=\
"forward:accept:sintf=vpn1,saddr=10.36.81.0/24,dinft=srv1" \
in-interface-list=vpn1 out-interface-list=srv1 src-address=10.36.81.0/24
add action=drop chain=forward comment=forward:drop log-prefix=drop:default
/ip firewall nat
add action=masquerade chain=srcnat comment=\
"srcnat:masquerade:dintf=wan1_mgmt" out-interface-list=wan1-mgmt
add action=masquerade chain=srcnat comment="srcnat:masquerade:dintf=wan1" \
out-interface-list=wan1
add action=masquerade chain=srcnat comment="srcnat:masquerade:dintf=wan2" \
ipsec-policy=out,none out-interface-list=wan2
/ip ipsec policy
set 0 disabled=yes
/ip route
add comment=wan1:check-gw:cloudflare disabled=no distance=1 dst-address=\
1.1.1.2/32 gateway=pppoe-out1 routing-table=main scope=10
add comment=wan1:check-gw:opendns disabled=no distance=1 dst-address=\
208.67.220.220/32 gateway=pppoe-out1 routing-table=main scope=10
add comment=wan2:check-gw:cloudflare disabled=no distance=1 dst-address=\
1.0.0.2/32 gateway=lte1 routing-table=main scope=10
add comment=wan2:check-gw:opendns disabled=no distance=1 dst-address=\
208.67.222.222/32 gateway=lte1 routing-table=main scope=10
add check-gateway=ping comment=wan1:default disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=1.1.1.2 routing-table=main target-scope=11
add check-gateway=ping comment=wan1:default disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=208.67.220.220 routing-table=main \
target-scope=11
add check-gateway=ping comment=wan2:default disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=1.0.0.2 routing-table=main target-scope=11
add check-gateway=ping comment=wan2:default disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=208.67.222.222 routing-table=main \
target-scope=11
/ipv6 address
add address=fd27:129::6f4:1cff:fe49:f591 eui-64=yes interface=vlan2091
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!*2000011
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!*2000011
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=***
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=pool.ntp.org
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard wps-button
set enabled=yes on-event=wps-accept