PBR Routing Rules in ROS 7.22 Stable

RouterOS General
21

I don't think it's related to the routing rules. From your configuration export above, you have multiple subnets attached to the same interface (ether2 in this particular case) without VLAN separation. They are in the same broadcast domain and will see things like ARP broadcasts from all subnets.

When 192.168.1.153 sends something to 192.168.5.8, it will use the router as gateway, you'll see a packet with source 192.168.1.153 and destination 192.168.5.8 arriving at the router on interface ether2 - lan. The router will then have to forward this packet, which results in a packet with the exact same source and destination addresses going out of the router through interface ether2 - lan.

If your do packet capturing on interface ether2 - lan, you'll see "duplicate" packets with same source and destination IP address, but if you look deeper at the ethernet frames, you'll see that those packets have different source and destination MAC addresses.

If you have a managed switch attached to ether2 - lan, it's preferable to properly configure VLANs, to really separate those subnets.

22

I didn't realize that the Mac was different, here's what I got from the packet capture

# packet
1	0.000000000	192.168.1.119	192.168.5.8	TCP	66	49181 → 8090 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

# layer 2
Ethernet II, Src: LiteON_4e:e5:26 (6c:4b:90:4e:e5:26), Dst: Routerboardc_91:26:8d (04:f4:1c:91:26:8d)

And this re-transmission packet for SYN

# packet
2	0.000053418	192.168.1.119	192.168.5.8	TCP	66	[TCP Retransmission] 49181 → 8090 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

# layer 2
Ethernet II, Src: Routerboardc_91:26:8d (04:f4:1c:91:26:8d), Dst: HewlettPacka_4b:2c:c8 (94:40:c9:4b:2c:c8)

Yes, I think the issue is at Layer 2, but strangely, my old configuration on the RB1100AHx2 seems to be working fine. Is there a difference between the routing rules in versions 6.40 and 7.22?

23

Here my old config on RB1100AHx2 @anav @CGGXANNX

mar/01/2026 16:43:18 by RouterOS 6.40.8

/interface ethernet
set [ find default-name=ether1 ] disabled=yes name=biznet
set [ find default-name=ether2 ] name="ether2 - lan"
set [ find default-name=ether3 ] name="ether3 - wlan"
set [ find default-name=ether4 ] name="ether4 - voip"
set [ find default-name=ether5 ] name="ether5 - cctv"
set [ find default-name=ether6 ] name="ether6 - iptv"
set [ find default-name=ether7 ] name="ether7 - it"
set [ find default-name=ether10 ] name="ether10 - trans-dedicated"
set [ find default-name=ether11 ] name="ether11 - trans-broadband"
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity="RS Melinda 2"
/ip firewall layer7-protocol
add name=twitter regexp=twitter.com
add name=playstore regexp="^.+(c.android.clients.google.com).\$"
add name=youtube regexp=youtube.com
add name=donlotan regexp="^.get.+\.(exe|rar|zip|7z|cab|asf|mov|wmv|mpg|mpeg|
mkv|avi|flv|wav|rm|mp3|mp4|ram|rmvb|dat|daa|iso|nrg|bin|vcd|mp2|3gp|mpe|qt
|raw|wma|ogg|apk|deb|tar|bzip|gzip|gzip2|0[0-9][0-9]).\$"
add comment="block streaming" name=stream regexp="^.+(youtube\.|ytimg\.|goog
levideo\.com|youtu\.be|catchplay\.com|iflix\.com|dailymotion\.com|met
acafe\.com|mccont\.com|netflix\.com|vimeo\.com|hulu\.com|twitch\.tv|
\.netflix\.|\.fbcdn\.|bigo\.tv|\.instagram\.).$"
add name=video regexp=
"\.(mp4|wmv|avi|mpg|mpeg|flv|mov|3gp|rm|rm1|dat|vob|asf)"
add name=streaming regexp="http/(0.9|1.0|1.1)[x09-x0d ][1-5][0-9][0-9][x09-x0d
_-~](content-type: video)"
add name=facebook regexp=facebook.com
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp_pool1 ranges=
192.168.33.51-192.168.33.253,192.168.35.50-192.168.35.250
add name=dhcp_pool2 ranges=192.168.60.10-192.168.60.199
/ip dhcp-server
add add-arp=yes address-pool=dhcp_pool1 authoritative=after-2sec-delay 
disabled=no interface="ether3 - wlan" lease-time=1h name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface="ether6 - iptv" name=dhcp2
/queue simple
add comment="Bandwith Dedicated" dst=192.168.5.3/32 max-limit=50M/50M name=
full-bandwith-dedicated priority=1/1 target="192.168.1.0/24,192.168.2.0/24
,192.168.3.0/24,192.168.4.0/24,192.168.5.0/24,192.168.6.0/24,192.168.40.0/
24,192.168.60.0/24"
add disabled=yes max-limit=20M/20M name=server priority=1/1 target=
192.168.5.3/32,192.168.5.12/32
add max-limit=5M/5M name=kiosk target=
192.168.1.155/32,192.168.1.156/32,192.168.40.138/32
add max-limit=10M/10M name=poliklinik-psikiatri target=
192.168.5.110/32,192.168.5.112/32
add max-limit=10M/10M name=eswl target=192.168.5.105/32
add max-limit=30M/30M name="manajemen; marketing" target="192.168.6.119/32,192
.168.1.194/32,192.168.6.12/32,192.168.6.109/32,192.168.6.34/32,192.168.6.2
1/32,192.168.6.17/32,192.168.6.23/32,192.168.6.189/32,192.168.6.191/32"
add max-limit=25M/25M name="keuangan; akunting" target="192.168.6.223/32,192.1
68.6.123/32,192.168.6.100/32,192.168.6.102/32,192.168.6.196/32,192.168.6.1
97/32,192.168.6.252/32,192.168.6.137/32,192.168.6.101/32,192.168.6.114/32,
192.168.6.186/32,192.168.6.110/32,192.168.6.103/32,192.168.6.151/32,192.16
8.6.103/32,192.168.6.108/32"
add max-limit=5M/5M name="ct-scan; bdm" target=
192.168.6.170/32,192.168.6.171/32,192.168.6.172/32,192.168.6.173/32
add max-limit=5M/5M name=cp-e-money target=192.168.1.130/32
add comment="Bandwith Broadband" max-limit=50M/50M name=
full-bandwith-broadband target=192.168.33.0/24,192.168.35.0/24
/queue tree
add disabled=yes max-limit=50M name=total-download-dedicated parent=
"ether10 - trans-dedicated"
add disabled=yes max-limit=50M name=total-upload-dedicated parent=
"ether10 - trans-dedicated"
add disabled=yes max-limit=50M name=total-download-broadband parent=
"ether11 - trans-broadband"
add disabled=yes max-limit=50M name=total-upload-broadband parent=
"ether11 - trans-broadband"
/queue type
add kind=pcq name="pcq download" pcq-classifier=dst-address 
pcq-dst-address6-mask=64 pcq-rate=5M pcq-src-address6-mask=64
add kind=pcq name="pcq upload" pcq-classifier=src-address 
pcq-dst-address6-mask=64 pcq-rate=2M pcq-src-address6-mask=64
/queue simple
add limit-at=5M/5M max-limit=10M/10M name=wifi-ranap parent=
full-bandwith-dedicated priority=4/4 queue="pcq upload/pcq download" 
target="192.168.60.50/32,192.168.60.51/32,192.168.60.52/32,192.168.60.53/3
2,192.168.60.54/32,192.168.60.55/32,192.168.60.56/32,192.168.60.57/32,192.
168.60.58/32,192.168.60.59/32,192.168.60.60/32,192.168.60.61/32,192.168.60
.62/32,192.168.60.63/32,192.168.60.64/32,192.168.60.65/32,192.168.60.66/32
,192.168.60.67/32,192.168.60.68/32,192.168.60.69/32"
add max-limit=20M/20M name=bpjs-radiologi priority=1/1 queue=
pcq-upload-default/pcq-download-default target=
192.168.40.140/32,192.168.40.139/32,192.168.40.141/32,192.168.40.142/32
add max-limit=3M/3M name="hk; kesling; ipsrs; log-umum; pneumatic" queue=
pcq-upload-default/pcq-download-default target="192.168.6.160/32,192.168.6
.59/32,192.168.6.176/32,192.168.6.105/32,192.168.1.127/32,192.168.6.193/32
"
add max-limit=15M/15M name="farmasi; log-farmasi" queue=
pcq-upload-default/pcq-download-default target="192.168.1.132/32,192.168.1
.112/32,192.168.1.144/32,192.168.1.102/32,192.168.1.121/32,192.168.6.121/3
2,192.168.6.120/32"
add max-limit=20M/20M name="billing; kasir; estimasi; billing-ranap" queue=
pcq-upload-default/pcq-download-default target="192.168.1.103/32,192.168.1
.116/32,192.168.1.118/32,192.168.1.117/32,192.168.2.102/32,192.168.1.152/3
2,192.168.5.107/32,192.168.65.23/32,192.168.3.101/32"
add max-limit=25M/25M name="admission; rekam-medik; bpjs-1" queue=
pcq-upload-default/pcq-download-default target="192.168.1.125/32,192.168.1
.131/32,192.168.1.150/32,192.168.1.154/32,192.168.1.101/32,192.168.1.106/3
2,192.168.1.107/32,192.168.1.119/32,192.168.1.103/32,192.168.1.123/32,192.
168.1.105/32,192.168.1.151/32,192.168.1.135/32,192.168.6.115/32"
add burst-limit=15M/15M burst-threshold=10M/10M burst-time=10s/10s max-limit=
8M/8M name=poliklinik queue=pcq-upload-default/pcq-download-default 
target="192.168.1.137/32,192.168.2.111/32,192.168.1.138/32,192.168.1.139/3
2,192.168.6.246/32,192.168.2.117/32,192.168.1.113/32,192.168.2.119/32,192.
168.2.103/32,192.168.2.113/32,192.168.2.104/32,192.168.2.89/32,192.168.2.1
10/32,192.168.2.112/32,192.168.5.111/32,192.168.2.116/32,192.168.2.109/32,
192.168.6.132/32,192.168.2.115/32,192.168.2.118/32,192.168.2.108/32,192.16
8.1.134/32,192.168.5.109/32,192.168.2.105/32,192.168.2.107/32,192.168.2.12
4/32,192.168.5.113/32,192.168.5.203/32,192.168.5.170/32,192.168.5.106/32"
add burst-limit=10M/10M burst-threshold=7M/7M burst-time=10s/10s max-limit=
5M/5M name=poliklinik-gigi queue=pcq-upload-default/pcq-download-default 
target=192.168.2.122/32,192.168.2.123/32
add max-limit=10M/10M name=ugd queue=pcq-upload-default/pcq-download-default 
target=192.168.1.104/32,192.168.1.114/32
add max-limit=20M/20M name="laboratorium; lab-covid" queue=
pcq-upload-default/pcq-download-default target="192.168.1.146/32,192.168.5
.101/32,192.168.1.148/32,192.168.5.10/32,192.168.60.100/32"
add max-limit=20M/30M name=radiologi queue=
pcq-upload-default/pcq-download-default target=
192.168.1.126/32,192.168.1.153/32,192.168.1.157/32,192.168.1.100/32
add max-limit=20M/20M name="nurse-station; vk; ppi; kamar-bayi; icu; ok" 
queue=pcq-upload-default/pcq-download-default target="192.168.1.124/32,192
.168.1.110/32,192.168.2.100/32,192.168.2.99/32,192.168.2.106/32,192.168.3.
105/32,192.168.3.102/32,192.168.3.103/32,192.168.4.75/32,192.168.4.101/32,
192.168.4.98/32,192.168.4.111/32,192.168.4.112/32,192.168.4.113/32,192.168
.4.115/32,192.168.1.124/32,192.168.5.104/32,192.168.6.150/32,192.168.2.125
/32"
add max-limit=15M/15M name=casemix queue=
pcq-upload-default/pcq-download-default target=
192.168.5.117/32,192.168.6.111/32,192.168.6.112/32
add max-limit=10M/10M name=mcdc queue=pcq-upload-default/pcq-download-default 
target="192.168.5.185/32,192.168.5.43/32,192.168.5.44/32,192.168.5.45/32,1
92.168.5.46/32,192.168.5.55/32"
add max-limit=10M/10M name=wifi-keuangan queue=
pcq-upload-default/pcq-download-default target=192.168.6.174/32
add limit-at=20M/20M max-limit=50M/50M name=browsing packet-marks=no-mark 
parent=full-bandwith-broadband priority=3/3 queue=
pcq-upload-default/pcq-download-default target=
192.168.33.0/24,192.168.35.0/24
add limit-at=1M/1M max-limit=25M/25M name=streaming packet-marks=
packet-streaming parent=full-bandwith-broadband queue=
pcq-upload-default/pcq-download-default target=
192.168.33.0/24,192.168.35.0/24
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/ip address
add address=192.168.0.254/24 comment=cctv interface="ether5 - cctv" network=
192.168.0.0
add address=192.168.1.254/24 comment=lan interface="ether2 - lan" network=
192.168.1.0
add address=192.168.2.254/24 interface="ether2 - lan" network=192.168.2.0
add address=192.168.3.254/24 interface="ether2 - lan" network=192.168.3.0
add address=192.168.4.254/24 interface="ether2 - lan" network=192.168.4.0
add address=192.168.5.1/24 interface="ether2 - lan" network=192.168.5.0
add address=192.168.6.1/24 interface="ether2 - lan" network=192.168.6.0
add address=192.168.33.254/24 comment=wlan interface="ether3 - wlan" 
network=192.168.33.0
add address=192.168.40.254/24 comment=voip interface="ether4 - voip" network=
192.168.40.0
add address=192.168.60.254/24 comment=iptv interface="ether6 - iptv" network=
192.168.60.0
add address=192.168.65.254/24 interface="ether6 - iptv" network=192.168.65.0
add address=192.168.70.254/24 comment="it management" interface="ether7 - it" 
network=192.168.70.0
add address=192.168.35.254/24 interface="ether3 - wlan" network=
192.168.35.0
add address=xxx.xxx.xxx..194/29 comment="isp transtech dedicated" interface=
"ether10 - trans-dedicated" network=xxx.xxx.xxx..192
add address=192.168.34.254/24 interface="ether3 - wlan" network=
192.168.34.0
add address=xxx.xxx.xxx.2/29 comment="isp transtech broadband" interface=
"ether11 - trans-broadband" network=xxx.xxx.xxx.0
/ip dhcp-server network
add address=192.168.33.0/24 gateway=192.168.33.254
add address=192.168.35.0/24 gateway=192.168.35.254
add address=192.168.60.0/24 dns-server=192.168.60.254 gateway=192.168.60.254
add address=192.168.65.0/24 dns-server=192.168.65.254 gateway=192.168.65.254
/ip dns
set allow-remote-requests=yes servers=xxx.xxx.xxx..10,xxx.xxx.xxx..3,xxx.xxx.xxx..4
/ip dns static
add address=127.0.0.1 comment="implementasi blok trafik" disabled=yes name=
.youtube.com
add address=192.168.60.4 disabled=yes name=melinda2.sismadak
add address=192.168.1.108 disabled=yes name=siha.local
add address=192.168.70.104 comment=docker-traefik name=.melinda2.local
add address=192.168.70.104 name=melinda2.local
add address=127.0.0.1 comment=windows-update-list disabled=yes name=
download.windowsupdate.com
add address=127.0.0.1 disabled=yes name=download.microsoft.com
add address=127.0.0.1 disabled=yes name=go.microsoft.com
add address=127.0.0.1 disabled=yes name=dl.delivery.mp.microsoft.com
add address=127.0.0.1 disabled=yes name=.delivery.mp.microsoft.com
/ip firewall address-list
add address=192.168.33.0/24 list=boleh-streaming
add address=192.168.35.0/24 list=boleh-streaming
add address=192.168.60.0/24 list=boleh-streaming
add address=192.168.65.0/24 list=boleh-streaming
add address=192.168.0.0/24 list=internet
add address=192.168.1.0/24 list=internet
add address=192.168.2.0/24 list=internet
add address=192.168.3.0/24 list=internet
add address=192.168.4.0/24 list=internet
add address=192.168.5.0/24 list=internet
add address=192.168.6.0/24 list=internet
add address=192.168.40.0/24 list=internet
add address=192.168.60.0/24 list=internet
add address=192.168.65.0/24 list=internet
add address=192.168.70.0/24 list=internet
add address=192.168.33.0/24 list=internet
add address=192.168.35.0/24 list=internet
/ip firewall filter
add action=add-dst-to-address-list address-list=youtube-address-lists 
address-list-timeout=15m chain=forward content=youtube.com in-interface=
"ether2 - lan" out-interface="ether10 - trans-dedicated" 
src-address-list=Internet
add action=reject chain=forward dst-address-list=youtube-address-lists 
in-interface="ether2 - lan" out-interface="ether10 - trans-dedicated" 
reject-with=icmp-network-unreachable src-address-list=!boleh
add action=add-dst-to-address-list address-list=facebook-address-lists 
address-list-timeout=15m chain=forward content=facebook.com in-interface=
"ether2 - lan" out-interface="ether10 - trans-dedicated" 
src-address-list=Internet
add action=reject chain=forward dst-address-list=facebook-address-lists 
in-interface="ether2 - lan" out-interface="ether10 - trans-dedicated" 
reject-with=icmp-network-unreachable src-address-list=!boleh
add action=reject chain=forward disabled=yes in-interface="ether2 - lan" 
layer7-protocol=stream out-interface="ether10 - trans-dedicated" 
reject-with=icmp-network-unreachable src-address-list=!boleh
add action=add-src-to-address-list address-list=suspectspam 
address-list-timeout=2h chain=forward comment=spammers connection-limit=
10,32 dst-port=25 protocol=tcp
add action=drop chain=forward dst-port=25 protocol=tcp src-address-list=
suspectspam
add action=add-src-to-address-list address-list=nakal address-list-timeout=1h 
chain=forward comment="user illegal" in-interface="ether2 - lan" 
out-interface="ether10 - trans-dedicated" src-address-list=!Internet
add action=drop chain=forward in-interface="ether2 - lan" out-interface=
"ether10 - trans-dedicated" src-address-list=!Internet
add action=fasttrack-connection chain=forward comment="bypass teramedik" 
connection-state=established,related dst-address=192.168.5.3 
in-interface="ether2 - lan" protocol=tcp src-address-list=Internet
add action=fasttrack-connection chain=forward comment=
"bypass packet out from teramedik" connection-state=established,related 
dst-address=149.129.249.48 in-interface="ether2 - lan" out-interface=
"ether10 - trans-dedicated" protocol=tcp src-address=192.168.5.3
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward comment="blok clip on u" disabled=yes 
layer7-protocol=twitter out-interface="ether10 - trans-dedicated"
add action=drop chain=forward comment="blok twitter" disabled=yes 
in-interface="ether2 - lan" layer7-protocol=twitter out-interface=
"ether10 - trans-dedicated" src-address-list=!boleh
add action=drop chain=forward comment="blok insta" disabled=yes in-interface=
"ether2 - lan" layer7-protocol=7 out-interface=
"ether10 - trans-dedicated" src-address-list=!boleh
add action=drop chain=forward comment="blok path" disabled=yes in-interface=
"ether2 - lan" layer7-protocol=6 out-interface=
"ether10 - trans-dedicated"
add action=drop chain=forward comment="blok game ol" disabled=yes 
layer7-protocol=9 out-interface="ether10 - trans-dedicated"
add action=drop chain=forward comment="blok nonton movie" disabled=yes 
layer7-protocol=D out-interface="ether10 - trans-dedicated"
add action=drop chain=forward comment="blok utup" disabled=yes in-interface=
"ether2 - lan" layer7-protocol=facebook log=yes out-interface=
"ether10 - trans-dedicated" src-address-list=!boleh
add action=drop chain=forward comment="blok indoxx1" disabled=yes 
layer7-protocol=15 log=yes out-interface="ether10 - trans-dedicated" 
src-address-list=!boleh
/ip firewall mangle
add action=mark-routing chain=prerouting comment="route to dedicated" 
in-interface="ether2 - lan" new-routing-mark=dedicated passthrough=no
add action=mark-routing chain=prerouting in-interface="ether4 - voip" 
new-routing-mark=dedicated passthrough=no
add action=mark-routing chain=prerouting in-interface="ether5 - cctv" 
new-routing-mark=dedicated passthrough=no
add action=mark-routing chain=prerouting in-interface="ether6 - iptv" 
new-routing-mark=dedicated passthrough=no
add action=mark-routing chain=prerouting in-interface="ether7 - it" 
new-routing-mark=dedicated passthrough=no
add action=mark-routing chain=prerouting comment="route to broadband" 
in-interface="ether3 - wlan" new-routing-mark=broadband passthrough=no
add action=mark-connection chain=forward comment="hostspot traffic" dst-port=
443 in-interface="ether3 - wlan" layer7-protocol=stream 
new-connection-mark=con-streaming passthrough=yes protocol=tcp
add action=mark-connection chain=forward dst-port=443 in-interface=
"ether3 - wlan" layer7-protocol=stream new-connection-mark=
con-streaming passthrough=yes protocol=udp
add action=mark-connection chain=forward dst-port=443 in-interface=
"ether3 - wlan" layer7-protocol=stream new-connection-mark=
con-streaming passthrough=yes protocol=tcp
add action=mark-connection chain=forward dst-port=443 in-interface=
"ether3 - wlan" layer7-protocol=stream new-connection-mark=
con-streaming passthrough=yes protocol=udp
add action=mark-packet chain=forward connection-mark=con-streaming 
new-packet-mark=packet-streaming passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat
/ip firewall raw
add action=drop chain=prerouting comment="drop windows update" content=
windowsupdate.microsoft.com src-address-list=!boleh-update
add action=drop chain=prerouting content=.windowsupdate.microsoft.com 
src-address-list=!boleh-update
add action=drop chain=prerouting content=.update.microsoft.com 
src-address-list=!boleh-update
add action=drop chain=prerouting content=.windowsupdate.com 
src-address-list=!boleh-update
add action=drop chain=prerouting content=download.windowsupdate.com 
src-address-list=!boleh-update
add action=drop chain=prerouting content=download.microsoft.com 
src-address-list=!boleh-update
add action=drop chain=prerouting content=.download.windowsupdate.com 
src-address-list=!boleh-update
add action=drop chain=prerouting content=wustat.windows.com src-address-list=
!boleh-update
add action=drop chain=prerouting content=ntservicepack.microsoft.com 
src-address-list=!boleh-update
add action=drop chain=prerouting content=go.microsoft.com src-address-list=
!boleh-update
add action=drop chain=prerouting content=dl.delivery.mp.microsoft.com 
src-address-list=!boleh-update
add action=drop chain=prerouting content=.delivery.mp.microsoft.com 
src-address-list=!boleh-update
add action=drop chain=prerouting disabled=yes dst-address-list=
windows-update-list dst-port=80,443 protocol=tcp src-address-list=
Internet
add action=drop chain=prerouting disabled=yes dst-address-list=
windows-update-list dst-port=80,443 protocol=udp src-address-list=
Internet
/ip proxy
set cache-path=web-proxy1 parent-proxy=0.0.0.0
/ip route
add comment="Gateway Routing Mark" distance=1 gateway=xxx.xxx.xxx..193 
routing-mark=dedicated
add distance=1 gateway=xxx.xxx.xxx.1 routing-mark=broadband
add check-gateway=ping comment="Gateway Main" distance=1 gateway=
xxx.xxx.xxx..193
add check-gateway=ping distance=2 gateway=xxx.xxx.xxx.1
/ip route rule
add comment="Main Rule" dst-address=xxx.xxx.xxx..0/29 table=main
add dst-address=xxx.xxx.xxx.0/29 table=main
add dst-address=192.168.0.0/24 table=main
add dst-address=192.168.1.0/24 table=main
add dst-address=192.168.2.0/24 table=main
add dst-address=192.168.3.0/24 table=main
add dst-address=192.168.4.0/24 table=main
add dst-address=192.168.5.0/24 table=main
add dst-address=192.168.6.0/24 table=main
add dst-address=192.168.33.0/24 table=main
add dst-address=192.168.34.0/24 table=main
add dst-address=192.168.35.0/24 table=main
add dst-address=192.168.40.0/24 table=main
add dst-address=192.168.60.0/24 table=main
add dst-address=192.168.65.0/24 table=main
add dst-address=192.168.70.0/24 table=main
add comment="Dedicated Rule" dst-address=xxx.xxx.xxx..0/29 table=dedicated
add comment="Broadband Rule" dst-address=xxx.xxx.xxx.0/29 table=broadband
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=2806
set ssh address=192.168.6.192/32 disabled=yes
set api disabled=yes
/ip traffic-flow
set enabled=yes interfaces="ether2 - lan"
/ip traffic-flow target
add dst-address=192.168.6.192 port=8980
/snmp
set contact=xxxxxxxxxx@gmail.com enabled=yes location="Lt UB" 
trap-generators=start-trap trap-interfaces=all trap-version=3
/system clock
set time-zone-name=Asia/Jakarta
/system clock manual
set time-zone=+07:00
/system identity
set name="RS Melinda 2"
/system logging
add topics=critical
add topics=firewall
/tool e-mail
set address=xxx.xxx.xxx..194 password=xxxxxxxx port=465 user=
xxxxxxxxxx@gmail.com
/tool graphing interface
add interface="ether10 - trans-dedicated"
/tool graphing queue
add
/tool graphing resource
add
/tool sniffer
set file-limit=30000KiB file-name=snif-radbpjs filter-interface=
"ether4 - voip" filter-stream=yes streaming-server=192.168.6.192
/tool traffic-monitor
add interface="ether3 - wlan" name=tmon1 threshold=0
add interface="ether2 - lan" name=tmon2 threshold=0 trigger=below
add interface="ether10 - trans-dedicated" name=tmon3 threshold=0 trigger=
always
24

Sure, but I still can’t upload the file, so I just copied and pasted the configuration, deleting some parts due to the text limit in the editor and hiding the sensitive information.

So the issue arises when the source address comes from the “ether2 - lan”; otherwise, there are no problems. I think this is due to the SMB and firewall configurations on the PACS Server; however, when I use two Mikrotik RB1100AH devices with a simple configuration, there are no issues with SMB, the firewall, or at Layer 1 or 2. @CGGXANNX @anav

2026-04-01 23:02:29 by RouterOS 7.22

/interface bridge
add name=bridge1-it
/interface ethernet
set [ find default-name=ether2 ] name="ether2 - lan"
set [ find default-name=ether3 ] name="ether3 - wlan"
set [ find default-name=ether4 ] name="ether4 - voip"
set [ find default-name=ether5 ] name="ether5 - cctv"
set [ find default-name=ether6 ] name="ether6 - iptv"
set [ find default-name=ether7 ] name="ether7 - it"
set [ find default-name=ether10 ] name="ether10 - trans-dedicated"
set [ find default-name=ether11 ] name="ether11 - trans-broadband"
/interface wireguard
add comment="WireGuard Remote Admin" listen-port=13231 mtu=1420 name=
wg1-admin
/interface list
add comment="Mangle untuk WAN" name=WAN
add comment="PBR untuk antar-LAN" name=LAN-ALL
add comment="PBR untuk LAN ke Dedicated" name=LAN-Dedicated
add comment="PBR untuk LAN ke Broadband" name=LAN-Broadband
add comment="QoS untuk Broadband" name=QoS-Broadband
add comment="QoS untuk Dedicated" name=QoS-Dedicated
/ip pool
add name=dhcp_pool1_wlan ranges=
192.168.33.10-192.168.33.253,192.168.35.10-192.168.35.250
add name=dhcp_pool2_iptv ranges=
192.168.60.10-192.168.60.253,192.168.65.10-192.168.65.253
/ip dhcp-server
add add-arp=yes address-pool=dhcp_pool1_wlan authoritative=after-2sec-delay 
interface="ether3 - wlan" lease-time=1h name=dhcp-wlan
add add-arp=yes address-pool=dhcp_pool2_iptv interface="ether6 - iptv" name=
dhcp-iptv
/queue type
add kind=pcq name=pcq-upload pcq-classifier=src-address
add kind=pcq name=pcq-download pcq-classifier=dst-address
/queue simple
add comment="SIMRS Prioritas 1" limit-at=10M/10M max-limit=50M/50M name=
sq-simrs priority=1/1 queue=pcq-upload/pcq-download target=192.168.5.3/32
add comment="PACS Server" dst=192.168.5.8/32 limit-at=10M/10M max-limit=
50M/50M name=sq-dpj-rad-to-pacs-server priority=1/1 queue=
pcq-upload/pcq-download target=192.168.1.153/32
add comment="PACS Server" limit-at=10M/10M max-limit=50M/50M name=
sq-pacs-server priority=1/1 queue=pcq-upload/pcq-download target=
192.168.5.8/32
add comment="InternalServer Prioritas 1" limit-at=5M/5M max-limit=20M/20M 
name=sq-internal-server priority=2/2 queue=pcq-upload/pcq-download 
target="192.168.70.100/32,192.168.70.101/32,192.168.70.102/32,192.168.70.1
03/32,192.168.70.104/32,192.168.70.105/32,192.168.70.106/32,192.168.70.107
/32,192.168.70.108/32,192.168.70.109/32,192.168.70.110/32,192.168.70.120/3
2,192.168.70.123/32,192.168.6.111/32,192.168.6.112/32"
add comment="VoIP Prioritas 2" limit-at=5M/5M max-limit=10M/10M name=sq-voip 
priority=2/2 queue=pcq-upload/pcq-download target=192.168.40.0/24
add comment="CCTV Prioritas 3" max-limit=20M/5M name=sq-cctv priority=3/3 
queue=default/default target=192.168.0.0/24
/queue tree
add comment="PARENT: Broadband UPLOAD" max-limit=15M name=BB-UP parent=global 
queue=default
add comment="PARENT: Broadband DOWNLOAD" max-limit=50M name=BB-DL parent=
global queue=default
add limit-at=3M max-limit=15M name=BB-UP-portal packet-mark=pkt-bb-portal-up 
parent=BB-UP priority=1 queue=pcq-upload
add limit-at=5M max-limit=50M name=BB-DL-portal packet-mark=pkt-bb-portal-dl 
parent=BB-DL priority=1 queue=pcq-download
add limit-at=3M max-limit=15M name=BB-UP-meeting packet-mark=
pkt-bb-meeting-up parent=BB-UP priority=3 queue=pcq-upload
add limit-at=5M max-limit=50M name=BB-DL-meeting packet-mark=
pkt-bb-meeting-dl parent=BB-DL priority=3 queue=pcq-download
add max-limit=5M name=BB-UP-streaming packet-mark=pkt-bb-streaming-up parent=
BB-UP priority=5 queue=pcq-upload
add max-limit=10M name=BB-DL-streaming packet-mark=pkt-bb-streaming-dl 
parent=BB-DL priority=5 queue=pcq-download
add max-limit=15M name=BB-UP-browsing packet-mark=pkt-bb-browsing-up parent=
BB-UP priority=6 queue=pcq-upload
add max-limit=50M name=BB-DL-browsing packet-mark=pkt-bb-browsing-dl parent=
BB-DL priority=6 queue=pcq-download
add comment="PARENT: Dedicated UPLOAD" max-limit=50M name=DD-UP parent=global 
queue=default
add comment="PARENT: Dedicated DOWNLOAD" max-limit=50M name=DD-DL parent=
global queue=default
add limit-at=10M max-limit=50M name=DD-UP-portal packet-mark=pkt-dd-portal-up 
parent=DD-UP priority=1 queue=pcq-upload
add limit-at=10M max-limit=50M name=DD-DL-portal packet-mark=pkt-dd-portal-dl 
parent=DD-DL priority=1 queue=pcq-download
add limit-at=6M max-limit=50M name=DD-UP-meeting packet-mark=
pkt-dd-meeting-up parent=DD-UP priority=3 queue=pcq-upload
add limit-at=6M max-limit=50M name=DD-DL-meeting packet-mark=
pkt-dd-meeting-dl parent=DD-DL priority=3 queue=pcq-download
add max-limit=10M name=DD-UP-streaming packet-mark=pkt-dd-streaming-up 
parent=DD-UP priority=5 queue=pcq-upload
add max-limit=10M name=DD-DL-streaming packet-mark=pkt-dd-streaming-dl 
parent=DD-DL priority=5 queue=pcq-download
add max-limit=50M name=DD-UP-browsing packet-mark=pkt-dd-browsing-up parent=
DD-UP priority=6 queue=pcq-upload
add max-limit=50M name=DD-DL-browsing packet-mark=pkt-dd-browsing-dl parent=
DD-DL priority=6 queue=pcq-download
/routing table
add comment="Route via TransDedicated" fib name=via-TransDedicated
add comment="Route via TransBroadband" fib name=via-TransBroadband
/interface bridge port
add bridge=bridge1-it interface="ether7 - it"
add bridge=bridge1-it interface=ether8
/interface list member
add comment="Member WAN" interface="ether10 - trans-dedicated" list=WAN
add interface="ether11 - trans-broadband" list=WAN
add comment="Member LAN-ALL" interface="ether2 - lan" list=LAN-ALL
add interface="ether3 - wlan" list=LAN-ALL
add interface="ether4 - voip" list=LAN-ALL
add interface="ether5 - cctv" list=LAN-ALL
add interface="ether6 - iptv" list=LAN-ALL
add interface="ether7 - it" list=LAN-ALL
add comment="Member LAN-Dedicated" interface="ether2 - lan" list=
LAN-Dedicated
add interface="ether4 - voip" list=LAN-Dedicated
add interface="ether5 - cctv" list=LAN-Dedicated
add interface="ether6 - iptv" list=LAN-Dedicated
add interface="ether7 - it" list=LAN-Dedicated
add comment="Member LAN-Broadband" interface="ether3 - wlan" list=
LAN-Broadband
add comment="Member QoS-Dedicated" interface="ether2 - lan" list=
QoS-Dedicated
add interface="ether6 - iptv" list=QoS-Dedicated
add interface="ether7 - it" list=QoS-Dedicated
add comment="Member QoS-Broadband" interface="ether3 - wlan" list=
QoS-Broadband
/interface wireguard peers
add allowed-address=xxx.xxx.xxx.2/32 client-allowed-address=::/0 interface=
wg1-admin name=pc-Mr.Robot public-key=
"wwxFL+04gN65NXuraJHYMB9Gtxxxxxxxxxxxxxxxxxxxxxx"
add allowed-address=xxx.xxx.xxx.3/32 client-allowed-address=::/0 interface=
wg1-admin name=lpt-Lenovo public-key=
"/3RCm6K/Kow1mFOBy96XReLyGxxxxxxxxxxxxxxxxxxxxxx"
/ip address
add address=192.168.1.254/24 comment=LAN interface="ether2 - lan" network=
192.168.1.0
add address=192.168.2.254/24 interface="ether2 - lan" network=192.168.2.0
add address=192.168.3.254/24 interface="ether2 - lan" network=192.168.3.0
add address=192.168.4.254/24 interface="ether2 - lan" network=192.168.4.0
add address=192.168.5.1/24 interface="ether2 - lan" network=192.168.5.0
add address=192.168.6.1/24 interface="ether2 - lan" network=192.168.6.0
add address=192.168.33.254/24 comment=WLAN interface="ether3 - wlan" network=
192.168.33.0
add address=192.168.35.254/24 interface="ether3 - wlan" network=192.168.35.0
add address=192.168.40.254/24 comment=VoIP interface="ether4 - voip" network=
192.168.40.0
add address=192.168.0.254/24 comment=CCTV interface="ether5 - cctv" network=
192.168.0.0
add address=192.168.60.254/24 comment=IPTV interface="ether6 - iptv" network=
192.168.60.0
add address=192.168.65.254/24 interface="ether6 - iptv" network=192.168.65.0
add address=192.168.70.254/24 comment="IT Management" interface="ether7 - it" 
network=192.168.70.0
add address=xxx.xxx.xxx..194/29 comment="WAN Dedicated" interface=
"ether10 - trans-dedicated" network=xxx.xxx.xxx..192
add address=xxx.xxx.xxx.2/29 comment="WAN Broadband" interface=
"ether11 - trans-broadband" network=xxx.xxx.xxx.0
add address=xxx.xxx.xxx.1/24 comment="WireGuard Admin" interface=wg1-admin 
network=xxx.xxx.xxx.0
/ip dhcp-server network
add address=192.168.33.0/24 dns-server=192.168.33.254 gateway=192.168.33.254
add address=192.168.35.0/24 dns-server=192.168.35.254 gateway=192.168.35.254
add address=192.168.60.0/24 dns-server=192.168.60.254 gateway=192.168.60.254
add address=192.168.65.0/24 dns-server=192.168.65.254 gateway=192.168.65.254
/ip dns
set allow-remote-requests=yes servers=
xxx.xxx.xxx..10,xxx.xxx.xxx..3,xxx.xxx.xxx..4,8.8.8.8
/ip firewall address-list
add address=192.168.33.0/24 list=boleh-streaming
add address=192.168.35.0/24 list=boleh-streaming
add address=192.168.60.0/24 list=boleh-streaming
add address=192.168.65.0/24 list=boleh-streaming
add address=192.168.5.3 list=simrs-server
add address=192.168.5.5 list=simrs-server
add address=192.168.5.8 list=internal-server
add address=192.168.60.2 list=internal-server
add address=192.168.60.33 list=internal-server
add address=192.168.60.44 list=internal-server
add address=192.168.60.101 list=internal-server
add address=192.168.60.102 list=internal-server
add address=192.168.60.211 list=internal-server
add address=192.168.6.111 list=internal-server
add address=192.168.70.0/24 list=internal-server
add address=192.168.0.0/24 list=internet
add address=192.168.1.0/24 list=internet
add address=192.168.2.0/24 list=internet
add address=192.168.3.0/24 list=internet
add address=192.168.4.0/24 list=internet
add address=192.168.5.0/24 list=internet
add address=192.168.6.0/24 list=internet
add address=192.168.40.0/24 list=internet
add address=192.168.60.0/24 list=internet
add address=192.168.65.0/24 list=internet
add address=192.168.70.0/24 list=internet
add address=192.168.33.0/24 list=internet
add address=192.168.35.0/24 list=internet
add address=192.168.40.142 list=internal-server
/ip firewall filter
add action=accept chain=input comment="IN: Accept loopback" in-interface=lo
add action=accept chain=input comment="IN: Accept broadcast" dst-address=
255.255.255.255 in-interface-list=LAN-ALL
add action=accept chain=input comment="IN: Accept directed broadcast" 
dst-address-type=broadcast in-interface-list=LAN-ALL
add action=accept chain=input comment="IN: Accept ICMP from Dedicated" 
in-interface-list=WAN protocol=icmp
add action=log chain=input comment="IN: Log invalid LAN" connection-state=
invalid in-interface-list=LAN-ALL log-prefix="DROP-INPUT-INVALID: "
add action=drop chain=input comment="IN: Drop invalid LAN" connection-state=
invalid in-interface-list=LAN-ALL
add action=accept chain=input comment="IN: Accept established/related" 
connection-state=established,related
add action=add-src-to-address-list address-list=nakal address-list-timeout=1h 
chain=input comment="IN: Log nakal" in-interface-list=LAN-ALL 
src-address-list=!internet
add action=drop chain=input comment="IN: Drop non-internet LAN" 
in-interface-list=LAN-ALL src-address-list=!internet
add action=accept chain=input comment="IN: Accept ICMP LAN rate-limited" 
in-interface-list=LAN-ALL limit=10,5:packet protocol=icmp
add action=accept chain=input comment="IN: Accept WireGuard" dst-port=13231 
in-interface-list=WAN protocol=udp
add action=accept chain=input comment="IN: Accept Winbox/SSH via WireGuard" 
dst-port=8291,2022 in-interface=wg1-admin protocol=tcp
add action=drop chain=input comment="IN: Drop Winbox/SSH dari WAN" dst-port=
8291,2022 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="IN: Accept Winbox/SSH dari LAN" 
dst-port=8291,2022 in-interface-list=LAN-ALL protocol=tcp
add action=accept chain=input comment="IN: Accept HTTP dari LAN" dst-port=
2806 in-interface-list=LAN-ALL protocol=tcp
add action=accept chain=input comment="IN: Accept DNS TCP" dst-port=53 
in-interface-list=LAN-ALL protocol=tcp
add action=accept chain=input comment="IN: Accept DNS UDP" dst-port=53 
in-interface-list=LAN-ALL protocol=udp
add action=accept chain=input comment="IN: Accept DHCP" dst-port=67 
in-interface-list=LAN-ALL protocol=udp
add action=accept chain=input comment="IN: Accept NTP" dst-port=123 
in-interface-list=LAN-ALL protocol=udp
add action=log chain=input comment="IN: Log DROP ALL input" log-prefix=
"DROP-INPUT-ALL: "
add action=drop chain=input comment="IN: DROP ALL input"
add action=log chain=forward comment="FWD: Log invalid forward" 
connection-state=invalid log-prefix="DROP-FORWARD-INVALID: "
add action=drop chain=forward comment="FWD: Drop invalid forward" 
connection-state=invalid
add action=accept chain=forward comment="FWD: Accept established/related" 
connection-state=established,related
add action=accept chain=forward comment="FWD: Accept new LAN-LAN" 
connection-state=new in-interface-list=LAN-ALL out-interface-list=LAN-ALL
add action=accept chain=forward comment="FWD: Accept new LAN-WAN" 
connection-state=new in-interface-list=LAN-ALL out-interface-list=WAN
add action=accept chain=forward comment="FWD: Accept dstnat" 
connection-nat-state=dstnat connection-state=new in-interface-list=WAN 
out-interface-list=LAN-ALL
add action=log chain=forward comment="FWD: Log drop WAN-LAN" 
connection-state=new in-interface-list=WAN log-prefix=
"DROP-FORWARD-WAN: " out-interface-list=LAN-ALL
add action=drop chain=forward comment="FWD: Drop new WAN-LAN" 
connection-state=new in-interface-list=WAN out-interface-list=LAN-ALL
add action=log chain=forward comment="FWD: Log DROP ALL forward" log-prefix=
"DROP-FORWARD-ALL: "
add action=drop chain=forward comment="FWD: DROP ALL forward"
/ip firewall mangle
add action=mark-connection chain=forward comment="PASS1 BB: Portal" 
connection-mark=no-mark connection-state=new dst-address-list=addr-portal 
in-interface-list=QoS-Broadband new-connection-mark=conn-bb-portal 
out-interface-list=WAN
add action=mark-connection chain=forward comment="PASS1 BB: Meeting" 
connection-mark=no-mark connection-state=new dst-address-list=
addr-meeting in-interface-list=QoS-Broadband new-connection-mark=
conn-bb-meeting out-interface-list=WAN
add action=mark-connection chain=forward comment="PASS1 BB: Streaming" 
connection-mark=no-mark connection-state=new dst-address-list=
addr-streaming in-interface-list=QoS-Broadband new-connection-mark=
conn-bb-streaming out-interface-list=WAN
add action=mark-connection chain=forward comment=
"PASS1 BB: Browsing (sisa packet)" connection-mark=no-mark 
connection-state=new in-interface-list=QoS-Broadband new-connection-mark=
conn-bb-browsing out-interface-list=WAN
add action=mark-connection chain=forward comment="PASS1 DD: Portal" 
connection-mark=no-mark connection-state=new dst-address-list=addr-portal 
in-interface-list=QoS-Dedicated new-connection-mark=conn-dd-portal 
out-interface-list=WAN
add action=mark-connection chain=forward comment="PASS1 DD: Meeting" 
connection-mark=no-mark connection-state=new dst-address-list=
addr-meeting in-interface-list=QoS-Dedicated new-connection-mark=
conn-dd-meeting out-interface-list=WAN
add action=mark-connection chain=forward comment="PASS1 DD: Streaming" 
connection-mark=no-mark connection-state=new dst-address-list=
addr-streaming in-interface-list=QoS-Dedicated new-connection-mark=
conn-dd-streaming out-interface-list=WAN
add action=mark-connection chain=forward comment="PASS1 DD: Browsing (sisa)" 
connection-mark=no-mark connection-state=new in-interface-list=
QoS-Dedicated new-connection-mark=conn-dd-browsing out-interface-list=WAN
add action=mark-packet chain=forward comment="PASS2 BB: Portal UPLOAD" 
connection-mark=conn-bb-portal new-packet-mark=pkt-bb-portal-up 
passthrough=no src-address-list=internet
add action=mark-packet chain=forward comment="PASS2 BB: Portal DOWNLOAD" 
connection-mark=conn-bb-portal dst-address-list=internet new-packet-mark=
pkt-bb-portal-dl passthrough=no
add action=mark-packet chain=forward comment="PASS2 BB: Meeting UPLOAD" 
connection-mark=conn-bb-meeting new-packet-mark=pkt-bb-meeting-up 
passthrough=no src-address-list=internet
add action=mark-packet chain=forward comment="PASS2 BB: Meeting DOWNLOAD" 
connection-mark=conn-bb-meeting dst-address-list=internet 
new-packet-mark=pkt-bb-meeting-dl passthrough=no
add action=mark-packet chain=forward comment="PASS2 BB: Streaming UPLOAD" 
connection-mark=conn-bb-streaming new-packet-mark=pkt-bb-streaming-up 
passthrough=no src-address-list=internet
add action=mark-packet chain=forward comment="PASS2 BB: Streaming DOWNLOAD" 
connection-mark=conn-bb-streaming dst-address-list=internet 
new-packet-mark=pkt-bb-streaming-dl passthrough=no
add action=mark-packet chain=forward comment="PASS2 BB: Browsing UPLOAD" 
connection-mark=conn-bb-browsing new-packet-mark=pkt-bb-browsing-up 
passthrough=no src-address-list=internet
add action=mark-packet chain=forward comment="PASS2 BB: Browsing DOWNLOAD" 
connection-mark=conn-bb-browsing dst-address-list=internet 
new-packet-mark=pkt-bb-browsing-dl passthrough=no
add action=mark-packet chain=forward comment="PASS2 DD: Portal UPLOAD" 
connection-mark=conn-dd-portal new-packet-mark=pkt-dd-portal-up 
passthrough=no src-address-list=internet
add action=mark-packet chain=forward comment="PASS2 DD: Portal DOWNLOAD" 
connection-mark=conn-dd-portal dst-address-list=internet new-packet-mark=
pkt-dd-portal-dl passthrough=no
add action=mark-packet chain=forward comment="PASS2 DD: Meeting UPLOAD" 
connection-mark=conn-dd-meeting new-packet-mark=pkt-dd-meeting-up 
passthrough=no src-address-list=internet
add action=mark-packet chain=forward comment="PASS2 DD: Meeting DOWNLOAD" 
connection-mark=conn-dd-meeting dst-address-list=internet 
new-packet-mark=pkt-dd-meeting-dl passthrough=no
add action=mark-packet chain=forward comment="PASS2 DD: Streaming UPLOAD" 
connection-mark=conn-dd-streaming new-packet-mark=pkt-dd-streaming-up 
passthrough=no src-address-list=internet
add action=mark-packet chain=forward comment="PASS2 DD: Streaming DOWNLOAD" 
connection-mark=conn-dd-streaming dst-address-list=internet 
new-packet-mark=pkt-dd-streaming-dl passthrough=no
add action=mark-packet chain=forward comment="PASS2 DD: Browsing UPLOAD" 
connection-mark=conn-dd-browsing new-packet-mark=pkt-dd-browsing-up 
passthrough=no src-address-list=internet
add action=mark-packet chain=forward comment="PASS2 DD: Browsing DOWNLOAD" 
connection-mark=conn-dd-browsing dst-address-list=internet 
new-packet-mark=pkt-dd-browsing-dl passthrough=no
add action=change-mss chain=forward comment="MSS clamp" new-mss=clamp-to-pmtu 
protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="SRCNAT via WAN Dedicated" 
out-interface="ether10 - trans-dedicated"
add action=masquerade chain=srcnat comment="SRCNAT via WAN Broadband" 
out-interface="ether11 - trans-broadband"
/ip firewall raw
add action=drop chain=prerouting comment=
"Block streaming non-boleh-streaming" dst-address-list=addr-streaming 
in-interface-list=LAN-ALL src-address-list=!boleh-streaming
add action=accept chain=prerouting comment="Accept TransBroadband subnet" 
in-interface="ether11 - trans-broadband" src-address=xxx.xxx.xxx.0/29
add action=drop chain=prerouting comment="Drop bogon 0.0.0.0/8" 
in-interface-list=WAN src-address=0.0.0.0/8
add action=drop chain=prerouting comment="Drop loopback" in-interface-list=
WAN src-address=127.0.0.0/8
add action=drop chain=prerouting comment="Drop link-local" in-interface-list=
WAN src-address=169.254.0.0/16
add action=drop chain=prerouting comment="Drop RFC1918 192.168.x" 
in-interface-list=WAN src-address=192.168.0.0/16
add action=drop chain=prerouting comment="Drop RFC1918 172.16.x" 
in-interface-list=WAN src-address=172.16.0.0/12
add action=drop chain=prerouting comment="Drop RFC1918 10.x" 
in-interface-list=WAN src-address=10.0.0.0/8
add action=drop chain=prerouting comment="Drop TCP FIN+SYN" protocol=tcp 
tcp-flags=fin,syn
add action=drop chain=prerouting comment="Drop TCP FIN+RST" protocol=tcp 
tcp-flags=fin,rst
add action=drop chain=prerouting comment="Drop TCP SYN+RST" protocol=tcp 
tcp-flags=syn,rst
add action=drop chain=prerouting comment="Drop TCP NULL" protocol=tcp 
tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=prerouting comment="Block WinUpdate" content=
windowsupdate.microsoft.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
*.windowsupdate.microsoft.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
*.update.microsoft.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
*.windowsupdate.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
download.windowsupdate.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
download.microsoft.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
*.download.windowsupdate.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
wustat.windows.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
ntservicepack.microsoft.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
go.microsoft.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
dl.delivery.mp.microsoft.com src-address-list=!boleh-update
add action=drop chain=prerouting comment="Block WinUpdate" content=
*.delivery.mp.microsoft.com src-address-list=!boleh-update
/ip route
add check-gateway=ping comment="Default via TransDedicated" disabled=no 
distance=1 dst-address=0.0.0.0/0 gateway=xxx.xxx.xxx..193 routing-table=
via-TransDedicated scope=30 target-scope=10
add comment="Default via TransBroadband" disabled=no distance=1 dst-address=
0.0.0.0/0 gateway=xxx.xxx.xxx.1 routing-table=via-TransBroadband scope=30 
target-scope=10
add check-gateway=ping comment="Main primary via TransDedicated" disabled=no 
distance=1 dst-address=0.0.0.0/0 gateway=xxx.xxx.xxx..193 routing-table=
main scope=30 target-scope=10
add comment="Main failover via TransBroadband" disabled=no distance=2 
dst-address=0.0.0.0/0 gateway=xxx.xxx.xxx.1 routing-table=main scope=30 
target-scope=10
/ip service
set ftp disabled=yes
set telnet disabled=yes
set ssh port=2022
set www port=2806
set api disabled=yes
set api-ssl disabled=yes
/routing rule
add action=lookup chain=user comment="PBR: Router WAN Dedicated reply" 
disabled=no src-address=xxx.xxx.xxx..194/32 table=via-TransDedicated
add action=lookup chain=user comment="PBR: Router WAN Broadband reply" 
disabled=no src-address=xxx.xxx.xxx.2/32 table=via-TransBroadband
add action=lookup chain=user comment="PBR: LAN to LAN" disabled=no 
dst-address=192.168.0.0/16 src-address=192.168.0.0/16 table=main
add action=lookup chain=user comment="PBR: LAN Dedicated" disabled=no 
src-address=192.168.1.0/24 table=via-TransDedicated
add action=lookup chain=user disabled=no src-address=192.168.2.0/24 table=
via-TransDedicated
add action=lookup chain=user disabled=no src-address=192.168.3.0/24 table=
via-TransDedicated
add action=lookup chain=user disabled=no src-address=192.168.4.0/24 table=
via-TransDedicated
add action=lookup chain=user disabled=no src-address=192.168.5.0/24 table=
via-TransDedicated
add action=lookup chain=user disabled=no src-address=192.168.6.0/24 table=
via-TransDedicated
add action=lookup chain=user comment="PBR: VoIP Dedicated" disabled=no 
src-address=192.168.40.0/24 table=via-TransDedicated
add action=lookup chain=user comment="PBR: CCTV Dedicated" disabled=no 
src-address=192.168.0.0/24 table=via-TransDedicated
add action=lookup chain=user comment="PBR: IPTV Dedicated" disabled=no 
src-address=192.168.60.0/24 table=via-TransDedicated
add action=lookup chain=user disabled=no src-address=192.168.65.0/24 table=
via-TransDedicated
add action=lookup chain=user comment="PBR: IT Dedicated" disabled=no 
src-address=192.168.70.0/24 table=via-TransDedicated
add action=lookup chain=user comment="PBR: WLAN Broadband" disabled=no 
src-address=192.168.33.0/24 table=via-TransBroadband
add action=lookup chain=user disabled=no src-address=192.168.35.0/24 table=
via-TransBroadband
/system clock
set time-zone-name=Asia/Jakarta
/system identity
set name=RTR-RSMelinda2
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.id.pool.ntp.org
add address=1.id.pool.ntp.org
add address=2.id.pool.ntp.org
add address=3.id.pool.ntp.org
/system routerboard settings
set enter-setup-on=delete-key
/tool romon
set enabled=yes
/tool sniffer
set file-name=snip_pacs_to_client_1.pcap filter-dst-ip-address=192.168.5.8/32 
filter-interface="ether2 - lan" filter-src-ip-address=192.168.1.119/32