Possible ARP issue with ILO

Darth · March 30, 2026, 4:09pm

I have just built a fresh home environment. HAP-AX3 in the house, HAP-ax2 in the garage (NAS lives there, too noisy indoors) and a CAP-AX in the loft. CAP behaves perfectly, managed with CAPSMAN.

Originally I had 2 HAP AX2s, but decided I want an AX3 to run containers. Bought the AX3, then needed to free up the garage AX2 so I can return it. I replaced the house AX2 with the new AX3. I then wiped the old House AX2, exported the garage config and loaded it on that unit, then swapped them over. Garage AX2 is not routing, and has no firewall, it’s just acting as a downstream switch. 6 VLANs involved, which I think are broadly correct as things work as I want them to.

CAP would not provision, cannot ping the house AX3 from the garage AX2, or vice versa, but I could get to the other services on the switch perfectly. I swapped the old AX2 back, and everything is fine. With the replacement in situ, I spent hours with Co-Pilot trying to get it to work, and failed. I then went out for a walk, and when I came back I brought the one that doesn’t work into the house, and plugged it into the same port on my AX3, and it worked perfectly. The AX2s were identical as far as I can tell.

Having just proved that the ‘bad’ AX2 is in fact not necessarily bad, i put it back in the garage, and stuff doesn’t work again. Unplug devices one at a time, and when I remove my HP Microserver Gen 8’s ILO, everything springs to life. plug it back in, falls apart again. The ILO is using the dedicated port, not the shared one - I could understand some odd behaviour from shared, but not dedicated.

Both AX2s are on 7.22.1, as are the routerboard firmwares. Sadly I have already sent back the one I had the box for (the one that worked), but I have no idea why two ostensibly identical devices behave differently. I am of course now stuck with the ‘bad’ one.

I imagine this is an ARP issue of some kind, but I can’t even identify the cause, let alone stop it. Currently i’m disabling ether2 where the ILO is, and maybe that’s the permanent solution, but I am struggling to even work out how to troubleshoot this. If i enable ether2, the ping timeouts start after 3 seconds, when i disable it again, they start instantly. I’m new here (and to Mikrotik), so I have no idea what the protocol is for sharing config or logs, but happy to share anything that anyone might need to advise. Basically, i’m looking for any advice on troubleshooting this. The ILO firmware is the latest I believe, can’t get to hpe to check currently.

Many thanks

DM

pe1chl · March 30, 2026, 4:21pm

You could run Torch or Packet Sniffer to see what traffic that ILO is generating.

jaclaz · March 30, 2026, 4:28pm

Post both the configs of the Ax3 and of the Ax2, instructions here:
Forum rules - #5 by gigabyte091

Darth · March 30, 2026, 6:27pm

Thanks

run torch on ether2 with port disabled, then enable the port. nothing shown.
point my browser from House / ether5 at the ILO’s IP, i get the ILO page, but no traffic shown in torch.
same behaviour with sniffer
if i stop then start torch, I see what i’d expect - TCP for the web page, udp for DNS, some multicasts.
I see the odd 0x8899 ethertype, RRCP (not familiar with it) and some lldp (0x88cc)

Above behaviour repeatable on garage ether5 too, so maybe neither sniffer or torch can capture correctly when the interface is disabled.

Darth · March 30, 2026, 6:27pm

Thanks. Hope this is what you need (and hope i’ve got all the secret stuff!)

Garage uplink is ether1, ILO is on ether2.
House downlink to garage is on ether4.
*10 is my fault, i am half way through fixing an unrelated problem with VLAN50, but that is not related to the ILO issue (the ILO issue was there before i removed VLAN50).
I have removed the scripts in the interest of brevity in the House config, it was too big.
Also removed static DNS from House config
Ether2 on Garage is disabled, per original post.
I have also tried this with auto-mac=yes on both ends, makes no difference
When i plug in the ILO, the radios de-provision on Garage, and ping is lost in both directions between the routers.
a Host on VLAN10 on the House router (physically on ether5) can ping both routers (10.0.10.1 and 10.0.10.2) all the time and both routers can ping the host as well.

Garage config

# 2026-03-22 19:02:13 by RouterOS 7.22.1
# software id = RDYU-3K1Y
#
# model = C52iG-5HaxD2HaxD
/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridgeLocal \
    vlan-filtering=yes
/interface ethernet
set [ find default-name=ether2 ] disabled=yes
/interface vlan
add comment="Infra mgmt IP" interface=bridgeLocal name=vlan10 vlan-id=10
add comment="IoT VLAN (no IP)" interface=bridgeLocal name=vlan30 vlan-id=30
add comment="Guest VLAN (no IP)" interface=bridgeLocal name=vlan40 vlan-id=40
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
# managed by CAPsMAN 10.0.10.1, traffic processing on CAP
# mode: AP, SSID: TJC, channel: 5680/ax/D
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp \
    datapath.vlan-id=20 disabled=no
# managed by CAPsMAN 10.0.10.1, traffic processing on CAP
# mode: AP, SSID: TJC, channel: 2412/ax
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp \
    datapath.vlan-id=20 disabled=no
/interface bridge port
add bridge=bridgeLocal comment="Uplink trunk to House" frame-types=\
    admit-only-vlan-tagged interface=ether1
add bridge=bridgeLocal comment="Access VLAN10 - ILO" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridgeLocal comment="Access VLAN40" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 pvid=40
add bridge=bridgeLocal comment="Access VLAN40" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether4 pvid=40
add bridge=bridgeLocal comment="Access VLAN30" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether5 pvid=30
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridgeLocal comment="Infra VLAN" tagged=bridgeLocal,ether1 \
    untagged=ether2 vlan-ids=10
add bridge=bridgeLocal comment="IoT VLAN" tagged=bridgeLocal,ether1 untagged=\
    ether5 vlan-ids=30
add bridge=bridgeLocal comment="Guest VLAN" tagged=bridgeLocal,ether1 \
    untagged=ether3,ether4 vlan-ids=40
add bridge=bridgeLocal tagged=bridgeLocal,ether1 vlan-ids=20
add bridge=bridgeLocal tagged=bridgeLocal,ether1 vlan-ids=50
add bridge=bridgeLocal tagged=bridgeLocal,ether1 vlan-ids=60
/interface wifi cap
set caps-man-addresses=10.0.10.1 enabled=yes slaves-datapath=capdp
/ip address
add address=10.0.10.2/24 interface=vlan10 network=10.0.10.0
/ip dns
set servers=9.9.9.9
/ip route
add dst-address=0.0.0.0/0 gateway=10.0.10.1
/ip service
set ftp disabled=yes
set ssh address=10.0.10.0/24
set telnet disabled=yes
set www disabled=yes
set winbox address=10.0.10.0/24
/system clock
set time-zone-name=Europe/London
/system identity
set name=Garage
/system ntp client
set enabled=yes
/system ntp client servers
add address=10.0.10.1

Darth · March 30, 2026, 6:27pm

House Config:

# 2026-03-30 17:49:30 by RouterOS 7.22.1
# software id = SDS3-1ITZ
#
# model = C53UiG+5HPaxD2HPaxD
/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge \
    port-cost-mode=short vlan-filtering=yes
/interface wireguard
add listen-port=51820 mtu=1420 name=wg-iphone
add listen-port=55730 mtu=1420 name=wg-nordvpn
/interface vlan
add interface=bridge name=vlan10 vlan-id=10
add interface=bridge name=vlan20 vlan-id=20
add interface=bridge name=vlan30 vlan-id=30
add interface=bridge name=vlan40 vlan-id=40
add interface=bridge name=vlan50 vlan-id=50
add interface=bridge name=vlan60 vlan-id=60
/interface ethernet switch
set 0 cpu-flow-control=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi datapath
add bridge=bridge comment="Trusted WiFi VLAN20" disabled=no name=dp_VLAN20 \
    vlan-id=20
add bridge=bridge client-isolation=yes comment="IoT VLAN30" disabled=no name=\
    dp_VLAN30 vlan-id=30
add bridge=bridge client-isolation=yes comment="Isolated VLAN50" disabled=no \
    name=dp_VLAN50 vlan-id=50
add bridge=bridge comment="Guest WiFi VLAN60" disabled=no name=dp_VLAN60 \
    vlan-id=60
add bridge=bridge comment="No VLAN tagging" disabled=no name=dp_plain
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=sec-trusted
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=sec-iot
add authentication-types=wpa2-psk disabled=no name=sec-untrusted
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=sec-guest
/interface wifi configuration
add channel.width=20mhz country="United Kingdom" datapath=dp_VLAN20 disabled=\
    no name=cfg-trusted security=sec-trusted ssid="TJC"
add channel.width=20mhz country="United Kingdom" datapath=dp_VLAN30 \
    datapath.client-isolation=yes disabled=no name=cfg-iot security=sec-iot \
    ssid="DCG"
add channel.width=20mhz country="United Kingdom" datapath=dp_VLAN50 \
    datapath.client-isolation=no disabled=no name=cfg-untrusted security=\
    sec-untrusted ssid="MEC"
add channel.width=20mhz country="United Kingdom" datapath=dp_VLAN60 disabled=\
    no name=cfg-guest security=sec-guest ssid="RGA"
add channel.width=20/40mhz country="United Kingdom" datapath=dp_VLAN20 \
    disabled=no name=cfg-trusted-24 security=sec-trusted ssid=\
    "TJC"
/ip pool
add name=pool10 ranges=10.0.10.10-10.0.10.200
add name=pool20 ranges=10.0.20.10-10.0.20.200
add name=pool30 ranges=10.0.30.10-10.0.30.200
add name=pool40 ranges=10.0.40.10-10.0.40.200
add name=pool50 ranges=10.0.50.10-10.0.50.200
add name=pool60 ranges=10.0.60.10-10.0.60.200
/ip dhcp-server
add add-arp=yes address-pool=pool10 comment=Infra interface=vlan10 \
    lease-script=dhcp-dns lease-time=20m name=dhcp10
add add-arp=yes address-pool=pool20 comment="Trusted WiFi" interface=vlan20 \
    lease-script=dhcp-dns lease-time=20m name=dhcp20
add add-arp=yes address-pool=pool30 comment=IoT interface=vlan30 \
    lease-script=dhcp-dns lease-time=20m name=dhcp30
add address-pool=pool40 comment="NAS / Wired Guest" interface=vlan40 \
    lease-script=dhcp-dns lease-time=20m name=dhcp40
add address-pool=pool60 comment="Guest WiFi" interface=vlan60 lease-script=\
    dhcp-dns lease-time=20m name=dhcp60
add address-pool=pool50 interface=vlan50 lease-time=1h name=dhcp50
/routing table
add fib name=nordvpn
add fib name=to-nordvpn
/interface bridge port
add bridge=bridge comment="Access port VLAN40" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether2 \
    internal-path-cost=10 path-cost=10 pvid=40
add bridge=bridge comment="Trunk to Garage" frame-types=\
    admit-only-vlan-tagged interface=ether3 internal-path-cost=10 path-cost=\
    10
add bridge=bridge comment="Access port VLAN10" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether5 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge comment="Trunk to Loft" frame-types=admit-only-vlan-tagged \
    interface=ether4
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge comment="Trusted WiFi VLAN" tagged=bridge,ether4,ether3 \
    vlan-ids=20
add bridge=bridge comment="IoT VLAN" tagged=bridge,ether4,ether3 vlan-ids=30
add bridge=bridge comment="Isolated VLAN" tagged=bridge,ether3,ether4 \
    vlan-ids=50
add bridge=bridge comment="Guest WiFi VLAN" tagged=bridge,ether3,ether4 \
    vlan-ids=60
add bridge=bridge comment="NAS / Wired Guest VLAN" tagged=\
    bridge,ether2,ether4 vlan-ids=40
add bridge=bridge comment="Infra VLAN" tagged=bridge,ether3,ether4 untagged=\
    ether5 vlan-ids=10
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=\
    all wan-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=vlan10 list=LAN
add interface=vlan20 list=LAN
add interface=vlan40 list=LAN
add interface=vlan60 list=LAN
/interface ovpn-server server
add mac-address=xx:xx:xx:xx:xx:xx name=ovpn-server1
/interface wifi cap
set caps-man-addresses=10.0.10.1 discovery-interfaces=bridge enabled=yes
/interface wifi capsman
set enabled=yes interfaces=bridge,vlan10,lo
/interface wifi provisioning
add action=create-dynamic-enabled comment=normal disabled=no \
    master-configuration=cfg-trusted name-format=Wifi-%I \
    slave-configurations=cfg-untrusted,cfg-guest,cfg-iot
add action=create-enabled disabled=yes master-configuration=cfg-trusted-24 \
    slave-configurations=cfg-untrusted,cfg-guest,cfg-iot
/interface wireguard peers
add allowed-address=0.0.0.0/0 client-allowed-address=0.0.0.0/0 \
    endpoint-address=pl128.nordvpn.com endpoint-port=51820 interface=\
    wg-nordvpn name=peer1 persistent-keepalive=1m public-key=\
    "kjAOzXQRVGpmQdqE2zPsITH8QHmFK83AAPktqWed9wM="
add allowed-address=10.44.0.2/32 client-allowed-address=::/0 interface=\
    wg-iphone name=iPhone public-key=\
    "L+V9o0fNYkMVKNqsX7spBzD/9oSvxM/C7ZCZX1jLO3Q=" responder=yes
add allowed-address=10.44.0.3/32 client-address=10.44.0.3/32 \
    client-allowed-address=::/0 client-dns=10.0.40.1 client-endpoint=\
    wg.<my domain> client-keepalive=25s client-listen-port=51820 interface=\
    wg-iphone name=iPad public-key=\
    "cbhUX7YJt6yydsJWKfI4PQBaFHqlIIME40DF1lYmUGw="
/ip address
add address=10.0.20.1/24 interface=vlan20 network=10.0.20.0
add address=10.0.30.1/24 interface=vlan30 network=10.0.30.0
add address=10.0.40.1/24 interface=vlan40 network=10.0.40.0
add address=10.0.60.1/24 interface=vlan60 network=10.0.60.0
add address=10.0.10.1/24 interface=vlan10 network=10.0.10.0
add address=10.5.0.2 interface=wg-nordvpn network=10.5.0.2
add address=10.0.70.1/24 interface=*58 network=10.0.70.0
add address=10.44.0.1/24 interface=wg-iphone network=10.44.0.0
add address=10.0.50.1/24 interface=vlan50 network=10.0.50.0
/ip dhcp-client
add comment=defconf interface=ether1 name=ether1
/ip dhcp-server network
add address=10.0.10.0/24 comment=Management dns-server=10.0.10.1 domain=\
    <my internal domain> gateway=10.0.10.1 netmask=24
add address=10.0.20.0/24 comment=Trusted dns-server=10.0.20.1 domain=\
    <my internal domain> gateway=10.0.20.1 netmask=24
add address=10.0.30.0/24 comment=IoT dns-server=10.0.30.1 domain=<my internal domain> \
    gateway=10.0.30.1 netmask=24
add address=10.0.40.0/24 comment=NAS domain=<my internal domain> gateway=10.0.40.1 \
    netmask=24
add address=10.0.50.0/24 comment=Isolated dns-server=10.0.50.1 domain=\
    <my internal domain> gateway=10.0.50.1 netmask=24
add address=10.0.60.0/24 comment=Guest domain=<my internal domain> gateway=10.0.60.1 \
    netmask=24
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall address-list
add address=173.245.48.0/20 list=CloudFlare
add address=103.21.244.0/22 list=CloudFlare
add address=103.22.200.0/22 list=CloudFlare
add address=103.31.4.0/22 list=CloudFlare
add address=141.101.64.0/18 list=CloudFlare
add address=108.162.192.0/18 list=CloudFlare
add address=190.93.240.0/20 list=CloudFlare
add address=188.114.96.0/20 list=CloudFlare
add address=197.234.240.0/22 list=CloudFlare
add address=198.41.128.0/17 list=CloudFlare
add address=162.158.0.0/15 list=CloudFlare
add address=104.16.0.0/13 list=CloudFlare
add address=104.24.0.0/14 list=CloudFlare
add address=172.64.0.0/13 list=CloudFlare
add address=131.0.72.0/22 list=CloudFlare
/ip firewall filter
add action=accept chain=forward comment="Allow DNAT to internal servers" \
    connection-nat-state=dstnat in-interface=ether1
add action=drop chain=input comment="INPUT: drop invalid" connection-state=\
    invalid log=yes log-prefix="drop - "
# no interface
# no interface
add action=accept chain=input comment="TEMP: allow VLAN50 to router" \
    in-interface=*10
add action=accept chain=input comment="INPUT: allow VLAN50 ping" disabled=yes \
    in-interface=*10 protocol=icmp
add action=accept chain=input comment="INPUT: allow VLAN50 to router" \
    disabled=yes in-interface=*10
add action=accept chain=input comment="INPUT: allow local CAPsMAN" disabled=\
    yes dst-address=0.0.0.0/0 dst-port=5246,5247 protocol=udp src-address=\
    0.0.0.0/0
add action=accept chain=forward comment="FW: VLAN40 -> VLAN10 (return)" \
    in-interface=vlan40 out-interface=vlan10
add action=accept chain=input comment=\
    "INPUT: allow CAPs / CAPsMAN from VLAN10" src-address=10.0.10.0/24
add action=accept chain=input comment="INPUT: accept established, related" \
    connection-state=established,related
add action=accept chain=input comment="INPUT: allow ICMP" protocol=icmp
add action=accept chain=input comment="Allow WireGuard" dst-port=51820 \
    protocol=udp
add action=accept chain=forward comment="FW: Allow iPhone WG  VLAN40" \
    connection-nat-state="" dst-address=10.0.40.0/24 src-address=10.44.0.0/24
add action=drop chain=forward comment="FW: Block WG iPhone from other VLANs" \
    log=yes log-prefix="drop - " src-address=10.44.0.0/24
add action=accept chain=forward comment="FW - JellyFin" dst-port=30013 \
    in-interface=vlan20 log-prefix=TESTLOG- out-interface=vlan40 protocol=tcp
add action=accept chain=forward comment="FW - Infuse - iPhone" dst-address=\
    10.0.40.11 dst-port=445 in-interface=vlan20 log-prefix=TESTLOG- \
    out-interface=vlan40 protocol=tcp src-address=10.0.20.197
add action=accept chain=forward comment="FW - Infuse - iPad" dst-address=\
    10.0.40.11 dst-port=445 in-interface=vlan20 log-prefix=TESTLOG- \
    out-interface=vlan40 protocol=tcp src-address=10.0.20.199
add action=accept chain=input comment=\
    "INPUT: allow management from VLAN10 (Infra)" in-interface=vlan10
add action=accept chain=input comment="INPUT: VLAN20 DNS/DHCP" dst-port=\
    53,67,68 in-interface=vlan20 protocol=udp
add action=accept chain=input comment="IN: WG to DNS" dst-port=53 \
    in-interface=wg-iphone protocol=udp
add action=accept chain=input comment="INPUT: VLAN30 DNS/DHCP only" dst-port=\
    53,67,68 in-interface=vlan30 protocol=udp
add action=accept chain=input comment="INPUT: VLAN40 DNS/DHCP only" dst-port=\
    53,67,68 in-interface=vlan40 protocol=udp
add action=accept chain=input comment="INPUT: VLAN50 DNS/DHCP only" disabled=\
    yes dst-port=53,67,68 in-interface=*10 protocol=udp
add action=accept chain=input comment="INPUT: VLAN60 DNS/DHCP only" dst-port=\
    53,67,68 in-interface=vlan60 protocol=udp
add action=accept chain=forward comment="IP Camera from Frigate" dst-address=\
    10.0.30.192 src-address=10.0.40.11
add action=drop chain=input comment="INPUT: drop everything else from WAN" \
    in-interface-list=WAN log=yes log-prefix="drop - "
add action=drop chain=input comment="INPUT: drop everything else" log=yes \
    log-prefix="INPUT_Drop - "
add action=accept chain=forward comment="FW: VLAN50 -> NordVPN" disabled=yes \
    in-interface=*10 out-interface=wg-nordvpn
add action=accept chain=forward comment="FW: NordVPN -> VLAN50 return" \
    disabled=yes in-interface=wg-nordvpn out-interface=*10
add action=accept chain=forward comment="FW: allow DHCP OFFER to VLAN30" \
    dst-port=68 out-interface=vlan30 protocol=udp
add action=accept chain=forward comment="FW: allow DHCP OFFER to VLAN40" \
    dst-port=68 out-interface=vlan40 protocol=udp
add action=accept chain=forward comment="FORWARD: allow DHCP OFFER to VLAN60" \
    dst-port=68 out-interface=vlan60 protocol=udp
add action=drop chain=forward comment="FORWARD: drop invalid" \
    connection-state=invalid log=yes log-prefix="drop - "
add action=accept chain=forward comment=\
    "FORWARD: accept established, related" connection-state=\
    established,related
add action=accept chain=forward comment="FORWARD: allow DHCP OFFER to VLAN20" \
    dst-port=68 out-interface=vlan20 protocol=udp
add action=accept chain=forward comment="FORWARD: allow DHCP OFFER to VLAN50" \
    disabled=yes dst-port=68 out-interface=*10 protocol=udp
add action=accept chain=forward comment="FORWARD: VLAN10 -> WAN" \
    in-interface=vlan10 out-interface-list=WAN
add action=accept chain=forward comment="FORWARD: VLAN20 -> WAN" \
    in-interface=vlan20 out-interface-list=WAN
add action=accept chain=forward comment="FORWARD: VLAN30 -> WAN" \
    in-interface=vlan30 out-interface-list=WAN
add action=accept chain=forward comment="FORWARD: VLAN40 -> WAN" \
    in-interface=vlan40 out-interface-list=WAN
add action=accept chain=forward comment="FORWARD: VLAN50 -> WAN" disabled=yes \
    in-interface=*10 out-interface-list=WAN
add action=accept chain=forward comment="FORWARD: VLAN60 -> WAN" \
    in-interface=vlan60 out-interface-list=WAN
add action=accept chain=forward comment="FORWARD: VLAN10 -> VLAN20 (admin)" \
    in-interface=vlan10 out-interface=vlan20
add action=accept chain=forward comment="FORWARD: VLAN10 -> VLAN30 (admin)" \
    in-interface=vlan10 out-interface=vlan30
add action=accept chain=forward comment="FORWARD: VLAN10 -> VLAN40 (admin)" \
    in-interface=vlan10 log=yes out-interface=vlan40
add action=accept chain=forward comment="FORWARD: VLAN10 -> VLAN50 (admin)" \
    disabled=yes in-interface=vlan10 out-interface=*10
add action=accept chain=forward comment="FORWARD: VLAN10 -> VLAN60 (admin)" \
    in-interface=vlan10 out-interface=vlan60
add action=accept chain=forward comment=\
    "FORWARD: VLAN20 -> VLAN30 (trusted -> IoT)" in-interface=vlan20 \
    out-interface=vlan30
add action=accept chain=forward comment="FORWARD: FamilyRoom TV to JellyFin" \
    dst-address=10.0.40.11 dst-port=30013 protocol=tcp src-address=\
    10.0.30.200
add action=drop chain=forward comment="FORWARD: block VLAN30 -> VLAN10" \
    in-interface=vlan30 log=yes log-prefix="drop - " out-interface=vlan10
add action=drop chain=forward comment="FORWARD: block VLAN30 -> VLAN20" \
    in-interface=vlan30 log=yes log-prefix="drop - " out-interface=vlan20
add action=drop chain=forward comment="FORWARD: block VLAN30 -> VLAN40" \
    in-interface=vlan30 log=yes log-prefix="drop - " out-interface=vlan40
add action=drop chain=forward comment="FORWARD: block VLAN30 -> VLAN50" \
    disabled=yes in-interface=vlan30 log=yes log-prefix="drop - " \
    out-interface=*10
add action=drop chain=forward comment="FORWARD: block VLAN30 -> VLAN60" \
    in-interface=vlan30 log=yes log-prefix="drop - " out-interface=vlan60
add action=drop chain=forward comment=\
    "FORWARD: block VLAN30 device-to-device" in-interface=vlan30 log=yes \
    log-prefix="drop - " out-interface=vlan30
add action=drop chain=forward comment="FORWARD: block VLAN60 -> VLAN10" \
    in-interface=vlan60 log=yes log-prefix="drop - " out-interface=vlan10
add action=drop chain=forward comment="FORWARD: block VLAN60 -> VLAN20" \
    in-interface=vlan60 log=yes log-prefix="drop - " out-interface=vlan20
add action=drop chain=forward comment="FORWARD: block VLAN60 -> VLAN30" \
    in-interface=vlan60 log=yes log-prefix="drop - " out-interface=vlan30
add action=drop chain=forward comment="FORWARD: block VLAN60 -> VLAN40" \
    in-interface=vlan60 log=yes log-prefix="drop - " out-interface=vlan40
add action=drop chain=forward comment="FORWARD: block VLAN60 -> VLAN50" \
    disabled=yes in-interface=vlan60 log=yes log-prefix="drop - " \
    out-interface=*10
add action=drop chain=forward comment=\
    "FORWARD: block VLAN60 device-to-device" in-interface=vlan60 log=yes \
    log-prefix="drop - " out-interface=vlan60
add action=drop chain=forward comment="FORWARD: block VLAN50 -> VLAN10" \
    disabled=yes in-interface=*10 log=yes log-prefix="drop - " out-interface=\
    vlan10
add action=drop chain=forward comment="FORWARD: block VLAN50 -> VLAN20" \
    disabled=yes in-interface=*10 log=yes log-prefix="drop - " out-interface=\
    vlan20
add action=drop chain=forward comment="FORWARD: block VLAN50 -> VLAN30" \
    disabled=yes in-interface=*10 log=yes log-prefix="drop - " out-interface=\
    vlan30
add action=drop chain=forward comment="FORWARD: block VLAN50 -> VLAN40" \
    disabled=yes in-interface=*10 log=yes log-prefix="drop - " out-interface=\
    vlan40
add action=drop chain=forward comment="FORWARD: block VLAN50 -> VLAN60" \
    disabled=yes in-interface=*10 log=yes log-prefix="drop - " out-interface=\
    vlan60
add action=drop chain=forward comment=\
    "FORWARD: block VLAN50 device-to-device" disabled=yes in-interface=*10 \
    log=yes log-prefix="testdrop - " out-interface=*10
add action=drop chain=forward comment="FORWARD: drop everything else" log=yes \
    log-prefix="DefaultDrop -  "
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=to-nordvpn \
    src-address=10.0.50.0/24
/ip firewall nat
add action=dst-nat chain=dstnat comment="NAT: Crib Web Site" dst-port=443 \
    in-interface=ether1 log=yes log-prefix=CribNAT protocol=tcp \
    src-address-list=CloudFlare to-addresses=10.0.30.187 to-ports=443
add action=masquerade chain=srcnat comment=\
    "NAT: NordVPN WireGuard masquerade" out-interface=wg-nordvpn
add action=masquerade chain=srcnat comment="NAT: iPhone WireGuard masquerade" \
    out-interface=wg-iphone
add action=masquerade chain=srcnat comment="NAT: WAN masquerade" \
    out-interface-list=WAN
add action=redirect chain=dstnat dst-port=53 protocol=udp src-address=\
    10.0.50.0/24 to-ports=53
add action=redirect chain=dstnat dst-port=53 protocol=tcp src-address=\
    10.0.50.0/24 to-ports=53
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add dst-address=0.0.0.0/0 gateway=wg-nordvpn routing-table=nordvpn
add dst-address=10.0.40.0/24 gateway=wg-iphone
add dst-address=0.0.0.0/0 gateway=wg-nordvpn routing-table=to-nordvpn
/ip service
set ftp disabled=yes
set ssh address=10.0.10.0/24
set telnet disabled=yes
set www disabled=yes
set winbox address=10.0.10.0/24
set api disabled=yes
/ip ssh
set strong-crypto=yes
/ipv6 dhcp-client
add interface=ether1 pool-name=ee-ipv6 request=prefix
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/London
/system identity
set name=House
/system logging
add topics=caps
add disabled=yes topics=dhcp
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=1.1.1.1
/system scheduler
add interval=30s name=sync-dns on-event=sync-dns policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-03-21 start-time=20:20:33
add comment="Dynamic DNS CLoudflare" interval=5m name=Cloudflare_DNS \
    on-event=Dyn-DNS policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-03-27 start-time=15:27:48
/tool bandwidth-server
set enabled=no
/tool traffic-monitor
add interface=ether5 name=tmon1