Hello everybody!
I'm trying to finally switch over to a fiberoptic internet connection. In the process of that I have also upgraded my home network, using MikroTik devices. I've managed to set it (the home network) up like I intended, and have used it for about two months with the old LTE ISP without complaint. However, when I try to use my new fiberoptic connection I run into a major issue.
The fiberoptic ISP uses PPPoE on top of the physical connection to authenticate their subscribers. I've managed to configure this, and can successfully establish an internet connection via this. However, when the upload gets high (above 425 MBit/s, contract is for 500 MBit/s), the PPPoE connection just collapses and theautomatic retry fails.
In the rest of this post I will describe the setup and the problem in more detail, and explain what I tried to fix it. I'll also include two configurations of the router.
I've tried everything I could think of or found online, but nothing has worked. Any advice on how to fix the issue or how to diagnose it further would be greatly appreciated.
Setup
Devices:
- Router 1: hEX S 2025
- Access Point 2: hAP ax²
- Access Point 3: hAP ax²
- Access Point 4: wAP ax
- Coax-Modem 1 - 3: SYMARIX TGU 21 G.hn
Remarks:
- The coax modems together can be thought of like an unmanaged switch with ports that are really far apart.
- The coax modems, the access points and one server (not depicted) have static DHCP leases.
- The router can reach the old ISPs WiFi router (now in bridge mode) via VLAN 2. This VLAN is only configured on Access Point 2.
- In addition to the depicted VLANs the physical connection is also used untagged, because the coax modems themself cannot be reached via a VLAN.
- The VLANs reach Access Point 4 via an EoIP tunnel that I forgot to draw.
- The access points are managed by CAPsMAN running on Router 1.
- The SFP module was supplied by the ISP.
The issue
When I activate the PPPoE interface on the router, it quickly establishes a connection to the ISP. I can also use that connection. However, if the upload gets high, then the PPPoE connection collapses.
To put numbers on that: the collapse happens above 425 MBit/s, the contract is for 500 MBit/s.
I use a speedtest to trigger the issue, but I've also seen it happen on the speedtest of my local internet regulator.
The message displayed at the bottom of the window of the PPPoE interface in WinBox reads: "terminating... - failed to authenticate ourselves to peer"
What I've tried
-
Talk to my ISP:
- Apparently on their side the connection goes away because they no longer receive keepalive packages. The connection remains open for a long time if I don't trigger the problem, so I don't think that they receive no such packages at all.
- They mentioned they had other customers with problems who used the hEX S 2025. However, it appears that those problems were fixed by disabling the auto negotiation on the SFP module (something I also had to do). The issue I'm posting about seems to be separate from that.
- They recommended that I redo my router configuration.
-
I started to reconfigure my router from scratch.
- I did a lot of speedtests after every couple of options.
- I got to the point where all I had left to do was enabling internet access for the VLANs and set up the WiFi. The issue still didn't appear.
-
I decided to start from scratch again to add comment everywhere and to make sure I hadn't forgotten anything important.
- I got to basically the same point again, and did a little bit more.
- I did a speedtest, the issue immediately reappeared.
-
I did a lot of online research, both on this forum and the general internet. I couldn't find anyone with this problem. A couple things were vaguely similar, but when I tried their solutions it still didn't work. Also, in all such cases there still were clear differences between their issue and mine.
-
I reached out to the ISP for clarification on what exactly they mean by keepalive package.
- I did this on friday afternoon, and haven't heard back yet. It seems that their support ends at noon that day. I'll update on this once I have an answer.
- If they mean LCP echo replies (they send requests) that would be really confusing, because the logs state that a reply is sent a couple seconds before the connection collapses.
-
I've monitored the hardware utilization.
- The CPU never even crosses 50%.
- Hardly any RAM is used at all.
-
I've compared the configs from points 2 and 3. I can see nothing that would cause this in the diff. I've also tried applying all the differences individually on the broken config, and could not get it to work.
Configurations
I made the following changes to the configuration exports by hand. I did this to reduce the size of the diff output. I believe all these changes don't affect behaviour. If needed, I can post the original exports.
- strip comments
- rename interface lists to be identical
- reorder list creation and membership assignment
- synchronized interface names
- redacted pppoe user
- reorder vlan interfaces by vlan id
- reorder bridge vlan settings by vlan id
- reorder dhcp leases by ip
- reorder firewall address lists by ip
- remove log prefixes
- change identity name (for privacy)
- change static dns entries (for privacy)
Working Config
# 2025-11-16 16:02:53 by RouterOS 7.20.4
# software id = PAP1-2ZUP
#
# model = E60iUGS
# serial number = redacted
/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp1 ] auto-negotiation=no speed=1G-baseX
/interface pppoe-client
add add-default-route=yes disabled=no interface=sfp1 keepalive-timeout=disabled name=isp use-peer-dns=yes user=redacted
/interface vlan
add interface=bridge name=vlan_meta vlan-id=1
add interface=bridge name=vlan_isp_old vlan-id=4
add interface=bridge name=vlan_resident vlan-id=10
add interface=bridge name=vlan_guest vlan-id=20
add interface=bridge name=vlan_iot vlan-id=30
add interface=bridge name=vlan_server vlan-id=40
/interface list
add name=list_discover
add name=list_inet
add name=list_lans
/ip pool
add name=pool_meta ranges=172.16.1.0-172.16.255.254
add name=pool_resident ranges=172.17.1.0-172.17.255.254
add name=pool_guest ranges=172.18.1.0-172.18.255.254
add name=pool_iot ranges=172.19.1.0-172.19.255.254
add name=pool_server ranges=172.20.1.0-172.20.255.254
/ip dhcp-server
add address-pool=pool_meta interface=vlan_meta lease-time=1d name=dhcp_meta
add address-pool=pool_resident interface=vlan_resident lease-time=1d name=dhcp_resident
add address-pool=pool_guest interface=vlan_guest lease-time=1d name=dhcp_guest
add address-pool=pool_iot interface=vlan_iot lease-time=1d name=dhcp_iot
add address-pool=pool_server interface=vlan_server lease-time=1d name=dhcp_server
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3 pvid=20
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=20
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=20
/ip neighbor discovery-settings
set discover-interface-list=list_discover
/interface bridge vlan
add bridge=bridge tagged=bridge,ether3 untagged=ether2 vlan-ids=1
add bridge=bridge tagged=bridge,ether2 vlan-ids=4
add bridge=bridge tagged=bridge,ether2 vlan-ids=10
add bridge=bridge tagged=bridge,ether2 untagged=ether3,ether4,ether5 vlan-ids=20
add bridge=bridge tagged=bridge,ether2 vlan-ids=30
add bridge=bridge tagged=bridge,ether2 vlan-ids=40
/interface list member
add interface=vlan_meta list=list_discover
add interface=isp list=list_inet
add interface=vlan_meta list=list_lans
/ip address
add address=172.16.0.1/16 interface=vlan_meta network=172.16.0.0
add address=172.17.0.1/16 interface=vlan_resident network=172.17.0.0
add address=172.18.0.1/16 interface=vlan_guest network=172.18.0.0
add address=172.19.0.1/16 interface=vlan_iot network=172.19.0.0
add address=172.20.0.1/16 interface=vlan_server network=172.20.0.0
/ip dhcp-client
add default-route-distance=2 interface=vlan_isp_old use-peer-ntp=no
/ip dhcp-server lease
add address=172.16.0.2 mac-address=F4:1E:57:F3:4B:F1 server=dhcp_meta
add address=172.16.0.3 mac-address=F4:1E:57:F3:4C:68 server=dhcp_meta
add address=172.16.0.4 mac-address=F4:1E:57:EC:EA:DE server=dhcp_meta
add address=172.16.0.11 mac-address=00:05:9E:48:A2:17 server=dhcp_meta
add address=172.16.0.12 mac-address=00:05:9E:48:A2:29 server=dhcp_meta
add address=172.16.0.13 mac-address=00:05:9E:48:A4:F2 server=dhcp_meta
add address=172.20.0.100 mac-address=7C:D3:0A:35:EB:5B server=dhcp_server
/ip dhcp-server network
add address=172.16.0.0/16 gateway=172.16.0.1
add address=172.17.0.0/16 gateway=172.17.0.1
add address=172.18.0.0/16 gateway=172.18.0.1
add address=172.19.0.0/16 gateway=172.19.0.1
add address=172.20.0.0/16 gateway=172.20.0.1
/ip firewall address-list
add address=0.0.0.0/8 list=not_inet
add address=10.0.0.0/8 list=not_inet
add address=100.64.0.0/10 list=not_inet
add address=127.0.0.0/8 list=not_inet
add address=169.254.0.0/16 list=not_inet
add address=172.16.0.0/12 list=not_inet
add address=172.16.0.0/16 list=lan
add address=192.0.0.0/24 list=not_inet
add address=192.0.2.0/24 list=not_inet
add address=192.88.99.0/24 list=not_inet
add address=192.168.0.0/16 list=not_inet
add address=198.18.0.0/15 list=not_inet
add address=198.51.100.0/24 list=not_inet
add address=203.0.113.0/24 list=not_inet
add address=224.0.0.0/4 list=not_inet
add address=240.0.0.0/4 list=not_inet
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=drop chain=input dst-port=22,8291 in-interface=!vlan_meta protocol=tcp
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface-list=list_lans
add action=drop chain=input
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward dst-address-list=not_inet out-interface-list=list_inet
add action=jump chain=forward in-interface-list=list_inet jump-target=inet
add action=jump chain=forward in-interface=vlan_meta jump-target=meta
add action=jump chain=forward in-interface=vlan_resident jump-target=resident
add action=jump chain=forward in-interface=vlan_guest jump-target=guest
add action=jump chain=forward in-interface=vlan_iot jump-target=iot
add action=jump chain=forward in-interface=vlan_server jump-target=server
add action=drop chain=forward
add action=drop chain=inet src-address-list=not_inet
add action=drop chain=inet disabled=yes dst-address-list=not_inet
add action=jump chain=inet jump-target=inet_icmp protocol=icmp
add action=drop chain=inet
add action=accept chain=inet_icmp icmp-options=0:0-255 protocol=icmp
add action=accept chain=inet_icmp icmp-options=3:0-255 protocol=icmp
add action=accept chain=inet_icmp icmp-options=8:0-255 protocol=icmp
add action=accept chain=inet_icmp icmp-options=11:0-255 protocol=icmp
add action=accept chain=inet_icmp icmp-options=12:0-255 protocol=icmp
add action=drop chain=inet_icmp
add action=accept chain=meta out-interface-list=list_inet
add action=drop chain=meta
add action=accept chain=resident out-interface-list=list_inet
add action=accept chain=resident out-interface=vlan_iot
add action=accept chain=resident out-interface=vlan_server
add action=drop chain=resident
add action=accept chain=guest out-interface-list=list_inet
add action=accept chain=guest out-interface=vlan_server
add action=drop chain=guest
add action=accept chain=iot out-interface-list=list_inet
add action=accept chain=iot out-interface=vlan_server
add action=drop chain=iot
add action=accept chain=server out-interface-list=list_inet
add action=drop chain=server
/ip firewall nat
add action=masquerade chain=srcnat out-interface=isp src-address=172.16.0.0/16
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 list=not_inet
add address=::1/128 list=not_inet
add address=::ffff:0.0.0.0/96 list=not_inet
add address=64:ff9b::/96 list=not_inet
add address=64:ff9b:1::/48 list=not_inet
add address=100::/64 list=not_inet
add address=2001:20::/28 list=not_inet
add address=2001:db8::/32 list=not_inet
add address=3fff::/20 list=not_inet
add address=5f00::/16 list=not_inet
add address=fc00::/7 list=not_inet
add address=fe80::/10 list=not_inet
/ipv6 firewall filter
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmpv6
add action=accept chain=input dst-port=33434-33534 protocol=udp
add action=drop chain=input
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward dst-address-list=not_inet out-interface-list=list_inet
add action=jump chain=forward in-interface-list=list_inet jump-target=inet
add action=jump chain=forward in-interface=vlan_meta jump-target=meta
add action=jump chain=forward in-interface=vlan_resident jump-target=resident
add action=jump chain=forward in-interface=vlan_guest jump-target=guest
add action=jump chain=forward in-interface=vlan_iot jump-target=iot
add action=jump chain=forward in-interface=vlan_server jump-target=server
add action=drop chain=forward
add action=drop chain=inet src-address-list=not_inet
add action=jump chain=inet jump-target=inet_icmp protocol=icmpv6
add action=drop chain=inet
add action=accept chain=inet_icmp icmp-options=1:0-255 protocol=icmpv6
add action=accept chain=inet_icmp icmp-options=2:0-255 protocol=icmpv6
add action=accept chain=inet_icmp icmp-options=128:0-255 protocol=icmpv6
add action=accept chain=inet_icmp icmp-options=129:0-255 protocol=icmpv6
add action=drop chain=inet_icmp
add action=accept chain=meta out-interface-list=list_inet
add action=drop chain=meta
add action=accept chain=resident out-interface-list=list_inet
add action=accept chain=resident in-interface=vlan_iot
add action=accept chain=resident in-interface=vlan_server
add action=drop chain=resident
add action=accept chain=guest out-interface-list=list_inet
add action=accept chain=guest out-interface=vlan_server
add action=drop chain=guest
add action=accept chain=iot out-interface-list=list_inet
add action=accept chain=iot out-interface=vlan_server
add action=drop chain=iot
add action=accept chain=server out-interface-list=list_inet
add action=drop chain=server
/system clock
set time-zone-name=Europe/Vienna
Broken Config
# 2025-11-16 16:17:48 by RouterOS 7.20.4
# software id = PAP1-2ZUP
#
# model = E60iUGS
# serial number = redacted
/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] disabled=yes
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=sfp1 ] auto-negotiation=no speed=1G-baseX
/interface pppoe-client
add add-default-route=yes disabled=no interface=sfp1 keepalive-timeout=disabled name=isp use-peer-dns=yes user=redacted
/interface vlan
add interface=bridge name=vlan_meta vlan-id=1
add interface=bridge name=vlan_isp_old vlan-id=4
add interface=bridge name=vlan_resident vlan-id=10
add interface=bridge name=vlan_guest vlan-id=20
add interface=bridge name=vlan_iot vlan-id=30
add interface=bridge name=vlan_server vlan-id=40
/interface list
add name=list_discover
add name=list_inet
add name=list_lans
/ip pool
add name=pool_meta ranges=172.16.1.0-172.16.255.254
add name=pool_resident ranges=172.17.1.0-172.17.255.254
add name=pool_guest ranges=172.18.1.0-172.18.255.254
add name=pool_iot ranges=172.19.1.0-172.19.255.254
add name=pool_server ranges=172.20.1.0-172.20.255.254
/ip dhcp-server
add address-pool=pool_meta interface=vlan_meta lease-time=1d name=dhcp_meta
add address-pool=pool_resident interface=vlan_resident lease-time=1d name=dhcp_resident
add address-pool=pool_guest interface=vlan_guest lease-time=1d name=dhcp_guest
add address-pool=pool_iot interface=vlan_iot lease-time=1d name=dhcp_iot
add address-pool=pool_server interface=vlan_server lease-time=1d name=dhcp_server
/ipv6 pool
add name=unique_local prefix=fd86:e49c:8c3::/48 prefix-length=64
/ip smb
set enabled=no
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3 pvid=20
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=20
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=20
/ip neighbor discovery-settings
set discover-interface-list=list_discover
/interface bridge vlan
add bridge=bridge tagged=bridge,ether3 untagged=ether2 vlan-ids=1
add bridge=bridge tagged=bridge,ether2 vlan-ids=10
add bridge=bridge tagged=bridge,ether2 untagged=ether3,ether4,ether5 vlan-ids=20
add bridge=bridge tagged=bridge,ether2 vlan-ids=30
add bridge=bridge tagged=bridge,ether2 vlan-ids=40
/interface list member
add interface=vlan_meta list=list_discover
add interface=vlan_isp_old list=list_inet
add interface=ether1 list=list_inet
add interface=isp list=list_inet
add interface=vlan_guest list=list_lans
add interface=vlan_iot list=list_lans
add interface=vlan_meta list=list_lans
add interface=vlan_resident list=list_lans
add interface=vlan_server list=list_lans
/ip address
add address=172.16.0.1/16 interface=vlan_meta network=172.16.0.0
add address=172.17.0.1/16 interface=vlan_resident network=172.17.0.0
add address=172.18.0.1/16 interface=vlan_guest network=172.18.0.0
add address=172.19.0.1/16 interface=vlan_iot network=172.19.0.0
add address=172.20.0.1/16 interface=vlan_server network=172.20.0.0
/ip dhcp-client
# Interface not active
add default-route-distance=2 interface=ether1
add default-route-distance=3 interface=vlan_isp_old
/ip dhcp-server lease
add address=172.16.0.2 mac-address=F4:1E:57:F3:4B:F1 server=dhcp_meta
add address=172.16.0.3 mac-address=F4:1E:57:F3:4C:68 server=dhcp_meta
add address=172.16.0.4 mac-address=F4:1E:57:EC:EA:DE server=dhcp_meta
add address=172.16.0.11 mac-address=00:05:9E:48:A2:17 server=dhcp_meta
add address=172.16.0.12 mac-address=00:05:9E:48:A2:29 server=dhcp_meta
add address=172.16.0.13 mac-address=00:05:9E:48:A4:F2 server=dhcp_meta
add address=172.20.0.100 mac-address=7C:D3:0A:35:EB:5B server=dhcp_server
/ip dhcp-server network
add address=172.16.0.0/16 gateway=172.16.0.1
add address=172.17.0.0/16 gateway=172.17.0.1
add address=172.18.0.0/16 gateway=172.18.0.1
add address=172.19.0.0/16 gateway=172.19.0.1
add address=172.20.0.0/16 gateway=172.20.0.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add cname=device2.dev.mydomain.invalid name=www.cloud.invalid type=CNAME
add address=172.20.0.100 name=device2.dev.mydomain.invalid type=A
add address=fd86:e49c:8c3:4:fcbb:d9b6:7ff1:79db name=device2.dev.mydomain.invalid type=AAAA
/ip firewall address-list
add address=0.0.0.0/8 list=not_inet
add address=10.0.0.0/8 list=not_inet
add address=100.64.0.0/10 list=not_inet
add address=127.0.0.0/8 list=not_inet
add address=169.254.0.0/16 list=not_inet
add address=172.16.0.0/12 list=not_inet
add address=172.16.0.0/16 list=lan
add address=172.17.0.0/16 list=lan
add address=172.18.0.0/16 list=lan
add address=172.19.0.0/16 list=lan
add address=172.20.0.0/16 list=lan
add address=192.0.0.0/24 list=not_inet
add address=192.0.2.0/24 list=not_inet
add address=192.88.99.0/24 list=not_inet
add address=192.168.0.0/16 list=not_inet
add address=198.18.0.0/15 list=not_inet
add address=198.51.100.0/24 list=not_inet
add address=203.0.113.0/24 list=not_inet
add address=224.0.0.0/4 list=not_inet
add address=240.0.0.0/4 list=not_inet
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=drop chain=input dst-port=22,8291 in-interface=!vlan_meta protocol=tcp
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface-list=list_lans
add action=drop chain=input
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward dst-address-list=not_inet out-interface-list=list_inet
add action=jump chain=forward in-interface-list=list_inet jump-target=inet
add action=jump chain=forward in-interface=vlan_meta jump-target=meta
add action=jump chain=forward in-interface=vlan_resident jump-target=resident
add action=jump chain=forward in-interface=vlan_guest jump-target=guest
add action=jump chain=forward in-interface=vlan_iot jump-target=iot
add action=jump chain=forward in-interface=vlan_server jump-target=server
add action=drop chain=forward
add action=drop chain=inet src-address-list=not_inet
add action=accept chain=inet icmp-options=0:0-255 protocol=icmp
add action=accept chain=inet icmp-options=3:0 protocol=icmp
add action=accept chain=inet icmp-options=3:1 protocol=icmp
add action=accept chain=inet icmp-options=3:4 protocol=icmp
add action=accept chain=inet icmp-options=8:0-255 protocol=icmp
add action=accept chain=inet icmp-options=11:0-255 protocol=icmp
add action=accept chain=inet icmp-options=12:0-255 protocol=icmp
add action=accept chain=inet connection-nat-state=dstnat connection-state=new disabled=yes
add action=drop chain=inet
add action=accept chain=meta out-interface-list=list_inet
add action=drop chain=meta
add action=accept chain=resident out-interface-list=list_inet
add action=accept chain=resident out-interface=vlan_iot
add action=accept chain=resident out-interface=vlan_server
add action=drop chain=resident
add action=accept chain=guest out-interface-list=list_inet
add action=accept chain=guest out-interface=vlan_server
add action=drop chain=guest
add action=accept chain=iot out-interface-list=list_inet
add action=accept chain=iot out-interface=vlan_server
add action=drop chain=iot
add action=accept chain=server out-interface-list=list_inet
add action=drop chain=server
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=list_inet src-address-list=lan
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 address
add address=::1 from-pool=unique_local interface=vlan_meta
add address=::1 from-pool=unique_local interface=vlan_resident
add address=::1 from-pool=unique_local interface=vlan_guest
add address=::1 from-pool=unique_local interface=vlan_iot
add address=::1 from-pool=unique_local interface=vlan_server
/ipv6 firewall address-list
add address=::/128 list=not_inet
add address=::1/128 list=not_inet
add address=::ffff:0.0.0.0/96 list=not_inet
add address=64:ff9b::/96 list=not_inet
add address=64:ff9b:1::/48 list=not_inet
add address=100::/64 list=not_inet
add address=2001:20::/28 list=not_inet
add address=2001:db8::/32 list=not_inet
add address=3fff::/20 list=not_inet
add address=5f00::/16 list=not_inet
add address=fc00::/7 list=not_inet
add address=fe80::/10 list=not_inet
/ipv6 firewall filter
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmpv6
add action=accept chain=input dst-port=33434-33534 protocol=udp
add action=accept chain=input dst-port=22,8291 in-interface=vlan_meta protocol=tcp
add action=accept chain=input disabled=yes src-address=ff00::/8
add action=drop chain=input
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward dst-address-list=not_inet out-interface-list=list_inet
add action=jump chain=forward in-interface-list=list_inet jump-target=inet
add action=jump chain=forward in-interface=vlan_meta jump-target=meta
add action=jump chain=forward in-interface=vlan_resident jump-target=resident
add action=jump chain=forward in-interface=vlan_guest jump-target=guest
add action=jump chain=forward in-interface=vlan_iot jump-target=iot
add action=jump chain=forward in-interface=vlan_server jump-target=server
add action=drop chain=forward
add action=drop chain=inet src-address-list=not_inet
add action=accept chain=inet icmp-options=1:0-255 protocol=icmpv6
add action=accept chain=inet icmp-options=2:0-255 protocol=icmpv6
add action=accept chain=inet icmp-options=128:0-255 protocol=icmpv6
add action=accept chain=inet icmp-options=129:0-255 protocol=icmpv6
add action=drop chain=inet
add action=accept chain=inet disabled=yes out-interface=vlan_server
add action=accept chain=meta out-interface-list=list_inet
add action=drop chain=meta
add action=accept chain=resident out-interface-list=list_inet
add action=accept chain=resident in-interface=vlan_iot
add action=accept chain=resident in-interface=vlan_server
add action=drop chain=resident
add action=accept chain=guest out-interface-list=list_inet
add action=accept chain=guest out-interface=vlan_server
add action=drop chain=guest
add action=accept chain=iot out-interface-list=list_inet
add action=accept chain=iot out-interface=vlan_server
add action=drop chain=iot
add action=accept chain=server out-interface-list=list_inet
add action=drop chain=server
/ipv6 nd
set [ find default=yes ] disabled=yes
add interface=vlan_meta
add interface=vlan_resident
add interface=vlan_guest
add interface=vlan_iot
add interface=vlan_server
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=PrivNet01
/system logging
add topics=pppoe