Hi everyone
I’ve set up a PPTP to access my MT remotely, however, I am unable to access LAN devices, e.g U*q**ti antennae etc…
I have done some reading and tried advice from other similar posts, but still no luck.
Also when setting ARP to proxy-arp and rebooting, the network basically comes to a standstill.
Would appreciate if anyone could assist.
Thanks.
Current script:
/interface bridge
add admin-mac=4C:5E:0C:A2:63:4C arp=proxy-arp auto-mac=no comment=\
"To view all traffic:" name=bridge protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] name=ether1-FIBRE-UP speed=100Mbps
set [ find default-name=ether2 ] l2mtu=1598 mac-address=4C:5E:0C:A2:63:4F name=\
ether2-CLOUDGATE-PC-INTERNET speed=100Mbps
set [ find default-name=ether3 ] l2mtu=1598 mac-address=4C:5E:0C:A2:63:4E name=\
ether3-15-VOORJAAR-INTERNET speed=100Mbps
set [ find default-name=ether4 ] l2mtu=1598 mac-address=4C:5E:0C:A2:63:4D name=\
ether4-EMPTY speed=100Mbps
set [ find default-name=ether5 ] arp=proxy-arp l2mtu=1598 mac-address=\
4C:5E:0C:A2:63:4C mtu=1492 name=ether5-POWERBEAM-ISO-WIRELESS-BRIDGE-PoE \
poe-out=forced-on speed=100Mbps
set [ find default-name=sfp1 ] disabled=yes
/interface pppoe-client
add add-default-route=yes allow=pap comment="" disabled=no \
interface=ether1-FIBRE-UP keepalive-timeout=60 max-mru=1400 max-mtu=1400 \
mrru=1600 name=ISP1-AFRIHOST-200/100-FIBRE user=
/interface pptp-client
add connect-to=154.117.185.86 mrru=1600 name=pptp-out1 user="Cape Town"
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 5 default-vlan-id=0
/ip firewall layer7-protocol
add name=YouTube regexp="^..+\\.(youtube.com|googlevideo.com|akamaihd.net).*\$"
add name=Netflix regexp=\
"^.+(netflix|nflxext|nflximg|nflxsearch|nflxso|nflxvideo).*\$"
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.40
add name=PPPoE ranges=192.168.88.100-192.168.88.200
add name=pool1 ranges=192.168.88.50-192.168.88.100
add name=VPN ranges=192.168.88.90-192.168.88.100
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay disabled=no interface=\
bridge name=default
/interface ppp-server
add disabled=no name=ppp-in1 port=serial0 ring-count=0
/ppp profile
set *0 dns-server=192.168.88.2 local-address=PPPoE use-encryption=no
set *FFFFFFFE dns-server=192.168.88.2 remote-address=VPN use-encryption=no
/queue simple
add max-limit=1M/4M name="Tyke DHCP" target=192.168.88.16/32
add max-limit=2M/10M name=atta target=192.168.88.15/32
add max-limit=2M/10M name=Ngamlana target=192.168.88.29/32
add max-limit=10M/20M name="Bardien Static" target=192.168.88.10/32
add max-limit=2M/10M name=Dunno target=192.168.88.26/32
/interface bridge port
add bridge=bridge interface=ether2-CLOUDGATE-PC-INTERNET
add bridge=bridge interface=ether5-POWERBEAM-ISO-WIRELESS-BRIDGE-PoE
add bridge=bridge interface=ether3-15-VOORJAAR-INTERNET
add bridge=bridge interface=ether4-EMPTY
/interface pppoe-server server
add authentication=pap disabled=no interface=bridge keepalive-timeout=5 \
max-mru=1400 max-mtu=1400 mrru=1600 one-session-per-host=yes service-name=\
Internet
/interface pptp-server server
set enabled=yes
/ip address
add address=192.168.88.2/24 interface=bridge network=192.168.88.0
add address=10.0.0.2 network=10.0.0.0
add address=192.168.88.4 interface=ether3-15-VOORJAAR-INTERNET network=\
192.168.88.4
add address=192.168.88.0/24 interface=bridge network=192.168.88.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add add-default-route=no dhcp-options=hostname,clientid disabled=no
# DHCP client can not run on slave interface!
add add-default-route=no dhcp-options=hostname,clientid disabled=no interface=\
ether4-EMPTY
/ip dhcp-server lease
add address=192.168.88.16 client-id=1:f4:28:53:db:d0:49 mac-address=\
F4:28:53:DB:D0:49 server=default
add address=192.168.88.18 client-id=1:c4:4e:ac:12:7b:7 mac-address=\
C4:4E:AC:12:7B:07 server=default
add address=192.168.88.17 client-id=1:6c:c2:17:7f:b:8c mac-address=\
6C:C2:17:7F:0B:8C server=default
add address=192.168.88.15 client-id=1:c8:3a:35:41:4d:80 mac-address=\
C8:3A:35:41:4D:80 server=default
add address=192.168.88.29 client-id=1:30:96:fb:81:bd:79 mac-address=\
30:96:FB:81:BD:79 server=default
add address=192.168.88.14 client-id=1:74:83:c2:ee:9d:b6 mac-address=\
74:83:C2:EE:9D:B6 server=default
add address=192.168.88.10 client-id=1:9c:b6:54:a4:5c:4d mac-address=\
9C:B6:54:A4:5C:4D server=default
add address=192.168.88.26 client-id=1:58:d9:d5:1a:d7:98 mac-address=\
58:D9:D5:1A:D7:98 server=default
/ip dhcp-server network
add address=192.168.88.0/24 comment="default configuration" dns-server=\
192.168.88.2 gateway=192.168.88.2 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A # Check if you need \
this subnet before enable it" list=bogons
add address=127.0.0.0/8 comment="Loopback [RFC 3330]" list=bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you ne\
ed this subnet before enable it" list=bogons
add address=192.168.0.0/16 comment="Private[RFC 1918] - CLASS C # Check if you n\
eed this subnet before enable it" disabled=yes list=bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons
add address=224.0.0.0/4 comment=\
"MC, Class D, IANA # Check if you need this subnet before enable it" list=\
bogons
add address=192.168.88.0/24 comment="Internal Subnet" list=internal-nets
/ip firewall filter
add action=add-src-to-address-list address-list=Syn_Flooder \
address-list-timeout=30m chain=input comment="Add Syn Flood IP to the list" \
connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" src-address-list=\
Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
address-list-timeout=1w chain=input comment="Port Scanner Detect" protocol=\
tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" src-address-list=\
Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=ICMP \
protocol=icmp
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=drop chain=forward comment="Client dc" src-address=192.168.88.103
add action=jump chain=forward comment="Jump for icmp forward flow" jump-target=\
ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
bogons
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
protocol=tcp src-address-list=spammers
add action=drop chain=forward comment="Client DHCP Block" src-address=\
192.168.88.16
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input comment="Accept to established connections" \
connection-state=established
add action=accept chain=input comment="Accept to related connections" \
connection-state=related
add action=accept chain=input comment="Full access to SUPPORT address list" \
src-address-list=support
add action=accept chain=input comment=\
"Accept all connections from local network" in-interface=bridge
add action=accept chain=input comment="Accept WebFig Access from Local" \
dst-port=80 in-interface=bridge protocol=tcp src-address=192.168.88.0/24
add action=accept chain=input comment="Accept WinBox Access from Local" \
dst-port=81,8291 protocol=tcp src-address=192.168.88.0/24
add action=accept chain=input comment="Accept Radius UDP" dst-port=\
1700,1812,1813 protocol=udp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=accept chain=input comment="Accept WinBox Remote" dst-port=8291 \
protocol=tcp
add action=accept chain=input comment="Allow L2TP" dst-port=1701 protocol=udp
add action=accept chain=input comment="Allow PPTP" dst-port=1723 protocol=tcp
add action=accept chain=inpur comment="Allow SSTP" dst-port=443 protocol=tcp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
protocol=icmp
add action=drop chain=input dst-port=53 in-interface=\
ISP1-AFRIHOST-200/100-FIBRE protocol=udp
add action=drop chain=input comment="Block all access to the winbox - except to \
support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUPPORT\
\_ADDRESS LIST" disabled=yes dst-port=8291 protocol=tcp src-address-list=\
!support
add action=drop chain=input comment="Drop TCP Port 53" dst-port=53 \
in-interface=ISP1-AFRIHOST-200/100-FIBRE protocol=udp
add action=drop chain=input comment="Drop UDP Port 53" dst-port=53 \
in-interface=ISP1-AFRIHOST-200/100-FIBRE protocol=tcp
add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE THIS RU\
LE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED" disabled=yes
add action=drop chain=input disabled=yes in-interface=\
ISP1-AFRIHOST-200/100-FIBRE
add action=drop chain=forward disabled=yes src-address=192.168.88.16
/ip firewall mangle
add action=mark-packet chain=prerouting comment="internal-traffic packet mark" \
dst-address-list=internal-nets new-packet-mark=internal-traffic \
passthrough=yes src-address-list=internal-nets
add action=mark-packet chain=prerouting comment=\
"customer-servers-out packet mark" new-packet-mark=customer-servers-out \
passthrough=yes src-address-list=customer-servers
add action=mark-packet chain=prerouting comment=\
"customer-servers-in packet mark" dst-address-list=customer-servers \
new-packet-mark=customer-servers-in passthrough=yes
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment="admin-in packet mark DNS" \
in-interface=*1 new-packet-mark=admin-in passthrough=yes protocol=udp \
src-port=53
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment="admin-in packet mark snmp" \
dst-port=161 in-interface=*1 new-packet-mark=admin-in passthrough=yes \
protocol=udp
add action=mark-connection chain=prerouting comment=\
"Remote Protocols admin connection mark" new-connection-mark=admin \
passthrough=yes port=20,21,22,23,3389,8291 protocol=tcp
add action=mark-connection chain=prerouting comment=\
"icmp connection mark as admin" new-connection-mark=admin passthrough=yes \
protocol=icmp src-address-list=internal-nets
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment="admin-in packet mark" \
connection-mark=admin in-interface=*1 new-packet-mark=admin-in passthrough=\
yes
add action=mark-packet chain=prerouting comment="admin-out packet mark" \
connection-mark=admin new-packet-mark=admin-out passthrough=yes
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment=\
"streaming video in packet mark" connection-mark=streaming-video \
in-interface=*1 new-packet-mark=streaming-video-in passthrough=yes
add action=mark-packet chain=prerouting comment=\
"streaming video out packet mark" connection-mark=streaming-video \
new-packet-mark=streaming-video-out passthrough=yes
add action=mark-connection chain=prerouting comment=\
"http traffic connection mark" dst-port=80,443 new-connection-mark=http \
passthrough=yes protocol=tcp src-address-list=internal-nets
add action=mark-connection chain=prerouting comment=\
"http traffic connection mark" connection-bytes=5000000-4294967295 \
dst-port=80,443 new-connection-mark=http-download passthrough=yes protocol=\
tcp src-address-list=internal-nets
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment="http in packet mark" \
connection-mark=http in-interface=*1 new-packet-mark=http-in passthrough=\
yes
add action=mark-packet chain=prerouting comment="http out packet mark" \
connection-mark=http new-packet-mark=http-out passthrough=yes
add action=mark-connection chain=prerouting comment=\
"wow connetion mark as gaming" dst-port=1119,3724,6112-6114,4000,6881-6999 \
new-connection-mark=games passthrough=yes protocol=tcp src-address-list=\
internal-nets
add action=mark-connection chain=prerouting comment=\
"eve online connetion mark as gaming" dst-address=87.237.38.200 \
new-connection-mark=games passthrough=yes src-address-list=internal-nets
add action=mark-connection chain=prerouting comment=\
"starcraft 2 connetion mark as gaming" dst-port=1119 new-connection-mark=\
games passthrough=yes protocol=tcp src-address-list=internal-nets
add action=mark-connection chain=prerouting comment=\
"heros of newerth connetion mark as gaming" dst-port=11031,11235-11335 \
new-connection-mark=games passthrough=yes protocol=tcp src-address-list=\
internal-nets
add action=mark-connection chain=prerouting comment=\
"steam connetion mark as gaming" dst-port=27014-27050 new-connection-mark=\
games passthrough=yes protocol=tcp src-address-list=internal-nets
add action=mark-connection chain=prerouting comment=\
"xbox live connetion mark as gaming" dst-port=3074 new-connection-mark=\
games passthrough=yes protocol=tcp src-address-list=internal-nets
add action=mark-connection chain=prerouting comment=\
"ps3 online connetion mark as gaming" dst-port=5223 new-connection-mark=\
games passthrough=yes protocol=tcp src-address-list=internal-nets
add action=mark-connection chain=prerouting comment=\
"wii online connetion mark as gaming" dst-port=28910,29900,29901,29920 \
new-connection-mark=games passthrough=yes protocol=tcp src-address-list=\
internal-nets
add action=mark-packet chain=prerouting comment=\
"games packet mark forever-saken-game" dst-address-list=external-nets \
new-packet-mark=games-in passthrough=yes src-address-list=\
forever-saken-game
add action=mark-packet chain=prerouting comment="games packet mark starcraft2" \
dst-address-list=external-nets new-packet-mark=games-in passthrough=yes \
protocol=udp src-port=1119,6113
add action=mark-packet chain=prerouting comment="games packet mark wow" \
dst-address-list=external-nets new-packet-mark=games-in passthrough=yes \
protocol=udp src-port=53,3724
add action=mark-packet chain=prerouting comment="games packet mark HoN" \
dst-address-list=external-nets new-packet-mark=games-in passthrough=yes \
protocol=udp src-port=11031,11235-11335
add action=mark-packet chain=prerouting comment="games packet mark steam in" \
dst-address-list=external-nets new-packet-mark=games-in passthrough=no \
port=4380,28960,27000-27030 protocol=udp
add action=mark-packet chain=prerouting comment="games packet mark steam out" \
dst-port=53,1500,3005,3101,3478,4379-4380,4380,28960,27000-27030,28960 \
new-packet-mark=games-out passthrough=yes protocol=udp src-address-list=\
internal-nets
add action=mark-packet chain=prerouting comment="games packet mark xbox live" \
dst-address-list=external-nets new-packet-mark=games-in passthrough=yes \
protocol=udp src-port=88,3074,3544,4500
add action=mark-packet chain=prerouting comment="games packet mark ps3 online" \
dst-address-list=external-nets new-packet-mark=games-in passthrough=yes \
protocol=udp src-port=3478,3479,3658
add action=mark-packet chain=prerouting comment="games packet mark in" \
connection-mark=games dst-address-list=external-nets new-packet-mark=\
games-in passthrough=yes
add action=mark-packet chain=prerouting comment="games packet mark out" \
connection-mark=games new-packet-mark=games-out passthrough=yes
add action=mark-packet chain=prerouting comment="voip-in packet mark teamspeak" \
dst-address-list=external-nets new-packet-mark=voip-in passthrough=yes \
protocol=udp src-port=9987
add action=mark-packet chain=prerouting comment=\
"voip-out packet mark teamspeak" dst-port=9987 new-packet-mark=voip-out \
passthrough=yes protocol=udp src-address-list=internal-nets
add action=mark-packet chain=prerouting comment=\
"voip-out packet mark teamspeak" dst-address-list=external-nets \
new-packet-mark=voip-in passthrough=yes protocol=udp src-port=9987
add action=mark-packet chain=prerouting comment="voip-in packet mark ventrilo" \
dst-address-list=external-nets new-packet-mark=voip-in passthrough=yes \
protocol=udp src-port=3784
add action=mark-packet chain=prerouting comment="voip-out packet mark ventrilo" \
dst-port=3784 new-packet-mark=voip-out passthrough=yes protocol=udp \
src-address-list=internal-nets
add action=mark-packet chain=prerouting comment="voip-in packet mark ventrilo" \
dst-address-list=external-nets new-packet-mark=voip-in passthrough=yes \
protocol=tcp src-port=3784
add action=mark-packet chain=prerouting comment="voip-out packet mark ventrilo" \
dst-port=3784 new-packet-mark=voip-out passthrough=yes protocol=tcp \
src-address-list=internal-nets
add action=mark-packet chain=prerouting comment="voip-in packet mark SIP" \
dst-address-list=internal-nets new-packet-mark=voip-in passthrough=yes \
port=5060 protocol=tcp
add action=mark-packet chain=prerouting comment="voip-out packet mark SIP" \
new-packet-mark=voip-out passthrough=yes port=5060 protocol=tcp \
src-address-list=internal-nets
add action=mark-packet chain=prerouting comment="voip-in packet mark udp SIP" \
dst-address-list=internal-nets new-packet-mark=voip-in passthrough=yes \
port=5004,5060 protocol=udp
add action=mark-packet chain=prerouting comment="voip-out packet mark udp SIP" \
new-packet-mark=voip-out passthrough=yes port=5004,5060 protocol=udp \
src-address-list=internal-nets
add action=mark-packet chain=prerouting comment="voip-in packet mark RTP" \
dst-address-list=internal-nets new-packet-mark=voip-in packet-size=100-400 \
passthrough=yes port=16348-32768 protocol=udp
add action=mark-packet chain=prerouting comment="voip-out packet mark RTP" \
new-packet-mark=voip-in packet-size=100-400 passthrough=yes port=\
16348-32768 protocol=udp src-address-list=internal-nets
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment="vpn-in packet mark GRE" \
in-interface=*1 new-packet-mark=vpn-in passthrough=yes protocol=gre
add action=mark-packet chain=prerouting comment="vpn-out packet mark GRE" \
new-packet-mark=vpn-out passthrough=yes protocol=gre
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment="vpn-in packet mark ESP" \
in-interface=*1 new-packet-mark=vpn-in passthrough=yes protocol=ipsec-esp
add action=mark-packet chain=prerouting comment="vpn-out packet mark ESP" \
new-packet-mark=vpn-out passthrough=yes protocol=ipsec-esp
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment=\
"vpn-in packet mark VPN UDP ports" in-interface=*1 new-packet-mark=vpn-in \
passthrough=yes protocol=udp src-port=500,1701,4500
add action=mark-packet chain=prerouting comment=\
"vpn-out packet mark VPN UDP ports" new-packet-mark=vpn-out passthrough=yes \
protocol=udp src-port=500,1701,4500
# ether1-gateway DSL 1 not ready
add action=mark-packet chain=prerouting comment="vpn-in packet mark PPTP" \
in-interface=*1 new-packet-mark=vpn-in passthrough=yes protocol=tcp \
src-port=1723
add action=mark-packet chain=prerouting comment="vpn-out packet mark PPTP" \
new-packet-mark=vpn-out passthrough=yes protocol=tcp src-port=1723
add action=mark-routing chain=prerouting in-interface=all-ppp new-routing-mark=\
to_ISP1 passthrough=no per-connection-classifier=src-address-and-port:2/0
add action=mark-routing chain=prerouting in-interface=all-ppp new-routing-mark=\
to_ISP2 passthrough=no per-connection-classifier=src-address-and-port:2/1
add action=mark-connection chain=prerouting comment="UPSTREAM CONNECTION" \
in-interface=ISP1-AFRIHOST-200/100-FIBRE new-connection-mark=All-Inconn \
passthrough=yes
add action=mark-packet chain=prerouting comment=UPSTREAM connection-mark=\
All-Inconn new-packet-mark=All-inpkt passthrough=yes
add action=mark-connection chain=forward comment="DOWNSTREAM CONNECTION" \
in-interface=ISP1-AFRIHOST-200/100-FIBRE new-connection-mark=All-Outconn \
passthrough=yes
add action=mark-packet chain=forward comment=DOWNSTREAM connection-mark=\
All-Outconn new-packet-mark=All-Outpkt passthrough=yes
add action=mark-packet chain=forward comment="SAMODIEN DOWNSTREAM" dst-address=\
192.168.88.101 new-packet-mark=samo-pkt packet-mark=All-Outpkt passthrough=\
yes
add action=mark-packet chain=forward comment=DOLLIEDOWNSTREAM dst-address=\
192.168.88.102 new-packet-mark=dollie-pkt packet-mark=All-Outpkt \
passthrough=yes
add action=mark-packet chain=forward comment="DOMINGO DOWNSTREAM" dst-address=\
192.168.88.103 new-packet-mark=dom-pkt packet-mark=All-Outpkt passthrough=\
yes
add action=mark-packet chain=forward comment="HENDRICKS DOWNSTREAM" \
dst-address=192.168.88.104 new-packet-mark=hend-pkt packet-mark=All-Outpkt \
passthrough=yes
add action=mark-packet chain=forward comment="BARDIEN DOWNSTREAM" dst-address=\
192.168.88.105 new-packet-mark=bard-pkt packet-mark=All-Outpkt passthrough=\
yes
add action=mark-packet chain=forward comment="ATTA DOWNSTREAM" dst-address=\
192.168.88.106 new-packet-mark=atta-pkt packet-mark=All-Outpkt passthrough=\
yes
add action=mark-packet chain=forward comment="ABDOL DOWNSTREAM" dst-address=\
192.168.88.107 new-packet-mark=abdol-pkt packet-mark=All-Outpkt \
passthrough=yes
add action=mark-packet chain=forward comment="KILIAN DOWNSTREAM" dst-address=\
192.168.88.108 new-packet-mark=kilian-pkt packet-mark=All-Outpkt \
passthrough=yes
add action=mark-packet chain=forward comment="MASTER DOWNSTREAM" dst-address=\
192.168.88.2 new-packet-mark=Master-pkt packet-mark=All-Outpkt passthrough=\
yes
add action=mark-packet chain=forward comment=Samodien-Down connection-bytes=\
1000000-0 new-packet-mark=samo-dpkt packet-mark=samo-pkt passthrough=yes \
protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment=Dollie-Down connection-bytes=\
1000000-0 new-packet-mark=dollie-dpkt packet-mark=dollie-pkt passthrough=\
yes protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment=Domingo-Down connection-bytes=\
1000000-0 new-packet-mark=dom-dpkt packet-mark=dom-pkt passthrough=yes \
protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment=Hendricks-Down connection-bytes=\
1000000-0 new-packet-mark=hend-dpkt packet-mark=hend-pkt passthrough=yes \
protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment=Bardien-Down connection-bytes=\
1000000-0 new-packet-mark=bard-dpkt packet-mark=bard-pkt passthrough=yes \
protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment=Atta-Down connection-bytes=\
1000000-0 new-packet-mark=atta-dpkt packet-mark=atta-pkt passthrough=yes \
protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment=Abdol-Down connection-bytes=\
1000000-0 new-packet-mark=abdol-dpkt packet-mark=abdol-pkt passthrough=yes \
protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment=Kilian-Down connection-bytes=\
1000000-0 new-packet-mark=kilian-dpkt packet-mark=kilian-pkt passthrough=\
yes protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment=SAMO-Streams layer7-protocol=*6 \
new-packet-mark=samo-spkt packet-mark=samo-pkt passthrough=no
add action=mark-packet chain=forward comment=DOLLIE-Streams layer7-protocol=*6 \
new-packet-mark=dollie-spkt packet-mark=dollie-pkt passthrough=no
add action=mark-packet chain=forward comment=DOMINGO-Streams layer7-protocol=*6 \
new-packet-mark=dom-spkt packet-mark=dom-pkt passthrough=no
add action=mark-packet chain=forward comment=HENDRICKS-Streams layer7-protocol=\
*6 new-packet-mark=hend-spkt packet-mark=hend-pkt passthrough=no
add action=mark-packet chain=forward comment=BARDIEN-Streams layer7-protocol=*6 \
new-packet-mark=bard-spkt packet-mark=bard-pkt passthrough=no
add action=mark-packet chain=forward comment=ATTA-Streams layer7-protocol=*6 \
new-packet-mark=atta-spkt packet-mark=atta-pkt passthrough=no
add action=mark-packet chain=forward comment=ABDOL-Streams layer7-protocol=*6 \
new-packet-mark=abdol-spkt packet-mark=abdol-pkt passthrough=no
add action=mark-packet chain=forward comment=KILIAN-Streams layer7-protocol=*6 \
new-packet-mark=kilian-spkt packet-mark=kilian-pkt passthrough=no
add action=mark-packet chain=forward comment="SAMODIEN BROWSING" \
connection-bytes=0-1000000 new-packet-mark=samo-bpkt packet-mark=samo-pkt \
passthrough=no protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment="DOLLIE BROWSING" \
connection-bytes=0-1000000 new-packet-mark=dollie-bpkt packet-mark=\
dollie-pkt passthrough=no protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment="DOMINGO BROWSING" \
connection-bytes=0-1000000 new-packet-mark=dom-bpkt packet-mark=dom-pkt \
passthrough=no protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment="HENDRICKS BROWSING" \
connection-bytes=0-1000000 new-packet-mark=hend-bpkt packet-mark=hend-pkt \
passthrough=no protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment="BARDIEN BROWSING" \
connection-bytes=0-1000000 new-packet-mark=bard-bpkt packet-mark=bard-pkt \
passthrough=no protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment="ATTA BROWSING" connection-bytes=\
0-1000000 new-packet-mark=atta-bpkt packet-mark=atta-pkt passthrough=no \
protocol=tcp src-port=80,443
add action=mark-packet chain=forward comment="ABDOL BROWSING" connection-bytes=\
0-1000000 new-packet-mark=abdol-bpkt packet-mark=abdol-pkt passthrough=no \
protocol=tcp src-port=80,443
add action=mark-connection chain=forward comment="YouTube DL Conn Mark" \
in-interface=ISP1-AFRIHOST-200/100-FIBRE layer7-protocol=YouTube \
new-connection-mark=YouTube_DL_Conn passthrough=yes
add action=mark-connection chain=forward comment=Netflix_Conn in-interface=\
ISP1-AFRIHOST-200/100-FIBRE layer7-protocol=Netflix new-connection-mark=\
Netflix_Conn passthrough=yes
add action=mark-packet chain=forward comment=Netflix_Packet connection-mark=\
Netflix_Conn new-packet-mark=Netflix_Packet passthrough=no
add action=mark-packet chain=forward comment=YouTube_DL_Packet connection-mark=\
YouTube_DL_Conn new-packet-mark=YouTube_DL_Packet passthrough=no
add action=mark-connection chain=prerouting comment=YouTube_UP_Conn \
in-interface=bridge layer7-protocol=YouTube new-connection-mark=\
YouTube_UP_Conn passthrough=yes
add action=mark-packet chain=forward comment=YouTube_UP_Packet connection-mark=\
YouTube_UP_Conn new-packet-mark=YouTube_UP_Packet passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
out-interface=ISP1-AFRIHOST-200/100-FIBRE to-addresses=0.0.0.0
# no interface
add action=masquerade chain=srcnat out-interface=*11
add action=masquerade chain=srcnat dst-address=192.168.88.0/24 src-address=\
192.168.88.0/24
/ip proxy
set anonymous=yes enabled=yes max-cache-size=none port=53281
/ip route
add check-gateway=ping distance=1 gateway=ISP1-AFRIHOST-200/100-FIBRE \
routing-mark=to_ISP1
add check-gateway=ping distance=1 gateway=*11 routing-mark=to_ISP2
add check-gateway=ping distance=1 gateway=ISP1-AFRIHOST-200/100-FIBRE
add check-gateway=ping distance=2 gateway=*11
add distance=1 dst-address=192.168.88.0/24 gateway=192.168.88.2
add distance=1 dst-address=192.168.88.3/32 gateway=*F00002
add distance=1 dst-address=192.168.88.50/32 gateway=bridge
/ip route rule
add action=lookup-only-in-table dst-address=192.168.88.0/24 table=main
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes port=2222
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ppp aaa
set use-radius=yes
/ppp secret
add name=spideradmin profile=default-encryption service=pptp
/radius
add address=192.168.88.2 service=ppp,login
/radius incoming
set accept=yes port=1700
/system clock
set time-zone-autodetect=no time-zone-name=Africa/Johannesburg
/system logging
set 1 action=echo
/system script
add dont-require-permissions=no name=script1 owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive source="/ip firew\
all filter\r\
\n\r\
\nadd action=drop chain=input comment=\"Drop to syn flood list\" disabled=no\
\_src-address-list=Syn_Flooder\r\
\nadd action=add-src-to-address-list address-list=Port_Scanner address-list-\
timeout=1w chain=input comment=\"Port Scanner Detect\"\r\
\ndisabled=no protocol=tcp psd=21,3s,3,1\r\
\nadd action=drop chain=input comment=\"Drop to port scan list\" disabled=no\
\_src-address-list=Port_Scanner\r\
\nadd action=jump chain=input comment=\"Jump for icmp input flow\" disabled=\
no jump-target=ICMP protocol=icmp\r\
\nadd action=drop chain=input\r\
\ncomment=\"Block all access to the winbox - except to support list # DO NOT\
\_ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUPPORT ADDRESS LIST\"\r\
\ndisabled=yes dst-port=8291 protocol=tcp src-address-list=!support\r\
\nadd action=jump chain=forward comment=\"Jump for icmp forward flow\" disab\
led=no jump-target=ICMP protocol=icmp\r\
\nadd action=drop chain=forward comment=\"Drop to bogon list\" disabled=no d\
st-address-list=bogons\r\
\nadd action=add-src-to-address-list address-list=spammers address-list-time\
out=3h chain=forward comment=\"Add Spammers to the list for 3 hours\"\r\
\nconnection-limit=30,32 disabled=no dst-port=25,587 limit=30/1m,0 protocol=\
tcp\r\
\nadd action=drop chain=forward comment=\"Avoid spammers action\" disabled=n\
o dst-port=25,587 protocol=tcp src-address-list=spammers\r\
\nadd action=accept chain=input comment=\"Accept DNS - UDP\" disabled=no por\
t=53 protocol=udp\r\
\nadd action=accept chain=input comment=\"Accept DNS - TCP\" disabled=no por\
t=53 protocol=tcp\r\
\nadd action=accept chain=input comment=\"Accept to established connections\
\" connection-state=established\r\
\ndisabled=no\r\
\nadd action=accept chain=input comment=\"Accept to related connections\" co\
nnection-state=related disabled=no\r\
\nadd action=accept chain=input comment=\"Full access to SUPPORT address lis\
t\" disabled=no src-address-list=support\r\
\nadd action=drop chain=input comment=\"Drop anything else! # DO NOT ENABLE \
THIS RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED\"\r\
\ndisabled=yes\r\
\nadd action=accept chain=ICMP comment=\"Echo request - Avoiding Ping Flood\
\" disabled=no icmp-options=8:0 limit=1,5 protocol=icmp\r\
\nadd action=accept chain=ICMP comment=\"Echo reply\" disabled=no icmp-optio\
ns=0:0 protocol=icmp\r\
\nadd action=accept chain=ICMP comment=\"Time Exceeded\" disabled=no icmp-op\
tions=11:0 protocol=icmp\r\
\nadd action=accept chain=ICMP comment=\"Destination unreachable\" disabled=\
no icmp-options=3:0-1 protocol=icmp\r\
\nadd action=accept chain=ICMP comment=PMTUD disabled=no icmp-options=3:4 pr\
otocol=icmp\r\
\nadd action=drop chain=ICMP comment=\"Drop to the other ICMPs\" disabled=no\
\_protocol=icmp\r\
\nadd action=jump chain=output comment=\"Jump for icmp output\" disabled=no \
jump-target=ICMP protocol=icmp"
