# 2025-10-22 20:53:26 by RouterOS 7.20.2
# software id = IY4D-ZVRF
#
# model = CRS305-1G-4S+
/interface bridge
add frame-types=admit-only-vlan-tagged mvrp=yes name=bridge port-cost-mode=\
short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] l2mtu=10218 rx-flow-control=auto \
tx-flow-control=auto
set [ find default-name=sfp-sfpplus1 ] l2mtu=10218 name=sfp-sfpplus1:CRS326 \
rx-flow-control=auto tx-flow-control=auto
set [ find default-name=sfp-sfpplus2 ] l2mtu=10218 name=\
sfp-sfpplus2:Nvidia-Shield
set [ find default-name=sfp-sfpplus3 ] l2mtu=10218 name=sfp-sfpplus3:Audience \
rx-flow-control=auto tx-flow-control=auto
set [ find default-name=sfp-sfpplus4 ] l2mtu=10218 rx-flow-control=auto \
tx-flow-control=auto
/interface vlan
add interface=bridge name=vlan9 vlan-id=9
/disk
add slot=proxmox2 smb-address=10.0.9.242 smb-share=\
Backup/mikrotik/Switch-CRS305 smb-user=root type=smb
/interface list
add name=TRUSTED
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/port
set 0 name=serial0
/user group
add name=mktxp_group policy="read,api,!local,!telnet,!ssh,!ftp,!reboot,!write,\
!policy,!test,!winbox,!password,!web,!sniff,!sensitive,!romon,!rest-api"
/interface bridge port
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
sfp-sfpplus1:CRS326
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface="sfp-sfpplus2:Nvidia Shield" pvid=90
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
sfp-sfpplus3:Audience
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=ether1 pvid=1000
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/interface bridge vlan
add bridge=bridge tagged=bridge,sfp-sfpplus1:CRS326,sfp-sfpplus3:Audience \
vlan-ids=9
add bridge=bridge tagged=bridge,sfp-sfpplus3:Audience,sfp-sfpplus1:CRS326 \
untagged=sfp-sfpplus2:Nvidia-Shield vlan-ids=90
add bridge=bridge tagged=bridge,sfp-sfpplus1:CRS326,sfp-sfpplus3:Audience \
vlan-ids=10
add bridge=bridge tagged=bridge,sfp-sfpplus1:CRS326,sfp-sfpplus3:Audience \
vlan-ids=11
add bridge=bridge tagged=bridge,sfp-sfpplus1:CRS326,sfp-sfpplus3:Audience \
vlan-ids=31
add bridge=bridge tagged=bridge,sfp-sfpplus1:CRS326 untagged=ether1 vlan-ids=\
1000
/interface list member
add interface=sfp-sfpplus1:CRS326 list=TRUSTED
add interface=sfp-sfpplus2:Nvidia-Shield list=TRUSTED
add interface=sfp-sfpplus3:Audience list=TRUSTED
add interface=sfp-sfpplus4 list=TRUSTED
/interface ovpn-server server
add mac-address=FE:82:CC:44:A1:CB name=ovpn-server1
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.0.9.249/24 interface=vlan9 network=10.0.9.0
/ip dns
set servers=10.0.9.254
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.0.9.254 routing-table=main \
suppress-hw-offload=no
/ip ssh
set host-key-size=4096 host-key-type=ed25519 strong-crypto=yes
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=switch-crs305.hks.lan
/system ntp client
set enabled=yes
/system ntp client servers
add address=pool.ntp.org
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add interval=1d name="schedule update" on-event="/system package update\
\ncheck-for-updates once\
\n:delay 3s;\
\n:if ( [get status] = \"New version is available\") do={ install }" \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2025-02-25 start-time=01:00:00
add name=reboot-to-upgrade-firmware on-event="/system routerboard\
\n:if ([get current-firmware] != [get upgrade-firmware]) do={ /system rout\
erboard settings set auto-upgrade=yes; :delay 15; /system reboot; } " \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup
add interval=1d name=backup on-event=backup policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2025-02-28 start-time=00:00:00
/system script
add dont-require-permissions=no name=backup owner=mathias policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\
## Set local variables. Change the value between \"\" to reflect your envi\
ronment. Do not delete quotation marks. \
\n\
\n### Set Local and Remote Filename variables. Do not change this unless y\
ou want to edit the format of the filename.\
\n### Default \"local file name\" is always the same to avoid lots of file\
s and running out of space, \"remote file name\" uploaded to FTP has the d\
ate\
\n:local hostname [/system identity get name]\
\n:local date [/system clock get date] \
\n:local localfilename \"\$hostname-Backup-Daily\";\
\n:local remotesystem \"proxmox2/\"\
\n:local remotepath \"\$remotesystem\"\
\n:local remotefilename \"\$hostname-\$date\";\
\n\
\n### Enable for Debug removing staing hash in the following lines\
\n:log info \"\$localfilename\";\
\n:log info \"\$remotefilename\";\
\n:log info \"\$hostname\";\
\n:log info \"\$date\";\
\n\
\n### Stating the Backup\
\n:log info \"STARTING BACKUP\";\
\n\
\n### Create backup file and export the config.\
\nexport compact show-sensitive file=\"\$localfilename\"\
\n/system backup save name=\"\$localfilename\"\
\n:log info \"Backup Created Successfully\"\
\n:log info \$remotefilename\
\n:log info \$remotepath;\
\n\
\n/system backup save name=\"\$remotepath/\$remotefilename.backup\"\
\n/export compact show-sensitive file=\"\$remotepath/\$remotefilename.rsc\
\"\
\n\
\n:log info \"Config Uploaded Successfully\"\
\n:log info \"Backup Uploaded Successfully\"\
\n\
\n### Finishing the Backup\
\n:log info \"BACKUP FINISHED\";"
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
/tool sniffer
set filter-vlan=1000
On CRS326 I only changed all bridge ports to “admit-only-vlan-tagged” as it’s my aggregation switch which is only switching tagged traffic.
Therefore I also haven’t set a separate neighbor discovery option only for specific ports as all ports are trusted.
