Their configuration:
# 2026-06-27 11:09:33 by RouterOS 7.23.1
# software id = 31UI-6J08
#
# model = RB2011UiAS
# serial number = *moderator's edit*
/caps-man channel
add band=2ghz-g/n extension-channel=XX name=2g
add band=5ghz-a/n/ac extension-channel=XXXX frequency=\
5500,5660,5580,5260,5180 name=5g
/interface bridge
add admin-mac=DC:2C:6E:70:8A:F9 auto-mac=no name=bridge port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] name=ether1-wan
set [ find default-name=ether2 ] name=ether2-gig
set [ find default-name=ether3 ] name=ether3-gig
set [ find default-name=ether4 ] name=ether4-gig
set [ find default-name=ether5 ] name=ether5-gig
set [ find default-name=ether6 ] name=ether6-fast
set [ find default-name=ether7 ] name=ether7-fast
set [ find default-name=ether8 ] name=ether8-fast
set [ find default-name=ether9 ] name=ether9-fast
set [ find default-name=ether10 ] name=ether10-fast
set [ find default-name=sfp1 ] advertise="10M-baseT-half,10M-baseT-full,100M-b\
aseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full"
/interface vlan
add comment="Forces guests onto 10.0.0.x" interface=bridge name=public-vlan \
vlan-id=10
/caps-man datapath
add bridge=bridge name=private
add bridge=bridge name=public vlan-id=10 vlan-mode=use-tag
/caps-man security
add authentication-types=wpa-psk,wpa2-psk name=private
add authentication-types=wpa-psk,wpa2-psk name=public
/caps-man configuration
add channel=2g country="united kingdom" datapath=private installation=indoor \
mode=ap name=2g-private security=private ssid=bridgend-private
add channel=5g country="united kingdom" datapath=private \
datapath.local-forwarding=yes installation=indoor mode=ap name=5g-private \
security=private ssid=bridgend-private
add channel=2g country="united kingdom" datapath=public installation=indoor \
mode=ap name=2g-public security=public ssid=bridgend-public
add channel=5g country="united kingdom" datapath=public \
datapath.local-forwarding=yes installation=indoor mode=ap name=5g-public \
security=public ssid=bridgend-public
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wifi datapath
add bridge=bridge disabled=no name=private
add bridge=bridge disabled=no name=public vlan-id=10
/interface wifi security
add authentication-types=wpa-psk,wpa2-psk disabled=no name=private
add authentication-types=wpa-psk,wpa2-psk disabled=no name=public
/interface wifi configuration
add country="United Kingdom" datapath=private disabled=no name=2g-private \
security=private ssid=bridgend-private-2g
add country="United Kingdom" datapath=private disabled=no name=5g-private \
security=private ssid=bridgend-private-5g
add country="United Kingdom" datapath=public disabled=no name=2g-public \
security=public ssid=bridgend-public-2g
add country="United Kingdom" datapath=public disabled=no name=5g-public \
security=public ssid=bridgend-public-5g
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=private ranges=192.168.88.10-192.168.88.254
add name=public ranges=10.0.0.10-10.0.0.254
/ip dhcp-server
add address-pool=private interface=bridge lease-time=4h name=private
add address-pool=public interface=public-vlan lease-time=1h name=public
/ip smb users
set [ find default=yes ] disabled=yes
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/system script
add dont-require-permissions=no name=NextDNS owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\
\_NextDNS IP update. Although Virgin Media is static, this script triggers\
\_the IP address @ NextDNS to be updated. When NextDNS receives the simple\
\_HTTP request, it updates it's internal database with the public IP addre\
ss.\r\
\n\r\
\n# Private profile.\r\
\n/tool fetch https://link-ip.nextdns.io/87f42b/47f587944a1aaed0\r\
\n\r\
\n# Public profile.\r\
\n/tool fetch https://link-ip.nextdns.io/3cde4e/47f587944a1aaed0\r\
\n\r\
\n# Remove downloaded file.\r\
\n/file remove \"47f587944a1aaed0\""
/caps-man access-list
add allow-signal-out-of-range=10s comment="Rob's tablet" disabled=no \
mac-address=52:71:C5:84:B3:9E ssid-regexp=""
add allow-signal-out-of-range=10s comment="Rob's mobile" disabled=no \
mac-address=4E:13:35:FE:44:B2 ssid-regexp=""
add allow-signal-out-of-range=10s comment="Rob's laptop" disabled=no \
mac-address=00:45:E2:81:E4:61 ssid-regexp=""
add allow-signal-out-of-range=10s comment=PRINTER002 disabled=no mac-address=\
B4:B6:86:A8:6C:C5 ssid-regexp=""
add allow-signal-out-of-range=10s comment=PRINTER001 disabled=no mac-address=\
B0:22:7A:BD:BD:8B ssid-regexp=""
add comment=DESKTOP012 disabled=no mac-address=90:DE:80:63:99:65
add comment="DESKTOP010 Bev" disabled=no mac-address=90:DE:80:F3:46:54
/caps-man manager
set enabled=yes package-path=/pub/ upgrade-policy=suggest-same-version
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=g master-configuration=\
2g-private name-format=prefix-identity name-prefix=2g \
slave-configurations=2g-public
add action=create-dynamic-enabled hw-supported-modes=a master-configuration=\
5g-private name-format=prefix-identity name-prefix=5g \
slave-configurations=5g-public
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2-gig \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3-gig \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4-gig \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5-gig \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6-fast \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7-fast \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8-fast \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether9-fast \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10-fast \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1 \
internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1-wan list=WAN
add interface=public-vlan list=VLAN
/interface ovpn-server server
add auth=sha1,md5 mac-address=FE:6E:23:B0:F9:B9 name=ovpn-server1
/interface wifi capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=\
none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=2g-private \
name-format=2g-private-%I slave-configurations=2g-public supported-bands=\
2ghz-n
add action=create-dynamic-enabled disabled=no master-configuration=5g-private \
name-format=5g-private-%I slave-configurations=5g-public supported-bands=\
5ghz-ac
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.0.0.1/24 interface=public-vlan network=10.0.0.0
/ip dhcp-client
add comment=defconf interface=ether1-wan name=ether1
/ip dhcp-server lease
add address=192.168.88.242 client-id=1:18:fd:74:d1:36:d7 mac-address=\
18:FD:74:D1:36:D7 server=private
add address=192.168.88.228 client-id=1:b0:22:7a:bd:bd:8b mac-address=\
B0:22:7A:BD:BD:8B server=private
add address=192.168.88.226 client-id=1:54:ab:3a:1f:36:82 mac-address=\
54:AB:3A:1F:36:82 server=private
add address=192.168.88.197 client-id=1:ec:8e:b5:70:ed:ff mac-address=\
EC:8E:B5:70:ED:FF server=private
add address=192.168.88.188 client-id=1:b4:b6:86:a8:6c:c5 mac-address=\
B4:B6:86:A8:6C:C5 server=private
/ip dhcp-server network
add address=10.0.0.0/24 comment="Public network" dns-server=\
45.90.28.115,45.90.30.115 gateway=10.0.0.1
add address=192.168.88.0/24 comment="Private network" dns-server=192.168.88.1 \
gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes use-doh-server=\
https://dns.nextdns.io/87f42b/ROUTER001 verify-doh-cert=yes
/ip dns static
add address=45.90.28.0 name=dns.nextdns.io type=A
add address=45.90.30.0 name=dns.nextdns.io type=A
add address=2a07:a8c0:: name=dns.nextdns.io type=AAAA
add address=2a07:a8c1:: name=dns.nextdns.io type=AAAA
add address=192.168.88.1 name=router001.lan type=A
/ip firewall filter
add action=accept chain=input comment="accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMP (ping)" protocol=icmp
add action=accept chain=input comment=\
"accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment=\
"Allow DNS from VLAN to LAN based DNS server" dst-address=192.168.88.1 \
dst-port=53 in-interface-list=VLAN protocol=udp
add action=drop chain=input comment="drop all not coming from LAN inc. VLAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=\
"fasttrack - disables queues" connection-state=established,related
add action=accept chain=forward comment=\
"accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="FTP port forward" dst-port=21 \
in-interface-list=WAN protocol=tcp to-addresses=192.168.88.197
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/lcd
set backlight-timeout=5m
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=Europe/London
/system identity
set name=ROUTER001
/system scheduler
add comment="Update NextDNS public IP" interval=2h name="NextDNS IP update" \
on-event="/system script run NextDNS" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2023-01-18 start-time=16:00:00
/tool graphing interface
add interface=ether1-wan
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
