Hi.
I have a new mikrotik chateau lte12 and need some help. Everything works, except Onedive for Business and Outlook on my clients. When I change the router, Outlook and Onedive is connecting without problems. I captured some traffic on my client and found out, that only with outlook and onedrive i have TCP ReTransmits. As it works with same SIM in my TP-Link MR600 router, the problem should be related to the mikrotik chateau lte12, but i can’t find the issue. Teams, Sykpe, Websurfing etc. works without problems on both routers. Please Help!
1854 15:27:41 09.09.2020 14.4715489 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:Flags=......S., SrcPort=49883, DstPort=HTTPS(443), PayloadLen=0, Seq=2988734820, Ack=0, Win=64240 ( Negotiating scale factor 0x8 ) = 64240 {TCP:295, IPv4:294}
1856 15:27:41 09.09.2020 14.4942058 OUTLOOK.EXE s-0005.s-msedge.net 10.100.68.19 TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=49883, PayloadLen=0, Seq=2216698322, Ack=2988734821, Win=65535 ( Scale factor not supported ) = 16776960 {TCP:295, IPv4:294}
1857 15:27:41 09.09.2020 14.4943283 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:Flags=...A...., SrcPort=49883, DstPort=HTTPS(443), PayloadLen=0, Seq=2988734821, Ack=2216698323, Win=517 (scale factor 0x8) = 132352 {TCP:295, IPv4:294}
1858 15:27:41 09.09.2020 14.4948682 OUTLOOK.EXE 10.100.68.19 e584.g.akamaiedge.net TCP TCP:Flags=......S., SrcPort=49884, DstPort=HTTPS(443), PayloadLen=0, Seq=1797575830, Ack=0, Win=64240 ( Negotiating scale factor 0x8 ) = 64240 {TCP:297, IPv4:296}
1867 15:27:41 09.09.2020 14.5110228 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TLS TLS:TLS Rec Layer-1 HandShake: Client Hello. {TLS:299, SSLVersionSelector:298, TCP:295, IPv4:294}
1878 15:27:41 09.09.2020 14.5293230 OUTLOOK.EXE e584.g.akamaiedge.net 10.100.68.19 TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=49884, PayloadLen=0, Seq=1749374128, Ack=1797575831, Win=29200 ( Negotiated scale factor 0x7 ) = 3737600 {TCP:297, IPv4:296}
1879 15:27:41 09.09.2020 14.5294025 OUTLOOK.EXE 10.100.68.19 e584.g.akamaiedge.net TCP TCP:Flags=...A...., SrcPort=49884, DstPort=HTTPS(443), PayloadLen=0, Seq=1797575831, Ack=1749374129, Win=517 (scale factor 0x8) = 132352 {TCP:297, IPv4:296}
1880 15:27:41 09.09.2020 14.5297238 OUTLOOK.EXE 10.100.68.19 e584.g.akamaiedge.net TLS TLS:TLS Rec Layer-1 HandShake: Client Hello. {TLS:301, SSLVersionSelector:300, TCP:297, IPv4:296}
1940 15:27:41 09.09.2020 14.7498841 OUTLOOK.EXE 10.100.68.19 40.101.55.162 TCP TCP:Flags=......S., SrcPort=49885, DstPort=HTTPS(443), PayloadLen=0, Seq=3469340691, Ack=0, Win=64240 ( Negotiating scale factor 0x8 ) = 64240 {TCP:305, IPv4:304}
1941 15:27:41 09.09.2020 14.7541079 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:[ReTransmit #1867]Flags=...AP..., SrcPort=49883, DstPort=HTTPS(443), PayloadLen=181, Seq=2988734821 - 2988735002, Ack=2216698323, Win=517 (scale factor 0x8) = 132352 {TCP:295, IPv4:294}
1944 15:27:41 09.09.2020 14.7781774 OUTLOOK.EXE 40.101.55.162 10.100.68.19 TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=49885, PayloadLen=0, Seq=1074959472, Ack=3469340692, Win=65535 ( Negotiated scale factor 0x8 ) = 16776960 {TCP:305, IPv4:304}
1945 15:27:41 09.09.2020 14.7782860 OUTLOOK.EXE 10.100.68.19 40.101.55.162 TCP TCP:Flags=...A...., SrcPort=49885, DstPort=HTTPS(443), PayloadLen=0, Seq=3469340692, Ack=1074959473, Win=517 (scale factor 0x8) = 132352 {TCP:305, IPv4:304}
1946 15:27:41 09.09.2020 14.7785789 OUTLOOK.EXE 10.100.68.19 40.101.55.162 TLS TLS:TLS Rec Layer-1 HandShake: Client Hello. {TLS:307, SSLVersionSelector:306, TCP:305, IPv4:304}
1947 15:27:41 09.09.2020 14.7861995 OUTLOOK.EXE 10.100.68.19 e584.g.akamaiedge.net TCP TCP:[ReTransmit #1880]Flags=...AP..., SrcPort=49884, DstPort=HTTPS(443), PayloadLen=193, Seq=1797575831 - 1797576024, Ack=1749374129, Win=517 (scale factor 0x8) = 132352 {TCP:297, IPv4:296}
1968 15:27:41 09.09.2020 14.8918048 OUTLOOK.EXE s-0005.s-msedge.net 10.100.68.19 TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=49883, PayloadLen=0, Seq=2216698322, Ack=2988734821, Win=65535 ( Scale factor not supported ) = 16776960 {TCP:295, IPv4:294}
1969 15:27:41 09.09.2020 14.8918700 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:Flags=...A...., SrcPort=49883, DstPort=HTTPS(443), PayloadLen=0, Seq=2988735002, Ack=2216698323, Win=517 (scale factor 0x8) = 132352 {TCP:295, IPv4:294}
1977 15:27:41 09.09.2020 14.9127024 OUTLOOK.EXE 10.100.68.19 outlook.a1.group TCP TCP:Flags=......S., SrcPort=49886, DstPort=HTTPS(443), PayloadLen=0, Seq=3444453986, Ack=0, Win=64240 ( Negotiating scale factor 0x8 ) = 64240 {TCP:312, IPv4:230}
1982 15:27:41 09.09.2020 14.9510463 OUTLOOK.EXE outlook.a1.group 10.100.68.19 TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=49886, PayloadLen=0, Seq=4080430433, Ack=3444453987, Win=8190 ( Negotiated scale factor 0x8 ) = 2096640 {TCP:312, IPv4:230}
1983 15:27:41 09.09.2020 14.9511354 OUTLOOK.EXE 10.100.68.19 outlook.a1.group TCP TCP:Flags=...A...., SrcPort=49886, DstPort=HTTPS(443), PayloadLen=0, Seq=3444453987, Ack=4080430434, Win=514 (scale factor 0x8) = 131584 {TCP:312, IPv4:230}
1984 15:27:41 09.09.2020 14.9514675 OUTLOOK.EXE 10.100.68.19 outlook.a1.group TLS TLS:TLS Rec Layer-1 HandShake: Client Hello. {TLS:314, SSLVersionSelector:313, TCP:312, IPv4:230}
1988 15:27:41 09.09.2020 15.0229012 OUTLOOK.EXE 10.100.68.19 40.101.55.162 TCP TCP:[ReTransmit #1946]Flags=...AP..., SrcPort=49885, DstPort=HTTPS(443), PayloadLen=187, Seq=3469340692 - 3469340879, Ack=1074959473, Win=517 (scale factor 0x8) = 132352 {TCP:305, IPv4:304}
1999 15:27:41 09.09.2020 15.0764918 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:[ReTransmit #1867]Flags=...AP..., SrcPort=49883, DstPort=HTTPS(443), PayloadLen=181, Seq=2988734821 - 2988735002, Ack=2216698323, Win=517 (scale factor 0x8) = 132352 {TCP:295, IPv4:294}
2012 15:27:41 09.09.2020 15.0952455 OUTLOOK.EXE 10.100.68.19 e584.g.akamaiedge.net TCP TCP:[ReTransmit #1880]Flags=...AP..., SrcPort=49884, DstPort=HTTPS(443), PayloadLen=193, Seq=1797575831 - 1797576024, Ack=1749374129, Win=517 (scale factor 0x8) = 132352 {TCP:297, IPv4:296}
2018 15:27:41 09.09.2020 15.2080739 OUTLOOK.EXE 10.100.68.19 outlook.a1.group TCP TCP:[ReTransmit #1984]Flags=...AP..., SrcPort=49886, DstPort=HTTPS(443), PayloadLen=183, Seq=3444453987 - 3444454170, Ack=4080430434, Win=514 (scale factor 0x8) = 131584 {TCP:312, IPv4:230}
2047 15:27:41 09.09.2020 15.3234957 OUTLOOK.EXE 10.100.68.19 40.101.55.162 TCP TCP:[ReTransmit #1946]Flags=...AP..., SrcPort=49885, DstPort=HTTPS(443), PayloadLen=187, Seq=3469340692 - 3469340879, Ack=1074959473, Win=517 (scale factor 0x8) = 132352 {TCP:305, IPv4:304}
2078 15:27:42 09.09.2020 15.5090427 OUTLOOK.EXE 10.100.68.19 outlook.a1.group TCP TCP:[ReTransmit #1984]Flags=...AP..., SrcPort=49886, DstPort=HTTPS(443), PayloadLen=183, Seq=3444453987 - 3444454170, Ack=4080430434, Win=514 (scale factor 0x8) = 131584 {TCP:312, IPv4:230}
2079 15:27:42 09.09.2020 15.5480563 OUTLOOK.EXE e584.g.akamaiedge.net 10.100.68.19 TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=49884, PayloadLen=0, Seq=1749374128, Ack=1797575831, Win=29200 ( Negotiated scale factor 0x7 ) = 3737600 {TCP:297, IPv4:296}
2080 15:27:42 09.09.2020 15.5481206 OUTLOOK.EXE 10.100.68.19 e584.g.akamaiedge.net TCP TCP:Flags=...A...., SrcPort=49884, DstPort=HTTPS(443), PayloadLen=0, Seq=1797576024, Ack=1749374129, Win=517 (scale factor 0x8) = 132352 {TCP:297, IPv4:296}
2094 15:27:42 09.09.2020 15.6881853 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:[ReTransmit #1867]Flags=...AP..., SrcPort=49883, DstPort=HTTPS(443), PayloadLen=181, Seq=2988734821 - 2988735002, Ack=2216698323, Win=517 (scale factor 0x8) = 132352 {TCP:295, IPv4:294}
2095 15:27:42 09.09.2020 15.6975880 OUTLOOK.EXE s-0005.s-msedge.net 10.100.68.19 TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=49883, PayloadLen=0, Seq=2216698322, Ack=2988734821, Win=65535 ( Scale factor not supported ) = 16776960 {TCP:295, IPv4:294}
2096 15:27:42 09.09.2020 15.6976429 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:[Dup Ack #1969]Flags=...A...., SrcPort=49883, DstPort=HTTPS(443), PayloadLen=0, Seq=2988735002, Ack=2216698323, Win=517 (scale factor 0x8) = 132352 {TCP:295, IPv4:294}
2097 15:27:42 09.09.2020 15.7048624 OUTLOOK.EXE 10.100.68.19 e584.g.akamaiedge.net TCP TCP:[ReTransmit #1880]Flags=...AP..., SrcPort=49884, DstPort=HTTPS(443), PayloadLen=193, Seq=1797575831 - 1797576024, Ack=1749374129, Win=517 (scale factor 0x8) = 132352 {TCP:297, IPv4:296}
2117 15:27:42 09.09.2020 15.9300385 OUTLOOK.EXE 10.100.68.19 40.101.55.162 TCP TCP:[ReTransmit #1946]Flags=...AP..., SrcPort=49885, DstPort=HTTPS(443), PayloadLen=187, Seq=3469340692 - 3469340879, Ack=1074959473, Win=517 (scale factor 0x8) = 132352 {TCP:305, IPv4:304}
2124 15:27:42 09.09.2020 16.1128508 OUTLOOK.EXE 10.100.68.19 outlook.a1.group TCP TCP:[ReTransmit #1984]Flags=...AP..., SrcPort=49886, DstPort=HTTPS(443), PayloadLen=183, Seq=3444453987 - 3444454170, Ack=4080430434, Win=514 (scale factor 0x8) = 131584 {TCP:312, IPv4:230}
2262 15:27:43 09.09.2020 16.8896323 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:[ReTransmit #1867]Flags=...AP..., SrcPort=49883, DstPort=HTTPS(443), PayloadLen=181, Seq=2988734821 - 2988735002, Ack=2216698323, Win=517 (scale factor 0x8) = 132352 {TCP:295, IPv4:294}
2265 15:27:43 09.09.2020 16.9103637 OUTLOOK.EXE 10.100.68.19 e584.g.akamaiedge.net TCP TCP:[ReTransmit #1880]Flags=...AP..., SrcPort=49884, DstPort=HTTPS(443), PayloadLen=193, Seq=1797575831 - 1797576024, Ack=1749374129, Win=517 (scale factor 0x8) = 132352 {TCP:297, IPv4:296}
2323 15:27:43 09.09.2020 17.1434592 OUTLOOK.EXE 10.100.68.19 40.101.55.162 TCP TCP:[ReTransmit #1946]Flags=...AP..., SrcPort=49885, DstPort=HTTPS(443), PayloadLen=187, Seq=3469340692 - 3469340879, Ack=1074959473, Win=517 (scale factor 0x8) = 132352 {TCP:305, IPv4:304}
2324 15:27:43 09.09.2020 17.2926218 OUTLOOK.EXE s-0005.s-msedge.net 10.100.68.19 TCP TCP:Flags=.....R.., SrcPort=HTTPS(443), DstPort=49883, PayloadLen=0, Seq=2216698323, Ack=2988734821, Win=0 (scale factor 0x8) = 0 {TCP:295, IPv4:294}
2325 15:27:43 09.09.2020 17.2930644 OUTLOOK.EXE 10.100.68.19 s-0005.s-msedge.net TCP TCP:Flags=......S., SrcPort=49894, DstPort=HTTPS(443), PayloadLen=0, Seq=483928721, Ack=0, Win=64240 ( Negotiating scale factor 0x8 ) = 64240 {TCP:365, IPv4:294}
At first, i tried with default config. Then disabled the fasttrack rules etc. Deleted the config and tried the basic nat setup form the wiki in different variants… Played with filter rules and setting the last few days without success. everything else works, just outlook and onedrive for business makes problems. in my current setup, i deleted all filter rules, my current config:
[admin@MikroTik] > export compact
# sep/09/2020 15:53:26 by RouterOS 7.1beta2
# software id = ZWWL-1RYS
#
# model = RBD53G-5HacD2HnD
# serial number = C8CA0C5FAE50
/interface bridge
add admin-mac=48:8F:5A:17:40:A8 auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/interface wireless
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-1740AE station-roaming=enabled wireless-protocol=802.11
/interface vlan
add interface=bridge name=ImpGuest vlan-id=70
add interface=bridge name=ImpIoT vlan-id=72
add interface=bridge name=ImpWiFi vlan-id=68
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=default ip-type=ipv4
add apn=webapn.at authentication=chap ip-type=ipv4 name=webapn
/interface lte
set [ find ] allow-roaming=no apn-profiles=webapn name=lte1 network-mode=lte
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection=allowed mode=dynamic-keys name=profile1 supplicant-identity=MikroTik wpa2-pre-shared-key=LANme2home
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge security-profile=profile1 ssid=MikroTik-1740AD station-roaming=enabled wireless-protocol=802.11 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec profile
add dh-group=modp2048,modp1536,modp1024 enc-algorithm=aes-256,aes-128,3des hash-algorithm=md5 name=AES256
/ip ipsec peer
add address=51.15.27.118/32 name=online profile=AES256
/ip ipsec proposal
add auth-algorithms=md5 enc-algorithms=aes-256-cbc name=proposal1 pfs-group=none
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=pool_lan64 ranges=10.100.64.10-10.100.64.60
add comment=ImpGuest name=pool70 ranges=10.100.70.10-10.100.70.50
add comment=ImpWiFi name=pool68 ranges=10.100.68.10-10.100.68.100
add comment=ImpIoT name=pool72 ranges=10.100.72.10-10.100.72.100
add name=dhcp_pool5 ranges=10.100.70.1-10.100.70.50
/ip dhcp-server
add address-pool=pool_lan64 bootp-support=none disabled=no interface=bridge lease-time=6h name=LAN64
add address-pool=pool68 disabled=no interface=ImpWiFi lease-time=6h name=ImpWiFi
add address-pool=pool70 disabled=no interface=ImpGuest lease-time=6h name=ImpGuest
add address-pool=pool72 disabled=no interface=ImpIoT lease-time=12h name=ImpIoT
/ip vrf
add list=all name=main
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip firewall connection tracking
set enabled=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge,ether3 vlan-ids=68,70,72
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
add interface=ImpIoT list=LAN
add interface=ImpWiFi list=LAN
add interface=ImpGuest list=LAN
add interface=ether1 list=LAN
/interface lte settings
set external-antenna=both
/ip address
add address=10.100.64.254/24 comment=defconf interface=ether1 network=10.100.64.0
add address=10.100.68.254/24 interface=ImpWiFi network=10.100.68.0
add address=10.100.70.254/24 interface=ImpGuest network=10.100.70.0
add address=10.100.72.254/24 interface=ImpIoT network=10.100.72.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-server network
add address=10.100.64.0/24 comment=defconf dns-server=10.100.64.1,10.100.32.1 domain=in.4net.stream gateway=10.100.64.254 netmask=24
add address=10.100.68.0/24 dns-server=10.100.64.1,10.100.32.1 domain=in.4net.stream gateway=10.100.68.254 netmask=24
add address=10.100.70.0/24 dns-server=10.100.64.1,10.100.32.1 domain=in.4net.stream gateway=10.100.70.254 netmask=24
add address=10.100.72.0/24 dns-server=10.100.64.1,10.100.32.1 domain=in.4net.stream gateway=10.100.72.254 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=10.100.64.254 comment=defconf name=router.lan type=A
/ip firewall nat
add action=accept chain=srcnat dst-address=10.100.32.0/20 src-address=10.100.64.0/19
add action=accept chain=srcnat disabled=yes out-interface=lte1 src-address=92.248.45.247
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=lte1
/ip ipsec identity
add auth-method=rsa-key key=tik.4net.stream my-id=fqdn:tik.4net.stream peer=online remote-id=fqdn:gw00.4net.stream remote-key=gw00.4net.stream
/ip ipsec policy
add dst-address=10.100.32.0/20 peer=online proposal=proposal1 sa-dst-address=51.15.27.118 sa-src-address=0.0.0.0 src-address=10.100.64.0/19 tunnel=yes
/ip route
add dst-address=10.100.96.0/24 gateway=10.100.64.253 type=unicast
add dst-address=10.100.48.0/24 gateway=10.100.64.253 type=unicast
add dst-address=10.100.66.0/24 gateway=10.100.64.253 type=unicast
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=10.100.0.0/16
set ssh address=10.100.0.0/16
set api address=10.100.0.0/16
set winbox address=10.100.0.0/16
set api-ssl address=10.100.0.0/16
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
add address=::224.0.0.0/100 comment="defconf: other" list=bad_ipv6
add address=::127.0.0.0/104 comment="defconf: other" list=bad_ipv6
add address=::/104 comment="defconf: other" list=bad_ipv6
add address=::255.0.0.0/104 comment="defconf: other" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Vienna
/system logging
set 0 action=disk
set 1 action=disk
set 2 action=disk
set 3 action=disk
add topics=firewall
add disabled=yes topics=packet
/system package update
set channel=development
/system routerboard settings
set cpu-frequency=auto
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Thanks!