Hello, I have a recent setup with a Wireguard VPN configured on a Mikrotik RG951G. I am able to connect to the VPN and access the Mikrotik router, but am unable to access or ping anything else on the LAN.
R1
LAN MT=221.229.1.0/24
WAN MT= 192.168.1.3
Router LAN=192.168.1.1
Router IP Public = 181.90.15.215
Internet
R2
Router IP Public =190.229.65.220
Router LAN=192.168.1.1
WAN MT = 192.168.1.2
LAN MT =192.168.0.0/24
CONFIG R1
# 2023-09-14 15:06:12 by RouterOS 7.11.2
# software id = MI9P-MCN3
#
# model = RB951G-2HnD
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz frequency=2412 name=\
CLR-Canal1
add band=5ghz-a/n/ac frequency=5220 name=CLR-Canal1
/interface bridge
add fast-forward=no name=Bridge-CLR
add fast-forward=no name=Bridge-Lan
add fast-forward=no name=Bridge-Visita
/interface ethernet
set [ find default-name=ether1 ] name=lan5
set [ find default-name=ether5 ] name=wan1
set [ find default-name=ether4 ] arp=proxy-arp disabled=yes name=wan2
set [ find default-name=ether3 ] disabled=yes name=wan3
set [ find default-name=ether2 ] disabled=yes name=wan4
/interface wireless
# managed by CAPsMAN
# channel: 2437/20-Ce/gn(20dBm), SSID: CLR, CAPsMAN forwarding
set [ find default-name=wlan1 ] antenna-gain=0 country=no_country_set \
frequency-mode=manual-txpower name=wlan3 ssid=Mkt-Sistemas \
station-roaming=enabled
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface vrrp
add interface=Bridge-Lan name=vrrp1 priority=254
/caps-man datapath
add bridge=Bridge-CLR client-to-client-forwarding=yes local-forwarding=no \
name=CLR-Datapath1
add bridge=Bridge-Visita client-to-client-forwarding=no local-forwarding=no \
name=CLR-Datapath2
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm name=CLR-Seguridad1
add authentication-types=wpa2-psk encryption=aes-ccm name=CLR-Seguridad2
/caps-man configuration
add channel=CLR-Canal6 country=argentina datapath=CLR-Datapath1 mode=ap name=\
CAPs-Lan security=CLR-Seguridad1 ssid="CLR"
add channel=CLR-Canal6 country=argentina datapath=CLR-Datapath2 mode=ap name=\
CAPs-Visita security=CLR-Seguridad2 ssid=CLR-VISITA
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
/interface list
add name=Lista-WAN
add name=Lista-Lan
/interface lte apn
set [ find default=yes ] add-default-route=no ip-type=ipv4 use-network-apn=no \
use-peer-dns=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip firewall layer7-protocol
add name=Youtube regexp="^.+(youtube|googlevideo|akamaihd).*\$"
add name=Facebook regexp=\
"^.+(facebook|instagram|twitter|snapchat|fbcdn.net).*\$"
add name=BlockList regexp="^.+(AnyDesk|TeamViewer).*\$"
/ip pool
add name=DHCP_Pool_1 ranges=221.229.1.36-221.229.1.59
add name=DHCP_Pool_4 ranges=192.168.12.3-192.168.12.254
/ip dhcp-server
add add-arp=yes address-pool=DHCP_Pool_1 authoritative=after-2sec-delay \
interface=Bridge-Lan lease-time=1h name=DHCP-Server use-radius=yes
add add-arp=yes address-pool=DHCP_Pool_4 authoritative=after-2sec-delay \
interface=Bridge-CLR lease-time=1h name=DHCP-CLR
/port
set 0 baud-rate=9600 data-bits=8 flow-control=none name=usb1 parity=none \
stop-bits=1
/queue type
add kind=pcq name=PCQ_download pcq-classifier=dst-address pcq-limit=\
25000000KiB pcq-rate=5M
add kind=pcq name=PCQ_upload pcq-classifier=src-address pcq-limit=25000000KiB \
pcq-rate=5M
add cake-diffserv=besteffort cake-nat=yes kind=cake name=Cake
add kind=fq-codel name="fc codel"
/queue simple
add max-limit=5M/10M name=queue1 queue=Cake/Cake target=\
221.229.1.206/32,221.229.1.84/32,221.229.1.198/32 total-queue=Cake
add max-limit=10M/30M name=QueueWF-CLR queue=Cake/Cake target=Bridge-CLR \
total-queue=Cake
add limit-at=5M/10M max-limit=5M/10M name=Queue-WF-Visita parent=QueueWF-CLR \
queue=Cake/Cake target=Bridge-Visita total-queue=Cake
add burst-limit=20M/30M burst-threshold=5M/10M burst-time=20s/15s max-limit=\
10M/20M name=Queue-WF-CLR-Dia parent=QueueWF-CLR priority=1/1 queue=\
Cake/Cake target=Bridge-CLR time=6h-18h59m59s,sun,mon,tue,wed,thu,fri,sat \
total-queue=Cake
add limit-at=1M/5M max-limit=1M/5M name=Queue-WF-CLR-Noche parent=QueueWF-CLR \
queue=Cake/Cake target=Bridge-CLR time=\
19h-5h59m59s,sun,mon,tue,wed,thu,fri,sat total-queue=Cake
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
add disabled=no name=default-v3 version=3
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
add disabled=yes instance=default-v3 name=backbone-v3
/routing table
add disabled=no fib name=to_wan1
add fib name=to_wan2
add fib name=to_wan3
add fib name=to_wan4
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/system logging action
set 1 disk-file-name=flash/log
/user group
add name=geo-api policy="read,write,api,!local,!telnet,!ssh,!ftp,!reboot,!poli\
cy,!test,!winbox,!password,!web,!sniff,!sensitive,!romon,!rest-api"
/user-manager attribute
add name=User-Name type-id=1 value-type=string
/user-manager limitation
add name=CLR-Limit-1
/user-manager profile
add name=CLR-Profile-1 name-for-users=CLR-Profile-1
/user-manager user group
add attributes=User-Name:1 inner-auths=\
ttls-pap,ttls-chap,ttls-mschap1,ttls-mschap2,peap-mschap2 name=\
CLR-Grupo-1 outer-auths=\
pap,chap,mschap1,mschap2,eap-tls,eap-ttls,eap-peap,eap-mschap2
/user-manager user
add group=CLR-Grupo-1 name=6C:3B:6B:64:87:89
add group=CLR-Grupo-1 name=4C:5E:0C:D0:BD:87
add group=CLR-Grupo-1 name=6C:3B:6B:64:86:ED
add group=CLR-Grupo-1 name=6C:3B:6B:82:CA:BC
add group=CLR-Grupo-1 name=08:55:31:EC:5F:A9
add group=CLR-Grupo-1 name=D4:CA:6D:A2:9E:B5
add group=CLR-Grupo-1 name=6C:3B:6B:64:87:CB
add group=CLR-Grupo-1 name=4C:5E:0C:CA:29:30
add comment=Montial group=CLR-Grupo-1 name=3C:52:82:37:40:E8
add comment="DVR Borrar" group=CLR-Grupo-1 name=00:8C:EF:8B:6D:85
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=CAPs-Lan \
slave-configurations=CAPs-Visita
/interface bridge port
add bridge=Bridge-Lan edge=yes hw=no ingress-filtering=no interface=Lista-Lan \
point-to-point=no
/ip firewall connection tracking
set enabled=yes tcp-established-timeout=5m
/ip neighbor discovery-settings
set discover-interface-list=all
/ip settings
set max-neighbor-entries=8192 tcp-syncookies=yes
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add interface=wan1 list=Lista-WAN
add interface=wan2 list=Lista-WAN
add interface=wan3 list=Lista-WAN
add interface=wan4 list=Lista-WAN
add interface=lan5 list=Lista-Lan
add interface=wireguard1 list=Lista-Lan
/interface ovpn-server server
set auth=sha1,md5
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead
set authentication=pap,chap,mschap1,mschap2 default-profile=default
/interface wireguard peers
add allowed-address=192.168.0.0/24,10.255.255.0/30 \
endpoint-address=190.229.65.220 endpoint-port=13231 interface=wireguard1 \
public-key="OEvaYZed0LjDpm6TqylVvkDnoaNXvJ40QPNjOp6w51c="
/interface wireless cap
#
set bridge=Bridge-Lan caps-man-certificate-common-names=CAPsMAN-64D1541BBC2B \
discovery-interfaces=Bridge-Lan enabled=yes interfaces=wlan3
/ip address
add address=192.168.11.1/24 interface=Bridge-Visita network=192.168.11.0
add address=192.168.10.1/24 interface=Bridge-Visita network=192.168.10.0
add address=192.168.2.3/24 interface=wan2 network=192.168.2.0
add address=192.168.1.3/24 interface=wan1 network=192.168.1.0
add address=192.168.3.3/24 interface=wan3 network=192.168.3.0
add address=221.229.1.254 interface=vrrp1 network=221.229.1.254
add address=192.168.4.3/24 interface=wan4 network=192.168.4.0
add address=221.229.1.5/24 interface=Bridge-Lan network=221.229.1.0
add address=192.168.12.1/24 interface=Bridge-CLR network=192.168.12.0
add address=10.255.255.1/30 interface=wireguard1 network=10.255.255.0
/ip cloud
set update-time=no
/ip dhcp-server
add add-arp=yes address-pool=DHCP_Pool_2 authoritative=after-2sec-delay \
interface=Bridge-Visita lease-time=1h name=DHCP-Visita
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=192.168.10.1 gateway=192.168.10.1
add address=192.168.11.0/24 dns-server=192.168.11.1 gateway=192.168.11.1
add address=192.168.12.0/24 dns-server=192.168.12.1 gateway=192.168.12.1
add address=221.229.1.0/24 dns-server=221.229.1.254 gateway=221.229.1.254 \
ntp-server=221.229.1.1
/ip dns
set allow-remote-requests=yes cache-size=4096KiB max-concurrent-queries=200 \
max-concurrent-tcp-sessions=40 query-total-timeout=7s servers=\
208.67.222.123,208.67.220.123,8.8.8.8,8.8.4.4
/ip dns static
add address=127.0.0.1 regexp="^(.*)(anydesk)(.*)\$"
add address=127.0.0.1 regexp="^(.*)(teamviewer)(.*)\$"
add address=127.0.0.1 regexp="^(.*)(supremo)(.*)\$"
add address=127.0.0.1 regexp="^(.*)(nanosystems)(.*)\$"
add address=127.0.0.1 regexp="^(.*)(realvnc)(.*)\$"
add address=127.0.0.1 regexp="^(.*)(remotedesktop)(.*)\$"
/ip firewall address-list
add address=221.229.1.15 list=Permitidos
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here"
add action=accept chain=input comment="Permitir acceso WireGuard" dst-port=\
13231 protocol=udp src-address=190.229.65.220
add action=accept chain=input comment="Permitir acceso WireGuard" disabled=\
yes log=yes src-address=10.255.255.0/30
add action=accept chain=forward dst-address=221.229.1.0/24 src-address=\
192.168.0.0/24
add action=accept chain=forward dst-address=192.168.0.0/24 src-address=\
221.229.1.0/24
add action=add-src-to-address-list address-list=Denegar address-list-timeout=\
1d chain=input connection-limit=10,32 protocol=tcp
add action=tarpit chain=input connection-limit=3,32 protocol=tcp \
src-address-list=Denegar
add action=jump chain=forward comment="SYN Flood protect" connection-state=\
new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=accept chain=SYN-Protect connection-state=new limit=400,5:packet \
protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp \
tcp-flags=syn
add action=accept chain=input comment=\
"Permitir paquetes de conexiones establecidas o relacionadas" \
connection-state=established,related
add action=accept chain=input dst-port=3389 protocol=tcp
add action=accept chain=forward comment=\
"Permisos para los que pueden navegar" src-address-list=Permitidos
add action=drop chain=forward comment=\
"Denegamos a todos para que solo los permitidos peuden navegar" \
src-address-list=Denegar
add action=drop chain=input in-interface-list=Lista-WAN
add action=fasttrack-connection chain=forward connection-state=\
established,related disabled=yes hw-offload=yes
add action=accept chain=forward connection-state=established,related \
disabled=yes
/ip firewall mangle
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=\
Bridge-Lan
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=\
Bridge-CLR
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=\
vrrp1
add action=accept chain=prerouting dst-address=192.168.4.0/24 in-interface=\
Bridge-Visita
add action=accept chain=prerouting dst-address=192.168.2.0/24 in-interface=\
Bridge-Lan
add action=accept chain=prerouting dst-address=192.168.2.0/24 in-interface=\
Bridge-CLR
add action=accept chain=prerouting dst-address=192.168.2.0/24 in-interface=\
vrrp1
add action=accept chain=prerouting dst-address=192.168.3.0/24 in-interface=\
Bridge-Lan
add action=accept chain=prerouting dst-address=192.168.3.0/24 in-interface=\
Bridge-CLR
add action=accept chain=prerouting dst-address=192.168.3.0/24 in-interface=\
vrrp1
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=wan1 new-connection-mark=wan1_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=wan2 new-connection-mark=wan2_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=wan4 new-connection-mark=wan4_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=wan3 new-connection-mark=wan3_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Visita new-connection-mark=\
wan4_conn passthrough=yes per-connection-classifier=both-addresses:1/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Lan new-connection-mark=\
wan1_conn passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-CLR new-connection-mark=\
wan1_conn passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=vrrp1 new-connection-mark=wan1_conn \
passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Lan new-connection-mark=\
wan2_conn passthrough=yes per-connection-classifier=both-addresses:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-CLR new-connection-mark=\
wan2_conn passthrough=yes per-connection-classifier=both-addresses:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=vrrp1 new-connection-mark=wan2_conn \
passthrough=yes per-connection-classifier=both-addresses:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Lan new-connection-mark=\
wan3_conn passthrough=yes per-connection-classifier=both-addresses:3/2
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-CLR new-connection-mark=\
wan3_conn passthrough=yes per-connection-classifier=both-addresses:3/2
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=vrrp1 new-connection-mark=wan3_conn \
passthrough=yes per-connection-classifier=both-addresses:3/2
add action=mark-routing chain=prerouting connection-mark=wan1_conn \
in-interface=Bridge-Lan new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan1_conn \
in-interface=Bridge-CLR new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan1_conn \
in-interface=vrrp1 new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan2_conn \
in-interface=Bridge-Lan new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan2_conn \
in-interface=Bridge-CLR new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan2_conn \
in-interface=vrrp1 new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan3_conn \
in-interface=Bridge-Lan new-routing-mark=to_wan3 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan3_conn \
in-interface=Bridge-CLR new-routing-mark=to_wan3 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan3_conn \
in-interface=vrrp1 new-routing-mark=to_wan3 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan4_conn \
in-interface=Bridge-Visita new-routing-mark=to_wan4 passthrough=yes
add action=mark-routing chain=output connection-mark=wan1_conn \
new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=output connection-mark=wan2_conn \
new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=output connection-mark=wan3_conn \
new-routing-mark=to_wan3 passthrough=yes
add action=mark-routing chain=output connection-mark=wan4_conn \
new-routing-mark=to_wan4 passthrough=yes
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=\
PermitidoAR to-addresses=8.8.8.8 to-ports=53
add action=dst-nat chain=dstnat dst-port=53 protocol=tcp src-address-list=\
PermitidoAR to-addresses=8.8.8.8 to-ports=53
add action=dst-nat chain=dstnat dst-port=53 protocol=udp to-ports=53
add action=dst-nat chain=dstnat dst-port=53 protocol=tcp to-ports=53
add action=masquerade chain=srcnat out-interface=wan1
add action=masquerade chain=srcnat out-interface=wan2
add action=masquerade chain=srcnat out-interface=wan3
add action=masquerade chain=srcnat out-interface=wan4
add action=masquerade chain=srcnat disabled=yes log=yes out-interface=\
wireguard1
/ip firewall raw
add action=drop chain=prerouting dst-port=53 in-interface-list=Lista-WAN \
protocol=udp
add action=drop chain=prerouting dst-port=53 in-interface-list=Lista-WAN \
protocol=tcp
/ip firewall service-port
set irc disabled=no
/ip hotspot service-port
set ftp disabled=yes
/ip pool
add name=DHCP_Pool_3 next-pool=DHCP_Pool_2 ranges=192.168.11.3-192.168.11.254
add name=DHCP_Pool_2 next-pool=DHCP_Pool_3 ranges=192.168.10.3-192.168.10.254
/ip route
add comment="Moniitorea Router1" disabled=no distance=1 dst-address=\
8.8.8.8/32 gateway=192.168.1.1 pref-src="" routing-table=main scope=10 \
suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Defecto Router1" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add comment="Moniitorea Router2" disabled=no distance=1 dst-address=\
8.8.4.4/32 gateway=192.168.2.1 pref-src="" routing-table=main scope=10 \
suppress-hw-offload=no target-scope=10
add comment="Moniitorea Router3" disabled=no distance=1 dst-address=\
9.9.9.9/32 gateway=192.168.3.1 pref-src="" routing-table=main scope=10 \
suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Defecto Router2" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Defecto Router3" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add comment="Moniitorea Router4" disabled=no distance=1 dst-address=\
1.1.1.1/32 gateway=192.168.4.1 pref-src="" routing-table=main scope=10 \
suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Defecto Router4" disabled=no distance=4 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 1" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=to_wan1 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 2" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=to_wan2 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 3" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=to_wan3 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 4" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=to_wan4 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 2" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=to_wan2 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 3" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=to_wan3 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 4" disabled=no distance=4 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=to_wan4 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 1" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=to_wan1 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 3" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=to_wan3 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 4" disabled=no distance=4 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=to_wan4 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 1" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=to_wan1 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 2" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=to_wan2 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 4" disabled=no distance=4 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=to_wan4 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 1" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=to_wan1 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 2" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=to_wan2 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 3" disabled=no distance=4 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=to_wan3 \
scope=30 suppress-hw-offload=no target-scope=11
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=221.229.1.12/32 disabled=yes
set ssh disabled=yes
set api address=221.229.1.12/32 disabled=yes
set winbox address=221.229.1.12/32
set api-ssl address=221.229.1.12/32 disabled=yes
/ip smb
set allow-guests=no
/ip ssh
set forwarding-enabled=remote strong-crypto=yes
/ip traffic-flow
set interfaces=wan1
/ip traffic-flow target
add dst-address=221.229.1.12 port=1234 version=ipfix
/ip upnp
set show-dummy-rule=no
/ipv6 nd
set [ find default=yes ] advertise-dns=no
/radius
add address=127.0.0.1 service=dhcp
/radius incoming
set accept=yes
/routing bfd configuration
add disabled=no
/system clock
set time-zone-name=America/Argentina/Buenos_Aires
/system identity
set name=Mkt-Sistemas
/system leds
set 0 leds="" type=interface-activity
add interface=wan2 leds="" type=interface-activity
add interface=wan3 leds="" type=interface-activity
add interface=wan4 leds="" type=interface-activity
add interface=lan5 leds="" type=interface-activity
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=221.229.1.1
/system routerboard settings
set auto-upgrade=yes
/system routerboard reset-button
set enabled=yes
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
/user aaa
set use-radius=yes
/user-manager
set enabled=yes
/user-manager profile-limitation
add limitation=CLR-Limit-1 profile=CLR-Profile-1
/user-manager router
add address=127.0.0.1 name=CLR-Router-1
/user-manager user-profile
add profile=CLR-Profile-1 user=08:55:31:EC:5F:A9
CONFIG R2
# 2023-09-14 15:23:14 by RouterOS 7.11.2
# software id = E5B8-S0K6
#
# model = RB951G-2HnD
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz frequency=2412 name=Canal1
/interface bridge
add fast-forward=no name=Bridge-Lan
add fast-forward=no name=Bridge-Visita
/interface ethernet
set [ find default-name=ether5 ] name=lan5
set [ find default-name=ether1 ] name=wan1
set [ find default-name=ether2 ] disabled=yes name=wan2
set [ find default-name=ether3 ] disabled=yes name=wan3
set [ find default-name=ether4 ] disabled=yes name=wan4
/interface wireless
# managed by CAPsMAN
# channel: 2437/20-eC/gn(20dBm), SSID: LM, CAPsMAN forwarding
set [ find default-name=wlan1 ] antenna-gain=0 country=no_country_set \
frequency-mode=manual-txpower ssid=Mkt-LaMalligastena station-roaming=\
enabled
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface vrrp
add interface=Bridge-Lan name=vrrp1 priority=255
/caps-man datapath
add bridge=Bridge-Lan client-to-client-forwarding=yes name=Datapath1
add bridge=Bridge-Visita client-to-client-forwarding=no name=Datapath2
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm name=Seguridad1
add authentication-types=wpa2-psk encryption=aes-ccm name=Seguridad2
/caps-man configuration
add channel=Canal6 country=argentina datapath=Datapath1 mode=ap name=CAPs-Lan \
security=Seguridad1 ssid=LM
add channel=Canal6 country=argentina datapath=Datapath2 mode=ap name=\
CAPs-Visita security=Seguridad2 ssid=VISITA
/interface list
add name=ListaWan
add name=ListaLan
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=Coralino-Profile supplicant-identity=""
/ip pool
add name=DHCP_Pool_1 ranges=192.168.0.160-192.168.0.250
add name=DHCP_Pool_2 ranges=192.168.11.3-192.168.11.254
/ip dhcp-server
add add-arp=yes address-pool=DHCP_Pool_1 authoritative=after-2sec-delay \
interface=Bridge-Lan lease-time=1h name=DHCP-Server
add add-arp=yes address-pool=DHCP_Pool_2 authoritative=after-2sec-delay \
interface=Bridge-Visita lease-time=1h name=DHCP-Visita
/ppp profile
add dns-server=192.168.0.254 local-address=192.168.100.254 name=profile1 \
only-one=yes remote-address=172.10.10.1 use-encryption=required
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/routing table
add fib name=to_wan1
add fib name=to_wan2
add fib name=to_wan3
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/interface wireless
add disabled=no keepalive-frames=disabled mac-address=66:D1:54:0E:B2:47 \
master-interface=*FFFFFFFF mode=station multicast-buffering=disabled \
name=wlan2 ssid="" wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=CAPs-Lan \
slave-configurations=CAPs-Visita
/interface bridge port
add bridge=Bridge-Lan hw=no ingress-filtering=no interface=ListaLan \
point-to-point=no
/interface bridge settings
set use-ip-firewall-for-pppoe=yes use-ip-firewall-for-vlan=yes
/ip firewall connection tracking
set enabled=yes tcp-established-timeout=5m
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set max-neighbor-entries=8192 tcp-syncookies=yes
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface l2tp-server server
set authentication=mschap2 default-profile=default use-ipsec=yes
/interface list member
add interface=wan1 list=ListaWan
add interface=wan2 list=ListaWan
add interface=wan4 list=ListaWan
add interface=wan3 list=ListaWan
add interface=lan5 list=ListaLan
add interface=wireguard1 list=ListaLan
/interface ovpn-server server
set auth=sha1 certificate=*B cipher=aes256-cbc
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead
set authentication=pap,chap,mschap1,mschap2 default-profile=default
/interface sstp-server server
set authentication=mschap2 certificate=*A default-profile=profile1
/interface wireguard peers
add allowed-address=221.229.1.0/24,192.168.1.0/24,10.255.255.0/30 \
endpoint-address=181.90.15.215 endpoint-port=13231 interface=wireguard1 \
public-key="YZ5ylzydRqvrlZ1rA4BxgcvLp1xwMU0y0YXKt7ST5l8="
/interface wireless cap
#
set bridge=Bridge-Lan caps-man-certificate-common-names=CAPsMAN-C4AD34E89C6B \
discovery-interfaces=Bridge-Lan enabled=yes interfaces=wlan1
/ip address
add address=192.168.0.254/24 interface=vrrp1 network=192.168.0.0
add address=192.168.0.251/24 interface=Bridge-Lan network=192.168.0.0
add address=192.168.11.1/24 interface=Bridge-Visita network=192.168.11.0
add address=192.168.1.2/24 interface=wan1 network=192.168.1.0
add address=10.255.255.2/30 interface=wireguard1 network=10.255.255.0
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.254 gateway=192.168.0.254
add address=192.168.11.0/24 dns-server=192.168.11.1 gateway=192.168.11.1
/ip dns
set allow-remote-requests=yes cache-size=4096KiB max-concurrent-queries=200 \
max-concurrent-tcp-sessions=40 query-total-timeout=7s servers=\
8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.0.0/24 comment="Denegar a todos" list=Denegar
add address=192.168.0.0/24 comment="Habilita a Todos" list=Permitidos
/ip firewall filter
add action=accept chain=input comment="Permitir acceso WireGuard" dst-port=\
13231 protocol=udp src-address=181.90.15.215
add action=accept chain=input disabled=yes src-address=10.255.255.0/30
add action=accept chain=forward dst-address=192.168.0.0/24 src-address=\
221.229.1.0/24
add action=accept chain=forward dst-address=221.229.1.0/24 src-address=\
192.168.0.0/24
add action=add-src-to-address-list address-list=Denegar address-list-timeout=\
1d chain=input connection-limit=10,32 protocol=tcp
add action=tarpit chain=input connection-limit=3,32 protocol=tcp \
src-address-list=Denegar
add action=jump chain=forward comment="SYN Flood protect" connection-state=\
new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=accept chain=SYN-Protect connection-state=new limit=400,5:packet \
protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp \
tcp-flags=syn
add action=accept chain=input comment=\
"Permitir paquetes de conexiones establecidas o relacionadas" \
connection-state=established,related
add action=accept chain=input comment="Permitir acceso RemoteDesktop" \
dst-port=3389 log=yes protocol=tcp
add action=accept chain=input comment="Permitir acceso Mobiliza" dst-port=\
5185 log=yes protocol=tcp
add action=drop chain=forward src-mac-address=D8:EB:97:1A:F5:9C
add action=drop chain=forward src-mac-address=98:DE:D0:7F:AC:81
add action=drop chain=forward src-mac-address=D8:47:32:02:6D:87
add action=accept chain=forward src-address-list=Permitidos
add action=drop chain=forward src-address-list=Denegar
add action=drop chain=input in-interface-list=ListaWan
add action=fasttrack-connection chain=forward connection-state=\
established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related
/ip firewall mangle
add action=accept chain=prerouting dst-address=192.168.2.0/24 in-interface=\
Bridge-Lan
add action=accept chain=prerouting dst-address=192.168.2.0/24 in-interface=\
Bridge-Visita
add action=accept chain=prerouting dst-address=192.168.2.0/24 in-interface=\
vrrp1
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=\
Bridge-Lan
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=\
Bridge-Visita
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=\
vrrp1
add action=accept chain=prerouting dst-address=181.10.147.248/29 \
in-interface=Bridge-Lan
add action=accept chain=prerouting dst-address=181.10.147.248/29 \
in-interface=Bridge-Visita
add action=accept chain=prerouting dst-address=181.10.147.248/29 \
in-interface=vrrp1
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=wan1 new-connection-mark=wan1_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=wan2 new-connection-mark=wan2_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=wan3 new-connection-mark=wan3_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Lan new-connection-mark=\
wan1_conn passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Visita new-connection-mark=\
wan1_conn passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=vrrp1 new-connection-mark=wan1_conn \
passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Lan new-connection-mark=\
wan2_conn passthrough=yes per-connection-classifier=both-addresses:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Visita new-connection-mark=\
wan2_conn passthrough=yes per-connection-classifier=both-addresses:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=vrrp1 new-connection-mark=wan2_conn \
passthrough=yes per-connection-classifier=both-addresses:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Lan new-connection-mark=\
wan3_conn passthrough=yes per-connection-classifier=both-addresses:3/2
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=Bridge-Visita new-connection-mark=\
wan3_conn passthrough=yes per-connection-classifier=both-addresses:3/2
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface=vrrp1 new-connection-mark=wan3_conn \
passthrough=yes per-connection-classifier=both-addresses:3/2
add action=mark-routing chain=prerouting connection-mark=wan1_conn \
in-interface=Bridge-Lan new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan1_conn \
in-interface=Bridge-Visita new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan1_conn \
in-interface=vrrp1 new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan2_conn \
in-interface=Bridge-Lan new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan2_conn \
in-interface=Bridge-Visita new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan2_conn \
in-interface=vrrp1 new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan3_conn \
in-interface=Bridge-Lan new-routing-mark=to_wan3 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan3_conn \
in-interface=Bridge-Visita new-routing-mark=to_wan3 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan3_conn \
in-interface=vrrp1 new-routing-mark=to_wan3 passthrough=yes
add action=mark-routing chain=output connection-mark=wan1_conn \
new-routing-mark=to_wan1 passthrough=yes
add action=mark-routing chain=output connection-mark=wan2_conn \
new-routing-mark=to_wan2 passthrough=yes
add action=mark-routing chain=output connection-mark=wan3_conn \
new-routing-mark=to_wan3 passthrough=yes
/ip firewall nat
add action=redirect chain=dstnat dst-port=53 protocol=udp to-ports=53
add action=redirect chain=dstnat dst-port=53 protocol=tcp to-ports=53
add action=masquerade chain=srcnat out-interface=wan1
add action=masquerade chain=srcnat out-interface=wan2
add action=masquerade chain=srcnat out-interface=wan3
add action=masquerade chain=srcnat disabled=yes out-interface=wireguard1
add action=dst-nat chain=dstnat dst-address=192.168.1.2 dst-port=3389 \
protocol=tcp to-addresses=192.168.0.6 to-ports=3389
add action=dst-nat chain=dstnat dst-address=192.168.1.2 dst-port=5185 \
protocol=tcp to-addresses=192.168.0.6 to-ports=5185
/ip firewall raw
add action=drop chain=prerouting dst-port=53 in-interface=wan3 protocol=udp \
src-port=""
add action=drop chain=prerouting dst-port=53 in-interface=wan1 protocol=udp \
src-port=""
add action=drop chain=prerouting dst-port=53 in-interface=wan2 protocol=udp \
src-port=""
add action=drop chain=prerouting dst-port=53 in-interface=wan3 protocol=tcp \
src-port=""
add action=drop chain=prerouting dst-port=53 in-interface=wan1 protocol=tcp \
src-port=""
add action=drop chain=prerouting dst-port=53 in-interface=wan2 protocol=tcp \
src-port=""
/ip firewall service-port
set irc disabled=no
/ip route
add comment="Moniitorea Router1" disabled=no distance=1 dst-address=\
8.8.8.8/32 gateway=192.168.1.1 pref-src="" routing-table=main scope=10 \
suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Defecto Router1" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add comment="Moniitorea Router2" disabled=no distance=1 dst-address=\
8.8.4.4/32 gateway=192.168.2.1 pref-src="" routing-table=main scope=10 \
suppress-hw-offload=no target-scope=10
add comment="Moniitorea Router3" disabled=no distance=1 dst-address=\
9.9.9.9/32 gateway=192.168.3.1 pref-src="" routing-table=main scope=10 \
suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Defecto Router2" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Defecto Router3" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add comment="Moniitorea Router4" disabled=no distance=1 dst-address=\
1.1.1.1/32 gateway=192.168.4.1 pref-src="" routing-table=main scope=10 \
suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Defecto Router4" disabled=no distance=4 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 1" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=to_wan1 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 2" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=to_wan2 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 3" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=to_wan3 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 2" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=to_wan2 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 3" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=8.8.8.8 pref-src="" routing-table=to_wan3 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 1" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=to_wan1 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 3" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=to_wan3 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 1" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=to_wan1 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 2" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=9.9.9.9 pref-src="" routing-table=to_wan2 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 1" disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=to_wan1 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 2" disabled=no distance=3 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=to_wan2 \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Rutea Router 3" disabled=no distance=4 \
dst-address=0.0.0.0/0 gateway=1.1.1.1 pref-src="" routing-table=to_wan3 \
scope=30 suppress-hw-offload=no target-scope=11
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes port=8081
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.0.36/32
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip traffic-flow
set interfaces=wan3
/ppp secret
add name=cmena profile=profile1
/radius
add address=127.0.0.1 service=dhcp
/radius incoming
set accept=yes port=1700
/routing bfd configuration
add disabled=no
/system clock
set time-zone-name=America/Argentina/Buenos_Aires
/system identity
set name=Mkt-LaMalligastena
/system leds
set 0 interface=*6
add interface=wan1 leds="" type=interface-status
add interface=wan2 leds="" type=interface-status
add interface=wan3 leds="" type=interface-status
add interface=wan4 leds="" type=interface-status
add interface=lan5 leds="" type=interface-status
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=time.afip.gov.ar
/tool bandwidth-server
set enabled=no
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
/tool sniffer
set filter-interface=lan5