Hello,
I am hoping someone can shed some light about my issue. I have wireguard set up with a hub and two spokes. The issue is that throughput from hub to spokes is awful. Spokes to hub works fine. The hub itself is 10GB/s fibre connection, so technically it should be fine, but it's not. One of the spokes is also fibre but it is 400/200. that is site B. site C is on LTE connection, and I am getting 100/50. Since site b's ipv4 is behind cgnat, I am using ipv6 to the hub (or site A) and vice versa. site C is also behind cgnat, does not have ipv6 so it initiates the connection to the hub's static ipv4 address. on paper everything works fine besides the throughput. If I try to watch blue iris server on site C from site B, it stalls after a few seconds. If I connect from the hub, it works without a glitch. if i vpn in to the hub and connect to the blue iris server on site C from site B, it also works. I have tried everything I can think of. checked the config, disabled firewall rules. played with MTU. i thought perhaps mixing ipv4 and ipv6 may be an issue, so instead i connected site b to the hub the same way site C is connected and that did nothing. tried using chat gpt to see if damned AI can figure something out, and it was a gigantic waste of time. I am posting the configs for all sites, and would love if someone can double check my setup. The hub is running on new hex S router, site b is original hex s and site c is hap ax2
Hub:
2026-09-18 15:17:37 by RouterOS 7.24.4
software id = DN5P-VPI3
model = E60iUGS
serial number =
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether2 ] comment=WiFi
set [ find default-name=ether3 ] comment=Hallway
set [ find default-name=ether4 ] comment="Living Room"
set [ find default-name=sfp1 ] comment="Internet Link"
/interface wireguard
add listen-port=13231 mtu=1420 name=C19
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp ranges=192.168.22.10-192.168.22.249
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/ip smb
set enabled=no
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set accept-router-advertisements=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=Internet interface=sfp1 list=WAN
add comment=Wireguard interface=C19 list=LAN
/interface wireguard peers
add allowed-address=192.255.255.1/32,192.168.11.0/24,192.168.99.0/24
client-allowed-address=::/0 comment= endpoint-address=
endpoint-port=13231 interface=C19
name="Site B" persistent-keepalive=10s public-key=
"
add allowed-address=192.255.255.4/32,192.168.88.0/24,192.168.77.0/24
client-allowed-address=::/0 comment=Krcheta endpoint-port=13231
interface=C19 name="Site C" persistent-keepalive=10s public-key=
""
/ip address
add address=192.168.22.1/24 comment=defconf interface=bridge network=
192.168.22.0
add address=192.255.255.2/24 comment="Wireguard Tunnel" interface=C19
network=192.255.255.0
add address=192.168.33.1/24 comment="VPN Range" interface=C19 network=
192.168.33.0
/ip dhcp-client
add comment=defconf interface=sfp1 name=sfp1
add interface=*A name=client1
/ip dhcp-server lease
/ip dns
set allow-remote-requests=yes cache-size=64000KiB servers=192.168.22.2
/ip dns static
add address=192.168.22.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.22.99 list="No Internet"
add address=192.168.22.222 disabled=yes list="No Internet"
/ip firewall filter
add action=drop chain=forward comment="Prevents Internet Access" log-prefix=
blocked-internet-access-attempt out-interface=sfp1 src-address-list=
"No Internet"
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=accept chain=input comment="wireguard 2" dst-port=13231 protocol=
udp
add action=accept chain=forward comment="Wireguard routing" in-interface=C19
out-interface=C19
add action=accept chain=forward comment="wireguard accept" in-interface=C19
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related disabled=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=accept chain=input dst-address=192.168.22.222 dst-port=32400
protocol=tcp src-port=32400
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment=Plex dst-address-list="" dst-port=
32400 in-interface=sfp1 protocol=tcp to-addresses=192.168.22.222
to-ports=32400
add action=masquerade chain=srcnat comment="wireguard masquarade"
out-interface=sfp1 src-address=192.168.33.0/24
/ip firewall raw
add action=notrack chain=prerouting comment="Bypass FastTrack for WireGuard"
disabled=yes in-interface=C19
/ip route
add disabled=no distance=1 dst-address=192.168.11.0/24 gateway=C19
routing-table=main scope=30 target-scope=10
add disabled=no distance=1 dst-address=192.168.99.0/24 gateway=C19
routing-table=main
add disabled=no dst-address=192.168.88.0/24 gateway=C19 routing-table=main
add disabled=no dst-address=192.168.77.0/24 gateway=C19 routing-table=main
/ipv6 route
add disabled=no distance=1 dst-address=::/0
add disabled=no distance=1 dst-address=::/0
add disabled=no distance=1 dst-address=::/0
add disabled=no distance=1 dst-address=::/0 gateway=
routing-table=main scope=30 target-scope=10
/ip service
set ftp disabled=yes
set ssh available-from=192.168.22.0/24,192.168.11.0/24 disabled=yes
set telnet disabled=yes
set www available-from=
192.168.22.0/24,192.168.11.0/24,192.168.33.0/24,192.168.99.0/24
set winbox available-from="192.168.22.0/24,192.168.11.0/24,192.255.255.0/30,19
2.168.33.0/24,192.168.99.0/24"
set api available-from=
192.168.22.0/24,192.168.11.0/24,192.168.33.0/24,192.168.99.0/24
set api-ssl available-from=192.168.22.0/24,192.168.11.0/24,192.168.33.0/24
/ipv6 address
/ipv6 dhcp-client
add interface=sfp1 request=address use-interface-duid=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
add address=ff00::/8 comment="defconf: multicast" list=bad_ipv6
add address=100::/64 comment="defconf: RFC6890 Discard-only" list=
not_global_ipv6
add address=2001::/32 comment="defconf: RFC6890 TEREDO" list=not_global_ipv6
add address=2001:2::/48 comment="defconf: RFC6890 Benchmark" list=
not_global_ipv6
add address=fc00::/7 comment="defconf: RFC6890 Unique-Local" list=
not_global_ipv6
add address=::/128 comment="defconf: unspecified" list=bad_dst_ipv6
add address=::/128 comment="defconf: unspecified" list=bad_src_ipv6
add address=ff00::/8 comment="defconf: multicast" list=bad_src_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="accept established,related,untracked"
connection-state=established,related,untracked
add action=accept chain=input comment="accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="accept UDP traceroute" dst-port=
33434-33534 protocol=udp
add action=accept chain=input comment=wireguard dst-port=13231 protocol=udp
add action=accept chain=input comment=
"accept DHCPv6-Client prefix delegation" dst-port=546 protocol=udp
src-address=fe80::/10
add action=accept chain=forward comment=
"accept established,related,untracked" connection-state=
established,related,untracked
add action=accept chain=forward comment="accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="INPUT : Accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="INPUT : Accept established, related"
connection-state=established,related
add action=accept chain=forward comment="FWD : Accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="FWD : Accept established, related"
connection-state=established,related
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=drop chain=input comment=
"drop everything else not coming from LAN" in-interface-list=!LAN
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop packets with bad source/dest"
src-address-list=bad_ipv6
add action=drop chain=forward comment=
"drop everything else from WAN not DST-NATed" connection-nat-state=
!dstnat in-interface-list=!LAN
add action=drop chain=forward comment="FWD : Drop everything else"
in-interface=sfp1 log-prefix="DROP : IPv6 FORWARD"
add action=drop chain=input comment="INPUT : Drop everything else"
in-interface=sfp1 log-prefix="DROP : IPv6 INPUT"
/ipv6 nd
set [ find default=yes ] hop-limit=64 interface=bridge
managed-address-configuration=yes other-configuration=yes
add hop-limit=64 interface=sfp1 managed-address-configuration=yes
other-configuration=yes
/system clock
set time-zone-name=Europe
/system identity
set name=Chmd
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Site B:
2026-09-18 15:15:49 by RouterOS 7.24.4
software id = IPJT-IMVH
model = RB760iGS
serial number =
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge
port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] advertise=1G-baseT-half,1G-baseT-full
comment=Uplink
set [ find default-name=ether2 ] comment=
set [ find default-name=ether3 ] comment=
set [ find default-name=ether4 ] comment=
set [ find default-name=sfp1 ] advertise="10M-baseT-half,10M-baseT-full,100M-b
aseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full"
/interface wireguard
add comment="" listen-port=13231 mtu=1420 name=P14
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/ip pool
add name=dhcp ranges=192.168.11.10-192.168.11.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=defconf relay=
255.255.255.255
/ip smb users
set [ find default=yes ] disabled=yes
/snmp community
add addresses=::/0 name=
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1
internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set accept-router-advertisements=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=P14 list=LAN
/interface ovpn-server server
add auth=sha1,md5 mac-address=FE:0E:3D:C5:7C:E0 name=ovpn-server1
/interface wireguard peers
add allowed-address="192.255.255.2/32,192.168.22.0/24,192.168.33.0/24,192.168.
88.0/24,192.168.77.0/24" client-allowed-address=::/0 comment=""
endpoint-address= endpoint-port=13231 interface=P14 name=
"Site A" persistent-keepalive=10s public-key=
""
/ip address
add address=192.168.11.1/24 comment=defconf interface=bridge network=
192.168.11.0
add address=192.168.99.1/24 interface=P14 network=192.168.99.0
add address=192.255.255.1/24 interface=P14 network=192.255.255.0
/ip dhcp-client
add comment=defconf interface=ether1 name=ether1
/ip dhcp-server lease
/ip dhcp-server network
add address=192.168.11.0/24 comment=defconf dns-server=192.168.11.2 domain=
gateway=192.168.11.1 netmask=24 ntp-server=192.168.11.1
/ip dns
set allow-remote-requests=yes cache-size=50000KiB servers=
9.9.9.9,208.67.222.222,1.0.0.1
/ip dns adlist
add disabled=yes url=https://big.oisd.nl/
add disabled=yes url=
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
add disabled=yes url=https://adaway.org/hosts.txt
add disabled=yes url=https://v.firebog.net/hosts/Easyprivacy.txt
add disabled=yes url="https://raw.githubusercontent.com/hagezi/dns-blocklists/\
main/domains/multi.txt"
/ip dns static
add address=192.168.11.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.11.242 list="No Internet"
add address=192.168.11.243 list="No Internet"
add address=192.168.11.245 list="No Internet"
add address=192.168.11.246 list="No Internet"
add address=192.168.11.247 list="No Internet"
add address=192.168.11.75 list="No Internet"
add address=192.168.11.31 list="No Internet"
/ip firewall filter
add action=drop chain=forward comment="No Internet Rule" out-interface=ether1
src-address-list="No Internet"
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=accept chain=input comment="wireguard accept" dst-port=13231
protocol=udp
add action=accept chain=forward comment="wireguard accept forward"
in-interface=P14
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface=P14
passthrough=no protocol=tcp tcp-flags=syn
add action=change-mss chain=forward in-interface=P14 new-mss=clamp-to-pmtu
passthrough=no protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment="WireGuard MSS Clamping" new-mss=
1348 out-interface=P14 protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="wireguard masquerade"
out-interface=ether1 src-address=192.168.99.0/24
add action=dst-nat chain=dstnat comment=plex disabled=yes dst-port=32400
in-interface=ether1 protocol=tcp to-addresses=192.168.11.11 to-ports=
32400
/ip firewall raw
add action=notrack chain=prerouting comment="Bypass FastTrack for WireGuard"
disabled=yes in-interface=P14
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add comment="wireguard remote" disabled=no distance=1 dst-address=
192.168.22.0/24 gateway=P14 routing-table=main scope=30 target-scope=10
add comment="wireguard remote" disabled=no distance=1 dst-address=
192.168.33.0/24 gateway=P14 routing-table=main scope=30 target-scope=10
add comment=Krcheta disabled=no distance=1 dst-address=192.168.88.0/24
gateway=P14 routing-table=main scope=30 target-scope=10
add disabled=no distance=1 dst-address=192.168.77.0/24 gateway=P14
routing-table=main scope=30 target-scope=10
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www available-from=
192.168.11.0/24,192.168.22.0/24,192.168.33.0/24,192.168.99.0/24
set winbox available-from=
192.168.11.0/24,192.168.22.0/24,192.168.33.0/24,192.168.99.0/24
set api available-from=192.168.11.0/24,192.168.22.0/24,192.168.33.0/24
set api-ssl available-from=192.168.11.0/24,192.168.22.0/24
/ip upnp
set show-dummy-rule=no
/ipv6 address
add from-pool=supernova interface=bridge
/ipv6 dhcp-client
add add-default-route=yes interface=ether1 pool-name=sua
pool-prefix-length=64 request=address,prefix
/ipv6 firewall address-list
add address=::1/128 comment="defconf: RFC6890 lo" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: RFC6890 IPv4 mapped" list=
bad_ipv6
add address=2001::/23 comment="defconf: RFC6890" list=bad_ipv6
add address=2001:db8::/32 comment="defconf: RFC6890 documentation" list=
bad_ipv6
add address=2001:10::/28 comment="defconf: RFC6890 orchid" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: RFC6890 Discard-only" list=
not_global_ipv6
add address=2001::/32 comment="defconf: RFC6890 TEREDO" list=not_global_ipv6
add address=2001:2::/48 comment="defconf: RFC6890 Benchmark" list=
not_global_ipv6
add address=fc00::/7 comment="defconf: RFC6890 Unique-Local" list=
not_global_ipv6
add address=::/128 comment="defconf: unspecified" list=bad_dst_ipv6
add address=::/128 comment="defconf: unspecified" list=bad_src_ipv6
add address=ff00::/8 comment="defconf: multicast" list=bad_src_ipv6
/ipv6 firewall filter
add action=accept chain=input
add action=accept chain=input comment="accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="accept UDP traceroute" dst-port=
33434-33534 protocol=udp
add action=accept chain=input comment=
"accept DHCPv6-Client prefix delegation" dst-port=546 protocol=udp
src-address=fe80::/10
add action=accept chain=input comment="wireguard accept" dst-port=13231
protocol=udp src-port=13231
add action=accept chain=input comment="INPUT : Accept established, related"
connection-state=established,related
add action=accept chain=input comment="INPUT: Accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment=
"accept established,related,untracked" connection-state=
established,related,untracked
add action=accept chain=forward comment="accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="FWD : Accept established, related"
connection-state=established,related
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=input comment=
"drop everything else not coming from LAN" in-interface-list=!LAN
add action=drop chain=forward comment="drop packets with bad source/dest"
src-address-list="bad ipv6"
add action=drop chain=input comment="INPUT: Drop anything else" in-interface=
ether1
add action=drop chain=forward comment="FWD: Drop anything else" in-interface=
ether1
/ipv6 firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=3389 protocol=tcp
src-port=3389 to-address=2a06:63c5:870d:1301:5aff:2463:c59f:5881/128
add action=dst-nat chain=dstnat disabled=yes dst-port=3389 protocol=udp
src-port=3389 to-address=2a06:63c5:870d:1301:5aff:2463:c59f:5881/128
/ipv6 nd
automatic dns option advertising is not started, re-apply dns config
set [ find default=yes ] advertise-dns=yes
/routing bfd configuration
add disabled=no
/snmp
set contact=Nenad enabled=yes location="Prijedorska 14 Zajecar"
trap-community=mreza
/system clock
set time-zone-name=Europe/Belgrade
/system identity
set name=Prijedorska14
/system ntp client
set enabled=yes
/system ntp server
set broadcast=yes enabled=yes multicast=yes
/system ntp client servers
add address=0.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Site C:
2026-09-18 15:18:06 by RouterOS 7.24.4
software id = 660Z-FWP0
model = C52iG-5HaxD2HaxD
serial number =
/interface bridge
add name=bridge
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1596
set [ find default-name=ether2 ] l2mtu=1596
set [ find default-name=ether3 ] comment= l2mtu=1596
set [ find default-name=ether4 ] comment="" l2mtu=1596
set [ find default-name=ether5 ] comment="" l2mtu=1596
/interface wifi
set [ find default-name=wifi1 ] channel.width=20/40/80mhz
configuration.country=Some .mode=ap .ssid=KNK disabled=no
set [ find default-name=wifi2 ] configuration.country= .mode=ap .ssid=
-NK2G disabled=no security.authentication-types=wpa2-psk
.encryption=ccmp .multi-passphrase-group=""
/interface wireguard
add listen-port=13231 mtu=1420 name=Krcheta
/interface ethernet switch
set switch1 cpu-flow-control=yes
/interface list
add name=WAN
add name=LAN
/interface wifi channel
add band=5ghz-ax disabled=no name=channel1 width=20/40/80/160/320mhz
add band=5ghz-n disabled=no name=channel2 width=20/40/80+80mhz
/interface wifi security
add authentication-types=
wpa-psk,wpa2-psk,wpa2-psk-sha2,wpa-eap,wpa2-eap,wpa3-psk,owe disabled=no
encryption="" name=sec1
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=sec2
add authentication-types=wpa2-psk encryption=ccmp ft=yes ft-over-ds=yes name=
roam-sec
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.100
/ip dhcp-server
add address-pool=dhcp interface=bridge name=dhcp1
/snmp community
set [ find default=yes ] name=mreza
/user group
add name=homeassistant policy="reboot,write,policy,test,api,!local,!telnet,!ss
h,!ftp,!read,!winbox,!password,!web,!sniff,!sensitive,!romon,!rest-api"
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=*1
add bridge=bridge interface=wifi1
add bridge=bridge interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ipv6 settings
set accept-router-advertisements=yes allow-fast-path=no max-neighbor-entries=
15360
/interface list member
add interface=bridge list=LAN
add interface=Krcheta list=LAN
add interface=ether1 list=WAN
/interface ovpn-server server
add mac-address=FE:07:A3:12:5D:BA name=ovpn-server1
/interface wifi capsman
set interfaces=ether2,ether3,ether4,ether5,bridge
/interface wifi provisioning
add action=create-dynamic-enabled master-configuration=roam-5ghz
supported-bands=5ghz-ac
add action=create-dynamic-enabled master-configuration=roam-5ghz
supported-bands=5ghz-ax
add action=create-dynamic-enabled master-configuration=roam-2ghz
supported-bands=2ghz-n
add action=create-dynamic-enabled master-configuration=roam-2ghz
supported-bands=2ghz-ax
/interface wireguard peers
add allowed-address="192.255.255.2/32,192.168.22.0/24,192.168.33.0/24,192.168.
11.0/24,192.168.99.0/24" client-allowed-address=::/0 client-keepalive=10s
comment="Charcot 19" endpoint-address= endpoint-port=13231
interface=Krcheta name="Site A" persistent-keepalive=10s public-key=
""
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
add address=192.168.77.1/24 comment=Wireguard interface=Krcheta network=
192.168.77.0
add address=192.255.255.4/24 interface=Krcheta network=192.255.255.0
/ip dhcp-client
Interface not active
add default-route-tables=main interface=ether2 name=ether2
add interface=ether1 name=client1
/ip dhcp-server lease
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
netmask=24 ntp-server=192.168.88.1
/ip dns
set allow-remote-requests=yes cache-size=40960KiB servers=192.168.88.1
/ip dns adlist
add disabled=yes url=
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
add disabled=yes url=https://big.oisd.nl/
add disabled=yes url=https://v.firebog.net/hosts/Easyprivacy.txt
add disabled=yes url=https://adaway.org/hosts.txt
/ip firewall address-list
add address=192.168.88.107 list="No Internet"
add address=192.168.88.106 list="No Internet"
add address=192.168.88.101 list="No Internet"
add address=192.168.88.86 list="No Internet"
add address=192.168.88.87 list="No Internet"
add address=192.168.88.109 list="No Internet"
/ip firewall filter
add action=drop chain=forward comment="no internet" log-prefix=
blocked-internet-access-attempt out-interface=ether1 src-address-list=
"No Internet"
add action=accept chain=input comment="accept icmp" protocol=icmp
add action=accept chain=forward comment="Wireguard accept" in-interface=
Krcheta
add action=accept chain=input dst-port=13231 protocol=udp
add action=accept chain=input comment="accept established" connection-state=
established
add action=accept chain=input comment="accept related and untracked"
connection-state=related,untracked
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related disabled=yes
add action=drop chain=input comment="drop not from LAN" in-interface-list=
!LAN
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all WAN not dstnated"
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip firewall raw
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=no distance=1 dst-address=192.168.22.0/24 gateway=Krcheta
routing-table=main
add disabled=no distance=1 dst-address=192.168.33.0/24 gateway=Krcheta
routing-table=main
add disabled=no distance=1 dst-address=192.168.11.0/24 gateway=Krcheta
routing-table=main scope=30 target-scope=10
add disabled=no distance=1 dst-address=192.168.99.0/24 gateway=Krcheta
routing-table=main scope=30 target-scope=10
/ip service
set ssh available-from=192.168.11.0/24,192.168.22.0/24,192.168.88.0/24
disabled=yes
set telnet disabled=yes
set www available-from="192.168.11.0/24,192.168.22.0/24,192.168.33.0/24,192.16
8.88.0/24,192.168.99.0/24,192.168.8.0/24"
set winbox available-from="192.168.11.0/24,192.168.22.0/24,192.168.33.0/24,192
.168.88.0/24,192.168.99.0/24,192.168.8.0/24"
/ip upnp
set allow-disable-external-interface=yes show-dummy-rule=no
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/
/system identity
set name=Krcheta
/system logging
add disabled=yes topics=wireless
add disabled=yes topics=dhcp,debug
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes use-local-clock=yes
/system ntp client servers
add address=pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN