# feb/05/2021 12:23:47 by RouterOS 6.48
# software id = E7KR-KZ0Z
#
# model = RB4011iGS+
# serial number = D4460CC95D62
/interface bridge
add admin-mac=48:8F:5A:85:82:E5 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1-ISP
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=12h name=\
    defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment="defconf LAN" interface=bridge list=LAN
add comment=defconf interface=ether1-ISP list=WAN
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=\
    192.168.1.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1-ISP
/ip dhcp-server lease
add address=192.168.1.150 client-id=1:dc:a6:32:b7:2d:f5 comment=RPi1 \
    mac-address=DC:A6:32:B7:2D:F5 server=defconf
add address=192.168.1.110 client-id=1:62:32:b1:9a:84:f3 comment=RPi1 \
    mac-address=62:32:B1:9A:84:F3 server=defconf
add address=192.168.1.120 client-id=1:dc:a6:32:b7:2d:d9 comment=RPi1 \
    mac-address=DC:A6:32:B7:2D:D9 server=defconf
add address=192.168.1.22 client-id=1:62:32:b1:95:e9:9a comment=\
    "TP-Link RangeExtender" mac-address=62:32:B1:95:E9:9A server=defconf
add address=192.168.1.57 client-id=1:84:d8:1b:dd:44:c0 comment=\
    "TPLink Access Point" lease-time=12h mac-address=84:D8:1B:DD:44:C0 \
    server=defconf
add address=192.168.1.130 client-id=1:dc:A6:32:01:d4:b7 comment=RPi1 \
    mac-address=DC:A6:32:01:D4:B7 server=defconf
add address=192.168.1.100 client-id=1:00:90:A9:E8:25:06 comment=RPi1 \
    mac-address=00:90:A9:E8:25:06 server=defconf
add address=192.168.1.35 client-id=1:DC:A6:32:1A:55:08 comment=RPi1 \
    mac-address=DC:A6:32:1A:55:08 server=defconf
add address=192.168.1.90 client-id=1:DC:A6:32:B7:4B:67 comment=RPi1 \
    mac-address=DC:A6:32:B7:4B:67 server=defconf
add address=192.168.1.43 client-id=1:b8:27:eb:22:59:48 comment=\
    "Rpi3B+ LCD Display" mac-address=B8:27:EB:22:59:48 server=defconf
add address=192.168.1.50 client-id=1:62:32:b1:57:a9:71 comment=\
    "PiZeroW Network Monitor" mac-address=62:32:B1:57:A9:71 server=defconf
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface=ether1-ISP out-interface-list=WAN
add action=dst-nat chain=dstnat comment="PiMedia HTTPS" dst-port=443 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.1.130 to-ports=\
    443
add action=dst-nat chain=dstnat comment="PiMedia SSH" dst-port=32022 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.1.130 to-ports=22
add action=dst-nat chain=dstnat comment="MQTT Broker" dst-port=11883 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.1.120 to-ports=\
    11883
/ip route
add distance=1 gateway=ether1-ISP
/system clock
set time-zone-name=America/Toronto
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN