Here's my config:
Code: Select all
# apr/13/2021 17:31:55 by RouterOS 6.48.1
# software id = E5TS-FVUZ
#
# model = RB760iGS
# serial number = AE370C704F06
/interface bridge
add admin-mac=48:8F:5A:D9:36:A5 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.50-192.168.1.254
add name=vpn ranges=192.168.89.2-192.168.89.255
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/ip address
add address=192.168.1.1/24 comment=defconf interface=ether2 network=\
192.168.1.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=no interface=ether1 use-peer-dns=no \
use-peer-ntp=no
/ip dhcp-server lease
add address=192.168.1.101 mac-address=18:74:2E:D8:F5:0C
add address=192.168.1.201 mac-address=00:11:32:10:AA:9A
add address=192.168.1.242 mac-address=A8:A1:59:3F:AA:0B
add address=192.168.1.243 mac-address=A8:A1:59:3F:A1:1F
add address=192.168.1.126 mac-address=10:98:C3:BC:DF:8B
add address=192.168.1.148 mac-address=00:0C:29:28:BC:6B
add address=192.168.1.150 mac-address=C8:34:8E:60:E5:D1
add address=192.168.1.151 mac-address=B8:31:B5:31:9A:33
add address=192.168.1.152 mac-address=A4:5E:60:B9:45:F1
add address=192.168.1.200 mac-address=00:11:32:6D:17:99
add address=192.168.1.210 mac-address=00:0C:29:62:51:D7
add address=192.168.1.125 mac-address=98:09:CF:8F:6C:BA
add address=192.168.1.100 mac-address=50:14:79:1E:47:76
add address=192.168.1.153 mac-address=4C:ED:FB:BF:10:BB
add address=192.168.1.5 mac-address=00:0C:29:40:E7:75
add address=192.168.1.215 client-id=1:0:11:32:e1:d5:8 mac-address=\
00:11:32:E1:D5:08 server=defconf
add address=192.168.1.64 client-id=\
ff:8a:54:d0:44:0:2:0:0:ab:11:95:a0:47:56:6c:49:c3:14 mac-address=\
DC:A6:32:49:07:48 server=defconf
add address=192.168.1.77 client-id=\
ff:10:4e:b6:48:0:2:0:0:ab:11:95:a0:47:56:6c:49:c3:14 mac-address=\
DC:A6:32:49:07:4A server=defconf
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
192.168.89.0/24
add action=dst-nat chain=dstnat comment=Plex dst-port=32400 protocol=tcp \
to-addresses=192.168.1.210 to-ports=32400
add action=dst-nat chain=dstnat comment=Jellyfin dst-port=8920 protocol=tcp \
to-addresses=192.168.1.210
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=ether1 type=external
add interface=ether2 type=internal
add interface=ether3 type=internal
add interface=ether4 type=internal
/ppp secret
add name=vpn
/system clock
set time-zone-name=America/Los_Angeles
/system clock manual
set time-zone=-08:00
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN