/interface bridge
add admin-mac=02:DC:3A:E0:66:1F auto-mac=no mtu=1500 name=HotSpot
add admin-mac=6C:67:6B:32:96:32 auto-mac=no name=LAN
add name=Lo0
add admin-mac=6C:66:6B:93:74:33 auto-mac=no name=WAN
/interface ethernet
set [ find default-name=ether1 ] mac-address=6C:02:58:22:78:32 name=\
    ether1-WAN
set [ find default-name=ether2 ] mac-address=6C:2A:6B:32:95:32 name=\
    ether2-LAN
set [ find default-name=ether3 ] mac-address=6C:3A:6B:32:95:32 name=\
    ether3-LAN
set [ find default-name=ether4 ] mac-address=6C:4A:6B:32:95:32 name=\
    ether4-WANSlave
set [ find default-name=ether5 ] mac-address=6C:5A:6B:32:95:32 name=\
    ether5-WANSlave
/interface eoip
add allow-fast-path=no dont-fragment=inherit !keepalive local-address=\
    192.168.5.1 mac-address=02:DC:3A:E0:66:CF mtu=1500 name="for test" \
    remote-address=192.168.5.2 tunnel-id=55
/interface vlan
add interface=LAN name=HS_VLAN vlan-id=200
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
add dns-name=hotspot.maximatelecom html-directory=flash/hotspot login-by=\
    mac,https,http-pap mac-auth-password=ctrhtn name=hsprof1 \
    radius-mac-format=XX-XX-XX-XX-XX-XX ssl-certificate=hotspot.maximatelecom \
    use-radius=yes
/ip ipsec proposal
set [ find default=yes ] disabled=yes
add auth-algorithms=md5 enc-algorithms=3des name=MT
/ip pool
add name=HotSpot ranges=192.168.200.3-192.168.200.254
add name=LAN ranges=192.168.0.51-192.168.0.200
/ip dhcp-server
add address-pool=LAN disabled=no interface=LAN name=LAN-DHCP
add address-pool=HotSpot disabled=no interface=HotSpot name=HotSpot-DHCP
/ip hotspot
add address-pool=HotSpot disabled=no interface=HotSpot login-timeout=5m name=\
    hotspot1 profile=hsprof1
/snmp community
set [ find default=yes ] addresses=10.1.1.142/32 name="fG54djk\$mn"
/interface bridge port
add bridge=WAN interface=ether1-WAN
add bridge=HotSpot interface=HS_VLAN
add bridge=LAN interface="for test"
add bridge=LAN interface=ether2-LAN
add bridge=LAN interface=ether3-LAN
add bridge=LAN interface=ether4-WANSlave
add bridge=LAN interface=ether5-WANSlave
/interface sstp-server server
set default-profile=default-encryption enabled=yes port=1723
/ip address
add address=192.168.0.1/24 interface=LAN network=192.168.0.0
add address=192.168.200.1/24 interface=HotSpot network=192.168.200.0
add address=92.38.32.95/25 interface=WAN network=92.38.32.0
add address=172.16.200.16 interface=Lo0 network=172.16.200.16
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no \
    interface=WAN
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
add address=192.168.200.0/24 dns-server=192.168.200.1 gateway=192.168.200.1
/ip dns
set allow-remote-requests=yes query-server-timeout=5s servers=\
    93.170.190.252,8.8.8.8
/ip dns static
add address=93.170.190.240 name=unifi
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=WAN protocol=tcp
add action=drop chain=input dst-port=53 in-interface=WAN protocol=udp
add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-port=8291,6589,5920-5921,1723,5000-5002 \
    protocol=tcp
add action=accept chain=input dst-port=8291,5920-5921,6589,123 protocol=udp
add action=accept chain=input comment="Allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="Allow IPSec-esp" protocol=ipsec-esp
add action=accept chain=input dst-port=4500 protocol=udp
add action=accept chain=input protocol=udp src-port=53,2812,2813
add action=drop chain=input connection-state=invalid,new disabled=yes \
    in-interface=WAN
add action=accept chain=input in-interface=LAN port=53 protocol=tcp
add action=accept chain=input in-interface=LAN port=53 protocol=udp
add action=drop chain=input in-interface=LAN
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=92.38.32.95 dst-port=5000-5002 \
    protocol=tcp to-addresses=192.168.0.12 to-ports=5000-5002
add action=dst-nat chain=dstnat dst-address=92.38.32.95 dst-port=5920-5921 \
    protocol=tcp to-addresses=192.168.0.108 to-ports=5920-5921
add action=dst-nat chain=dstnat dst-address=92.38.32.95 dst-port=5920-5921 \
    protocol=udp to-addresses=192.168.0.108 to-ports=5920-5921
add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes to-addresses=0.0.0.0
add action=src-nat chain=srcnat dst-address=10.0.0.0/8 src-address=\
    192.168.200.0/24 to-addresses=172.16.200.16
add action=dst-nat chain=dstnat dst-address=172.16.200.16 src-address=\
    10.0.0.0/8 to-addresses=192.168.200.1
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
    out-interface=WAN src-address=192.168.200.0/24 to-addresses=0.0.0.0
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
    out-interface=WAN src-address=192.168.0.0/24 to-addresses=0.0.0.0
/ip hotspot user
add name=admin password=C1sco1234567
/ip hotspot walled-garden
add dst-host=wi-fi.ru server=hotspot1
add dst-host=auth.wi-fi.ru server=hotspot1
add dst-host=login.wi-fi.ru server=hotspot1
add comment="place hotspot rules here" disabled=yes
add dst-host=login.wi-fi.ru server=hotspot1
add dst-host=ads.adfox.ru server=hotspot1
add dst-host=":^www\\.apple\\.com"
add dst-host=":^clients4\\.google\\.com"
add dst-host=":^connectivitycheck\\.android\\.com"
add dst-host=":^www\\.apple\\.com"
add dst-host=":^www\\.airport\\.us"
add dst-host=":^www\\.itools\\.info"
add dst-host=":^www\\.appleiphonecel\\.com"
add dst-host=":^captive\\.apple\\.com"
add dst-host=":^www\\.thinkdifferent\\.us"
add dst-host=":^www\\.ibook\\.info"
add dst-host=":^www\\.google\\.com"
add dst-host=":^clients3\\.google\\.com"
add dst-host=":^clients5\\.google\\.com"
add dst-host=":^akamaiedge\\.net"
add dst-host=":^akamaitechnologies\\.com"
add dst-host=":^www\\.msftncsi\\.com"
add dst-host=":^www\\.msftncsi\\.com\\.edgesuite\\.net"
add dst-host=":^android\\.connectivitycheck\\.com"
add dst-host=":^clients\\.l\\.google\\.com"
add dst-host=cdn.wi-fi.ru
add dst-host=":^connectivitycheck\\.gstatic\\.com"
add dst-host=":^apple\\.com\\.edgekey\\.net"
add dst-host=":^gsp1\\.apple\\.com"
add dst-host=":^www\\.thinkdifferent\\.info"
add dst-host=212.188.7.247
add dst-host=":^ad\\.adriver\\.ru" server=hotspot1
add dst-host=creative.wi-fi.ru
add dst-host=*.static.wi-fi.ru
add dst-host=static*.wi-fi.ru
add dst-host=ar.tns-counter.ru
add dst-host=dev-auth.wi-fi.ru
add dst-host=esia.gosuslugi.ru
add dst-host=banners.adfox.ru
add dst-host=matchid.adfox.yandex.ru
add dst-host=cstream.wi-fi.ru
/ip hotspot walled-garden ip
add action=accept disabled=no dst-host=login.wi-fi.ru server=hotspot1
add action=accept disabled=no dst-address=10.1.0.210 dst-port=2812-2813 \
    protocol=udp server=hotspot1
add action=accept disabled=no dst-address=10.1.1.10 server=hotspot1
add action=accept disabled=no dst-address=10.1.1.11 server=hotspot1
add action=accept disabled=no dst-address=173.194.32.0/24
add action=accept disabled=no dst-address=212.188.7.0/24
/ip ipsec peer
add address=91.220.120.125/32 enc-algorithm=3des hash-algorithm=md5 lifetime=\
    8h local-address=92.38.32.95 secret=MaximA2013
/ip ipsec policy
set 0 disabled=yes
add dst-address=10.0.0.0/8 level=unique proposal=MT sa-dst-address=\
    91.220.120.125 sa-src-address=92.38.32.95 src-address=172.16.200.16/32 \
    tunnel=yes
/ip route
add distance=3 gateway=92.38.32.1
/ip service
set telnet disabled=yes
set ssh port=6589
/ip upnp
set allow-disable-external-interface=yes enabled=yes
/ppp secret
add local-address=192.168.5.1 name=test password=test profile=\
    default-encryption remote-address=192.168.5.2 service=sstp
/radius
add accounting-port=2813 address=10.1.0.210 authentication-port=2812 secret=\
    ****** service=hotspot src-address=172.16.200.16 timeout=3s
/snmp
set enabled=yes
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system identity
set name=NOVIKOV
/system logging
add topics=radius
add topics=hotspot
/system ntp client
set enabled=yes primary-ntp=91.226.136.155 secondary-ntp=198.60.73.8
/system routerboard settings
set cpu-frequency=850MHz protected-routerboot=disabled
/tool graphing interface
add
add interface=HotSpot
add
/tool graphing resource
add
add