1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
| # jul/05/2022 18:13:49 by RouterOS 7.3.1
# software id = **************
#
# model = RB4011iGS+
# serial number = *******************
/interface bridge
add arp=proxy-arp name=lan
/interface bridge
add name=wan
/interface vlan
add interface=wan loop-protect=off name=vlan6-wan vlan-id=6
/interface list
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.2.10-192.168.2.127
add name=vpn ranges=192.168.2.128-192.168.2.168
/ip dhcp-server
add address-pool=dhcp interface=lan name=dhcp-lan
/ipv6 dhcp-server
add address-pool=wan6 interface=lan name=dhcp-v6
/port
set 0 name=serial0
set 1 name=serial1
/ppp profile
set *0 dhcpv6-pd-pool=wan6 local-address=192.168.2.254 remote-address=vpn \
remote-ipv6-prefix-pool=wan6
add name=default-wan6
set *FFFFFFFE dhcpv6-pd-pool=wan6 local-address=192.168.2.254 remote-address=\
vpn remote-ipv6-prefix-pool=wan6
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan6-wan max-mru=1500 \
max-mtu=1500 name=pppoe-wan profile=default-wan6 user=************
/interface bridge port
add bridge=lan interface=ether2
add bridge=lan interface=ether3
add bridge=lan interface=ether4
add bridge=lan interface=ether5
add bridge=lan interface=ether6
add bridge=lan interface=ether7
add bridge=lan interface=ether8
add bridge=lan interface=ether9
add bridge=lan interface=ether10
/interface bridge port
add bridge=wan interface=ether1
add bridge=wan interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set enabled=yes use-ipsec=required
/interface list member
add interface=lan list=LAN
add interface=pppoe-wan list=WAN
/interface ovpn-server server
set default-profile=default-encryption enabled=yes
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead
set authentication=pap,chap,mschap1,mschap2 enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes port=444
/ip address
add address=192.168.2.254/24 interface=ether2 network=192.168.2.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=wan interface=wan
/ip dhcp-server lease
add address=192.168.2.253 client-id=1:2c:c8:1b:98:d4:a9 mac-address=\
2C:C8:1B:98:D4:A9 server=dhcp-lan
add address=192.168.2.250 client-id=1:68:d7:9a:cc:2e:e8 mac-address=\
68:D7:9A:CC:2E:E8 server=dhcp-lan
add address=192.168.2.251 client-id=1:68:d7:9a:cc:2f:18 mac-address=\
68:D7:9A:CC:2F:18 server=dhcp-lan
add address=192.168.2.1 client-id=1:0:24:9b:18:80:61 mac-address=\
00:24:9B:18:80:61 server=dhcp-lan
add address=192.168.2.252 mac-address=********************** server=dhcp-lan
add address=192.168.2.200 mac-address=********************** server=dhcp-lan
/ip dhcp-server network
add address=192.168.2.0/24 domain=local gateway=192.168.2.254 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.2.254 name=lan
add address=192.168.2.253 comment="automatic-from-dhcp (magic comment)" name=\
*****************.local ttl=15m
add address=192.168.2.250 comment="automatic-from-dhcp (magic comment)" name=\
*****************.local ttl=15m
add address=192.168.2.251 comment="automatic-from-dhcp (magic comment)" name=\
*****************.local ttl=15m
add address=192.168.2.1 comment="automatic-from-dhcp (magic comment)" name=\
*****************.local ttl=15m
add address=192.168.2.21 comment="automatic-from-dhcp (magic comment)" name=\
*****************.local ttl=15m
add address=192.168.2.252 name=**********.nl
add address=192.168.2.252 name=**********.nl
add address=192.168.2.252 name=**********.nl
add address=192.168.2.252 name=**********.nl
add address=192.168.2.252 name=**********.nl
/ip firewall filter
add action=accept chain=input comment="establised, related" connection-state=\
established,related
add action=accept chain=input comment=icmp protocol=icmp
add action=accept chain=input comment=ipsec dst-port=4500,500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input protocol=ipsec-ah
add action=accept chain=input protocol=l2tp
add action=accept chain=input protocol=gre
add action=accept chain=input comment=l2tp dst-port=1701 protocol=udp
add action=accept chain=input comment=pptp dst-port=1723 protocol=tcp
add action=accept chain=input comment=sstp dst-port=444 protocol=tcp
add action=accept chain=input comment="all from lan" in-interface-list=LAN
add action=accept chain=input comment="all from lan" in-interface-list=LAN
add action=accept chain=input dst-address=255.255.255.255
add action=fasttrack-connection chain=forward comment="established, related" \
connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment="established, related" \
connection-state=established,related
add action=accept chain=forward comment="all from lan" in-interface-list=LAN
add action=accept chain=forward comment="all from lan" disabled=yes \
out-interface-list=LAN
add action=accept chain=forward comment=wan disabled=yes out-interface-list=\
WAN
add action=accept chain=forward comment=dstnat connection-nat-state=dstnat
add action=accept chain=forward disabled=yes dst-port=\
80,443,545,902,9443,18914,27015,34197,62222,62223 in-interface-list=WAN \
out-interface-list=LAN protocol=tcp
add action=accept chain=forward disabled=yes dst-port=\
80,443,545,902,9443,18914,27015,34197,62222,62223 in-interface-list=WAN \
out-interface-list=LAN protocol=udp
add action=accept chain=output
add action=drop chain=input comment="drop all" log-prefix=BLOCK4I
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all" log-prefix=BLOCK4F
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=\
80,443,545,902,9443,18914,27015,34197,62223 in-interface-list=WAN \
protocol=tcp to-addresses=192.168.2.252
add action=dst-nat chain=dstnat dst-port=\
80,443,545,902,9443,18914,27015,34197,62223 in-interface-list=WAN \
protocol=udp to-addresses=192.168.2.252
add action=dst-nat chain=dstnat dst-port=62222 in-interface-list=WAN \
protocol=tcp to-addresses=192.168.2.252 to-ports=22
add action=dst-nat chain=dstnat dst-port=62222 in-interface-list=WAN \
protocol=udp to-addresses=192.168.2.252 to-ports=22
add action=masquerade chain=srcnat comment=masquerade ipsec-policy=out,none \
out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
192.168.2.0/24
add action=dst-nat chain=dstnat dst-address=89.32.241.159 dst-port=\
80,443,545,902,9443,18914,27015,34197,62222,62223 protocol=tcp \
to-addresses=192.168.2.252
/ipv6 address
add address=::1 from-pool=wan6 interface=lan
/ipv6 dhcp-client
add add-default-route=yes interface=pppoe-wan pool-name=wan6 \
pool-prefix-length=56 prefix-hint=::/56 request=address,prefix
/ipv6 firewall filter
add action=accept chain=input connection-state=established
add action=accept chain=input protocol=icmpv6
add action=accept chain=input comment=ipsec dst-port=4500,500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input protocol=ipsec-ah
add action=accept chain=input protocol=gre
add action=accept chain=input comment=l2tp dst-port=1701 protocol=udp
add action=accept chain=input comment=pptp dst-port=1723 protocol=tcp
add action=accept chain=input comment=sstp dst-port=444 protocol=tcp
add action=accept chain=input comment=dhcpv6 dst-port=546 protocol=udp
add action=accept chain=input comment="all from lan" in-interface-list=LAN
add action=accept chain=input comment="all from lan" in-interface-list=LAN
add action=accept chain=forward comment="all from lan" in-interface-list=LAN
add action=accept chain=forward protocol=icmpv6
add action=accept chain=forward comment="established, related" \
connection-state=established,related
add action=accept chain=forward comment=wan out-interface-list=WAN
add action=accept chain=forward dst-port=\
80,443,545,902,9443,18914,27015,34197,62222,62223 in-interface-list=WAN \
out-interface-list=LAN protocol=udp src-port=""
add action=accept chain=forward dst-port=\
80,443,545,902,9443,18914,27015,34197,62222,62223 in-interface-list=WAN \
out-interface-list=LAN protocol=tcp src-port=""
add action=accept chain=output comment="accept all"
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=input log-prefix=BLOCK6i
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all" log-prefix=BLOCK6F
/ipv6 firewall nat
add action=dst-nat chain=dstnat dst-port=62222 protocol=tcp to-ports=22
/ipv6 nd
add advertise-mac-address=no interface=lan other-configuration=yes
/ppp secret
add name=vpn
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=router
/system scheduler
add interval=30s name="DNS update" on-event="# SPDX-License-Identifier: CC0-1.\
0\r\
\n\r\
\n:local dnsttl \"15m\"\r\
\n\r\
\n:local magiccomment \"automatic-from-dhcp (magic comment)\"\r\
\n:local activehosts [:toarray \"\"]\r\
\n\r\
\n:foreach lease in [/ip dhcp-server lease find] do={\r\
\n :local hostname [/ip dhcp-server lease get value-name=host-name \$leas\
e]\r\
\n :local hostaddr [/ip dhcp-server lease get value-name=address \$lease]\
\r\
\n\r\
\n :if ([:len \$hostname] > 0) do={\r\
\n :local regdomain \"\$hostname.local\"\r\
\n :set activehosts (\$activehosts, \$regdomain)\r\
\n\r\
\n :if ([:len [/ip dns static find where name=\$regdomain]] = 0) do={\r\
\n /ip dns static add name=\$regdomain address=\$hostaddr comment=\$m\
agiccomment ttl=\$dnsttl\r\
\n } else={\r\
\n :if ([:len [/ip dns static find where name=\$regdomain comment=\$m\
agiccomment]] = 1) do={\r\
\n /ip dns static set address=\$hostaddr [/ip dns static find name=\
\$regdomain comment=\$magiccomment]\r\
\n }\r\
\n }\r\
\n }\r\
\n}\r\
\n\r\
\n:foreach dnsentry in [/ip dns static find where comment=\$magiccomment] \
do={\r\
\n :local hostname [/ip dns static get value-name=name \$dnsentry]\r\
\n :if ([:type [:find \$activehosts \$hostname]] = \"nil\") do={\r\
\n /ip dns static remove \$dnsentry\r\
\n }\r\
\n}\r\
\n" policy=read,write,test start-time=startup
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-interface=wan memory-limit=1000KiB |