213

 export compact
# nov/18/2016 16:44:09 by RouterOS 6.37.1
# software id = SA10-W5I5
#
/interface bridge
add name=bridge2
/interface ethernet
set [ find default-name=ether1 ] comment=Wan name=Wan-ISP
set [ find default-name=ether2 ] comment=Local
/ip neighbor discovery
set Wan-ISP comment=Wan discover=no
set ether2 comment=Local
set ether3 discover=no
set ether4 discover=no
set ether5 discover=no
set bridge2 discover=no
/interface vlan
add comment=VoIP interface=ether3 name=vlan4 vlan-id=4
/ip neighbor discovery
set vlan4 comment=VoIP discover=no
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,3des
/ip pool
add name=dhcp_pool1 ranges=172.16.2.30-172.16.2.254
add name=dhcp_pool2 ranges=172.16.3.30-172.16.3.254
add name=dhcp_pool3 ranges=172.16.4.30-172.16.4.254
add name=dhcp_pool4 ranges=172.16.5.30-172.16.5.254
add name=L2TPServer ranges=172.16.6.1-172.16.6.30
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=ether2 lease-time=3d name=\
    dhcp1
add address-pool=dhcp_pool2 disabled=no interface=ether3 lease-time=3d name=\
    dhcp2
add address-pool=dhcp_pool3 disabled=no interface=bridge2 lease-time=3d name=\
    dhcp3
add address-pool=dhcp_pool4 disabled=no interface=ether5 lease-time=3d name=\
    dhcp4
/ppp profile
add local-address=L2TPServer name=L2TP remote-address=L2TPServer
/queue tree
add disabled=yes max-limit=9500k name=in parent=global
add disabled=yes max-limit=9500k name=def-in packet-mark=def_in parent=in
add disabled=yes limit-at=1M max-limit=2M name=voip-in packet-mark=voip_in \
    parent=in priority=1
add disabled=yes max-limit=9500k name=out parent=global
add disabled=yes max-limit=9500k name=def-out packet-mark=def_out parent=out
add disabled=yes limit-at=1M max-limit=2M name=voip-out packet-mark=voip_out \
    parent=out priority=1
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge port
add bridge=bridge2 interface=vlan4
add bridge=bridge2 interface=ether4
/interface l2tp-server server
set authentication=mschap2 ipsec-secret=********* use-ipsec=yes
/interface pptp-server server
set enabled=yes
/ip address
add address=172.16.2.1/24 interface=ether2 network=172.16.2.0
add address=172.16.3.1/24 interface=ether3 network=172.16.3.0
add address=172.16.4.1/24 interface=vlan4 network=172.16.4.0
add address=172.16.5.1/24 interface=ether5 network=172.16.5.0
add address=************ interface=Wan-ISP network=***********
/ip dhcp-server network
add address=172.16.2.0/24 dns-server=172.16.3.2,8.8.8.8 gateway=172.16.2.1
add address=172.16.3.0/24 dns-server=172.16.3.2,172.16.3.1 gateway=172.16.3.1
add address=172.16.4.0/24 dns-server=172.16.3.2,172.16.3.1 gateway=172.16.4.1
add address=172.16.5.0/24 dns-server=172.16.3.2,172.16.3.1 gateway=172.16.5.1
/ip dns
set allow-remote-requests=yes servers=************,***************
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=Wan-ISP protocol=udp
add action=accept chain=input comment="Allow Ping" protocol=icmp
add action=accept chain=forward protocol=icmp
add action=accept chain=forward comment=Terminal disabled=yes dst-port=6984 \
    protocol=tcp
add action=accept chain=input comment="Accept established connections" \
    connection-state=established
add action=accept chain=forward connection-state=established
add action=accept chain=input comment="Accept related connections" \
    connection-state=related
add action=accept chain=forward connection-state=related
add action=accept chain=input comment=PPPTP dst-address=************* \
    dst-port=1723 in-interface=Wan-ISP protocol=tcp
add action=drop chain=input comment="Drop invalid connections" \
    connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=accept chain=input comment="Allow UDP" protocol=udp
add action=accept chain=forward protocol=udp
add chain=input comment="Allow IKE" dst-port=500 protocol=udp
add chain=input comment="Allow IPSec-esp" protocol=ipsec-esp
add chain=input comment="Allow IPSec-ah" protocol=ipsec-ah
/ip firewall mangle
add action=mark-packet chain=forward new-packet-mark=def_out passthrough=yes \
    src-address=172.16.2.0/24
add action=mark-packet chain=forward dst-address=172.16.2.0/24 new-packet-mark=\
    def_in passthrough=yes
add action=mark-packet chain=forward new-packet-mark=voip_out src-address=\
    172.16.4.2
add action=mark-packet chain=forward dst-address=172.16.4.2 new-packet-mark=\
    voip_in
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.1.0/24 src-address=\
    172.16.2.0/24
add action=dst-nat chain=dstnat disabled=yes dst-port=6984 in-interface=Wan-ISP \
    protocol=tcp to-addresses=172.16.3.3 to-ports=3389
add action=masquerade chain=srcnat out-interface=Wan-ISP
add action=redirect chain=dstnat dst-port=7777 in-interface=Wan-ISP protocol=\
    tcp to-ports=80
/ip ipsec peer
add address=****************** dh-group=modp1536 exchange-mode=main-l2tp \
    generate-policy=port-override passive=yes secret=**************
/ip route
add distance=1 gateway=***************
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add local-address=172.16.2.1 name=Wizart password=*************** remote-address=\
    172.16.2.3 service=pptp
/system clock
set time-zone-name=Europe/Moscow
/tool mac-server
set [ find default=yes ] disabled=yes
add
add interface=ether2
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2