export-09.06.2021

# sep/06/2021 13:17:24 by RouterOS 6.48.3
# software id = d34d-b33f
#
# model = RB760iGS
# serial number = 3.14192
/interface bridge
add admin-mac= auto-mac=no ingress-filtering=yes name=bridge \
    vlan-filtering=yes
/interface ethernet
set [ find default-name=ether5 ] loop-protect=on poe-out=off
set [ find default-name=sfp1 ] disabled=yes
/interface vlan
add interface=bridge name=vlan_cameras vlan-id=30
add interface=bridge name=vlan_guest vlan-id=10
add interface=bridge name=vlan_lan vlan-id=11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-server option
add code=6 name=HollyDNS value="'192.168.1.13''192.168.1.14''192.168.1.1'"
add code=6 name=EverlyDNS value="'192.168.1.14''192.168.1.13''192.168.1.1'"
add code=6 name=LocalDNS value="'192.168.1.1'"
add code=42 name="NTP Server" value="'192.168.1.16'"
/ip kid-control
add fri=6h-22h mon=6h-21h name=Kiddo thu=6h-21h tue=6h-21h wed=6h-21h
/ip pool
add name=pool_lan ranges=192.168.1.100-192.168.1.125
add name=pool_guest ranges=192.168.10.2-192.168.10.14
add name=pool_cameras ranges=192.168.30.2-192.168.30.14
/ip dhcp-server
add address-pool=pool_lan disabled=no interface=vlan_lan name=dhcp_lan
add address-pool=pool_guest disabled=no interface=vlan_guest name=dhcp_guest
add address-pool=pool_cameras disabled=no interface=vlan_cameras name=\
    dhcp_cameras
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether3 pvid=11
add bridge=bridge interface=ether4
add bridge=bridge ingress-filtering=yes interface=ether5 frame-types=admit-only-vlan-tagged
add bridge=bridge disabled=yes interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=ether5,bridge vlan-ids=10
add bridge=bridge tagged=ether5,bridge vlan-ids=30
add bridge=bridge tagged=ether5,bridge vlan-ids=11
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=vlan_cameras list=LAN
add interface=vlan_guest list=LAN
add interface=vlan_lan list=LAN
/ip address
add address=192.168.10.1/25 interface=vlan_guest network=192.168.10.0
add address=192.168.30.1/28 interface=vlan_cameras network=192.168.30.0
add address=192.168.1.1/25 interface=vlan_lan network=192.168.1.0
/ip dhcp-client
add disabled=no interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.1.0/25 dhcp-option=HollyDNS gateway=192.168.1.1 netmask=\
    25
add address=192.168.10.0/28 dns-server=208.67.222.222,208.67.220.220 gateway=\
    192.168.10.1 netmask=28
add address=192.168.30.0/28 gateway=192.168.30.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.1.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="Allow Vlan" in-interface=vlan_lan
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=defcon ipsec-policy=out,none \
    out-interface-list=WAN
/ip kid-control device
add mac-address=C0:8C:71:A7:70:D1 name=Jubilee user=Kiddo
add mac-address=24:4B:FE:8E:6A:2C name="Dunkin Desktop" user=Kiddo
add mac-address=58:B1:0F:BE:CD:24 name=Dunkin-Tablet user=Kiddo
add mac-address=B8:A1:75:DF:34:A9 name="Dunkin Roku" user=Kiddo
add mac-address=DC:FB:48:ED:7C:81 name="Dunkin Chromebook" user=Kiddo
/system clock
set time-zone-name=America/New_York
/system identity
set name=Morehead
/system ntp client
set enabled=yes primary-ntp=192.168.1.16
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN