# 2025-05-28 18:25:11 by RouterOS 7.18
# software id = TLQZ-WEZB
#
# model = RB3011UiAS
# serial number = HF209FGWVQT
/interface bridge
add admin-mac=78:9A:18:56:DD:91 arp=proxy-arp auto-mac=no comment=defconf name=bridge port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] arp=proxy-arp comment=WAN
set [ find default-name=ether2 ] comment="Kraso PC - VLAN10"
set [ find default-name=ether3 ] comment="Server 1 - VLAN20"
set [ find default-name=ether4 ] comment="Server 2 - VLAN20"
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=ether6 ] disabled=yes
set [ find default-name=ether7 ] disabled=yes
set [ find default-name=ether8 ] comment="Mercusys AP"
set [ find default-name=ether9 ] comment=IMM
set [ find default-name=ether10 ] poe-out=off
set [ find default-name=sfp1 ] disabled=yes
/interface vlan
add comment="VLAN Pro klienty" interface=bridge name=vlan10 vlan-id=10
add comment="VLAN Pro servery" interface=bridge name=vlan20 vlan-id=20
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment="List v\9Aech vlan\F9" name=VLANy
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=vlan20 ranges=192.168.20.2-192.168.20.254
add name=vlan10 ranges=192.168.10.2-192.168.10.249
add name=vlan10-vpn ranges=192.168.10.251-192.168.10.254
/ip dhcp-server
add address-pool=vlan20 interface=vlan20 lease-time=10m name=dhcp-servery
add address-pool=vlan10 interface=vlan10 lease-time=10m name=dhcp-klienti
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
/ppp profile
add bridge=bridge dns-server=192.168.10.1,1.1.1.1 interface-list=LAN local-address=192.168.10.250 name=ovpn remote-address=vlan10-vpn use-encryption=yes use-ipv6=no
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=yes name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/routing table
add disabled=no fib name=to-mk
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2 internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3 internal-path-cost=10 path-cost=10 pvid=20
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4 internal-path-cost=10 path-cost=10 pvid=20
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5 internal-path-cost=10 path-cost=10 pvid=20
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8 internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1 internal-path-cost=10 path-cost=10
add bridge=bridge ingress-filtering=no interface=ether9 internal-path-cost=10 path-cost=10 pvid=20
add bridge=bridge interface=ether10 pvid=20
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192 soft-max-neighbor-entries=8191
/interface bridge vlan
add bridge=bridge tagged=bridge untagged=ether3,ether4,ether5,ether9,ether10 vlan-ids=20
add bridge=bridge tagged=bridge untagged=ether2,ether8 vlan-ids=10
/interface l2tp-server server
set authentication=mschap1,mschap2 default-profile=ovpn max-mru=1400 max-mtu=1400 max-sessions=3 use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=vlan10 list=VLANy
add interface=vlan20 list=VLANy
/interface ovpn-server server
add auth=sha1,md5 certificate=server cipher=blowfish128,aes128-cbc,aes192-cbc,aes256-cbc default-profile=ovpn disabled=no mac-address=FE:D7:E9:78:D6:9E name=\
    ovpn-server1 require-client-certificate=yes
/ip address
add address=192.168.20.1/24 comment="Gateway pro servery" interface=vlan20 network=192.168.20.0
add address=192.168.10.1/24 comment="Gateway pro klienty" interface=vlan10 network=192.168.10.0
add address=192.168.10.250 comment="Gateway pro VPN" interface=vlan10 network=192.168.10.0
add address=192.168.88.1 disabled=yes interface=ether8 network=192.168.88.0
add address=111.111.111.193/28 interface=ether1 network=111.111.111.192
/ip cloud
set ddns-update-interval=1m
/ip dhcp-client
add comment=defconf interface=ether1
add add-default-route=no disabled=yes interface=ether9 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=192.168.10.3 client-id=1:0:eb:d8:34:34:df mac-address=00:EB:D8:34:34:DF server=dhcp-klienti
add address=192.168.20.4 client-id=ff:e9:bb:23:7b:0:1:0:1:2f:4d:28:ef:40:f2:e9:bb:23:7b mac-address=40:F2:E9:BB:23:7B server=dhcp-servery
add address=192.168.20.2 client-id=ff:41:ec:62:e8:0:2:0:0:ab:11:c6:d9:44:7f:2:9a:98:44 mac-address=C2:CD:76:E7:E8:45 server=dhcp-servery
add address=192.168.10.248 client-id=1:84:47:9:f:dc:94 mac-address=84:47:09:0F:DC:94 server=dhcp-klienti
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=192.168.20.1,1.1.1.1 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=192.168.20.1,1.1.1.1 gateway=192.168.20.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall address-list
<truncated>
add list=Attempt
/ip firewall filter
add action=accept chain=input dst-address=111.111.111.193
add action=accept chain=input comment="Override, allow bonin ALL" src-address-list=BoninVerified
add action=accept chain=input comment="Allow openVPN" port=1194 protocol=tcp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="allow ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="Allow DNS requests to router" dst-port=53 in-interface-list=VLANy protocol=udp
add action=accept chain=forward comment="Allow returns from VLAN20 -> VLAN10" connection-state=established,related in-interface=vlan20 out-interface=vlan10
add action=accept chain=forward comment="Allow VLAN10 -> VLAN20" connection-state=new in-interface=vlan10 out-interface=vlan20
add action=drop chain=forward comment="Drop VLAN20 -> VLAN10" in-interface=vlan20 out-interface=vlan10
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes out-interface-list=WAN
add action=dst-nat chain=dstnat comment="NAT SSH FOR SERVER" dst-port=2222 in-interface=ether1 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.20.2 to-ports=\
    22
add action=dst-nat chain=dstnat comment="NAT SSH FOR SERVER2" dst-port=2223 in-interface=ether1 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.20.4 \
    to-ports=22
add action=dst-nat chain=dstnat comment="NAT HTTP FOR SERVER - CERT VALIDATION" dst-port=80 in-interface=ether1 protocol=tcp src-address=0.0.0.0/0 to-addresses=\
    192.168.20.4 to-ports=80
add action=dst-nat chain=dstnat comment="NAT WINGS API FOR SERVER" dst-port=6954 in-interface-list=WAN protocol=tcp to-addresses=192.168.20.2 to-ports=6954
add action=dst-nat chain=dstnat comment="NAT WINGS SFTP FOR SERVER" dst-port=4789 in-interface-list=WAN protocol=tcp to-addresses=192.168.20.2 to-ports=4789
add action=dst-nat chain=dstnat comment="NAT GAME RANGE FOR SERVER - TCP" dst-port=7777-8000 in-interface=ether1 protocol=tcp src-address=0.0.0.0/0 to-addresses=\
    192.168.20.2 to-ports=7777-8000
add action=dst-nat chain=dstnat comment="NAT GAME RANGE FOR SERVER - UDP" dst-port=7777-8000 in-interface=ether1 protocol=udp to-addresses=192.168.20.2 to-ports=\
    7777-8000
add action=add-src-to-address-list address-list=Attempt address-list-timeout=none-dynamic chain=dstnat comment="NAT ARMA RANGE FOR SERVER - UDP LOG" dst-port=\
    2302-2306 in-interface=ether1 protocol=udp
add action=dst-nat chain=dstnat comment="NAT ARMA RANGE FOR SERVER - UDP" dst-port=2302-2306 in-interface=ether1 protocol=udp to-addresses=192.168.20.2 to-ports=\
    2302-2306
add action=dst-nat chain=dstnat comment="NAT ARMA RANGE FOR SERVER - TCP" dst-port=2302-2306 in-interface=ether1 protocol=tcp to-addresses=192.168.20.2 to-ports=\
    2302-2306
add action=dst-nat chain=dstnat comment="NAT BMC TO ALLOW LIST " disabled=yes dst-port=65501 in-interface=ether1 protocol=tcp src-address-list=BoninVerified \
    to-addresses=192.168.88.251 to-ports=443
add action=dst-nat chain=dstnat comment="NAT BMC TO ALLOW LIST " disabled=yes dst-port=65500 in-interface=ether1 protocol=tcp src-address-list=BoninVerified \
    to-addresses=192.168.20.3 to-ports=443
add action=dst-nat chain=dstnat disabled=yes dst-port=9090 protocol=tcp src-address-list=BoninVerified to-addresses=192.168.20.2 to-ports=9090
add action=dst-nat chain=dstnat comment="NAT WINGS API FOR SERVER2" dst-port=5454 in-interface-list=WAN protocol=tcp to-addresses=192.168.20.4 to-ports=5454
add action=dst-nat chain=dstnat comment="NAT WINGS SFTP FOR SERVER2" dst-port=2443 in-interface-list=WAN protocol=tcp to-addresses=192.168.20.4 to-ports=2443
add action=src-nat chain=srcnat dst-address=10.192.2.151 protocol=tcp src-address-list=BoninVerified to-addresses=10.192.2.1
add action=dst-nat chain=dstnat dst-port=65531 in-interface=ether1 protocol=tcp src-address=109.164.34.126 to-addresses=10.192.2.151 to-ports=3211
add action=dst-nat chain=dstnat dst-port=3389 in-interface-list=WAN protocol=tcp to-addresses=192.168.10.248 to-ports=3389
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=no dst-address=192.168.1.1/32 gateway=ether9
add disabled=no dst-address=0.0.0.0/0 gateway=172.16.200.67 routing-table=to-mk suppress-hw-offload=no
/ip service
set www port=8080
set www-ssl certificate=HTTPS disabled=no
set winbox port=65530
/ip smb shares
set [ find default=yes ] directory=/pub
/ip ssh
set forwarding-enabled=both strong-crypto=yes
/lcd
set time-interval=daily
/lcd pin
set pin-number=7658
/ppp secret
add local-address=192.168.10.250 name=bonin routes="192.168.10.0/24, 192.168.20.0/24" service=ovpn
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing rule
add action=lookup disabled=no dst-address=111.111.111.192/28 table=to-mk
add action=lookup disabled=no src-address=111.111.111.192/28 table=to-mk
/system clock
set time-zone-name=Europe/Bratislava
/system identity
set name=R01_GameCore
/system logging
add disabled=yes topics=ppp,debug
add topics=ovpn,debug
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=132.163.96.2
/tool graphing interface
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool mac-server ping
set enabled=no