# dec/17/2020 13:44:48 by RouterOS 6.47.8
# software id =
#
# model = CCR1036-12G-4S
# serial number = ************
/interface bridge
add comment=LAN name=bridge1-LAN
/interface ethernet
set [ find default-name=ether1 ] comment=INET-MEG-REZERV
set [ find default-name=ether2 ] comment=INET-TTK
/interface list
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=172.115.0.2-172.115.255.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge1-LAN name=dhcp1
/interface bridge port
add bridge=bridge1-LAN interface=ether5
add bridge=bridge1-LAN interface=ether6
add bridge=bridge1-LAN interface=ether7
add bridge=bridge1-LAN interface=ether8
/interface list member
add interface=ether1 list=WAN
add interface=bridge1-LAN list=LAN
add interface=ether2 list=WAN
/ip address
add address=172.115.0.1/16 comment=LAN interface=bridge1-LAN network=\
    172.115.0.0
add address=188.170.**7.158/30 comment=INET-MEG-REZERV interface=ether1 \
    network=188.170.**7.156
add address=80.92.*5.26/24 comment=INET-TTK interface=ether2 network=80.92.*5.0
/ip dhcp-server network
add address=172.115.0.0/16 gateway=172.115.0.1
/ip dns
set servers=8.8.8.8
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept L2TP/IPSec" dst-port=\
    500,4500,1701 protocol=udp
add action=accept chain=input comment="defconf: accept IPSec-ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-packet chain=forward comment="mark http/s" new-packet-mark=\
    http/s passthrough=yes port=80,443 protocol=tcp
add action=mark-routing chain=prerouting comment="mark isp1" in-interface-list=\
    LAN new-routing-mark=isp1 passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:3/0
add action=mark-routing chain=prerouting comment="mark isp2" in-interface-list=\
    LAN new-routing-mark=isp2 passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:3/1
add action=mark-routing chain=prerouting comment="mark isp3" in-interface-list=\
    LAN new-routing-mark=isp3 passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:3/2
add action=mark-routing chain=output new-routing-mark=isp2 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
    out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address=80.92.*5.26 dst-port=80,8080,443 \
    protocol=tcp to-addresses=172.115.255.253
add action=masquerade chain=srcnat dst-address=172.115.255.253 dst-port=\
    80,8080,443 protocol=tcp src-address=172.115.0.0/16
/ip route
add check-gateway=ping distance=1 gateway=77.88.8.1 routing-mark=isp1
add check-gateway=ping distance=2 gateway=77.88.8.2 routing-mark=isp1
add check-gateway=ping distance=3 gateway=77.88.8.3 routing-mark=isp1
add check-gateway=ping distance=1 gateway=77.88.8.2 routing-mark=isp2
add check-gateway=ping distance=2 gateway=77.88.8.1 routing-mark=isp2
add check-gateway=ping distance=3 gateway=77.88.8.3 routing-mark=isp2
add distance=1 dst-address=172.115.0.0/16 gateway=bridge1-LAN pref-src=\
    172.115.0.1 routing-mark=isp2 scope=10
add check-gateway=ping disabled=yes distance=1 gateway=77.88.8.3 routing-mark=\
    isp3
add check-gateway=ping disabled=yes distance=2 gateway=77.88.8.2 routing-mark=\
    isp3
add check-gateway=ping disabled=yes distance=3 gateway=77.88.8.1 routing-mark=\
    isp3
add check-gateway=ping distance=1 gateway=188.170.**7.157
add distance=1 gateway=bridge1-LAN
add check-gateway=ping distance=1 gateway=80.92.*5.1
add check-gateway=ping distance=1 dst-address=77.88.8.1/32 gateway=\
    188.170.**7.157 scope=9
add check-gateway=ping distance=1 dst-address=77.88.8.2/32 gateway=80.92.*5.1 \
    scope=9
add check-gateway=ping disabled=yes distance=1 dst-address=77.88.8.3/32 \
    gateway=10.0.3.1 scope=9
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=*****
/system ntp client
set enabled=yes primary-ntp=88.147.254.230 secondary-ntp=88.147.254.235