# nov/23/2020 13:59:33 by RouterOS 6.44.6
# software id = Y0YF-5FGH
#
# model = 2011UiAS
# serial number = 4CA904B4A19C
/interface bridge
add fast-forward=no name=loopback
/interface ethernet
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] comment=RT speed=100Mbps
set [ find default-name=ether3 ] comment=RT_SIP speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=LAN
set [ find default-name=ether7 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether8 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether9 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether10 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface pptp-client
add connect-to=195.151.255.45 mrru=1600 name=vpn1 user=office_spaceport
add connect-to=88.200.151.210 mrru=1600 name=vpn2 user=office_spaceport
/interface vlan
add disabled=yes interface=ether10 name=Vlan667 vlan-id=667
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=pool1 ranges=192.168.84.100-192.168.84.140
/ip dhcp-server
add address-pool=pool1 authoritative=after-2sec-delay bootp-support=none \
    interface=ether6 lease-time=3d name=server1
/ppp profile
add name=profile1 use-encryption=required
/interface ovpn-client
add auth=md5 certificate=cert_export_office-remote.crt_0 cipher=aes192 \
    connect-to=********** mac-address=02:0C:E6:65:26:6C name=ovpn-mk-0 \
    profile=default-encryption user=office_84
add auth=md5 certificate=cert_export_remote-office-85.crt_0 cipher=aes192 \
    connect-to=************** disabled=yes mac-address=02:0C:E6:65:26:6C name=\
    ovpn-mk-85 profile=default-encryption user=office_spaceport
add auth=md5 certificate=cert_export_office-remote.crt_0 cipher=aes192 \
    connect-to=************** disabled=yes mac-address=02:0C:E6:65:26:6C \
    name=ovpn-mk97 profile=default-encryption user=office_spaceport
/routing ospf area
set [ find default=yes ] disabled=yes
/routing ospf instance
set [ find default=yes ] disabled=yes router-id=10.255.255.84
/snmp community
set [ find default=yes ] addresses=10.0.0.0/8
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100

/ip address
add address=192.168.84.1/24 interface=ether6 network=192.168.84.0
add address=1.1.1.198/30 interface=ether2 network=1.1.1.196
add address=10.255.255.84 interface=loopback network=10.255.255.84
add address=2.2.2.146/25 interface=ether3 network=2.2.2.128
add address=10.84.9.1/24 interface=ether9 network=10.84.9.0
add address=10.84.10.1/24 interface=ether10 network=10.84.10.0

/ip dhcp-server network
add address=192.168.84.0/24 dns-server=10.20.0.3,10.40.0.130 gateway=\
    192.168.84.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.0.0/16 list=LAN
add address=192.168.87.0/24 list=KB_87
add address=172.0.0.0/8 list=LAN
add address=10.10.10.0/24 list=LAN
add address=10.20.0.0/16 list=LAN
add address=10.84.0.0/16 list=LAN

/ip firewall filter
add action=drop chain=input comment=BLACK_LIST src-address-list=BLACK_LIST
add action=drop chain=output comment=BLACK_LIST src-address-list=BLACK_LIST
add action=drop chain=forward comment=BLACK_LIST src-address-list=BLACK_LIST
add action=add-src-to-address-list address-list=BAN_LIST \
    address-list-timeout=1d chain=input comment="Drop incoming DNS requests" \
    dst-port=53 protocol=udp src-address-list=!LAN
add action=drop chain=input comment="DROP BAN LIST" src-address-list=BAN_LIST
add action=accept chain=input comment=TRUST src-address-list=TRUST
add action=accept chain=input comment=LAN src-address-list=LAN
add action=accept chain=forward
add action=accept chain=output
add action=accept chain=input comment=Established connection-state=\
    established
add action=accept chain=input comment=Established connection-state=related
add action=drop chain=input comment=Established disabled=yes

/ip firewall nat
add action=masquerade chain=srcnat comment=RT_SIP dst-address=95.84.225.100 \
    out-interface=ether3 src-address=192.168.84.245
add action=dst-nat chain=dstnat comment=RT_SIP dst-address=37.204.176.146 \
    to-addresses=192.168.84.245
add action=masquerade chain=srcnat comment="Work time 08:00 - 22:00" \
    dst-address-list=!LAN src-address-list=LAN time=\
    8h-21h59m59s,sun,mon,tue,wed,thu,fri,sat
add action=dst-nat chain=dstnat disabled=yes dst-port=80 in-interface=*E \
    protocol=tcp src-address=195.144.29.9 src-address-list=TRUST \
    to-addresses=192.168.87.10 to-ports=80

/ip firewall service-port
set sip disabled=yes
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0

/ip route
add distance=1 gateway=1.1.1.197
add distance=1 dst-address=95.84.225.100/32 gateway=2.2.2.129

/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.84.0/24
set ssh disabled=yes
set api address=**** disabled=yes
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/lcd
set default-screen=informative-slideshow read-only-mode=yes
/routing ospf network
add area=backbone disabled=yes network=172.31.1.1/32
add area=backbone disabled=yes network=192.168.84.0/24
add area=backbone disabled=yes network=172.31.0.1/32
/routing rip interface
add authentication=simple key-chain=kb receive=v2
/routing rip keys
add chain=kb from-date=jun/27/2017 key=*********** key-id=0 to-date=forever
/routing rip neighbor
add address=172.31.1.1
/routing rip network
add network=192.168.84.0/24
add network=10.84.0.0/16
/snmp
set contact="CosmoRouter" enabled=yes
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system identity
set name=KB_84
/system logging
add prefix=OVPN topics=ovpn
/system ntp client
set enabled=yes primary-ntp=78.140.251.2 secondary-ntp=195.3.254.2
/system package update
set channel=long-term
/system scheduler
add interval=1d name=schedule1 on-event=backup policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    oct/01/2015 start-time=08:01:30

/tool netwatch
add disabled=yes down-script="/interface pptp-client disable vpn1\r\
    \n/interface pptp-client enable vpn2\r\
    \n" host=195.151.255.45 interval=30s up-script="/interface pptp-client dis\
    able vpn2\r\
    \n/interface pptp-client enable vpn1\r\
    \n"
/tool romon port
add