# software id =
#
# model = CRS125-24G-1S-2HnD
# serial number =
/interface bridge add arp=proxy-arp name=bridge-cam2
/interface bridge add admin-mac=МАК arp=proxy-arp auto-mac=no name=bridge-lan
/interface l2tp-client add allow=mschap2 connect-to=АЙ ПИ АДРЕС disabled=no name=l2tp-tk2 password=ПАРОЛЬ user=ЛОГИН
/interface list add comment=defconf name=WAN
/interface list add comment=defconf name=LAN
/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik
/ip pool add name=dhcp-lan ranges=192.168.2.20-192.168.2.254
/ip pool add name=dhcp-cam ranges=192.168.10.2-192.168.10.254
/ip dhcp-server add add-arp=yes address-pool=dhcp-lan disabled=no interface=bridge-lan lease-time=14w1d name=dhcp-lan
/ip dhcp-server add add-arp=yes address-pool=dhcp-cam disabled=no interface=bridge-cam2 lease-time=1w name=dhcp1
/metarouter add disabled=yes disk-size=48kiB name=mr1
/queue type add kind=pcq name="pcq-download 8M" pcq-classifier=dst-address pcq-rate=8M pcq-total-limit=5000KiB
/queue type add kind=pcq name=pcq-upload-8M pcq-classifier=src-address pcq-rate=8M pcq-total-limit=5000KiB
/queue simple add disabled=yes max-limit=45M/45M name="Internet download/upload limit" queue="pcq-upload-8M/pcq-download 8M" target=192.168.2.0/24
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether2
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether3
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether4
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether5
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether6
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether7
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether8
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether9
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether10
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether11
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether12
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether13
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether14
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether15
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether16
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether17
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether18
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether19
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether20
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether21
/interface bridge port add bridge=bridge-cam2 comment=defconf interface=ether22
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether23
/interface bridge port add bridge=bridge-lan comment=defconf interface=ether24
/interface bridge port add bridge=bridge-lan comment=defconf interface=sfp1
/interface bridge port add bridge=bridge-lan comment=defconf interface=wlan1
/ip neighbor discovery-settings set discover-interface-list=LAN
/interface l2tp-server server set ipsec-secret=СЕКРЕТ use-ipsec=yes
/interface list member add interface=bridge-lan list=LAN
/interface list member add interface=ether1 list=WAN
/interface sstp-server server set default-profile=default-encryption
/ip address add address=192.168.2.1/24 comment=lan interface=ether2 network=192.168.2.0
/ip address add address=192.168.10.1/24 interface=bridge-cam2 network=192.168.10.0
/ip cloud set ddns-update-interval=10m update-time=no
/ip dhcp-client add comment=defconf disabled=no interface=ether1
/ip dhcp-server lease add address=192.168.2.58 client-id=1:МАК mac-address=МАК server=dhcp-lan
/ip dhcp-server network add address=10.0.0.0/24 gateway=10.0.0.1
/ip dhcp-server network add address=192.168.2.0/24 comment=LAN gateway=192.168.2.1
/ip dhcp-server network add address=192.168.10.0/24 comment=CAM gateway=192.168.10.1
/ip dns set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list add address=192.168.10.0/24 list=nat-cam
/ip firewall address-list add address=192.168.2.0/24 list=nat-lan
/ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
/ip firewall filter add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 protocol=udp
/ip firewall filter add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
/ip firewall filter add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
/ip firewall filter add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
/ip firewall filter add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
/ip firewall filter add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
/ip firewall filter add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
/ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
/ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
/ip firewall filter add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
/ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes
/ip firewall filter add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
/ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall filter add chain=forward comment="Permit all PPP" in-interface=ether1
/ip firewall filter add chain=input comment="Permit L2TP" dst-port=1701 protocol=udp
/ip firewall filter add chain=input comment="Permit IPSec ports 500 and 4500" port=500,4500 protocol=udp
/ip firewall filter add chain=input comment="Permit IPSec protocol ipsec-esp" protocol=ipsec-esp
/ip firewall filter add action=accept chain=input comment="Permit GRE" protocol=gre
/ip firewall filter add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp
/ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip route add comment="" distance=1 dst-address=192.168.0.0/24 gateway=172.16.30.1
/ip route add distance=1 dst-address=192.168.3.0/24 gateway=172.16.30.1
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set ssh disabled=yes
/ip service set api disabled=yes
/ip service set api-ssl disabled=yes
/metarouter interface add static-interface=bridge-lan virtual-machine=mr1 vm-mac-address=МАК
/system clock set time-zone-name=Europe/Moscow
/system identity set name=GW2-TK2
/tool graphing interface add interface=bridge-lan
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN