CCR2004 config

# jan/17/2021 09:10:13 by RouterOS 6.48
# software id = 9S4Z-ANEJ
#
# model = CCR2004-1G-12S+2XS
# serial number = D4F0********
/interface bridge
add arp=proxy-arp name=bridge
/interface ethernet
set [ find default-name=sfp-sfpplus9 ] auto-negotiation=no
set [ find default-name=sfp-sfpplus10 ] auto-negotiation=no
set [ find default-name=sfp-sfpplus11 ] auto-negotiation=no
set [ find default-name=sfp-sfpplus12 ] auto-negotiation=no
/interface pppoe-client
add add-default-route=yes disabled=no interface=sfp-sfpplus1 max-mru=1492 \
    max-mtu=1492 name=pppoe-telekom password=******** use-peer-dns=yes user=\
    ********@t-online.hu
/interface bonding
add name=bonding1 slaves=sfp-sfpplus11,sfp-sfpplus12
add name=bonding2 slaves=sfp-sfpplus9,sfp-sfpplus10
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp ranges=192.168.1.10-192.168.1.200
add name=vpn ranges=192.168.89.2-192.168.89.255
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=1d name=dhcp
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge interface=sfp-sfpplus2
add bridge=bridge interface=sfp-sfpplus3
add bridge=bridge interface=sfp-sfpplus4
add bridge=bridge interface=sfp-sfpplus5
add bridge=bridge interface=sfp-sfpplus6
add bridge=bridge interface=sfp-sfpplus7
add bridge=bridge interface=sfp-sfpplus8
add bridge=bridge interface=sfp28-1
add bridge=bridge interface=sfp28-2
add bridge=bridge interface=bonding1
add bridge=bridge interface=bonding2
/interface list member
add interface=pppoe-telekom list=WAN
add interface=bridge list=LAN
/interface pptp-server server
set enabled=yes max-mru=1400 max-mtu=1400
/ip address
add address=192.168.1.2/24 interface=bridge network=192.168.1.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-server lease
add address=192.168.1.220 mac-address=B4:6C:47:6C:2C:87 server=dhcp
add address=192.168.1.100 mac-address=B8:6B:23:53:7F:8E server=dhcp
add address=192.168.1.10 mac-address=E0:63:DA:8F:69:C6 server=dhcp
add address=192.168.1.101 mac-address=68:AB:1E:E0:C6:1C server=dhcp
add address=192.168.1.110 mac-address=80:0A:80:56:9B:9E server=dhcp
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.2 gateway=192.168.1.2 \
    netmask=24
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A # Check if you nee\
    d this subnet before enable it" list=bogons
add address=127.0.0.0/8 comment="Loopback [RFC 3330]" list=bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you \
    need this subnet before enable it" list=bogons
add address=192.168.0.0/16 comment="Private[RFC 1918] - CLASS C # Check if you\
    \_need this subnet before enable it" disabled=yes list=bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=\
    bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons
add address=224.0.0.0/4 comment=\
    "MC, Class D, IANA # Check if you need this subnet before enable it" \
    list=bogons
/ip firewall filter
add action=add-src-to-address-list address-list=Syn_Flooder \
    address-list-timeout=30m chain=input comment=\
    "Add Syn Flood IP to the list" connection-limit=30,32 protocol=tcp \
    src-address=!192.168.0.0/16 tcp-flags=syn
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
    protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=drop chain=input comment="Drop to syn flood list" \
    src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
    address-list-timeout=1w chain=input comment="Port Scanner Detect" \
    protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" \
    src-address-list=Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=\
    ICMP protocol=icmp
add action=jump chain=forward comment="Jump for icmp forward flow" \
    jump-target=ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
    bogons
add action=add-src-to-address-list address-list=spammers \
    address-list-timeout=3h chain=forward comment=\
    "Add Spammers to the list for 3 hours" connection-limit=30,32 dst-port=\
    25,587 limit=30/1m,0:packet protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
    protocol=tcp src-address-list=spammers
add action=accept chain=input comment="Accept to established connections" \
    connection-state=established
add action=accept chain=input comment="Accept to related connections" \
    connection-state=related
add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE THIS \
    RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED" src-address=\
    !192.168.0.0/16
add action=accept chain=ICMP comment=\
    "Echo request - Avoiding Ping Flood, adjust the limit as needed" \
    icmp-options=8:0 limit=2,5:packet protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
    icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
    protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
    3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
    protocol=icmp
/ip firewall mangle
add action=change-mss chain=forward new-mss=1448 out-interface=pppoe-telekom \
    passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=!0-1448
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-telekom src-address=\
    192.168.1.0/24
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
    192.168.89.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.0.0/16
set ssh address=192.168.0.0/16
set api disabled=yes
set winbox address=192.168.0.0/16
set api-ssl disabled=yes
/ppp secret
add name=vpn password=********
/system clock
set time-zone-name=Europe/Budapest
/system identity
set name=kovacsr-router
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN