# sep/27/2018 20:30:35 by RouterOS 6.43.2
# software id = 5JRT-44ZR
#
# model = RouterBOARD 941-2nD
# serial number = 66160655EA0C
/interface bridge
add admin-mac=6C:3B:6B:X0:X0:X0 auto-mac=no fast-forward=no name=LAN
add arp=proxy-arp fast-forward=no name=steam
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-onlyn country="united states" disabled=no distance=indoors frequency=auto frequency-mode=superchannel mode=ap-bridge ssid=NET \
    wireless-protocol=802.11 wps-mode=disabled
/interface ethernet
set [ find default-name=ether1 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether2 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full name=ether2-master
set [ find default-name=ether3 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether4 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface pppoe-client
add add-default-route=yes default-route-distance=0 disabled=no interface=ether1 keepalive-timeout=60 name=pppoe-out1 password=AR7L6xUChm use-peer-dns=yes user=KH357549
/interface l2tp-client
add add-default-route=yes allow=mschap1,mschap2 connect-to=XXX disabled=no ipsec-secret=12345690 name=l2tp-out1 password=12345 use-ipsec=yes user=L2TP
/interface eoip
add allow-fast-path=no local-address=10.10.10.2 mac-address=02:2A:CE:FF:9F:F7 name=eoip-tunnel1 remote-address=10.10.10.1 tunnel-id=0
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=1L wpa2-pre-shared-key=\
/ip pool
add name=dhcp ranges=192.168.55.230-192.168.55.250
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay disabled=no interface=LAN name=defconf
/interface bridge port
add bridge=LAN interface=ether2-master
add bridge=LAN interface=wlan1
add bridge=LAN interface=ether3
add bridge=LAN interface=ether4
add bridge=steam interface=eoip-tunnel1
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=wlan1 list=discover
add interface=LAN list=discover
add interface=pppoe-out1 list=discover
add interface=LAN list=mac-winbox
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.55.1/24 interface=LAN network=192.168.55.0
/ip dhcp-server network
add address=192.168.55.0/24 comment=defconf gateway=192.168.55.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=accept chain=forward connection-state=established,related
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input protocol=icmp
add action=add-src-to-address-list address-list=blacklist_final address-list-timeout=2w1d chain=input comment="fail2ban: stage3 to final" connection-state=new dst-port=\
    22,8291 protocol=tcp src-address-list=blacklist_stage_3
add action=add-src-to-address-list address-list=blacklist_stage_3 address-list-timeout=1m chain=input comment="fail2ban: stage2 to stage3" connection-state=new dst-port=\
    22,8291 protocol=tcp src-address-list=blacklist_stage_2
add action=add-src-to-address-list address-list=blacklist_stage_2 address-list-timeout=6h chain=input comment="fail2ban: stage1 to stage2" connection-state=new dst-port=\
    22,8291 protocol=tcp src-address-list=blacklist_stage_1
add action=add-src-to-address-list address-list=blacklist_stage_1 address-list-timeout=12h chain=input comment="fail2ban: stage1" connection-state=new dst-port=22,8291 \
    protocol=tcp
add action=drop chain=input comment="fail2ban: drop brute forcers" dst-port=22,8291 protocol=tcp src-address-list=blacklist_final
add action=drop chain=input in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=pppoe-out1
# no interface
add action=masquerade chain=srcnat out-interface=*8
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
/ip route
add distance=1 dst-address=192.168.20.0/24 gateway=steam
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=44211
set api disabled=yes
set api-ssl disabled=yes