/interface bridge
add name=bridge-wifi
add arp=reply-only name=bridge-wifi-guest
add name=bridge-wifi-iot
add comment=vlan192 name=bridge1
add comment=vlan22 name=bridge1-vlan22
add comment=vlan3000 name=bridge1-vlan3000
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment=LAN
set [ find default-name=ether3 ] comment=Mikrotik-M1
set [ find default-name=ether10 ] comment=Mikrotik-SW
/interface vlan
add interface=ether10 name=vlan-22 vlan-id=22
add interface=ether10 name=vlan-192 vlan-id=192
add comment=no-internet-access interface=ether10 name=vlan-3000 vlan-id=3000
add interface=ether1 name=vlan3-eth1 use-service-tag=yes vlan-id=3
add interface=ether1 name=vlan30-eth1 vlan-id=30
/interface list
add name=WAN
add name=LAN
/ip dhcp-client option
add code=2 name=mgts-option2
add code=42 name=mgts-option42
add code=33 name=mgts-option33
add code=249 name=mgts-option249
add code=121 name=mgts-option121
add code=43 name=mgts-option43
add code=43 name=ubiq-opt43 value=0x01045FA58164
add code=121 name=ubiq_opt121 value=0x17005FA58001
/ip pool
add name=dhcp ranges=192.168.1.2-192.168.1.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge1 name=dhcp-bridge1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1-vlan22 interface=vlan-22
add bridge=bridge1 interface=vlan-192
add bridge=bridge1-vlan3000 interface=vlan-3000
add bridge=bridge1 disabled=yes interface=ether1
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=sfp1
/interface list member
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=ether10 list=LAN
add interface=sfp1 list=LAN
add interface=bridge1 list=LAN
/ip address
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0
/ip dhcp-client
add dhcp-options=clientid,hostname disabled=no interface=ether1
add dhcp-options=clientid,ubiq_opt121,ubiq-opt43,hostname disabled=no interface=vlan3-eth1
/ip firewall address-list
add address=192.168.120.0/24 list=address_wifi
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=tcp
add action=accept chain=forward comment="allow cam to node" dst-address=192.168.1.52 src-address=192.168.1.23
add action=reject chain=forward reject-with=icmp-network-unreachable src-address=192.168.1.23
add action=accept chain=input protocol=icmp
add action=accept chain=input comment="Unlock CAPsMAN" dst-address-type=local src-address-type=local
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward comment="Telegram VPN" connection-state=established,new in-interface=bridge1 out-interface=vpn-usa src-address-list=address_server
add action=accept chain=forward connection-state=established,new in-interface=bridge-wifi out-interface=vpn-usa src-address-list=address_wifi
add action=accept chain=forward connection-state=established,related in-interface=vpn-usa out-interface=bridge1
add action=accept chain=forward connection-state=established,related in-interface=vpn-usa out-interface=bridge-wifi
add action=accept chain=forward comment="1.1. Forward and Input Established and Related connections" connection-state=established,related log-prefix=debug-firewall
add action=drop chain=forward connection-state=invalid
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=tarpit chain=input connection-limit=3,32 protocol=tcp src-address-list=ddos-blacklist
add action=add-src-to-address-list address-list=ddos-blacklist address-list-timeout=1d chain=input comment="1.2. DDoS Protect - Connection Limit" connection-limit=100,32 in-interface=ether1 protocol=tcp
add action=add-src-to-address-list address-list="Port Scanners" address-list-timeout=none-dynamic chain=input in-interface=ether1 protocol=tcp psd=21,3s,3,1
add action=jump chain=forward comment="1.3. DDoS Protect - SYN Flood" connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect connection-state=new limit=200,5:packet protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp tcp-flags=syn
add action=jump chain=input connection-state=new in-interface=ether1 jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=drop chain=input comment="1.4. Protected - Ports Scanners" src-address-list="Port Scanners"
add action=add-src-to-address-list address-list="Port Scanners" address-list-timeout=none-dynamic chain=input in-interface-list=WAN protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="1.5. Protected - WinBox Access" src-address-list="Black List Winbox"
add action=add-src-to-address-list address-list="Black List Winbox" address-list-timeout=none-dynamic chain=input connection-state=new dst-port=8291 in-interface=ether1 log=yes log-prefix="BLACK WINBOX" protocol=tcp src-address-list="Winbox Stage 3"
add action=add-src-to-address-list address-list="Winbox Stage 3" address-list-timeout=1m chain=input connection-state=new dst-port=8291 in-interface=ether1 protocol=tcp src-address-list="Winbox Stage 2"
add action=drop chain=input comment="1.4. Protected - Ports Scanners" src-address-list="Port Scanners"
add action=add-src-to-address-list address-list="Winbox Stage 2" address-list-timeout=1m chain=input connection-state=new dst-port=8291 in-interface=ether1 protocol=tcp src-address-list="Winbox Stage 1"
add action=accept chain=input comment="SNMP Monitoring" dst-port=161 protocol=udp src-address=213.183.63.14
add action=accept chain=input dst-port=161 protocol=udp src-address=89.208.220.212
/ip firewall mangle
add action=mark-routing chain=prerouting comment="Mark Telegram" dst-address-list=Telegram new-routing-mark=mark_telegram passthrough=no src-address-list=address_server
add action=mark-routing chain=prerouting comment="Mark Telegram" dst-address-list=Telegram new-routing-mark=mark_telegram passthrough=no src-address-list=address_wifi
add action=mark-routing chain=prerouting comment="Mark Telegram" dst-address-list=Telegram new-routing-mark=mark_telegram passthrough=no src-address-list=address_wifi_guest
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes out-interface=ether1
add action=masquerade chain=srcnat out-interface=vpn-usa
add action=masquerade chain=srcnat out-interface-list=WAN src-address-list=address_wifi
add action=masquerade chain=srcnat out-interface-list=WAN src-address-list=address_server to-addresses=192.168.1.15
add action=masquerade chain=srcnat out-interface-list=WAN src-address-list=address_wifi_guest to-addresses=192.168.1.15
add action=masquerade chain=srcnat out-interface-list=WAN src-address-list=address_wifi_iot
add action=return chain=dstnat dst-port=25570 in-interface-list=WAN protocol=tcp src-address=185.165.241.35
add action=dst-nat chain=dstnat comment="HTTP hub" dst-port=80 in-interface=ether1 protocol=tcp to-addresses=192.168.1.14 to-ports=80
add action=dst-nat chain=dstnat comment="HTTPS hub" dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.1.14 to-ports=443
add action=dst-nat chain=dstnat comment="SSH/FTP hub" dst-port=20-22 in-interface=ether1 protocol=tcp to-addresses=192.168.1.14 to-
/ip firewall raw
add action=drop chain=prerouting dst-port=53 in-interface=ether1 log-prefix="[firewall-dns]" protocol=tcp
add action=drop chain=prerouting dst-port=53 in-interface=ether1 protocol=udp
/ip route rule
add action=unreachable comment="guest -> servers : drop" dst-address=192.168.1.0/24 src-address=192.168.129.0/24
add action=unreachable comment="iot -> servers : drop" dst-address=192.168.1.0/24 src-address=192.168.121.0/24
add action=unreachable comment="guest -> iot : drop" dst-address=192.168.121.0/24 src-address=192.168.129.0/24
add action=unreachable comment="iot -> guest : drop" dst-address=192.168.129.0/24 src-address=192.168.121.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.1.0/24,192.168.120.0/24
set ssh address=192.168.0.0/16
set api address=192.168.0.0/16
set winbox address=192.168.0.0/16,10.0.0.0/16
set api-ssl disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=ether9 type=internal
add interface=ether10 type=internal
add interface=ether1 type=external
/lcd
set backlight-timeout=23h
/routing rip
set garbage-timer=30s timeout-timer=1m update-timer=10s
/routing rip interface
add interface=bridge1 send=v1-2
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=MikroTik-M2
/system logging
add action=remote prefix="[account]" topics=account
add action=remote prefix="[backup]" topics=backup
add action=remote prefix="[crit]" topics=critical
add action=remote prefix="[email]" topics=e-mail
add action=remote prefix="[error]" topics=error
add action=remote prefix="[info]" topics=info
add action=remote prefix="[interface]" topics=interface
add action=remote prefix="[ovpn]" topics=ovpn
add action=remote prefix="[script]" topics=script
add action=remote prefix="[ssh]" topics=ssh
add action=remote prefix="[system]" topics=system
add action=remote prefix="[warning]" topics=warning
add action=remote prefix="[watchdog]" topics=watchdog
add action=remote prefix="[caps]" topics=caps
add action=remote disabled=yes topics=firewall
add action=remote prefix="[email]" topics=e-mail
/system scheduler
add interval=23h59m59s name=scheduler_daily-backup on-event=daily-backup policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=mar/29/2020 start-time=00:10:00