# 2025-05-16 RouterOS 7.19.1
# software id = 2ELI-QXJ6
#
# model = L009UiGS
/interface bridge
add admin-mac=D4:01:C3:CF:91:A5 arp=proxy-arp auto-mac=no comment=defconf \
    name=bridge port-cost-mode=short
/interface l2tp-client
add add-default-route=yes comment="ISP1 l2tp client" connect-to=\
    vpnserver.prov1.ru disabled=no name=l2tp-out1 user=username
/interface pppoe-client
add add-default-route=yes comment="ISP2 pppoe client" \
    default-route-distance=7 disabled=no interface=ether2 name=pppoe-out1 \
    user=username
/interface wireguard
add listen-port=12953 mtu=1420 name=wireguardint1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp ranges=192.168.1.2-192.168.1.140
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=defconf
/port
set 0 name=serial0
/ppp profile
add local-address=192.168.1.197 name=l2tp_profile remote-address=dhcp
/routing table
add disabled=no fib name=RT-ISP1
add disabled=no fib name=RT-ISP2
/system logging action
set 0 memory-lines=10000
/interface bridge port
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether6 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether8 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=sfp1 internal-path-cost=10 \
    path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=14336
/ipv6 settings
set max-neighbor-entries=7168
/interface l2tp-server server
set authentication=mschap2 default-profile=l2tp_profile enabled=yes \
    use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
add mac-address=FE:38:9D:D6:B9:F1 name=ovpn-server1
/interface wireguard peers
add allowed-address=10.0.0.2/32,192.168.1.0/24 interface=wireguardint1 \
    name=moinotebooktest persistent-keepalive=25s public-key=\
    "0-0-0-0-0-0-0-0-0"
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=\
    192.168.1.0
add address=10.0.0.1/24 interface=wireguardint1 network=10.0.0.0
/ip dhcp-client
add comment=defconf default-route-distance=5 default-route-tables=main \
    interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.1 gateway=\
    192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,77.88.8.8
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan type=A
/ip firewall address-list

/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment=WIREGUARD dst-port=0000 protocol=udp

add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=input comment="defconf: drop ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=accept chain=prerouting comment="1 prerouting ISP1" dst-address=\
    10.21.1.0/24
add action=accept chain=prerouting comment="2 prerouting ISP2" dst-address=\
    193.5.5.0/24
add action=accept chain=prerouting comment="3 prerouting LOCAL NETWORK" \
    dst-address=192.168.1.0/24
add action=mark-connection chain=prerouting comment=\
    "3 marc connetion ISP1 " connection-mark=no-mark in-interface=\
    l2tp-out1 new-connection-mark="ISP-1 "
add action=mark-connection chain=prerouting comment=\
    "4 marc connetion ISP2 " connection-mark=no-mark in-interface=\
    pppoe-out1 new-connection-mark="ISP-2 "
add action=mark-connection chain=prerouting comment=\
    "5 marc to brige ISP1 " connection-mark="ISP-1 " \
    dst-address-type=!local in-interface=bridge new-connection-mark=\
    "ISP-1 " per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting comment=\
    "6 marc to brige ISP2 " connection-mark="ISP-2 " \
    dst-address-type=!local in-interface=bridge new-connection-mark=\
    "ISP-2 " per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting comment=\
    "7 routing marc ISP 1 " connection-mark="ISP-1 " \
    in-interface=bridge new-routing-mark=RT-ISP1 passthrough=no
add action=mark-routing chain=prerouting comment="8 routing marc ISP 2" \
    connection-mark="ISP-2 " in-interface=bridge new-routing-mark=\
    RT-ISP2 passthrough=no
add action=mark-routing chain=output comment="9 marc output ISP1 " \
    connection-mark="ISP-1 " new-routing-mark=RT-ISP1 \
    passthrough=no
add action=mark-routing chain=output comment="10 marc output ISP2" \
    connection-mark="ISP-2 " new-routing-mark=RT-ISP2 passthrough=\
    no
/ip firewall nat
add action=masquerade chain=srcnat comment="ISP1 masquerade" ipsec-policy=\
    out,none out-interface=l2tp-out1
add action=masquerade chain=srcnat comment="ISP2 masquerade" ipsec-policy=\
    out,none out-interface=pppoe-out1

/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add comment=ISP1 disabled=yes distance=10 dst-address=0.0.0.0/0 gateway=\
    10.21.1.2 routing-table=RT-ISP1 scope=30 suppress-hw-offload=no \
    target-scope=10
add comment=ISP2 disabled=yes distance=15 dst-address=0.0.0.0/0 gateway=\
    193.5.5.5 routing-table=RT-ISP2 scope=30 suppress-hw-offload=no \
    target-scope=10
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
/ipv6 firewall address-list

/ipv6 firewall filter

/ppp secret

/system clock
set time-zone-name=Asia/Novosibirsk
/system logging
set 0 topics=info,!wireguard
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN