Mikrotik config

# mar/15/2019 10:01:33 by RouterOS 6.44.1
# software id =
#
# model = RB4011iGS+5HacQ2HnD
# serial number =
/interface bridge
add name=br1-lan
add arp=reply-only name=br2-guest
/interface ethernet
set [ find default-name=ether1 ] comment=Wan name=eth1-wan
set [ find default-name=ether2 ] comment="Main PC" name=eth2
set [ find default-name=ether3 ] comment=Server name=eth3
set [ find default-name=ether4 ] name=eth4
set [ find default-name=ether5 ] name=eth5
set [ find default-name=ether6 ] name=eth6
set [ find default-name=ether7 ] comment=\
    "\C3\EE\F1\F2\E8\ED\ED\E0\FF \F2\E5\EB\E5\E2\E8\E7\EE\F0" name=eth7
set [ find default-name=ether8 ] name=eth8
set [ find default-name=ether9 ] comment="Raspberry PI" name=eth9
set [ find default-name=ether10 ] comment=Vera name=eth10
set [ find default-name=sfp-sfpplus1 ] disabled=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=eth1-wan keepalive-timeout=60 \
    name=Rostelekom password=*** use-peer-dns=yes user=***
/interface 6to4
add comment="Hurricane Electric IPv6 Tunnel Broker" !keepalive local-address=\
    xx.xx.xx.xx mtu=1280 name=sit1 remote-address=216.66.86.122
/interface ovpn-client
add add-default-route=yes certificate=MikrotikOpenVPNClientCert connect-to=\
    xx.xx.xx.xx mac-address=XX:XX:XX:XX:XX:XX name=External_OVPN port=xxxx \
    user=xxxxx
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
    allowed mode=dynamic-keys name=wpa_wifi supplicant-identity="" \
    wpa2-pre-shared-key=xxx
add authentication-types=wpa2-psk eap-methods="" management-protection=\
    allowed mode=dynamic-keys name=wpa_guest supplicant-identity="" \
    wpa2-pre-shared-key=xxx
/interface wireless
set [ find default-name=wlan2 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
    default-authentication=no disabled=no frequency=2437 hide-ssid=yes mode=\
    ap-bridge name=wlan1 security-profile=wpa_wifi ssid="xxx" \
    tx-power-mode=all-rates-fixed wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan1 ] band=5ghz-a/n/ac channel-width=\
    20/40/80/160mhz-eeeeeCee country=russia default-authentication=no \
    disabled=no frequency=5745 frequency-mode=superchannel hide-ssid=yes \
    mode=ap-bridge name=wlan2 security-profile=wpa_wifi ssid="xxx" \
    tx-power-mode=all-rates-fixed wireless-protocol=802.11 wps-mode=disabled
add default-forwarding=no disabled=no keepalive-frames=disabled mac-address=\
    XX:XX:XX:XX:XX:XX master-interface=wlan1 multicast-buffering=disabled \
    name=guest_wlan24 security-profile=wpa_guest ssid="xxx" \
    wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
add default-forwarding=no disabled=no keepalive-frames=disabled mac-address=\
    XX:XX:XX:XX:XX:XX master-interface=wlan2 multicast-buffering=disabled \
    name=guest_wlan50 security-profile=wpa_guest ssid="xxx" \
    wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/ip kid-control
add disabled=yes fri=0s-9h,19h-1d mon=0s-9h,19h-1d name="Yandex Station" sat=\
    0s-1d sun=0s-1d thu=0s-9h,19h-1d tue=0s-9h,19h-1d wed=0s-9h,19h-1d
/ip pool
add name=dhcp ranges=192.168.1.2-192.168.1.254
add name=pool_guest ranges=192.168.254.2-192.168.254.254
add name=vpn_pool ranges=10.0.8.2-10.0.8.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=br1-lan lease-time=3h name=\
    dhcp_lan
add add-arp=yes address-pool=pool_guest disabled=no interface=br2-guest name=\
    dhcp_guest
/ppp profile
add local-address=10.0.8.1 name=openvpn remote-address=vpn_pool
/queue simple
add burst-limit=50M/50M burst-threshold=8M/8M burst-time=10s/10s max-limit=\
    10M/10M name=guest_shaper target=br2-guest
/system logging action
set 3 remote=192.168.1.xxx
/interface bridge port
add bridge=br1-lan interface=eth2
add bridge=br1-lan interface=eth3
add bridge=br1-lan interface=eth4
add bridge=br1-lan interface=eth5
add bridge=br1-lan interface=eth6
add bridge=br1-lan interface=eth7
add bridge=br1-lan interface=eth8
add bridge=br1-lan interface=eth9
add bridge=br1-lan interface=eth10
add bridge=br1-lan interface=wlan1
add bridge=br1-lan interface=wlan2
add bridge=br2-guest interface=guest_wlan24
add bridge=br2-guest interface=guest_wlan50
/interface ovpn-server server
set certificate=MikrotikOpenVPNServer cipher=blowfish128,aes128,aes192,aes256 \
    default-profile=openvpn enabled=yes mode=ethernet port=xxxx
/interface wireless access-list
add comment="\CD\EE\F3\F2\E1\F3\EA \CC\E0\F0\E8\ED\FB" mac-address=\
    XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Galaxy Note 3" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Galaxy S III" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Samsung Tab S" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Megafon \F2\E5\EB\E5\F4\EE\ED" disabled=yes mac-address=\
    XX:XX:XX:XX:XX:XX time=0s-1d,sun,mon,tue,wed,thu,fri,sat vlan-mode=no-tag
add comment="\CC\EE\E9 \F1\F2\E0\F0\FB\E9 Notebook" mac-address=\
    XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="\CC\E0\EC\E8\ED \F2\E5\EB\E5\F4\EE\ED" mac-address=\
    XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="\C1\E0\E1\F3\F8\EA\E8\ED \F2\E5\EB\E5\E2\E8\E7\EE\F0" \
    mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Samsung XCover" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Galaxy S8+" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Gear S2" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add authentication=no comment="\C1\EB\EE\EA" forwarding=no mac-address=\
    XX:XX:XX:XX:XX:XX
add comment="Digma 7543" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Galaxy A5" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Huawei M5" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add comment="Yandex Station" mac-address=XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add authentication=no comment="\C1\EB\EE\EA" forwarding=no mac-address=\
    XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add authentication=no comment="\C1\EB\EE\EA" forwarding=no mac-address=\
    XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add authentication=no comment="\C1\EB\EE\EA" forwarding=no mac-address=\
    XX:XX:XX:XX:XX:XX vlan-mode=no-tag
add authentication=no comment="\C1\EB\EE\EA" forwarding=no mac-address=\
    XX:XX:XX:XX:XX:XX vlan-mode=no-tag
/ip address
add address=192.168.1.1/24 interface=br1-lan network=192.168.1.0
add address=192.168.254.1/24 interface=br2-guest network=192.168.254.0
/ip dhcp-server lease
add address=192.168.1.xxx comment="Main PC" mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.1.xxx comment=Server mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.1.xxx comment="Vera Light" mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.1.xxx comment="LG Plasma" mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.1.xxx comment=HTPC mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.1.xxx comment=Iconbit mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.1.xxx always-broadcast=yes client-id=1:XX:XX:XX:XX:XX:XX \
    comment="Galaxy Note 3" mac-address=XX:XX:XX:XX:XX:XX server=dhcp_lan
add address=192.168.1.xxx always-broadcast=yes client-id=1:XX:XX:XX:XX:XX:XX \
    comment="\CD\EE\F3\F2\E1\F3\EA \CC\E0\F0\E8\ED\FB" mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp_lan
add address=192.168.1.xxx client-id=1:XX:XX:XX:XX:XX:XX comment="Galaxy Tab S" \
    disabled=yes mac-address=XX:XX:XX:XX:XX:XX server=dhcp_lan
add address=192.168.1.xxx comment="Galaxy S8+" mac-address=XX:XX:XX:XX:XX:XX \
    server=dhcp_lan
add address=192.168.1.xxx client-id=1:XX:XX:XX:XX:XX:XX comment="Gear S2" \
    mac-address=XX:XX:XX:XX:XX:XX server=dhcp_lan
add address=192.168.1.xxx client-id=1:XX:XX:XX:XX:XX:XX comment=\
    "Galaxy SCover" mac-address=XX:XX:XX:XX:XX:XX server=dhcp_lan
add address=192.168.1.xxx comment="Huawei M5" mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.1.xxx client-id=1:XX:XX:XX:XX:XX:XX comment=\
    "Yandex Station" mac-address=XX:XX:XX:XX:XX:XX server=dhcp_lan
add address=192.168.1.xxx client-id=1:XX:XX:XX:XX:XX:XX comment="Raspbery PI" \
    disabled=yes mac-address=XX:XX:XX:XX:XX:XX server=dhcp_lan
add address=192.168.1.xxx comment="Raspbery PI" mac-address=XX:XX:XX:XX:XX:XX \
    server=dhcp_lan
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 \
    netmask=24 ntp-server=192.168.1.1
add address=192.168.254.0/24 dns-server=8.8.8.8 gateway=192.168.254.1 \
    netmask=24
/ip dns
set allow-remote-requests=yes servers=192.168.1.xxx
/ip dns static
/ip firewall address-list
add address=ident.me list=Route_To_OVPN -- подобных записей, штук 60
add address=101.198.186.223 list=External_Black_List -- таких записей, штук 300
/ip firewall filter
add action=accept chain=input comment="Open VPN Server Mikrotik" dst-port=\
    xxxx in-interface=Rostelekom protocol=tcp src-address-list=\
    !External_Black_List
add action=accept chain=forward comment="Web Server" dst-port=80,443 \
    in-interface=Rostelekom protocol=tcp src-port=""
add action=accept chain=forward comment=Torrents dst-port=xxxx-xxxx \
    in-interface=Rostelekom protocol=tcp
add action=accept chain=forward dst-port=xxxx-xxxx in-interface=Rostelekom \
    protocol=udp
add action=accept chain=forward comment=FTP dst-port=990,xxxx-xxxx \
    in-interface=Rostelekom protocol=tcp src-address-list=\
    !External_Black_List
add action=accept chain=forward comment="SVN Server" dst-port=xxxx \
    in-interface=Rostelekom protocol=tcp src-address-list=\
    !External_Black_List
add action=accept chain=forward comment="SSH To Raspberry With Pork Knock" \
    dst-port=xxxx in-interface=Rostelekom protocol=tcp src-address-list=\
    Services_White_List
add action=accept chain=input comment=\
    "\C4\EE\F1\F2\F3\EF \EA \F0\EE\F3\F2\E5\F0\F3 With Pork Knock" dst-port=\
    8728,8291,22 in-interface=Rostelekom protocol=tcp src-address-list=\
    Services_White_List src-port=""
add action=accept chain=forward comment="RDP With Port Knock" dst-port=3389 \
    in-interface=Rostelekom protocol=tcp src-address-list=Services_White_List
add action=add-src-to-address-list address-list=ICMP_stage1 \
    address-list-timeout=5s chain=input comment="Port Knock for Services #1" \
    in-interface=Rostelekom packet-size=xxxx protocol=icmp
add action=add-src-to-address-list address-list=ICMP_stage2 \
    address-list-timeout=5s chain=input comment="Port Knock for Services #2" \
    in-interface=Rostelekom packet-size=xxxx protocol=icmp src-address-list=\
    ICMP_stage1
add action=add-src-to-address-list address-list=ICMP_stage3 \
    address-list-timeout=5s chain=input comment="Port Knock for Services #3" \
    in-interface=Rostelekom packet-size=xxxx protocol=icmp src-address-list=\
    ICMP_stage2
add action=add-src-to-address-list address-list=Services_White_List \
    address-list-timeout=1m chain=input comment="Port Knock for Services #4" \
    in-interface=Rostelekom packet-size=xxxx protocol=icmp src-address-list=\
    ICMP_stage3
add action=accept chain=input comment="6to4 Tonnel" protocol=ipv6-encap
add action=accept chain=output protocol=ipv6-encap
add action=accept chain=input comment=\
    "\D0\E0\E7\F0\E5\F8\E0\E5\EC \EF\E8\ED\E3\E8" protocol=icmp
add action=accept chain=forward protocol=icmp
add action=accept chain=input comment="\D0\E0\E7\F0\E5\F8\E0\E5\EC \F3\F1\F2\
    \E0\ED\EE\E2\EB\E5\ED\ED\FB\E5 \EF\EE\E4\EA\EB\FE\F7\E5\ED\E8\FF" \
    connection-state=established
add action=accept chain=forward connection-state=established
add action=accept chain=input comment="\D0\E0\E7\F0\E5\F8\E0\E5\EC \F1\E2\FF\
    \E7\E0\ED\ED\FB\E5 \EF\EE\E4\EA\EB\FE\F7\E5\ED\E8\FF" connection-state=\
    related
add action=accept chain=forward connection-state=related
add action=accept chain=forward comment="\CF\F0\EE\F5\EE\E6\E4\E5\ED\E8\E5 \F2\
    \F0\E0\F4\E8\EA\E0 \E8\E7 \EB\EE\EA\E0\EB\EA\E8 \E2 \E8\ED\F2\E5\F0\ED\E5\
    \F2" in-interface=!Rostelekom out-interface=Rostelekom
add action=reject chain=output comment="Disable All DNS" dst-port=53 \
    out-interface=Rostelekom protocol=udp reject-with=\
    icmp-network-unreachable
add action=reject chain=output dst-port=53 out-interface=Rostelekom protocol=\
    tcp reject-with=icmp-network-unreachable
add action=drop chain=input comment=\
    "\CF\EE\EB\ED\FB\E9 \E7\E0\EF\F0\E5\F2 \EE\F1\F2\E0\EB\FC\ED\EE\E3\EE" \
    in-interface=Rostelekom
add action=drop chain=forward in-interface=Rostelekom
/ip firewall mangle
add action=mark-routing chain=prerouting comment="Mark Route To VPN" \
    dst-address-list=Route_To_OVPN new-routing-mark=To_OVPN passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="https://it4it.club/topic/30-markir\
    uem-paketyi-i-zavorachivaet-trafik-do-konkretnyih-serverov-v-vpn/" \
    dst-address-list=Route_To_OVPN out-interface=External_OVPN
add action=masquerade chain=srcnat out-interface=Rostelekom
add action=netmap chain=dstnat comment="FTP Server" dst-port=990 \
    in-interface=Rostelekom protocol=tcp src-address-list=\
    !External_Black_List to-addresses=192.168.1.xxx to-ports=990
add action=netmap chain=dstnat comment="FTP Server" dst-port=xxxx-xxxx \
    in-interface=Rostelekom protocol=tcp to-addresses=192.168.1.xxx to-ports=\
    xxxx-xxxx
add action=netmap chain=dstnat comment="SVN Server" dst-port=xxxx \
    in-interface=Rostelekom protocol=tcp to-addresses=192.168.1.xxx to-ports=\
    xxxx
add action=netmap chain=dstnat comment="Web Server (HTTP)" dst-port=80 \
    in-interface=Rostelekom protocol=tcp to-addresses=192.168.1.xxx to-ports=\
    80
add action=netmap chain=dstnat comment="Web Server (HTTPS)" dst-port=443 \
    in-interface=Rostelekom protocol=tcp to-addresses=192.168.1.xxx to-ports=\
    443
add action=netmap chain=dstnat comment="Server RDP" dst-port=3389 \
    in-interface=Rostelekom protocol=tcp to-addresses=192.168.1.xxx to-ports=\
    3389
add action=dst-nat chain=dstnat comment=uTorrent dst-port=xxxx in-interface=\
    Rostelekom protocol=tcp to-addresses=192.168.1.xxx to-ports=xxxx
add action=dst-nat chain=dstnat comment=uTorrent dst-port=xxxx in-interface=\
    Rostelekom protocol=udp to-addresses=192.168.1.xxx to-ports=xxxx
add action=dst-nat chain=dstnat comment=qBitTorrent dst-port=xxxx \
    in-interface=Rostelekom protocol=tcp to-addresses=192.168.1.xxx to-ports=\
    xxxx
add action=dst-nat chain=dstnat comment=qBitTorrent dst-port=xxxx \
    in-interface=Rostelekom protocol=udp to-addresses=192.168.1.xxx to-ports=\
    xxxx
add action=dst-nat chain=dstnat comment="SSH To Raspberry" dst-port=xxxx \
    in-interface=Rostelekom protocol=tcp to-addresses=192.168.1.xxx to-ports=\
    xxxx
/ip kid-control device
add mac-address=XX:XX:XX:XX:XX:XX name="Yandex Station" user="Yandex Station"
/ip route
add distance=1 gateway=External_OVPN routing-mark=To_OVPN
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes
/ipv6 address
add address=xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx advertise=no interface=sit1
add address=xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx interface=br1-lan
/ipv6 firewall filter
add action=drop chain=input connection-state=invalid in-interface=Rostelekom
add action=accept chain=input connection-state=established,related \
    in-interface=Rostelekom
add action=accept chain=forward connection-state=established,related \
    in-interface=Rostelekom
add action=accept chain=input dst-port=546 in-interface=Rostelekom protocol=\
    udp
add action=accept chain=input in-interface=Rostelekom protocol=icmpv6
add action=accept chain=forward in-interface=Rostelekom protocol=icmpv6
add action=drop chain=input in-interface=Rostelekom log=yes
add action=drop chain=forward in-interface=Rostelekom
/ipv6 route
add distance=1 dst-address=2000::/3 gateway=xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
/ppp secret
add name=xxxxxx password=xxxxxxxx profile=openvpn service=ovpn
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system leds
add interface=wlan1 leds="wlan1_signal1-led,wlan1_signal2-led,wlan1_signal3-le\
    d,wlan1_signal4-led,wlan1_signal5-led" type=wireless-signal-strength
add interface=wlan1 leds=wlan1_tx-led type=interface-transmit
add interface=wlan1 leds=wlan1_rx-led type=interface-receive
/system logging
set 0 action=remote
set 1 action=remote
set 2 action=remote
set 3 action=remote
/system ntp client
set enabled=yes primary-ntp=89.109.251.21 secondary-ntp=89.109.251.22
/system ntp server
set enabled=yes multicast=yes
/system scheduler
add disabled=yes interval=1m name=RenewProviderDNS on-event=GetProviderDNS \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=sep/12/2018 start-time=10:17:08
add interval=5m name=PingAndReboot on-event=\
    "/system script run PingAndReboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-time=startup
add name=PingAndRebootStartup on-event=":delay 100;\r\
    \n/system scheduler disable PingAndReboot\r\
    \n:delay 1700;\r\
    \n/system scheduler enable PingAndReboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-time=startup
/system script
add dont-require-permissions=no name="Remove Mikrotik Static DNS" owner=alex \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="ip dns static remove [/ip dns static find comment=\"From Mikrotik \
    AdAway\"]"
add dont-require-permissions=no name=GetProviderDNS owner=alex policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    local ListName \"ProviderDNS\"\r\
    \n\r\
    \n/ip firewall address-list remove [find where list~\$ListName]\r\
    \n\r\
    \n#:local DNSServers ( [ip dns get dynamic-servers], [ip dns get servers])\
    \r\
    \n:local DNSServers ( [ip dns get dynamic-servers])\r\
    \n:foreach DNSServer in \$DNSServers do={\r\
    \n#\t:put (\"Server: \$DNSServer\")\r\
    \n#\t:if (\$DNSServer=\"8.8.8.8\" || \$DNSServer=\"8.8.4.4\") do={:put (\"\
    Good DNS \$DNSServer\")} else={:put (\"Bad DNS \$DNSServer\")}\r\
    \n\t:if (\$DNSServer!=\"8.8.8.8\" && \$DNSServer!=\"8.8.4.4\") do={/ip fir\
    ewall address-list add address=\$DNSServer list=\$ListName}\r\
    \n}\r\
    \n"
add dont-require-permissions=no name=PingAndReboot owner=alex policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    local PingCount 3\r\
    \n:local Google 8.8.8.8\r\
    \n:local Yandex 77.88.8.8\r\
    \n:local Mail 94.100.180.201\r\
    \n:local ResultGoogle [/ping count=\$PingCount \$Google interface=Rostelek\
    om]\r\
    \n:local Resultyandex [/ping count=\$PingCount \$Yandex interface=Rostelek\
    om]\r\
    \n:local ResultMail [/ping count=\$PingCount \$Mail interface=Rostelekom]\
    \r\
    \n:local MainIfInetOk false;\r\
    \n:set MainIfInetOk ((\$ResultGoogle + \$Resultyandex + \$ResultMail) >= (\
    2 * \$PingCount))\r\
    \n:put \"MainIfInetOk=\$MainIfInetOk\"\r\
    \nif (!\$MainIfInetOk) do={\r\
    \n/log error \"Bad connect\"\r\
    \n/system reboot\r\
    \n}\r\
    \nif (\$MainIfInetOk) do={\r\
    \n# /log info \"Connect OK\"\r\
    \n}"
/system watchdog
set auto-send-supout=yes send-email-to=mikrotik@mikrotik watch-address=\
    192.168.1.1
/tool e-mail
set address=smtp.yandex.ru from=mikrotik@mikrotik password=xxxxxx port=465 \
    start-tls=tls-only user=mikrotik@mikrotik