# apr/xx/2020 xx:06:17 by RouterOS 6.xx.x
# software id = 5Z4J-xxxx
#
# model = RBD52G-5HacD2HnD
# serial number = xxxxx
/interface bridge
add admin-mac=C4:AD:34:xx:xx:xx auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
    allowed mode=dynamic-keys name="wan wifi" supplicant-identity="" \
    wpa2-pre-shared-key=xxxxxxx
add authentication-types=wpa2-psk eap-methods="" management-protection=\
    allowed mode=dynamic-keys name="wifi interna" supplicant-identity="" \
    wpa2-pre-shared-key=xxxxxxx
add authentication-types=wpa2-psk eap-methods="" management-protection=\
    allowed mode=dynamic-keys name="WAN WiFi VOD" supplicant-identity="" \
    wpa2-pre-shared-key=xxxxxxx
add authentication-types=wpa2-psk eap-methods="" management-protection=\
    allowed mode=dynamic-keys name="wifi 5Ghz" supplicant-identity="" \
    wpa2-pre-shared-key=xxxxxx
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=italy disabled=no \
    installation=indoor keepalive-frames=disabled security-profile=\
    "WAN WiFi VOD" ssid=xxxxxxx station-roaming=disabled \
    wds-default-bridge=bridge wds-mode=dynamic wireless-protocol=802.11 \
    wmm-support=enabled
set [ find default-name=wlan2 ] country=italy installation=indoor mode=\
    ap-bridge security-profile="wifi 5Ghz" ssid=Tik5 wmm-support=enabled \
    wps-mode=disabled
add keepalive-frames=disabled mac-address=C6:AD:34:xx:xx:xx master-interface=\
    wlan1 multicast-buffering=disabled name=wlan3 security-profile=\
    "wifi interna" ssid=homemik wds-cost-range=0 wds-default-bridge=bridge \
    wds-default-cost=0 wds-mode=dynamic wmm-support=enabled wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp_pool1 ranges=192.168.3.2-192.168.3.254
add name=dhcp_pool2 ranges=192.168.10.2-192.168.10.254
add name=ovpn-pool ranges=192.168.131.10-192.168.131.200
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=bridge name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface=ether3 name=dhcp2
/ppp profile
add dns-server=192.168.131.1 local-address=192.168.131.1 name=ovpn \
    remote-address=ovpn-pool use-encryption=yes
/queue simple
add name=PC target=192.168.3.100/32
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge interface=wlan3
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=wlan1 list=WAN
/interface ovpn-server server
set auth=sha1 certificate=mikrotik cipher=aes256 default-profile=ovpn \
    enabled=yes port=1195
/ip address
add address=192.168.3.1/24 comment=defconf interface=bridge network=\
    192.168.3.0
add address=192.168.1.11/24 interface=wlan1 network=192.168.1.0
add address=192.168.10.1/24 interface=ether3 network=192.168.10.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add interface=wlan1
/ip dhcp-server lease
add address=192.168.3.100 client-id=1:0:17:31:89:xx:xx comment=\
    "My Desktop PC" mac-address=00:17:31:89:xx:xx server=dhcp1
add address=192.168.3.124 client-id=1:0:a:cd:xx:xx:f disabled=yes \
    mac-address=00:0A:CD:38:xx:xx server=dhcp1
add address=192.168.10.124 client-id=1:0:a:xx:xx:a6:f mac-address=\
    00:0A:CD:38:A6:0F server=dhcp2
add address=192.168.10.123 client-id=1:1c:75:8:xx:xx:4f mac-address=\
    1C:75:08:DD:xx:xx server=dhcp2
/ip dhcp-server network
add address=192.168.3.0/24 comment=defconf dns-server=192.168.3.1 gateway=\
    192.168.3.1
add address=192.168.10.0/24 gateway=192.168.10.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
add address=192.168.10.123 comment=pfsense name=sensexxxx.localdomain
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related" \
    connection-state=established,related
add action=drop chain=forward comment="syncth service" disabled=yes \
    dst-address=85.10.xxx.xx log=yes protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=forward dst-address-list=WAN src-address-list=LAN
add action=drop chain=input dst-port=80 in-interface-list=WAN protocol=tcp
add action=drop chain=input icmp-options=8:0-255 in-interface-list=WAN \
    protocol=icmp
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="From pfsense LAN" log=yes src-address=\
    192.168.10.0/24
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="permetti OpenVPN" dst-port=1194 \
    protocol=tcp
add action=accept chain=input comment="permetti OpenVPN" dst-port=1195 \
    protocol=tcp
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept established,related" \
    connection-state=established,related
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=drop chain=forward disabled=yes dst-address=192.168.3.0/24 \
    src-address=192.168.10.0/24
add action=drop chain=forward disabled=yes dst-address=192.168.10.0/24 log=\
    yes src-address=192.168.3.0/24
add action=drop chain=forward comment="Drop all else" disabled=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
# lte1 not ready
add action=masquerade chain=srcnat out-interface=*A
add action=dst-nat chain=dstnat comment="OpenVPN su pfsense" dst-port=1194 \
    protocol=udp to-addresses=192.168.10.123 to-ports=1194
add action=dst-nat chain=dstnat dst-port=xxxx in-interface-list=WAN \
    protocol=tcp to-addresses=192.168.3.100 to-ports=22448
add action=dst-nat chain=dstnat dst-port=xxxx in-interface-list=WAN \
    protocol=udp to-addresses=192.168.3.100 to-ports=14922
add action=dst-nat chain=dstnat comment="redirect DNS to pihole" disabled=yes \
    dst-address=!192.168.3.66 dst-port=53 log=yes protocol=udp src-address=\
    !192.168.3.66 to-addresses=192.168.3.66
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.3.66 \
    dst-port=53 log=yes protocol=tcp src-address=!192.168.3.66 to-addresses=\
    192.168.3.66
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.3.66 \
    dst-port=53 log=yes protocol=udp src-address=192.168.3.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.3.66 \
    dst-port=53 log=yes protocol=tcp src-address=192.168.3.0/24
add action=dst-nat chain=dstnat comment="DNS redirect to MIkrotik" dst-port=\
    53 log=yes protocol=tcp src-address=192.168.3.0/24 to-addresses=\
    192.168.3.1 to-ports=53
add action=dst-nat chain=dstnat dst-port=53 log=yes protocol=udp src-address=\
    192.168.3.0/24 to-addresses=192.168.3.1 to-ports=53
/ip route
add check-gateway=ping distance=1 gateway=192.168.1.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.3.100/32,192.168.10.0/24
/ppp secret
add name=vpn_user password=xxxxxxxx+abs profile=ovpn service=ovpn
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=homexxx
/system ntp client
set enabled=yes primary-ntp=193.204.114.105 secondary-ntp=193.204.114.233
/system routerboard mode-button
set enabled=yes on-event=\
    "/interface wireless set wlan2 disabled=(![get wlan2 disabled])"
/tool bandwidth-server
set authenticate=no
/tool graphing interface
add interface=ether1
/tool graphing queue
add allow-address=192.168.3.100/32
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN