jul/04/2021 10:46:53 by RouterOS 6.47.10
# software id = PYXQ-BLFN
#
# model = RB4011iGS+
# serial number = F0260E4A13CD
/interface bridge
add admin-mac=2C:C8:1B:65:35:C5 arp=proxy-arp auto-mac=no igmp-snooping=yes \
    name=lan-bridge protocol-mode=none
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] arp=proxy-arp l2mtu=1598 loop-protect=\
    off
/interface vlan
add interface=sfp-sfpplus1 name=vlan1.4 vlan-id=4
add interface=sfp-sfpplus1 loop-protect=off name=vlan1.6 vlan-id=6
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-client option
add code=60 name=option60-vendorclass value="'IPTV_RG'"
/ip dhcp-server option
add code=60 name=option60-vendorclass value="'IPTV_RG'"
add code=28 name=option28-broadcast value="'192.168.88.255'"
/ip dhcp-server option sets
add name=IPTV options=option60-vendorclass,option28-broadcast
/ip pool
add name=lan-dhcp ranges=192.168.88.64-192.168.88.191
/ip dhcp-server
add address-pool=lan-dhcp disabled=no interface=lan-bridge name=lan-server
/ppp profile
set *0 only-one=yes use-compression=yes use-ipv6=no use-upnp=no
add name=default-ipv6 only-one=yes use-compression=yes use-upnp=no
/interface pppoe-client
add add-default-route=yes allow=pap interface=vlan1.6 keepalive-timeout=20 \
    max-mru=1500 max-mtu=1500 name=pppoe-client profile=default-ipv6 \
    use-peer-dns=yes [email protected]
/routing bgp instance
set default disabled=yes
/interface bridge port
add bridge=lan-bridge comment=LAN interface=ether2
add bridge=lan-bridge comment=LAN interface=ether3
add bridge=lan-bridge comment=LAN interface=ether4
add bridge=lan-bridge comment=LAN interface=ether5
add bridge=lan-bridge comment=LAN interface=ether6
add bridge=lan-bridge comment=LAN interface=ether7
add bridge=lan-bridge comment=LAN interface=ether8
add bridge=lan-bridge comment=LAN interface=ether9
add bridge=lan-bridge comment=LAN interface=ether10
/ip neighbor discovery-settings
set discover-interface-list=none
/interface list member
add interface=sfp-sfpplus1 list=WAN
add interface=ether1 list=WAN
add interface=lan-bridge list=LAN
add interface=vlan1.4 list=WAN
add interface=vlan1.6 list=WAN
add interface=pppoe-client list=WAN
/ip address
add address=192.168.88.1/24 comment=mgmt-ip interface=lan-bridge network=\
    192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
add default-route-distance=210 dhcp-options=option60-vendorclass disabled=no \
    interface=vlan1.4 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=192.168.88.20 comment="Decoder 1" dhcp-option-set=IPTV \
    mac-address=00:02:9B:E5:D0:49 server=lan-server
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes cache-max-ttl=1d servers=\
    194.109.6.66,194.109.9.99
/ip dns static
add address=192.168.88.1 name=firsthome.kzp.home
/ip firewall filter
add action=accept chain=input comment=\
    "DEF: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="DEF: drop invalid" connection-state=\
    invalid log=yes
add action=accept chain=input comment="DEF: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "DEF: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input dst-address=192.168.88.1 dst-port=2222 \
    in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="DEF: drop all not coming from LAN" \
    in-interface-list=!LAN log=yes
add action=accept chain=forward comment="DEF: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="DEF: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="DEF: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "DEF: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="DEF: drop invalid" connection-state=\
    invalid log=yes
add action=drop chain=forward comment="DEF: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN \
    log=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="IPTV: range 1" dst-address=\
    213.75.112.0/21 out-interface=vlan1.4
add action=masquerade chain=srcnat comment="IPTV: range 2" dst-address=\
    217.166.0.0/16 out-interface=vlan1.4
# pppoe-client not ready
add action=masquerade chain=srcnat comment="DEF: masquerade" ipsec-policy=\
    out,none out-interface=pppoe-client src-address=192.168.0.0/16
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=ether1 \
    src-address=192.168.0.0/16
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh address=192.168.88.0/24 port=2222
set api disabled=yes
set winbox disabled=yes
set api-ssl disabled=yes
/ip ssh
set strong-crypto=yes
/ipv6 address
# address pool error: pool not found: 0 (4)
add address=::1 from-pool=0 interface=lan-bridge
/ipv6 dhcp-client
add add-default-route=yes interface=pppoe-client pool-name=0 \
    pool-prefix-length=48 request=prefix use-peer-dns=no
/ipv6 firewall filter
# no interface
add action=accept chain=input connection-state=established in-interface=\
    pppoe-client
# no interface
add action=accept chain=input connection-state=related in-interface=\
    pppoe-client
# no interface
add action=accept chain=input in-interface=pppoe-client protocol=icmpv6
# no interface
add action=accept chain=input comment="DHCPv6 for public addresses" \
    dst-address=fe80::/64 dst-port=546 in-interface=pppoe-client log-prefix=\
    DHCPv6 protocol=udp
# no interface
add action=reject chain=input in-interface=pppoe-client reject-with=\
    icmp-port-unreachable
# no interface
add action=accept chain=forward connection-state=related in-interface=\
    pppoe-client
# no interface
add action=accept chain=forward connection-state=established in-interface=\
    pppoe-client
# no interface
add action=reject chain=forward in-interface=pppoe-client reject-with=\
    icmp-no-route
/ipv6 nd
set [ find default=yes ] disabled=yes
add advertise-mac-address=no hop-limit=64 interface=lan-bridge
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=0.0.0.0/0 interface=vlan1.4 upstream=yes
add interface=lan-bridge
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=firsthome
/system logging
add topics=firewall,pppoe,ppp
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool sniffer
set file-name=capture-20210307-02.pcap filter-interface=sfp-sfpplus1 \
    filter-stream=yes streaming-enabled=yes streaming-server=192.168.88.191