mikrotik-config-2

# model = RBwAPG-5HacT2HnD

# serial number = D8F80CB0C736

/interface bridge

add comment=defconf name=bridge

/interface list

add comment=defconf name=WAN

add comment=defconf name=LAN

/interface wireless security-profiles

set [ find default=yes ] supplicant-identity=MikroTik

add authentication-types=wpa-psk,wpa2-psk management-protection=allowed mode=dynamic-keys name=profile1 supplicant-identity=MikroTik

/interface wireless

set [ find default-name=wlan1 ] band=2ghz-b disabled=no distance=indoors frequency=auto installation=outdoor mode=ap-bridge security-profile=profile1 ssid=MikroTik-AA400E-2.4GHz wireless-protocol=802.11

set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto installation=outdoor mode=ap-bridge security-profile=profile1 ssid=MikroTik-AA400D-5GHz wireless-protocol=802.11

/ip hotspot profile

set [ find default=yes ] html-directory=flash/hotspot

/ip pool

add name=dhcp ranges=192.168.88.10-192.168.88.254

/ip dhcp-server

add address-pool=dhcp disabled=no interface=bridge name=defconf

/queue tree

add max-limit=10M name=to-fr-parent parent=global

add limit-at=200k max-limit=10M name=to-fr-high-prio packet-mark=br-high-prio-to-fr parent=to-fr-parent priority=1

add limit-at=2M max-limit=10M name=to-fr-low-prio packet-mark=br-bulk-to-fr parent=to-fr-parent

add max-limit=10M name=from-fr-parent parent=global

add limit-at=200k max-limit=10M name=from-fr-high-prio packet-mark=br-high-prio-from-fr parent=from-fr-parent priority=1

add limit-at=2M max-limit=10M name=from-fr-low-prio packet-mark=br-bulk-from-fr parent=from-fr-parent

/queue simple

add disabled=yes max-limit=10M/10M name=in-parent queue=default/default target=192.168.88.0/24

add disabled=yes limit-at=1M/1M max-limit=10M/10M name=in-high-prio packet-marks=br-high-prio parent=in-parent priority=1/1 target=192.168.88.0/24

add disabled=yes limit-at=2M/2M max-limit=10M/10M name=in-bulk packet-marks=br-bulk parent=in-parent queue=default/default target=192.168.88.0/24

/interface bridge filter

add action=mark-packet chain=forward dst-address=192.168.88.254/32 dst-port=5150 ip-protocol=tcp log=yes mac-protocol=ip new-packet-mark=br-high-prio-to-fr

add action=mark-packet chain=forward ip-protocol=tcp log=yes mac-protocol=ip new-packet-mark=br-high-prio-from-fr src-address=192.168.88.254/32 src-port=5150

add action=mark-packet chain=forward ip-protocol=tcp log=yes mac-protocol=ip new-packet-mark=br-bulk-from-fr src-address=192.168.88.254/32 src-port=!5150

add action=mark-packet chain=forward dst-address=192.168.88.254/32 dst-port=!5150 ip-protocol=tcp log=yes mac-protocol=ip new-packet-mark=br-bulk-to-fr

/interface bridge port

add bridge=bridge comment=defconf interface=wlan1

add bridge=bridge comment=defconf interface=wlan2

add bridge=bridge interface=ether1

/interface bridge settings

set use-ip-firewall=yes

/ip neighbor discovery-settings

set discover-interface-list=LAN

/interface list member

add comment=defconf interface=bridge list=LAN

add comment=defconf interface=ether1 list=WAN

/ip address

add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0

/ip dhcp-client

# DHCP client can not run on slave interface!

add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1

/ip dhcp-server network

add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1

/ip dns

set allow-remote-requests=yes

/ip dns static

add address=192.168.88.1 comment=defconf name=router.lan

/ip firewall filter

add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked

add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid

add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp

add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1

add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec

add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes

add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked

add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid

add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

/ip firewall mangle

add action=mark-packet chain=forward disabled=yes dst-port=5150 log=yes log-prefix=PrioToFR new-packet-mark=high-prio passthrough=yes protocol=tcp src-address=192.168.88.21

add action=mark-packet chain=forward disabled=yes log=yes log-prefix=PrioFromFR new-packet-mark=high-prio passthrough=yes protocol=tcp src-address=192.168.88.254 src-port=5150

add action=mark-packet chain=forward disabled=yes dst-port=!5150 new-packet-mark=bulk passthrough=yes protocol=tcp src-address=192.168.88.21

add action=mark-packet chain=forward disabled=yes new-packet-mark=bulk passthrough=yes protocol=tcp src-address=192.168.88.254 src-port=!5150

/ip firewall nat

add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

/tool mac-server

set allowed-interface-list=LAN

/tool mac-server mac-winbox

set allowed-interface-list=LAN