/interface bridge
add arp=proxy-arp mtu=1500 name=bridge1
/interface ethernet
set [ find default-name=ether2 ] comment="Lan 1Gb" name=LAN2_Master
set [ find default-name=ether3 ] master-port=LAN2_Master name=LAN3_Slave
set [ find default-name=ether4 ] master-port=LAN2_Master name=LAN4_Slave
set [ find default-name=ether5 ] master-port=LAN2_Master name=LAN5_Slave
set [ find default-name=ether7 ] comment="Lan 100Mb" name=LAN7_Master
set [ find default-name=ether8 ] master-port=LAN7_Master name=LAN8_Slave
set [ find default-name=ether9 ] master-port=LAN7_Master name=LAN9_Slave
set [ find default-name=ether10 ] comment=IP-TV mtu=1480 name=LAN10 poe-out=\
off
set [ find default-name=ether1 ] comment=Internet name=WAN1
set [ find default-name=ether6 ] comment=IP-TV mac-address=xx:xx:xx:xx:xx:xx \
name=WAN2
set [ find default-name=sfp1 ] disabled=yes
/interface pppoe-client
add disabled=no interface=WAN1 max-mru=1480 max-mtu=1480 mrru=1600 name=\
Rostelecom password=BMsSx4qa use-peer-dns=yes user=fttx1000-224-247
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode \
antenna-gain=4 band=2ghz-b/g/n basic-rates-b="" channel-width=20/40mhz-eC \
country=russia disabled=no distance=indoors frequency=2437 \
guard-interval=long hw-protection-mode=rts-cts l2mtu=1600 mode=ap-bridge \
multicast-helper=disabled preamble-mode=short ssid=Mikrotik \
supported-rates-b="" tdma-period-size=auto tx-power-mode=all-rates-fixed \
wireless-protocol=802.11 wmm-support=enabled
/interface pptp-server
add name=my-pptp user=summit
/interface wireless nstreme
set wlan1 enable-polling=no
/ip neighbor discovery
set LAN2_Master comment="Lan 1Gb" discover=no
set LAN3_Slave discover=no
set LAN4_Slave discover=no
set LAN5_Slave discover=no
set LAN7_Master comment="Lan 100Mb" discover=no
set LAN8_Slave discover=no
set LAN9_Slave discover=no
set LAN10 comment=IP-TV discover=no
set WAN1 comment=Internet discover=no
set WAN2 comment=IP-TV discover=no
set sfp1 discover=no
set wlan1 discover=no
set Rostelecom discover=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=\
dynamic-keys wpa-pre-shared-key=xxxxx wpa2-pre-shared-key=xxxxx
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des pfs-group=none
/ip pool
add name=dhcp1 ranges=192.168.3.2-192.168.3.50
/ip dhcp-server
add address-pool=dhcp1 disabled=no interface=bridge1 lease-time=2d name=\
dhcp-server1
/interface l2tp-client
add connect-to=46.165.197.1 disabled=no mrru=1600 name=l2tp-out password=\
xxxxxx profile=default user=xxxxx
/system logging action
add disk-file-count=10 disk-file-name=disk2/log/log name=usb target=disk
/interface bridge filter
add action=drop chain=output comment="Drop Multicast packet" out-interface=\
!LAN10 packet-type=multicast
add action=drop chain=input in-interface=!LAN10 packet-type=multicast
/interface bridge port
add bridge=bridge1 interface=LAN2_Master
add bridge=bridge1 interface=LAN7_Master
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=LAN10
/interface l2tp-server server
set authentication=mschap1,mschap2 default-profile=default
/interface ovpn-server server
set cipher=blowfish128,aes128,aes192,aes256 mode=ethernet port=443 \
require-client-certificate=yes
/interface pptp-server server
set authentication=mschap2 default-profile=default enabled=yes
/ip address
add address=192.168.3.1/24 interface=bridge1 network=192.168.3.0
/ip arp
add address=192.168.3.2 interface=bridge1 mac-address=BC:5F:F4:D4:E0:7E
add address=192.168.3.3 interface=bridge1 mac-address=00:26:AA:01:E3:43
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add add-default-route=no dhcp-options=hostname,clientid disabled=no \
interface=WAN2 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=192.168.3.4 mac-address=74:5E:1C:01:F9:88 server=dhcp-server1
add address=192.168.3.5 always-broadcast=yes client-id=1:c0:f8:da:a9:5d:ab \
mac-address=C0:F8:DA:A9:5D:AB server=dhcp-server1
add address=192.168.3.3 always-broadcast=yes mac-address=00:26:AA:01:E3:43 \
server=dhcp-server1
add address=192.168.3.2 client-id=1:bc:5f:f4:d4:e0:7e mac-address=\
BC:5F:F4:D4:E0:7E server=dhcp-server1
add address=192.168.3.6 mac-address=40:2C:F4:2E:AC:A2 server=dhcp-server1
add address=192.168.3.7 always-broadcast=yes client-id=1:14:9a:10:68:51:c0 \
mac-address=14:9A:10:68:51:C0 server=dhcp-server1
/ip dhcp-server network
add address=192.168.3.0/24 dns-server=192.168.3.1 gateway=192.168.3.1 \
netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=212.20.59.26 name=sdp.svc.iptv.rt.ru
/ip firewall address-list
add address=185.85.120.10 comment=LostFilm list=web_block
add address=37.1.200.176 disabled=yes list=web_block
add address=179.43.151.249 comment="HD Club" disabled=yes list=web_block
/ip firewall filter
add action=jump chain=input comment="Drop pptp brute forcers" \
connection-state=new dst-port=1723 jump-target="Drop PPTP" protocol=tcp
add action=drop chain="Drop PPTP" src-address-list=Black_PPTP
add action=add-src-to-address-list address-list=Black_PPTP chain="Drop PPTP" \
connection-state=new src-address-list=pptp_stage2
add action=add-src-to-address-list address-list=pptp_stage2 \
address-list-timeout=1m chain="Drop PPTP" connection-state=new \
src-address-list=pptp_stage1
add action=add-src-to-address-list address-list=pptp_stage1 \
address-list-timeout=1m chain="Drop PPTP" connection-state=new
add chain=input comment="IPTV accept" dst-port=5000 protocol=udp
add chain=input protocol=igmp
add action=drop chain=input comment="Disable DNS requests from internet" \
connection-state=new dst-port=53 in-interface=Rostelecom protocol=udp
add chain=input comment="Allow ICMP" protocol=icmp
add chain=input comment="Accept established and related connections" \
connection-state=established,related
add chain=input comment="Accept access for Local Network" src-address=\
192.168.3.0/24
add chain=input comment="Accept WinBox" connection-state=new dst-port=8291 \
protocol=tcp
add chain=input comment="Accept PPTP tunels" connection-state=new dst-port=\
1723 protocol=tcp
add chain=input connection-state=new protocol=gre
add action=drop chain=input comment="Drop invalid connection" \
connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=drop chain=input comment="Drop all Mikrotik input connection" \
connection-state=new
/ip firewall mangle
add action=mark-routing chain=prerouting comment="Marking from VPN" \
dst-address-list=web_block new-routing-mark=vpn
/ip firewall nat
add action=masquerade chain=srcnat comment=Masquerade out-interface=\
Rostelecom
add action=masquerade chain=srcnat out-interface=l2tp-out
add action=masquerade chain=srcnat out-interface=WAN2
add action=dst-nat chain=dstnat comment="For Torrent NAS" dst-port=55971 \
in-interface=Rostelecom protocol=tcp to-addresses=192.168.3.2 to-ports=\
55971
add action=dst-nat chain=dstnat dst-port=55971 in-interface=Rostelecom \
protocol=udp to-addresses=192.168.3.2 to-ports=55971
add action=dst-nat chain=dstnat comment="For Skype" dst-port=16936 \
in-interface=Rostelecom protocol=tcp to-addresses=192.168.3.0/24 \
to-ports=16936
add action=dst-nat chain=dstnat dst-port=16936 in-interface=Rostelecom \
protocol=udp to-addresses=192.168.3.0/24 to-ports=16936
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/ip proxy
set cache-administrator=webadmin cache-on-disk=yes cache-path=disk2/proxy
/ip route
add distance=1 gateway=l2tp-out routing-mark=vpn
add distance=1 gateway=Rostelecom
add distance=1 dst-address=212.20.0.0/16 gateway=10.60.80.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip smb
set domain=WORKGROUP
/ip upnp
set allow-disable-external-interface=yes
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=Rostelecom type=external
/lcd
set backlight-timeout=5m default-screen=stats time-interval=hour
/lcd interface
set sfp1 disabled=yes
/lcd interface pages
set 0 interfaces="WAN1,LAN2_Master,LAN3_Slave,LAN4_Slave,LAN5_Slave,WAN2,LAN7_\
Master,LAN8_Slave,LAN9_Slave,LAN10,wlan1"
/lcd screen
set 0 timeout=5s
set 1 timeout=5s
set 2 timeout=5s
set 3 timeout=5s
set 4 timeout=5s
set 5 timeout=5s
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=0.0.0.0/0 interface=WAN2 upstream=yes
add interface=bridge1
/routing pim
set switch-to-spt=no
/system clock
set time-zone-autodetect=no time-zone-name=Asia/Novosibirsk
/system clock manual
set dst-delta=+06:00 dst-end="oct/26/2014 02:00:00" time-zone=+06:00
/system logging
set 0 action=usb
set 1 action=usb
set 2 action=usb
set 3 action=usb
add action=usb topics=wireless
add topics=script
add disabled=yes topics=pptp
add disabled=yes topics=igmp-proxy
add disabled=yes topics=pppoe
add disabled=yes topics=l2tp
/system ntp client
set enabled=yes primary-ntp=93.180.6.3 secondary-ntp=194.33.191.69
/system ntp server
set enabled=yes
/system routerboard settings
set cpu-frequency=700MHz
/system scheduler
add disabled=yes interval=1d name="Wi-Fi On" on-event=\
"/interface wireless enable 0" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
mar/09/2014 start-time=07:00:00
add disabled=yes interval=1d name="Wi-Fi Off" on-event=\
"/interface wireless disable 0" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
mar/09/2014 start-time=23:59:00
add interval=5m name=Ping on-event="/system script run ping_pppoe;" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
jan/18/2015 start-time=14:09:08
add disabled=yes name=Time on-event=":delay 100;\r\
\n/system scheduler disable Ping;\r\
\n/system script run ping_time;" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=\
startup
add interval=1w name="Backup E-Mail" on-event=\
"/system script run \"Backup E-Mail\"" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
mar/09/2014 start-time=00:00:01
/system script
add name=ping_pppoe owner=alexius policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":local \
MainIf \"Rostelecom\"\r\
\n:local PingCount 3\r\
\n:local google 8.8.8.8\r\
\n:local yandex 77.88.8.8\r\
\n:local mail 94.100.180.201\r\
\n:local ResultGoogle [/ping count=\$PingCount interface=\$MainIf \$Google\
\_]\r\
\n:local Resultyandex [/ping count=\$PingCount interface=\$MainIf \$yandex\
]\r\
\n:local ResultMail [/ping count=\$PingCount interface=\$MainIf \$mail]\r\
\n:local MainIfInetOk false;\r\
\n:set MainIfInetOk ((\$ResultGoogle + \$Resultyandex + \$ResultMail) >= (\
2 * \$PingCount))\r\
\n:put \"MainIfInetOk=\$MainIfInetOk\"\r\
\nif (!\$MainIfInetOk) do={\r\
\n/log error \"Bad connect\"\r\
\n:interface pppoe-client disable \$MainIf;\r\
\n:delay 5;\r\
\n:interface pppoe-client enable \$MainIf;\r\
\n}\r\
\nif (\$MainIfInetOk) do={\r\
\n#/log info \"Connect OK\"\r\
\n}"
add name="Backup E-Mail" owner=alexius policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":log in\
fo \"Starting Backup Script...\";\r\
\n:local sysname [/system identity get name];\r\
\n:local sysver [/system package get system version];\r\
\n:log info \"Flushing DNS cache...\";\r\
\n/ip dns cache flush;\r\
\n:delay 2;\r\
\n:log info \"Deleting last Backups...\";\r\
\n:foreach i in=[/file find] do={:if ([:typeof [:find [/file get \$i name]\
\_\\\r\
\n\"\$sysname-backup-\"]]!=\"nil\") do={/file remove \$i}};\r\
\n:delay 2;\r\
\n:local smtpserv [:resolve \"smtp.gmail.com\"];\r\
\n:local Eaccount \"summit1423@gmail.com\";\r\
\n:local pass \"router1423\";\r\
\n:local backupfile (\"\$sysname-backup-\" . \\\r\
\n[:pick [/system clock get date] 7 11] . [:pick [/system \\\r\
\nclock get date] 0 3] . [:pick [/system clock get date] 4 6] . \".backup\
\");\r\
\n:log info \"Creating new Full Backup file...\";\r\
\n/system backup save name=\$backupfile;\r\
\n:delay 2;\r\
\n:log info \"Sending Full Backup file via E-mail...\";\r\
\n/tool e-mail send from=\"<\$Eaccount>\" to=\$Eaccount server=\$smtpserv \
\\\r\
\nport=587 user=\$Eaccount password=\$pass start-tls=yes file=\$backupfile\
\_\\\r\
\nsubject=(\"\$sysname Full Backup (\" . [/system clock get date] . \")\")\
\_\\\r\
\nbody=(\"\$sysname full Backup file see in attachment.\\nRouterOS version\
: \\\r\
\n\$sysver\\nTime and Date stamp: \" . [/system clock get time] . \" \" . \
\\\r\
\n[/system clock get date]);\r\
\n:delay 5;\r\
\n:local exportfile (\"\$sysname-backup-\" . \\\r\
\n[:pick [/system clock get date] 7 11] . [:pick [/system \\\r\
\nclock get date] 0 3] . [:pick [/system clock get date] 4 6] . \".rsc\");\
\r\
\n:log info \"Creating new Setup Script file...\";\r\
\n/export verbose file=\$exportfile;\r\
\n:delay 2;\r\
\n:log info \"Sending Setup Script file via E-mail...\";\r\
\n/tool e-mail send from=\"<\$Eaccount>\" to=\$Eaccount server=\$smtpserv \
\\\r\
\nport=587 user=\$Eaccount password=\$pass start-tls=yes file=\$exportfile\
\_\\\r\
\nsubject=(\"\$sysname Setup Script Backup (\" . [/system clock get date] \
. \\\r\
\n\")\") body=(\"\$sysname Setup Script file see in attachment.\\nRouterOS\
\_\\\r\
\nversion: \$sysver\\nTime and Date stamp: \" . [/system clock get time] .\
\_\" \\\r\
\n\" . [/system clock get date]);\r\
\n:delay 5;\r\
\n:log info \"All System Backups emailed successfully.\\nBackuping complet\
ed.\";\r\
\n}"
add name="eoip tunnel ip check" owner=alexius policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive source="/ip dns\
\_cache flush\r\
\n:local currentip [:resolve 4ac704683cde.sn.mynetname.net];\r\
\n#:log info \"IP EoIP tunnel \$currentip\";\r\
\n:local tempip [/interface eoip get [/interface eoip find name=\"eoip-tun\
nel\"] remote-address];\r\
\n#:log info \"Connect To \$tempip\";\r\
\n\r\
\n:if (\$currentip != \$tempip) do={ \r\
\n:log info \"Menyaem IP adress EoIP tunnel\"\r\
\n:log info \"444a02ce6af4.sn.mynetname.net \$currentip\" \r\
\n/int eoip set \"eoip-tunnel\" remote-addres=\$currentip\r\
\n}"
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge1
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge1
/tool romon port
add
/tool sniffer
set filter-interface=LAN10 filter-stream=yes streaming-enabled=yes \
streaming-server=192.168.3.2
