






# jul/25/2018 15:38:25 by RouterOS 6.39.2
# software id = Z439-4UXW
#
/interface bridge
add admin-mac=CC:2D:E0:3F:17:54 auto-mac=no comment=defconf name=bridge
add name=bridge_wlan
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
/interface pppoe-client
add add-default-route=yes interface=ether1 name=pppoe-out1 use-peer-dns=yes
/interface pptp-server
add name=pptp-in1 user=""
/interface wireless
set [ find default-name=wlan1 ] arp=proxy-arp band=2ghz-b/g/n channel-width=\
    20/40mhz-Ce disabled=no distance=indoors frequency=auto mode=ap-bridge \
    ssid=MikroTik-3F175A wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee \
    disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=\
    MikroTik-3F1759 wireless-protocol=802.11
add disabled=no mac-address=CE:2D:E0:3F:17:59 master-interface=wlan2 name=wlan5 \
    ssid=NTTguest
add disabled=no mac-address=CE:2D:E0:3F:17:5A master-interface=wlan1 name=wlan6 \
    ssid=NTTguest
/interface list
add name=list1
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys wpa-pre-shared-key=*** wpa2-pre-shared-key=***
add authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys name=profile \
    wpa-pre-shared-key=guest wpa2-pre-shared-key=guest
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed \
    mode=dynamic-keys name=guest supplicant-identity="" wpa-pre-shared-key=\
    WiFiguest wpa2-pre-shared-key=WiFiguest
/ip dhcp-server
add disabled=no interface=ether1 name=dhcp3
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp ranges=192.168.0.151-192.168.0.199
add name=vpn-pool ranges=192.168.3.2-192.168.3.254
add name=vpn ranges=192.168.89.2-192.168.89.255
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge_wlan name=defconf
add address-pool=dhcp disabled=no name=server1
add address-pool=dhcp disabled=no interface=ether5 name=dhcp2
add address-pool=dhcp disabled=no interface=bridge name=dhcp1
/ppp profile
add change-tcp-mss=yes dns-server=192.168.0.231,192.168.89.1 local-address=\
    192.168.3.1 name=vpn remote-address=vpn-pool use-encryption=yes
set *FFFFFFFE dns-server=192.168.0.231,192.168.89.1 local-address=192.168.89.1 \
    remote-address=vpn
/interface bridge filter
# no interface
add action=drop chain=forward in-interface=*F
# no interface
add action=drop chain=forward out-interface=*F
# no interface
add action=drop chain=forward in-interface=*D
# no interface
add action=drop chain=forward out-interface=*D
add action=drop chain=forward in-interface=wlan5
add action=drop chain=forward out-interface=wlan5
add action=drop chain=forward in-interface=wlan6
add action=drop chain=forward out-interface=wlan6
/interface bridge port
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge interface=ether2-master
add bridge=bridge
add bridge=bridge
add bridge=bridge interface=wlan5
add bridge=bridge interface=wlan6
/interface l2tp-server server
set enabled=yes ipsec-secret=Password use-ipsec=yes
/interface list member
add interface=wlan1 list=list1
/interface pptp-server server
set authentication=mschap2 enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/ip address
add address=192.168.0.1/24 comment=defconf interface=ether2-master network=\
    192.168.0.0
add address=91.x.x.86/30 interface=ether1 network=91.x.x.84
/ip cloud
set ddns-enabled=yes update-time=no
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=192.168.0.0/24 comment=defconf gateway=192.168.0.1 netmask=24
add address=192.168.89.0/24 dns-server=192.168.0.231,192.168.89.1,91.151.196.68 \
    gateway=192.168.89.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=91.x.x.68,192.168.0.231
/ip dns static
add address=192.168.0.1 name=router
/ip firewall address-list

/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes
add action=accept chain=forward comment="defconf: accept established,related" \
    connection-state=established,related
add action=accept chain=forward dst-address=192.168.0.0/24 src-address=\
    192.168.3.0/24
add action=accept chain=forward dst-address=192.168.0.0/24 dst-port=3389 \
    protocol=tcp src-address=192.168.3.0/24
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add chain=input comment="Allow IKE" dst-port=500 protocol=udp
add chain=input comment="Allow IPSec-esp" protocol=ipsec-esp
add chain=input comment="Allow IPSec-ah" protocol=ipsec-ah
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=accept chain=input comment="Allow UDP" disabled=yes protocol=udp
add action=drop chain=forward in-interface=all-wireless out-interface=\
    all-ethernet
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface=ether1
add action=drop chain=input in-interface=ether1
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.122.0/24 src-address=\
    192.168.0.0/24
add action=accept chain=srcnat disabled=yes dst-address=176.x.x.162 \
    src-address=192.168.100.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=\
    ether1
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
    192.168.89.0/24
add action=netmap chain=dstnat dst-port=60000 in-interface=ether1 protocol=tcp \
    src-address-list=mango1 to-addresses=192.168.0.240
add action=netmap chain=dstnat dst-port=60000 in-interface=ether1 protocol=udp \
    src-address-list=mango1 to-addresses=192.168.0.240
add action=netmap chain=dstnat dst-port=5060 in-interface=ether1 protocol=udp \
    src-address-list=mango1 to-addresses=192.168.0.240
add action=netmap chain=dstnat in-interface=ether1 src-address-list=mango2 \
    to-addresses=192.168.0.240
add action=netmap chain=dstnat dst-port=3478-3479 in-interface=ether1 protocol=\
    tcp src-address-list=mango3 to-addresses=192.168.0.240
add action=netmap chain=dstnat dst-port=3478-3479 in-interface=ether1 port="" \
    protocol=udp src-address-list=mango3 to-addresses=192.168.0.240
/ip ipsec peer
add address=176.x.x.162/32 dh-group=modp1536 exchange-mode=main-l2tp \
    generate-policy=port-override nat-traversal=no secret=***
/ip route
add distance=1 gateway=91.151.196.85
add disabled=yes distance=1 dst-address=10.189.65.0/24 gateway=ether1 pref-src=\
    91.x.x.86
add check-gateway=ping distance=1 dst-address=192.168.122.0/24 gateway=bridge
add distance=1 dst-address=192.168.122.0/24 gateway=ether1
/ip route rule
add action=drop disabled=yes interface=ether4 routing-mark="" src-address=\
    192.168.88.0/24
/ip service
set telnet address=192.168.0.0/24,192.168.3.0/24,192.168.122.0/24
set ftp address=192.168.0.0/24,192.168.3.0/24,192.168.122.0/24
set ssh address=192.168.0.0/24,192.168.3.0/24,192.168.122.0/24
set winbox address=192.168.0.0/24,192.168.3.0/24,192.168.122.0/24
/ppp aaa
set use-radius=yes
/ppp secret
add name=vpnuser password=Password profile=vpn
add name=vpn password=Password
add name=vpnnew password=vpn profile=vpn
/radius
add address=192.168.0.231 domain=electro secret=*** service=\
    ppp,login,dhcp,ipsec
/system clock
set time-zone-name=Europe/Moscow