# jun/08/2020 00:41:39 by RouterOS 6.46.5
# software id = MMKB-HQVC
#
# model = 2011UiAS-2HnD
# serial number = 727A06******
/caps-man channel
add band=2ghz-g/n control-channel-width=20mhz extension-channel=XX frequency=2437 name=CAPS2_6ch tx-power=20
add band=2ghz-g/n control-channel-width=20mhz extension-channel=Ce frequency=2412 name=CAPS2_1ch tx-power=17
add band=2ghz-g/n control-channel-width=20mhz extension-channel=eC frequency=2462 name=CAPS2_11ch tx-power=17
add band=5ghz-a/n/ac extension-channel=disabled name=CAPS5_5g
/caps-man datapath
add client-to-client-forwarding=yes local-forwarding=yes name=datapath1_forw_caps
/interface bridge
add admin-mac=6C:3B:6B:**:**:** auto-mac=no comment=Bridge igmp-snooping=yes name=bridge
/interface ethernet
set [ find default-name=sfp1 ] comment="WAN ISP1" name=SFP
set [ find default-name=ether1 ] comment="WAN ISP2" speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether7 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether8 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether9 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether10 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface pppoe-server
add name=pppoe-dm7000s service=service8 user=dm7000s
/interface wireless
# managed by CAPsMAN
# channel: 2437/20-eC/gn(16dBm), SSID: MikroTik-RB2011UiAS-2HnD, local forwarding
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode band=2ghz-b/g/n country=russia \
    disabled=no disconnect-timeout=15s distance=indoors frequency-mode=manual-txpower hw-protection-mode=rts-cts \
    mode=ap-bridge multicast-buffering=disabled on-fail-retry-time=150ms preamble-mode=long ssid=MikroTik-RB2011 \
    tx-power-mode=all-rates-fixed wireless-protocol=802.11
/caps-man security
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm,tkip group-encryption=aes-ccm name=CAPS_sec
/caps-man configuration
add channel=CAPS2_1ch country=russia datapath=datapath1_forw_caps distance=indoors guard-interval=long \
    hw-protection-mode=cts-to-self keepalive-frames=enabled max-sta-count=20 mode=ap multicast-helper=full name=\
    cfg2-1 rx-chains=0,1,2,3 security=CAPS_sec ssid=MikroTik-RB2011UiAS-2HnD tx-chains=0,1,2,3
add channel=CAPS2_6ch country=russia datapath=datapath1_forw_caps distance=indoors guard-interval=long \
    hw-protection-mode=cts-to-self keepalive-frames=enabled max-sta-count=20 mode=ap multicast-helper=full name=\
    cfg2-6 rx-chains=0,1,2,3 security=CAPS_sec ssid=MikroTik-RB2011UiAS-2HnD tx-chains=0,1,2,3
add channel=CAPS2_11ch country=russia datapath=datapath1_forw_caps distance=indoors guard-interval=long \
    hw-protection-mode=cts-to-self keepalive-frames=enabled max-sta-count=20 mode=ap multicast-helper=full name=\
    cfg2-11 rx-chains=0,1,2,3 security=CAPS_sec ssid=MikroTik-RB2011UiAS-2HnD tx-chains=0,1,2,3
add channel=CAPS5_5g country=russia datapath=datapath1_forw_caps distance=indoors guard-interval=long \
    hw-protection-mode=cts-to-self keepalive-frames=enabled max-sta-count=20 mode=ap multicast-helper=full name=\
    cfg5-1 rx-chains=0,1,2,3 security=CAPS_sec ssid=MikroTik-5 tx-chains=0,1,2,3
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm mode=dynamic-keys \
    supplicant-identity=MikroTik unicast-ciphers=tkip,aes-ccm
/ip pool
add name=dhcp-pool ranges=192.168.1.150-192.168.1.250
add name=pool_ppp ranges=192.168.1.81-192.168.1.89
/ip dhcp-server
add address-pool=dhcp-pool disabled=no interface=bridge lease-time=3d name=defconf
/ppp profile
add change-tcp-mss=yes dns-server=178.217.152.10,77.88.8.8 local-address=192.168.1.1 name=ppp10-10 rate-limit=\
    10M/10M remote-address=pool_ppp use-compression=no use-mpls=no wins-server=192.168.1.1
add change-tcp-mss=yes dns-server=178.217.152.10,77.88.8.8 local-address=192.168.1.1 name=ppp15-15 rate-limit=\
    15M/15M remote-address=pool_ppp use-compression=no use-mpls=no wins-server=192.168.1.1
add change-tcp-mss=yes dns-server=8.8.8.8 local-address=192.168.1.1 name=ppp20-20 rate-limit=20M/20M \
    remote-address=pool_ppp use-compression=no use-mpls=no wins-server=192.168.1.1
add change-tcp-mss=yes dns-server=178.217.152.10,77.88.8.8 local-address=192.168.1.1 name=pppUnlim \
    remote-address=pool_ppp use-compression=no use-mpls=no
add change-tcp-mss=yes dns-server=178.217.152.10,77.88.8.8 local-address=192.168.1.1 name=ppp50-50 rate-limit=\
    50M/50M remote-address=pool_ppp use-compression=no use-mpls=no wins-server=192.168.1.1
add change-tcp-mss=yes dns-server=178.217.152.10,77.88.8.8 local-address=192.168.1.1 name=ppp30-30 rate-limit=\
    30M/30M remote-address=pool_ppp use-compression=no use-mpls=no wins-server=192.168.1.1
set *FFFFFFFE dns-server=192.168.1.1 local-address=192.168.89.1
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/user group
set full policy=\
    local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=gn identity-regexp=2H master-configuration=cfg2-6
add action=create-dynamic-enabled hw-supported-modes=gn,b identity-regexp=2n master-configuration=cfg2-11
add action=create-dynamic-enabled hw-supported-modes=gn,b identity-regexp=2n master-configuration=cfg2-1
add action=create-dynamic-enabled hw-supported-modes=ac,ac identity-regexp=5a master-configuration=cfg5-1
add master-configuration=cfg2-1
/interface bridge filter
# in/out-bridge-port matcher not possible when interface (SFP) is not slave
add action=drop chain=forward in-interface=SFP
# in/out-bridge-port matcher not possible when interface (SFP) is not slave
add action=drop chain=forward out-interface=SFP
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf disabled=yes interface=SFP
add bridge=bridge interface=ether1
add bridge=bridge interface=ether10
add bridge=bridge interface=ether7
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=WAN wan-interface-list=WAN
/interface l2tp-server server
set use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=SFP list=WAN
add interface=ether1 list=WAN
/interface pppoe-server server
add authentication=mschap1,mschap2 default-profile=ppp15-15 disabled=no interface=ether6 keepalive-timeout=\
    disabled one-session-per-host=yes service-name=service6
add authentication=mschap1,mschap2 default-profile=pppUnlim disabled=no interface=ether8 keepalive-timeout=\
    disabled one-session-per-host=yes service-name=service8
/interface sstp-server server
set default-profile=default-encryption
/interface wireless cap
# 
set bridge=bridge discovery-interfaces=bridge enabled=yes interfaces=wlan1
/ip address
add address=192.168.1.1/24 comment=defconf interface=ether1 network=192.168.1.0
add address=10.195.7.91/30 interface=SFP network=10.195.7.88
/ip cloud
set update-time=no
/ip dhcp-client
add interface=SFP
/ip dhcp-server config
set store-leases-disk=1h
/ip dhcp-server lease
add address=192.168.1.60 client-id=1:48:44:f7:a0:**:** mac-address=48:44:F7:A0:F9:54 server=defconf
add address=192.168.1.100 client-id=1:0:1e:b8:15:**:** comment="SkyWay Andromeda" mac-address=00:1E:B8:15:6F:C0 \
    server=defconf
add address=192.168.1.95 comment=ChromeCast mac-address=6C:AD:F8:FC:**:** server=defconf
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf domain=domain.local gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=178.217.152.10,1.1.1.1,77.88.8.8
/ip dns static
add address=192.168.1.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="IPTV UDP forwarding" dst-port=1234 protocol=udp
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=UnblockCapsman dst-address-type=local src-address-type=local
add action=accept chain=input comment="Allow IGMP" in-interface=SFP protocol=igmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related \
    disabled=yes
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" dst-address=!192.168.1.0/24 ipsec-policy=\
    out,none out-interface-list=WAN src-address=192.168.1.0/24
/ip route
add distance=1 gateway=10.195.7.89
/ip smb
set enabled=yes
/ip smb shares
set [ find default=yes ] disabled=yes
add directory=/disk1 name=disk
/ip smb users
add name=admin read-only=no
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip upnp interfaces
add interface=bridge type=internal
add interface=SFP type=external
/ppp secret
add name=remote profile=ppp15-15 service=pppoe
add name=dm7000s profile=ppp20-20 service=pppoe
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=0.0.0.0/0 interface=SFP upstream=yes
add interface=bridge
/snmp
set contact=1 trap-interfaces=bridge trap-target=0.0.0.0
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=MikroTik2011UiAS-2HnD
/system scheduler
add interval=12h name=AutoBackup on-event="export file=disk1/backup_mikrotik/backup_auto" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=feb/10/2018 start-time=11:29:36
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN