# sep/14/2019 11:43:55 by RouterOS 6.45.6
# software id =
#
# model = RouterBOARD 952Ui-5ac2nD
# serial number =
/interface bridge
add comment=LAN name=bridge1_lan1
add name=bridge2_work
/interface ethernet
set [ find default-name=ether1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=\
GPON_WAN
set [ find default-name=ether2 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=MGMT \
speed=1Gbps
set [ find default-name=ether3 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=\
WORKSTATION
set [ find default-name=ether4 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=RES
set [ find default-name=ether5 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=RES
/interface wireless
set [ find default-name=wlan2 ] comment=WLAN2 ssid=MikroTik
/interface eoip
add allow-fast-path=no ipsec-secret=pass local-address=10.101. \
mac-address=mac name=e_tunel_work remote-address=\
ip tunnel-id=xxxx
/interface wireless manual-tx-power-table
set wlan2 comment=WLAN2
/interface wireless nstreme
set wlan2 comment=WLAN2
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
management-protection=allowed mode=dynamic-keys name=profile1_soho \
supplicant-identity="" wpa-pre-shared-key=pass \
wpa2-pre-shared-key=pass
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
management-protection=allowed mode=dynamic-keys name=profile2_home \
supplicant-identity="" wpa-pre-shared-key=pass \
wpa2-pre-shared-key=pass
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n comment=WLAN1 country=russia \
disabled=no frequency=2452 mode=ap-bridge security-profile=profile2_home \
ssid=GTW_HOME tx-power=12 tx-power-mode=all-rates-fixed \
wireless-protocol=802.11 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=mac \
master-interface=wlan1 multicast-buffering=disabled name= \
security-profile=profile1_soho ssid=GTW wds-cost-range=0 \
wds-default-cost=0 wps-mode=disabled
/interface wireless manual-tx-power-table
set wlan1 comment=WLAN1
/interface wireless nstreme
set wlan1 comment=WLAN1
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=pool1_lan1 ranges=192.168.
add name=dhcp_pool2 ranges=192.168.
add name=dhcp_pool3 ranges=10.5.0.
/ip dhcp-server
add address-pool=pool1_lan1 disabled=no interface=bridge1_lan1 name=dhcp1
add address-pool=dhcp_pool3 disabled=no interface=ether1 name=dhcp2
/ppp profile
add local-address=192.168 name=profile1_pptp_home remote-address=\
192.168 use-encryption=yes
/interface bridge port
add bridge=bridge1_lan1 interface=ether2
add bridge=bridge1_lan1 interface=ether3
add bridge=bridge1_lan1 interface=wlan1
add bridge=bridge1_lan1 interface=ether4
/ip address
add address=192. interface=bridge1_lan1 network=192.
add address=10. interface=ether1 network=10.
/ip dhcp-server lease
add address=192. client-id=mac mac-address=\
mac server=dhcp1
add address=192. client-id=mac mac-address=\
mac server=dhcp1
add address=192. client-id=mac mac-address=\
mac server=dhcp1
add address=192. client-id=mac mac-address=\
mac server=dhcp1
/ip dhcp-server network
add address=10./24 gateway=10.
add address=192/24 gateway=192.
/ip dns
set allow-remote-requests=yes servers=
/ip dns static
add address=127.0.0.1 disabled=yes name=corel.com
add address=127.0.0.1 disabled=yes name=mc.corel.com
/ip firewall filter
add action=add-src-to-address-list address-list=DNS_FLOOD \
address-list-timeout=none-dynamic chain=input dst-port=53 in-interface=\
ether5 protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether5 protocol=udp
add action=drop chain=forward comment="deny valve steam" disabled=yes \
dst-port=4380,3478,4379,4380,27000-28999 protocol=udp
add action=drop chain=forward comment="deny valve" disabled=yes dst-port=\
3478,4379,4380,27000-27031,27036,28020-28045,28120-28145 protocol=tcp
add action=drop chain=forward comment="deny valve" disabled=yes dst-port=\
4380,3478,4379,4380,27000-27031,27036,28020-28045,28120-28145 protocol=\
udp
add action=drop chain=forward comment="deny wf" content=mail.ru disabled=yes \
src-address=192.168/24
add action=drop chain=input dst-port=20-25,53,135-139,445 protocol=udp
add action=accept chain=input comment="allow for pptp" dst-port=1723 \
protocol=tcp
add action=accept chain=input protocol=gre
add action=drop chain=input dst-port=20-25,53,135-139,445 protocol=tcp
add action=drop chain=input comment="deny icmp " in-interface=ether5 \
protocol=icmp src-address=!192./24
add action=reject chain=forward comment=deny_win_updates content=\
windowsupdate.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_ad.adriver.ru content=\
ad.adriver.ru reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_googleads.g.doubleclick.net \
content=googleads.g.doubleclick.net reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_pagead2.googlesyndication.com \
content=pagead2.googlesyndication.com reject-with=\
icmp-network-unreachable
add action=reject chain=forward comment=deny_download.windowsupdate.com \
content=download.windowsupdate.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_windowsupdate.com content=\
windowsupdate.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_ntservicepack.microsoft.com \
content=ntservicepack.microsoft.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_stats.microsoft.com content=\
stats.microsoft.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_wustat.windows.com content=\
wustat.windows.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_update.microsoft.com content=\
update.microsoft.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_corel.com content=corel.com \
reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_mc.corel.com content=\
mc.corel.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_ipm.corel.com content=\
ipm.corel.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_dam.corel.com content=\
dam.corel.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_diws.corel.com content=\
iws.corel.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_ads.viber.com content=\
ads.viber.com reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_an.yandex.ru content=\
an.yandex.ru reject-with=icmp-network-unreachable
add action=reject chain=forward comment=deny_license.piriform.com content=\
license.piriform.com reject-with=icmp-network-unreachable
/ip firewall nat
add action=masquerade chain=srcnat comment="all to out" out-interface=ether1 \
src-address=192.168/24
add action=masquerade chain=srcnat comment="all to out" disabled=yes \
src-address=10.5.24
/ip firewall raw
add action=drop chain=prerouting comment=BlackList src-address-list=blacklist
/ip route
add comment=gtw distance=1 gateway=10.
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip smb
set allow-guests=no
/ip smb shares
set [ find default=yes ] disabled=yes
/ppp secret
add name=user1 password=pswrds profile=profile1_pptp_home
add disabled=yes name=gtw password=pswrds profile=profile1_pptp_home service=\
pptp
/system clock
set time-zone-name=Asia
/system clock manual
set time-zone=+05:00
/system identity
set name=MikroTik_GTW
/system ntp client
set enabled=yes primary-ntp=194.40.240.11 secondary-ntp=194.40.240.12
/system scheduler
add disabled=yes interval=1d name=schedule1_wireless_wlan1_off on-event=\
"/inteface wireless disable 0" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=sep/11/2019 start-time=01:00:00
add disabled=yes interval=1d name=schedule1_wireless_wlan1_on on-event=\
"/interface wireless enable 0" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=sep/11/2019 start-time=07:00:00
add interval=1d name="Every day reboot GTW" on-event="/system reboot" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=sep/11/2019 start-time=06:00:00
/tool traffic-monitor
add interface=ether5 name=WAN on-event=":log info \"WAN DOWNLOADING UP 2M\"" \
threshold=2000000