Russian Users MikroTik | Форум пользователей MikroTik

# 2023-10-14 15:07:26 by RouterOS 7.11.2
# software id =
#
# model = RB4011iGS+5HacQ2HnD
# serial number =
/interface bridge
add name=bridge-LAN
add name=bridge-mobile
/interface ethernet
set [ find default-name=ether10 ] name=ether10-WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=profile-office \
supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=profile-mobile \
supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-onlyac channel-width=\
20/40/80mhz-XXXX country=russia3 disabled=no distance=indoors frequency=\
auto hw-protection-mode=rts-cts mode=ap-bridge name=wlan1-5GHz \
security-profile=profile-office ssid=wifi-Office \
wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=2ghz-onlyn channel-width=20/40mhz-XX \
country=russia3 disabled=no distance=indoors frequency=auto \
hw-protection-mode=rts-cts mode=ap-bridge name=wlan2-2GHz \
security-profile=profile-office ssid=wifi-Office \
wireless-protocol=802.11 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=4A:A9:8A:BC:C2:46 \
master-interface=wlan2-2GHz multicast-buffering=disabled name=wlan3-2Ghz \
security-profile=profile-mobile ssid=wifi-Mobile wds-cost-range=\
0 wds-default-cost=0 wps-mode=disabled
/ip pool
add name=dhcp_pool0 ranges=10.10.1.20-10.10.1.219
add name=dhcp_pool1 ranges=192.168.100.2-192.168.100.200
add name=vpn_pool ranges=10.10.2.2-10.10.2.50
/ip dhcp-server
add address-pool=dhcp_pool0 interface=bridge-LAN lease-time=1d name=dhcp1
add address-pool=dhcp_pool1 interface=bridge-mobile lease-time=1d name=dhcp2
/port
set 0 name=serial0
set 1 name=serial1
/ppp profile
add change-tcp-mss=yes local-address=10.10.2.1 name=vpn_profile \
remote-address=vpn_pool use-upnp=no
/queue simple
add max-limit=30M/30M name=queue1 queue=\
pcq-upload-default/pcq-download-default target=bridge-LAN
add max-limit=10M/10M name=queue2 queue=\
pcq-upload-default/pcq-download-default target=bridge-mobile
/interface bridge port
add bridge=bridge-LAN interface=ether1
add bridge=bridge-LAN interface=ether2
add bridge=bridge-LAN interface=ether3
add bridge=bridge-LAN interface=ether4
add bridge=bridge-LAN interface=ether5
add bridge=bridge-LAN interface=wlan1-5GHz
add bridge=bridge-LAN interface=wlan2-2GHz
add bridge=bridge-mobile interface=wlan3-2Ghz
/interface l2tp-server server
set authentication=mschap2 default-profile=vpn_profile enabled=yes max-mru=\
1396 max-mtu=1396 use-ipsec=required
/ip address
add address=82.82.82.82/24 interface=ether10-WAN network=82.82.82.0
add address=10.10.1.1/24 interface=bridge-LAN network=10.10.1.0
add address=192.168.100.1/24 interface=bridge-mobile network=192.168.100.0
/ip dhcp-server network
add address=10.10.1.0/24 dns-server=10.10.1.1 gateway=10.10.1.1
add address=192.168.100.0/24 dns-server=192.168.100.1 gateway=192.168.100.1
/ip dns
set allow-remote-requests=yes servers=77.88.8.88,77.88.8.2
/ip dns static
add address=10.10.1.6 name=S1
/ip firewall address-list
add address=1.1.1.1 list=rdp-1c
add address=1.1.1.1 list=engineers
/ip firewall filter
add action=accept chain=input comment="accept established & related" \
connection-state=established,related
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=input comment="accept management" dst-port=22,8291 \
protocol=tcp src-address-list=engineers
add action=accept chain=input comment="accept VPN" dst-port=1701,500,4500 \
in-interface=ether10-WAN protocol=udp
add action=accept chain=input in-interface=ether10-WAN protocol=ipsec-esp
add action=drop chain=input comment="drop all from WAN" in-interface=\
ether10-WAN
add action=accept chain=forward comment="accept established & related" \
connection-state=established,related
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop mobile to LAN" dst-address=\
10.0.0.0/8 src-address=192.168.100.0/24
add action=drop chain=forward dst-address=192.168.100.0/24 src-address=\
10.0.0.0/8
add action=drop chain=forward comment="drop all from WAN (exept dstnat)" \
connection-nat-state=!dstnat in-interface=ether10-WAN
/ip firewall nat
add action=src-nat chain=srcnat out-interface=ether10-WAN to-addresses=\
82.82.82.82
add action=dst-nat chain=dstnat dst-port=3389 in-interface=ether10-WAN \
protocol=tcp src-address-list=rdp-1c to-addresses=10.10.1.6 to-ports=3389
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=83.83.83.83 routing-table=\
main suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=Vpnuser profile=vpn_profile service=l2tp
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=GW1
/system leds
add interface=wlan2-2GHz leds="wlan2-2GHz_signal1-led,wlan2-2GHz_signal2-led,w\
lan2-2GHz_signal3-led,wlan2-2GHz_signal4-led,wlan2-2GHz_signal5-led" \
type=wireless-signal-strength
add interface=wlan2-2GHz leds=wlan2-2GHz_tx-led type=interface-transmit
add interface=wlan2-2GHz leds=wlan2-2GHz_rx-led type=interface-receive
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=pool.ntp.org
/system routerboard settings
set enter-setup-on=delete-key