do /export file=config

export file=config

# jun/12/2024 19:51:01 by RouterOS 6.37.3
#
/interface bridge
add name=bridge1
/interface wireless
set [ find default-name=wlan1 ] disabled=no mode=ap-bridge
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
/system routerboard settings
set protected-routerboot=disabled

/system default-configuration print

/system reset-configuration

#-------------------------------------------------------------------------------
                    :if ($action = "apply") do={
                      # wait for interfaces
                      :local count 0;
                      :while ([/interface ethernet find] = "") do={
                        :if ($count = 30) do={
                          :log warning "DefConf: Unable to find ethernet interfaces";
                          /quit;
                        }
                        :delay 1s; :set count ($count +1); 
                      };
                      :local count 0;
                      :while ([/interface wireless print count-only] < 1) do={ 
                        :set count ($count +1);
                        :if ($count = 40) do={
                          :log warning "DefConf: Unable to find wireless interface(s)"; 
                          /ip address add address=172.16.10.13/24 interface=ether1 comment="defconf";
                          /quit
                        }
                        :delay 1s;
                      };
                     /interface list add name=WAN comment="defconf"
                     /interface list add name=LAN comment="defconf"
                     /interface bridge
                       add name=bridge disabled=no auto-mac=yes protocol-mode=rstp comment=defconf;
                     :local bMACIsSet 0;
                     :foreach k in=[/interface find where !(slave=yes   || name="ether1" || passthrough=yes   || name="ether1" || name~"bridge")] do={
                       :local tmpPortName [/interface get $k name];
                       :if ($bMACIsSet = 0) do={
                         :if ([/interface get $k type] = "ether") do={
                           /interface bridge set "bridge" auto-mac=no admin-mac=[/interface get $tmpPortName mac-address];
                           :set bMACIsSet 1;
                         }
                       }
                         :if (([/interface get $k type] != "ppp-out") && ([/interface get $k type] != "lte")) do={
                           /interface bridge port
                             add bridge=bridge interface=$tmpPortName comment=defconf;
                         }
                       }
                      #/ip pool add name="default-dhcp" ranges=192.168.88.10-192.168.88.254;
                       /ip dhcp-server
                      #  add name=defconf address-pool="default-dhcp" interface=bridge lease-time=10m disabled=no;
                      #/ip dhcp-server network
                         #add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1 comment="defconf";
                      #/ip address add address=192.168.88.1/24 #interface=bridge comment="defconf";
                     /ip dns {
                         set allow-remote-requests=yes
                         static add name=router.lan address=172.16.10.13 comment=defconf
                     }
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
/interface ethernet switch vlan
add ports=ether1,ether2 switch=switch1 vlan-id=61
add ports=ether1,ether3 switch=switch1 vlan-id=61
add ports=ether1,switch1-cpu switch=switch1 vlan-id=*
/interface vlan
add interface=bridge1 vlan-id=* name=MGMT
/ip address
add address=172.16.10.1/24 interface=MGMT
/interface ethernet switch port
set ether1 vlan-mode=secure vlan-header=add-if-missing
set ether2 vlan-mode=secure vlan-header=always-strip default-vlan-id=61
set ether3 vlan-mode=secure vlan-header=always-strip default-vlan-id=61
set switch1-cpu vlan-header=leave-as-is vlan-mode=secure
                    
                      /interface wireless {
                    :local ifcId [/interface wireless find where default-name=wlan1]
                    :local currentName [/interface wireless get $ifcId name]
                        set $ifcId mode=ap-bridge band=2ghz-b/g/n disabled=no wireless-protocol=802.11 \
                           distance=indoors installation=indoor
                        set $ifcId channel-width=20/40mhz-XX;
                        set $ifcId frequency=auto
                        :local wlanMac  [/interface wireless get $ifcId mac-address];
                        :set ssid "MyWi-fi"
                        set $ifcId ssid=$ssid
                        #MikroTik-$[:pick $wlanMac 9 11]$[:pick $wlanMac 12 14]$[:pick $wlanMac 15 17]
                      }
                       /ip dhcp-client add interface=ether1 disabled=no comment="defconf";
                     /interface list member add list=LAN interface=bridge comment="defconf"
                     /interface list member add list=WAN interface=ether1 comment="defconf"
                     /ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="defconf: masquerade"
                     /ip firewall {
                       filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
                       filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
                       filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
                       filter add chain=input action=accept dst-address=127.0.0.1 comment="defconf: accept to local loopback (for CAPsMAN)"
                       filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
                       filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
                       filter add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
                       filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
                       filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
                       filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
                       filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed"
                     }

#
/interface bridge add name=bridge1
/interface bridge port
add interface=ether1 bridge=bridge1
add interface=ether3 bridge=bridge1
add interface=ether4 bridge=bridge1
/interface bridge port add interface=wlan1 bridge=local

/ip address add address=172.16.10.3/24 interface=bridge1
/ip dhcp-client add disable=yes interface=ether1
/interface list add name=LAN
/interface list member add list=LAN
/tool mac-server set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LAN

/interface wireless security-profiles
  add name=myProfile authentication-types=wpa2-psk mode=dynamic-keys \
    wpa2-pre-shared-key=1234567890 
/interface wireless
set wlan1 band=2ghz-b/g/n channel-width=20/40mhz-Ce
distance=indoors \mode=ap-bridge ssid=
MikroTik-51 wireless-protocol=802.11
/security-profiles=myprofiles frequency-mode=regulatory-domain \set country=united states antenna-gain=3
/interface bridge port add interface=wlan1 bridge=local

/system routerboard settings
set protected-routerboot=disabled
/ip service disable telnet,ftp,www,api
/ip service set ssh port=2200
/ip service set winbox address=172.16.10.3/24
/tool bandwidth-server set enabled=no
/ip dns set allow-remote-requests=no
/lcd set enabled=no
/ip ssh set strong-crypto=yes
/ip proxy set enabled=no
/ip socks set enabled=no
/ip cloud set ddns-enabled=no update-time=no