i'll try that.
PS: i'll post my export in here for a guy on reddit. ( or for anyone who wants to take a look at it )
# 2024-09-26 10:55:14 by RouterOS 7.16
# software id = U4AN-7YUP
#
# model = RB3011UiAS
# serial number = HF5096ZEDE6
/disk
set usb2 media-interface=none media-sharing=no
add media-interface=none media-sharing=no parent=usb2 partition-number=1 \
partition-offset=512 partition-size="31 004 294 656" type=partition
/interface bridge
add admin-mac=78:9A:18:76:4A:A7 auto-mac=no comment=defconf name=bridge \
port-cost-mode=short
add comment=docker_bridge name=docker_bridge
add name=lo_soflex
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
set [ find default-name=sfp1 ] disabled=yes
/interface veth
add address=10.10.104.8/24 comment=testtt gateway=10.10.104.254 gateway6="" \
name=veth111
/interface wireguard
add comment=server listen-port=51820 mtu=1420 name=wg0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
add dh-group=modp2048 dpd-interval=20s dpd-maximum-failures=3 enc-algorithm=\
aes-128 hash-algorithm=sha256 name=soflex-huawei
/ip ipsec peer
add address=119.8.74.219/32 exchange-mode=ike2 name=soflex-huawei passive=yes \
profile=soflex-huawei send-initial-contact=no
/ip ipsec proposal
set [ find default=yes ] disabled=yes
add auth-algorithms=sha256 enc-algorithms=aes-128-cbc,aes-128-ctr,aes-128-gcm \
lifetime=1h name=soflex-huawei pfs-group=modp2048
/ip pool
add name=default-dhcp ranges=10.2.88.1-10.2.88.253
add name=OVPN_SERVER_POOL ranges=192.168.192.1-192.168.192.253
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=4h name=defconf
/port
set 0 name=serial0
/ppp profile
add bridge-learning=no comment=OVPN_SERVER local-address=192.168.192.254 \
name=OVPN_SERVER only-one=yes remote-address=OVPN_SERVER_POOL \
use-encryption=yes use-ipv6=no
/system logging action
add disk-file-count=1 disk-file-name=logs/firewall.log disk-lines-per-file=\
15000 name=FirewallDisk target=disk
add disk-file-count=1 disk-file-name=logs/error.log disk-lines-per-file=8000 \
name=ErrorDisk target=disk
add disk-file-count=1 disk-file-name=logs/critical.log disk-lines-per-file=\
5000 name=CriticalDisk target=disk
add disk-file-count=1 disk-file-name=logs/warning.log disk-lines-per-file=\
5000 name=WarningDisk target=disk
add disk-file-count=1 disk-file-name=logs/info.log disk-lines-per-file=15000 \
name=InfoDisk target=disk
add disk-file-count=1 disk-file-name=logs/ovpn.log disk-lines-per-file=10000 \
name=OvpnDisk target=disk
add disk-file-count=1 disk-file-name=logs/system.log disk-lines-per-file=9000 \
name=SystemInfo target=disk
add disk-file-count=1 disk-file-name=logs/dns name=DnsDisk target=disk
add disk-file-count=1 disk-file-name=logs/container name=ContainerDisk \
target=disk
add disk-file-count=1 disk-file-name=logs/dhcp name=DhcpDisk target=disk
add disk-file-count=1 disk-file-name=logs/Debug name=DebugDisk target=disk
/container
add comment=testttt interface=veth111 root-dir=testtt-container
/container config
set ram-high=500 registry-url=https://registry-1.docker.io tmpdir=\
usb2-part1/docker_temp
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether9 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1 \
internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface detect-internet
set detect-interface-list=WAN wan-interface-list=WAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=WAN1 list=WAN
/interface ovpn-server server
set auth=sha256,sha512 certificate=ovpn_server cipher=\
aes128-cbc,aes192-cbc,aes256-cbc,aes128-gcm,aes192-gcm,aes256-gcm \
default-profile=OVPN_SERVER enabled=yes port=1198 protocol=udp \
require-client-certificate=yes
/interface wireguard peers
add allowed-address=10.10.103.2/32 client-address=10.10.103.2/32 client-dns=\
8.8.8.8 client-endpoint=vpn.brunolab.com.ar client-keepalive=20s \
client-listen-port=65031 interface=wg0 is-responder=yes name=\
"Bruno Celular" private-key=\
"UJXi6A27L7R521eYppi7l5sELMfXUAuuHNSo95vL00A=" public-key=\
"I1/mhHTxF6iyilmkFTdC41rCWZ8fOjGBWx9HXRPTu1o="
/ip address
add address=10.2.88.254/24 interface=bridge network=10.2.88.0
add address=10.2.88.1 interface=lo_soflex network=10.2.88.1
add address=10.10.103.254/24 interface=wg0 network=10.10.103.0
add address=10.10.104.254/24 interface=docker_bridge network=10.10.104.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=2m
/ip dhcp-client
add comment=defconf interface=WAN1 use-peer-dns=no
/ip dhcp-server network
add address=10.2.88.0/24 comment=defconf dns-server=8.8.8.8,1.1.1.1 gateway=\
10.2.88.254
/ip dns
set allow-remote-requests=yes cache-size=20480KiB servers=8.8.8.8,1.1.1.1
/ip dns adlist
add ssl-verify=no url=\
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=nb.brunolab.com.ar comment="Notebook Bruno" list=seguras
add address=209.13.0.0/16 comment=ARGENTINA list=ARGENTINA
add address=209.99.224.0/20 comment=ARGENTINA list=ARGENTINA
add address=216.244.192.0/18 comment=ARGENTINA list=ARGENTINA
add address=fortilabbo.duckdns.org comment="Juanjo Casa" list=Juanjo
add address=fortilabbo.fortiddns.com comment="Juanjo Casa" list=seguras
add address=192.168.196.18 comment="Tunel Huawei Soflex" list=seguras
add address=51.144.224.215 comment="Juanjo Azure" list=seguras
add address=119.8.74.219 comment=Soflex-Huawei list=seguras
add address=119.8.75.5 comment=Soflex-Huawei list=seguras
add address=119.8.74.219 comment="Soflex Huawei" list=ARGENTINA
add address=119.8.75.5 comment="Soflex Huawei" list=ARGENTINA
add address=181.13.190.62 comment=catamarca list=Juanjo
/ip firewall filter
add action=accept chain=input comment=established,related,untracked \
connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="ICMP Seguras" protocol=icmp \
src-address-list=seguras
add action=accept chain=input comment="ICMP Rango VPN" protocol=icmp \
src-address=192.168.192.0/24
add action=accept chain=input comment="ICMP Rango Wireguard" protocol=icmp \
src-address=10.10.103.0/24
add action=accept chain=input comment="ICMP Soflex Huawei" protocol=icmp \
src-address=192.168.201.0/24
add action=accept chain=input comment="Web Proxy" dst-port=65041 \
in-interface-list=WAN protocol=tcp src-address-list=Juanjo
add action=accept chain=input comment="OpenVPN Server" dst-port=1198 \
in-interface-list=WAN protocol=udp
add action=drop chain=input comment="Country Block" connection-state=new \
in-interface-list=WAN src-address-list=!ARGENTINA
add action=accept chain=input comment="Winbox - SSH - WAN" dst-port=\
20001,422,421 in-interface-list=WAN protocol=tcp src-address-list=seguras
add action=accept chain=input comment="Winbox - SSH - LAN" dst-port=20001,422 \
in-interface-list=LAN protocol=tcp
add action=accept chain=input comment="Winbox - SSH - OVPN" dst-port=\
20001,422 protocol=tcp src-address=192.168.192.0/24
add action=accept chain=input comment=DNS dst-port=53 in-interface-list=LAN \
protocol=udp
add action=accept chain=input comment=NTP dst-port=123 in-interface-list=!WAN \
protocol=udp
add action=accept chain=input comment="Broadcast - Multicast" \
dst-address-type=broadcast,multicast in-interface-list=LAN
add action=accept chain=input comment="Wireguard VPN" dst-port=51820 \
in-interface-list=WAN protocol=udp
add action=accept chain=input comment="IPSec - IKE" dst-port=500,4500 \
in-interface-list=WAN protocol=udp src-address=119.8.74.219
add action=accept chain=input comment="IPSec - ESP" in-interface-list=WAN \
protocol=ipsec-esp src-address=119.8.74.219
add action=drop chain=input comment="Drop Port Scanners" src-address-list=\
port_scanners
add action=add-src-to-address-list address-list=port_scanners \
address-list-timeout=4w2d chain=input comment="Port Knocking Trap" \
dst-port=3389,22,21,3306,5432,1194,1433,5060,8080,23,8291 \
in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="Not LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment=Fasttrack \
connection-mark=!ipsec connection-state=established,related hw-offload=\
yes
add action=accept chain=forward comment="established,related, untracked" \
connection-state=established,related,untracked
add action=drop chain=forward comment=Invalid connection-state=invalid
add action=drop chain=forward comment="drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=input comment="Drop Default" in-interface-list=WAN
/ip firewall mangle
add action=mark-connection chain=forward comment=ipsec-mark ipsec-policy=\
in,ipsec new-connection-mark=ipsec passthrough=no
add action=mark-connection chain=forward comment=ipsec-mark ipsec-policy=\
out,ipsec new-connection-mark=ipsec passthrough=no
/ip firewall nat
add action=redirect chain=dstnat comment="DNS Redirect" dst-port=53 \
in-interface-list=LAN protocol=udp
add action=masquerade chain=srcnat comment=masquerade-containers \
ipsec-policy=out,none out-interface-list=WAN src-address=10.10.104.0/24
add action=masquerade chain=srcnat comment=masquerade ipsec-policy=out,none \
out-interface-list=WAN
/ip firewall service-port
set ftp disabled=yes
set sip disabled=yes
/ip ipsec identity
add peer=soflex-huawei
/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.201.0/24 peer=soflex-huawei proposal=soflex-huawei \
src-address=10.2.88.0/24 tunnel=yes
/ip proxy
set enabled=yes
/ip service
set telnet disabled=yes
set ftp port=421
set www disabled=yes
set ssh port=422
set api disabled=yes
set winbox port=20001
set api-ssl disabled=yes
/lcd
set default-screen=informative-slideshow time-interval=daily
/ppp secret
add comment=Yo name=bruno profile=OVPN_SERVER service=ovpn
add comment=Juanjo name=juanjo profile=OVPN_SERVER service=ovpn
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=America/Argentina/Buenos_Aires
/system logging
set 0 action=InfoDisk disabled=yes
set 1 action=ErrorDisk
set 2 action=WarningDisk
set 3 action=CriticalDisk
add action=FirewallDisk topics=firewall
add action=OvpnDisk topics=ovpn,account,!packet,!debug
add action=SystemInfo topics=system,info
add action=OvpnDisk topics=ovpn,critical
add disabled=yes topics=ipsec
add action=DnsDisk topics=dns,error
add action=InfoDisk prefix=IPSec topics=ipsec,info,account,!packet,!debug
add action=ContainerDisk topics=container,debug
add action=DhcpDisk topics=dhcp,warning
add action=ContainerDisk topics=container,error
add action=ContainerDisk topics=container,info
add action=DebugDisk disabled=yes topics=debug
/system note
set show-at-login=no
/system ntp server
set broadcast=yes enabled=yes
/system scheduler
add comment="Loguea hacia telegram" interval=1m name=logtotg on-event=logtotg \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2024-09-13 start-time=17:22:54
add comment="Avisa cuando el equipo se reinicio" name=reboot on-event=reboot \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup
/system script
add comment="Log hacia Telegram" dont-require-permissions=no name=logtotg \
owner=bruno policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
global lastTime;\
\n:global output; \
\n:global mtIdentity [/system identity get name]; \
\n\
\n:local name \"casa\"\
\n:local chatId \"357485428\"\
\n:local apiKey \"6177509867:AAFrk0uZV5zm8nLpnEQpk1I_Nh9gK8pjS_M\"\
\n:local bot \"t.me/bruno_casa_bot\"\
\n\
\n:local LogGet [ :toarray [ /log find topics~\"system\" || message~\"logi\
n failure\" || message~\"logged\" || message~\"connected\" ]]; \
\_ \
\n\
\n:local LogtLineCount [ :len \$LogGet ]; \
\_ \
\n\
\nif (\$LogtLineCount > 0) do={ \
\_ \
\n\
\n :local currentTime \"\$[ /log get [ :pick \$LogGet (\$LogtLineCount \
-1) ] time ]\";\
\n\
\n :if ([:len \$currentTime] = 10 ) do={ \
\_ \
\n :set currentTime [ :pick \$currentTime 0 10 ]; \
\_ \
\n } \
\n\
\n :local output \"\$currentTime - \$[/log get [ :pick \$LogGet (\$Logt\
LineCount-1) ] message]\"; \
\n\
\n :if (([:len \$lastTime] < 1) || (([:len \$lastTime] > 0) && (\$lastT\
ime != \$currentTime))) do={ \
\n :set lastTime \$currentTime; \
\_ \
\n :tool fetch url=(\"https://api.telegram.org/bot\$apiKey/sendMess\
age\?chat_id=\$chatId&text=\$output\") keep-result=no \
\n }\
\n\
\n}"
add comment="Avisa cuando se reinicio el equipo" dont-require-permissions=no \
name=reboot owner=bruno policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
local chatId \"357485428\"\
\n:local apiKey \"6177509867:AAFrk0uZV5zm8nLpnEQpk1I_Nh9gK8pjS_M\"\
\n:local bot \"t.me/bruno_casa_bot\"\
\n\
\n# * Cuando un proveedor vuelve a tener conexi\C3\B3n\
\n\
\n:do { \
\n :delay 10\
\n :log warning message=\"Equipo reiniciado.\"\
\n :local message \"Equipo reiniciado.\"\
\n :local request \"https://api.telegram.org/bot\$apiKey/sendMessage\?cha\
t_id=\$chatId&text=\$message\"\
\n /tool fetch url=\"\$request\" output=none\
\n :delay 1\
\n} on-error={\
\n /log error \"No se pudo ejecutar la API Request a Telegram: \$messag\
e\";\
\n}\
\n/log info \"Api Request a Telegram ejecutada con \C3\A9xito.\";\
\n\
\n "
/system watchdog
set watchdog-timer=no
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
: 56 data bytes
.