/container mounts
add dst=/opt/adguardhome/conf name=agh_conf src=/disk1/conf/agh
/interface bridge
add admin-mac=xx auto-mac=no name=bridge-distribusi \
protocol-mode=none
add name=bridge-dockers protocol-mode=none
/interface ethernet
set [ find default-name=ether8 ] disable-running-check=no name=ether1-WAN
set [ find default-name=ether9 ] disable-running-check=no name=\
ether2-to-CRS_01-KTL
set [ find default-name=ether1 ] disable-running-check=no name=\
ether3-to-OLT_01-KTL
set [ find default-name=ether3 ] disable-running-check=no name=sfp-plus1
set [ find default-name=ether6 ] disable-running-check=no name=sfp-plus2
# unsupported speed
set [ find default-name=ether2 ] disable-running-check=no name=sfp1
# unsupported speed
set [ find default-name=ether4 ] disable-running-check=no name=\
sfp2-to-CRS_02-OLT_02-PGB
# unsupported speed
set [ find default-name=ether5 ] disable-running-check=no name=sfp3
# unsupported speed
set [ find default-name=ether7 ] disable-running-check=no name=sfp4-to-SW-KSA
/interface veth
add address=172.17.0.1/24 gateway=172.17.0.254 gateway6="" name=\
veth1-adguard-home
/interface vlan
add interface=bridge-distribusi name=vlan-171-dhcp-static-hotspot vlan-id=171
/interface list
add name=LAN
add name=WAN
/ip hotspot profile
set [ find default=yes ] hotspot-address=172.16.0.1 html-directory=flat-vc \
login-by=http-pap,mac-cookie radius-interim-update=10m use-radius=yes
add hotspot-address=172.16.0.1 html-directory=flat-vc login-by=\
http-pap,mac-cookie name=hs-prof-n70 radius-interim-update=10m \
use-radius=yes
add hotspot-address=10.1.0.1 html-directory=flat-vc login-by=\
http-pap,mac-cookie name=hs-prof-n70-vlan-171 radius-interim-update=10m \
use-radius=yes
/ip pool
add name=hs-pool-n70 ranges=172.16.192.1-172.16.255.254
add name=hs-pool-n70-vlan-171 ranges=10.1.192.1-10.1.255.254
/ip dhcp-server
add address-pool=hs-pool-n70 interface=bridge-distribusi lease-time=3d name=\
dhcp-n70
add address-pool=hs-pool-n70-vlan-171 interface=vlan-171-dhcp-static-hotspot \
lease-time=3d name=dhcp-n70-vlan-171
/ip hotspot
add address-pool=hs-pool-n70 disabled=no idle-timeout=none interface=\
bridge-distribusi name=hs-n70 profile=hs-prof-n70
add address-pool=hs-pool-n70-vlan-171 disabled=no idle-timeout=none \
interface=vlan-171-dhcp-static-hotspot name=hs-n70-vlan-171 profile=\
hs-prof-n70-vlan-171
/interface bridge port
add bridge=bridge-distribusi interface=ether2-to-CRS_01-KTL
add bridge=bridge-distribusi interface=ether3-to-OLT_01-KTL
add bridge=bridge-distribusi interface=sfp1
add bridge=bridge-distribusi interface=sfp2-to-CRS_02-OLT_02-PGB
add bridge=bridge-distribusi interface=sfp3
add bridge=bridge-distribusi interface=sfp4-to-SW-KSA
add bridge=bridge-dockers interface=veth1-adguard-home
/interface detect-internet
set detect-interface-list=WAN internet-interface-list=WAN lan-interface-list=\
LAN wan-interface-list=WAN
/interface list member
add interface=bridge-distribusi list=LAN
add interface=ether1-WAN list=WAN
add interface=veth1-adguard-home list=LAN
add interface=vlan-171-dhcp-static-hotspot list=LAN
/ip address
add address=172.16.0.1/16 comment="dhcp static hotspot network" interface=\
bridge-distribusi network=172.16.0.0
add address=192.168.100.254/24 interface=bridge-distribusi network=\
192.168.100.0
add address=192.168.101.254/24 interface=bridge-distribusi network=\
192.168.101.0
add address=103.xxx.xxx.xxx/30 interface=ether1-WAN network=103.xxx.xxx.xxx
add address=192.168.0.254/24 interface=bridge-distribusi network=192.168.0.0
add address=192.168.1.254/24 interface=bridge-distribusi network=192.168.1.0
add address=172.17.0.254/24 interface=bridge-dockers network=172.17.0.0
add address=192.168.70.254/24 interface=bridge-distribusi network=\
192.168.70.0
add address=10.1.0.1/16 comment="dhcp static hotspot network vlan 171" \
interface=vlan-171-dhcp-static-hotspot network=10.1.0.0
/ip dhcp-server network
add address=10.1.0.0/16 comment="hotspot network vlan 171" dns-server=\
10.1.0.1 domain=hotspot-n70.net gateway=10.1.0.1 netmask=16
add address=172.16.0.0/16 comment="hotspot network" dns-server=172.16.0.1 \
domain=hotspot-n70.id gateway=172.16.0.1 netmask=16
/ip dns
set allow-remote-requests=yes cache-size=1048576KiB max-concurrent-queries=\
1000000 max-concurrent-tcp-sessions=200000 max-udp-packet-size=16384 \
servers=172.17.0.1
/ip firewall address-list
add address=172.16.0.0/12 list=LOCAL-IP
add address=192.168.0.0/16 list=LOCAL-IP
add address=10.0.0.0/8 list=LOCAL-IP
add address=100.64.0.0/10 list=LOCAL-IP
add address=127.0.0.0/8 list=LOCAL-IP
add address=169.254.0.0/16 list=LOCAL-IP
add address=192.0.0.0/24 list=LOCAL-IP
add address=192.0.2.0/24 list=LOCAL-IP
add address=198.18.0.0/15 list=LOCAL-IP
add address=198.51.100.0/24 list=LOCAL-IP
add address=203.0.113.0/24 list=LOCAL-IP
add address=224.0.0.0/4 list=LOCAL-IP
add address=240.0.0.0/4 list=LOCAL-IP
add address=172.16.0.0/16 list=fs-local-ip
add address=192.168.100.0/24 list=fs-local-ip
add address=192.168.101.0/24 list=fs-local-ip
add address=172.23.168.1 comment=accept.172.23.168.1 list=mixradius.Mandatory
add address=n70.topsetting.com comment=accept.n70.topsetting.com list=\
mixradius.Mandatory
add address=0.0.0.0/8 list=LOCAL-IP
add address=192.88.99.0/24 list=LOCAL-IP
add address=172.16.0.0 comment="THE DUDE" list=TheDude-Blacklist-Scan
add address=172.16.0.1 list=TheDude-Blacklist-Scan
add address=192.168.100.254 list=TheDude-Blacklist-Scan
add address=192.168.101.254 list=TheDude-Blacklist-Scan
add address=192.168.101.0 list=TheDude-Blacklist-Scan
add address=192.168.100.0 list=TheDude-Blacklist-Scan
add address=172.17.0.0/24 list=fs-local-ip
add address=192.168.1.254 list=TheDude-Blacklist-Scan
add address=192.168.1.0 list=TheDude-Blacklist-Scan
add address=192.168.0.0 list=TheDude-Blacklist-Scan
add address=192.168.0.254 list=TheDude-Blacklist-Scan
add address=192.168.1.0/24 list=fs-local-ip
add address=192.168.0.0/24 list=fs-local-ip
add address=172.16.192.0/18 list=TheDude-Blacklist-Scan
add address=172.16.145.0/24 list=TheDude-Blacklist-Scan
add address=172.16.146.0/24 list=TheDude-Blacklist-Scan
add address=172.16.147.0/24 list=TheDude-Blacklist-Scan
add address=192.168.70.0/24 list=fs-local-ip
add address=10.1.0.0/16 comment="LAN - distribusi" list=fs-local-ip
add address=172.16.192.0/18 list=list_ttl_1
add address=10.1.192.0/18 comment="TTL 1" list=list_ttl_1
add address=172.16.147.0/24 list=list_ttl_1
/ip firewall filter
add action=accept chain=input comment="added by mixradius - bypass server" \
src-address-list=mixradius.Mandatory
add action=accept chain=forward dst-address-list=mixradius.Mandatory
add action=drop chain=input comment=DROP-DNS-ATTACK dst-port=\
53,5353,853,3128,8080 in-interface-list=WAN protocol=tcp
add action=drop chain=input dst-port=53,5353,853,3128,8080 in-interface-list=\
WAN protocol=udp
add action=drop chain=forward comment=DROP-COMMON-PORT dst-port=\
25,137-139,445,3389 protocol=tcp
add action=drop chain=forward dst-port=25,137-139,445,3389 protocol=udp
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here" disabled=yes
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=reject chain=forward comment="added by mixradius - drop expired" \
protocol=tcp src-address=10.127.0.0/18
add action=reject chain=forward dst-port=!53,5353 protocol=udp src-address=\
10.127.0.0/18
/ip firewall mangle
add action=accept chain=prerouting comment=LOCAL dst-address-list=fs-local-ip \
src-address-list=fs-local-ip
add action=accept chain=input dst-address-list=fs-local-ip src-address-list=\
fs-local-ip
add action=accept chain=output dst-address-list=fs-local-ip src-address-list=\
fs-local-ip
add action=mark-packet chain=prerouting comment=ICMP new-packet-mark=icmp \
passthrough=no protocol=icmp
add action=mark-packet chain=input new-packet-mark=icmp passthrough=no \
protocol=icmp
add action=mark-packet chain=forward new-packet-mark=icmp passthrough=no \
protocol=icmp
add action=mark-packet chain=output new-packet-mark=icmp passthrough=no \
protocol=icmp
add action=mark-packet chain=postrouting new-packet-mark=icmp passthrough=no \
protocol=icmp
add action=mark-connection chain=prerouting comment=DNS dst-port=53,5353,853 \
new-connection-mark=dns_conn protocol=tcp
add action=mark-connection chain=prerouting dst-port=53,5353,853 \
new-connection-mark=dns_conn protocol=udp
add action=mark-connection chain=forward dst-port=53,5353,853 \
new-connection-mark=dns_conn protocol=tcp
add action=mark-connection chain=forward dst-port=53,5353,853 \
new-connection-mark=dns_conn protocol=udp
add action=mark-connection chain=postrouting dst-port=53,5353,853 \
new-connection-mark=dns_conn protocol=tcp
add action=mark-connection chain=postrouting dst-port=53,5353,853 \
new-connection-mark=dns_conn protocol=udp
add action=mark-packet chain=prerouting connection-mark=dns_conn \
new-packet-mark=dns passthrough=no
add action=mark-packet chain=forward connection-mark=dns_conn \
new-packet-mark=dns passthrough=no
add action=mark-packet chain=postrouting connection-mark=dns_conn \
new-packet-mark=dns passthrough=no
add action=mark-connection chain=prerouting comment=VOIP dst-port=\
3478,3479,5060,5061,5090,5091,8801-8810,45395,1167,1719,1720,5004 \
new-connection-mark=voip_conn protocol=tcp
add action=mark-connection chain=prerouting dst-port=\
3478,3479,5060,5061,5090,5091,8801-8810,45395,1167,1719,1720,5004 \
new-connection-mark=voip_conn protocol=udp
add action=mark-connection chain=prerouting dst-port=\
1503,3784,3785,10000-20000 new-connection-mark=voip_conn protocol=tcp
add action=mark-connection chain=prerouting dst-port=\
1503,3784,3785,10000-20000 new-connection-mark=voip_conn protocol=udp
add action=mark-packet chain=forward connection-mark=voip_conn \
new-packet-mark=voip passthrough=no
add action=mark-connection chain=prerouting comment=\
"GAME (ML, FF, PUBG, COD)" connection-mark=!game_high_conn dst-port=\
6006,6674,7006,7889,8001-8010,8012,9006,9137 new-connection-mark=\
game_low_conn protocol=tcp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=6006,6674,7006,7889,8001-8010,8012,9006,9137 \
new-connection-mark=game_low_conn protocol=udp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=20561,39003,39006,39698,39779,39800,6008,7008,9008 \
new-connection-mark=game_low_conn protocol=tcp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=20561,39003,39006,39698,39779,39800,6008,7008,9008 \
new-connection-mark=game_low_conn protocol=udp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port="5000-5089,5092-5221,9000-9010,9443,5224-5227,5229-5241,2702,3702\
,5517,9992" new-connection-mark=game_low_conn protocol=tcp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port="5000-5089,5092-5221,9000-9010,9443,5224-5227,5229-5241,2702,3702\
,5517,9992" new-connection-mark=game_low_conn protocol=udp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=\
5520-5529,30000-30300,5568,5518,57621,4070,20371,8011,9030,41182-41192 \
new-connection-mark=game_low_conn protocol=tcp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=\
5520-5529,30000-30300,5568,5518,57621,4070,20371,8011,9030,41182-41192 \
new-connection-mark=game_low_conn protocol=udp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=4001-4009,5243-5509,5551-5559,5601-5700,8130,9120 \
new-connection-mark=game_low_conn protocol=tcp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=4001-4009,5243-5509,5551-5559,5601-5700,8130,9120 \
new-connection-mark=game_low_conn protocol=udp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=3013,50000,65010,65050,7085-7995,20001-20100,8013,7500-7650,8700 \
new-connection-mark=game_low_conn protocol=tcp
add action=mark-connection chain=prerouting connection-mark=!game_high_conn \
dst-port=3013,50000,65010,65050,7085-7995,20001-20100,8013,7500-7650,8700 \
new-connection-mark=game_low_conn protocol=udp
add action=mark-connection chain=prerouting connection-mark=game_low_conn \
connection-rate=!0-3M new-connection-mark=game_high_conn
add action=mark-packet chain=forward connection-mark=game_high_conn \
new-packet-mark=game_high passthrough=no
add action=mark-packet chain=forward connection-mark=game_low_conn \
new-packet-mark=game_low passthrough=no
add action=mark-connection chain=prerouting comment="HTTP, QUIC" \
connection-mark=!httpquic_high_conn dst-port=80,443 new-connection-mark=\
httpquic_low_conn protocol=tcp
add action=mark-connection chain=prerouting connection-mark=\
!httpquic_high_conn dst-port=80,443 new-connection-mark=httpquic_low_conn \
protocol=udp
add action=mark-connection chain=prerouting connection-bytes=500000-0 \
connection-mark=httpquic_low_conn connection-rate=!0-200k \
new-connection-mark=httpquic_high_conn
add action=mark-packet chain=forward connection-mark=httpquic_high_conn \
new-packet-mark=httpquic_high passthrough=no
add action=mark-packet chain=forward connection-mark=httpquic_low_conn \
new-packet-mark=httpquic_low passthrough=no
add action=mark-connection chain=forward comment="CONNECTION RATE" \
connection-mark=!high_conn new-connection-mark=low_conn
add action=mark-connection chain=forward connection-bytes=500000-0 \
connection-mark=low_conn connection-rate=!0-200k new-connection-mark=\
high_conn
add action=mark-packet chain=forward connection-mark=high_conn \
new-packet-mark=high_traffic passthrough=no
add action=mark-packet chain=forward connection-mark=low_conn \
new-packet-mark=low_traffic passthrough=no
add action=change-ttl chain=forward comment="CHANGE TTL" dst-address-list=\
list_ttl_1 new-ttl=set:1 out-interface-list=LAN passthrough=no
add action=change-ttl chain=postrouting dst-address-list=list_ttl_1 new-ttl=\
set:1 out-interface-list=LAN passthrough=no
/ip firewall nat
add action=src-nat chain=srcnat out-interface-list=WAN to-addresses=\
103.xxx.xxx.xxx
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="masquerade local network" \
src-address=10.1.0.0/16
add action=masquerade chain=srcnat src-address=172.16.0.0/16
add action=masquerade chain=srcnat src-address=172.17.0.0/24
add action=masquerade chain=srcnat src-address=192.168.0.0/24
add action=masquerade chain=srcnat src-address=192.168.1.0/24
add action=masquerade chain=srcnat src-address=192.168.70.0/24
add action=masquerade chain=srcnat src-address=192.168.100.0/24
add action=masquerade chain=srcnat src-address=192.168.101.0/24
add action=dst-nat chain=dstnat comment="forward dns" dst-port=53,5353,853 \
in-interface-list=LAN protocol=udp src-address=!172.17.0.1 to-addresses=\
172.17.0.1 to-ports=53
add action=dst-nat chain=dstnat dst-port=53,5353,853 in-interface-list=LAN \
protocol=tcp src-address=!172.17.0.1 to-addresses=172.17.0.1 to-ports=53
/ip hotspot user
add name=PTBMUN70