# jan/06/1970 07:43:15 by RouterOS 6.11
# software id = FP7P-M89C
#
/interface bridge
add name=bridge-lan protocol-mode=none
add l2mtu=1598 name=bridge-network protocol-mode=none
add l2mtu=1598 name=bridge-phones protocol-mode=none
add l2mtu=1600 name=bridge-public protocol-mode=none
add name=bridge-qa protocol-mode=none
add name=bridge-san protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] speed=1Gbps
set [ find default-name=ether2 ] speed=1Gbps
set [ find default-name=ether3 ] speed=1Gbps
set [ find default-name=ether4 ] speed=1Gbps
set [ find default-name=ether5 ] speed=1Gbps
set [ find default-name=ether7 ] advertise=1000M-full
set [ find default-name=ether11 ] mac-address=00:0C:42:9B:3E:00
set [ find default-name=ether12 ] mac-address=00:0C:42:9B:3E:01
set [ find default-name=ether13 ] mac-address=00:0C:42:9B:3E:02 speed=1Gbps
/interface vlan
add interface=bridge-phones l2mtu=1594 name=vlan-10-phones vlan-id=10
add interface=bridge-san l2mtu=65531 name=vlan-20-san vlan-id=20
add interface=bridge-network l2mtu=1594 name=vlan-21-network vlan-id=21
add interface=bridge-lan l2mtu=65531 name=vlan-30-lan vlan-id=30
add interface=bridge-public l2mtu=1596 name=vlan-40-wan vlan-id=40
/ip neighbor discovery
set vlan-10-phones discover=no
set vlan-20-san discover=no
set vlan-21-network discover=no
set vlan-30-lan discover=no
set vlan-40-wan discover=no
/interface ethernet switch port
set 1 default-vlan-id=21 vlan-header=add-if-missing vlan-mode=secure
set 5 vlan-header=add-if-missing
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp_pool2 ranges=10.105.10.100-10.105.10.199
add name=dhcp_pool3 ranges=10.105.30.100-10.105.30.199
add name=dhcp_pool4 ranges=10.105.21.100-10.105.21.199
add name=dhcp_pool5 ranges=10.105.50.100-10.105.50.199
/ip dhcp-server
add address-pool=dhcp_pool2 disabled=no interface=bridge-phones name=dhcp2
add address-pool=dhcp_pool3 disabled=no interface=bridge-lan name=dhcp3
add address-pool=dhcp_pool4 disabled=no interface=bridge-network name=dhcp4
add address-pool=dhcp_pool5 disabled=no interface=bridge-qa name=dhcp5
/port
set 0 name=serial0
set 1 name=serial1
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge port
add bridge=bridge-network interface=ether3
add bridge=bridge-network interface=ether4
add bridge=bridge-network interface=ether5
add bridge=bridge-network interface=ether6
add bridge=bridge-network interface=ether7
add bridge=bridge-network interface=ether8
add bridge=bridge-network interface=ether9
add bridge=bridge-phones interface=ether10
add bridge=bridge-public interface=ether13
add bridge=bridge-phones interface=ether1
/ip address
add address=10.105.10.254/24 interface=bridge-phones network=10.105.10.0
add address=10.105.20.254/24 interface=bridge-san network=10.105.20.0
add address=10.105.21.254/24 interface=bridge-network network=10.105.21.0
add address=10.105.30.254/24 interface=bridge-lan network=10.105.30.0
add address=10.105.40.254/24 interface=bridge-public network=10.105.40.0
add address=10.105.50.254/24 interface=bridge-qa network=10.105.50.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether13
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no interface=bridge-public
/ip dhcp-server network
add address=10.105.10.0/24 dns-server=10.105.21.3,10.105.21.250 gateway=10.105.10.254
add address=10.105.21.0/24 dns-server=10.105.21.3,10.105.21.250 gateway=10.105.21.254
add address=10.105.30.0/24 dns-server=10.105.21.3,10.105.21.250 gateway=10.105.30.254
add address=10.105.50.0/24 dns-server=10.105.21.3,10.105.21.250 gateway=10.105.50.254
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall filter
add chain=input comment="Accept established connections" connection-state=established
add chain=input comment="Accept related connections" connection-state=related
add action=drop chain=input comment="Drop invalid connections" connection-state=invalid
add chain=input comment=UDP protocol=udp
add chain=input comment="Allow limited pings" limit=50/5s,2 protocol=icmp
add action=drop chain=input comment="Drop excess pings" protocol=icmp
add chain=input comment=Phones in-interface=bridge-phones src-address=10.105.10.0/24
add chain=input comment=SAN in-interface=bridge-san src-address=10.105.20.0/24
add chain=input comment=Network in-interface=bridge-network src-address=10.105.21.0/24
add chain=input comment=LAN in-interface=bridge-lan src-address=10.105.30.0/24
add chain=input comment=WAN in-interface=bridge-public src-address=10.105.40.0/24
add chain=input comment=QA in-interface=bridge-qa src-address=10.105.50.0/24
add action=log chain=input comment="Log everything else" log-prefix="DROP INPUT"
add action=drop chain=input comment="Drop everything else"
/ip firewall nat
add action=masquerade chain=srcnat src-address=10.105.10.0/24
add action=masquerade chain=srcnat src-address=10.105.20.0/24
add action=masquerade chain=srcnat src-address=10.105.21.0/24
add action=masquerade chain=srcnat src-address=10.105.30.0/24
add action=masquerade chain=srcnat src-address=10.105.40.0/24
add action=masquerade chain=srcnat src-address=10.105.50.0/24 to-addresses=0.0.0.0
add action=dst-nat chain=dstnat dst-port=80 in-interface=bridge-public protocol=tcp to-addresses=10.105.21.3
add action=dst-nat chain=dstnat dst-port=3389 in-interface=bridge-public protocol=tcp to-addresses=10.105.21.7
/ip proxy
set max-cache-size=none parent-proxy=0.0.0.0
/ip service
set api disabled=yes
/ip upnp
set allow-disable-external-interface=no