# jan/30/2018 17:47:23 by RouterOS 6.41
# software id = S1MG-NEED
#
# model = RouterBOARD 750G r3
# serial number = XXXXXXXX
/interface bridge
add admin-mac=XXXXXXXXXX auto-mac=no name=bridge1
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add exclude=dynamic name=discover
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.4.10-192.168.4.100
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge1 name=defconf
/interface bridge port
add bridge=bridge1 interface=ether2-master
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=discover
/interface list member
add comment=defconf interface=ether2-master list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=bridge1 list=LAN
/ip address
add address=192.168.4.1/24 comment=defconf interface=ether2-master network=\
    192.168.4.0
/ip cloud
set update-time=no
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\
    ether1 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.4.0/24 comment=defconf gateway=192.168.4.1 netmask=24
/ip dns
set servers=192.168.4.5
/ip dns static
add address=192.168.4.1 name=router.lan
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=ether1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh port=2200
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=America/Chicago
/system identity
set name=hEX-1st
/system ntp client
set enabled=yes primary-ntp=97.107.129.217 secondary-ntp=66.135.44.92
/system ntp server
set enabled=yes manycast=no
/system routerboard mode-button
set enabled=no on-event=""
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no