# sep/01/2020 18:12:18 by RouterOS 6.47.1
# software id = X9GD-CZK4
#
# model = RB760iGS
# serial number = A36A0C819BFA
/caps-man channel
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee \
frequency=5180 name=channel51 skip-dfs-channels=yes
add band=2ghz-onlyn control-channel-width=20mhz extension-channel=disabled \
frequency=2412 name=channel1 tx-power=11
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled \
frequency=2437 name=channel6
add band=2ghz-onlyn control-channel-width=20mhz extension-channel=disabled \
frequency=2462 name=channel11 tx-power=11
add band=2ghz-g/n control-channel-width=20mhz extension-channel=XX name=\
CH2.4-auto reselect-interval=1h tx-power=-30
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=XXXX name=\
CH5-auto reselect-interval=1h tx-power=-30
/interface lte
set [ find ] name=lte1
/interface bridge
add admin-mac=48:8F:5A:2F:50:A5 auto-mac=no comment=defconf name=bridge
/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=\
datapath1
/caps-man rates
add basic=24Mbps ht-basic-mcs=mcs-3 ht-supported-mcs="mcs-3,mcs-4,mcs-5,mcs-6,\
mcs-7,mcs-8,mcs-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,\
mcs-18,mcs-19,mcs-20,mcs-21,mcs-22,mcs-23" name=rate1 supported=\
12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps vht-basic-mcs=""
add name=rates-24
add name=rate-51
add basic=6Mbps ht-basic-mcs=mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7 \
ht-supported-mcs="mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-8,mc\
s-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,mcs-18,mcs-19,\
mcs-20,mcs-21,mcs-22,mcs-23" name=default-rate supported=\
6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps vht-basic-mcs=\
mcs0-7 vht-supported-mcs=mcs0-9,mcs0-9,mcs0-9
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
name=security1
/caps-man configuration
add channel=channel6 channel.tx-power=15 country=israel datapath=datapath1 \
installation=any mode=ap multicast-helper=full name=cfg24 security=\
security1 ssid=hAP
add channel=channel51 channel.tx-power=25 country=israel datapath=datapath1 \
datapath.client-to-client-forwarding=no datapath.local-forwarding=no \
installation=any mode=ap multicast-helper=full name=cfg51 security=\
security1 ssid=hAP
add channel=CH2.4-auto channel.tx-power=11 country=israel datapath=datapath1 \
installation=any mode=ap multicast-helper=full name=Config2.4 rates=rate1 \
security=security1 ssid=CAPsMAN
add channel=CH5-auto channel.tx-power=25 country=israel datapath=datapath1 \
installation=any mode=ap multicast-helper=full name=Config5 rates=\
default-rate security=security1 ssid=CAPsMAN
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=publicip.net.il
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes upgrade-policy=\
suggest-same-version
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=bridge
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=g,gn \
master-configuration=Config2.4 name-format=prefix-identity name-prefix=\
2GHz
add action=create-dynamic-enabled hw-supported-modes=an,ac \
master-configuration=Config5 name-format=prefix-identity name-prefix=5GHz
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=\
cfg24 name-format=prefix-identity name-prefix=2.4g
add action=create-dynamic-enabled hw-supported-modes=an master-configuration=\
cfg51 name-format=prefix-identity name-prefix=5g
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=lte1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1h
/ip dhcp-client
add default-route-distance=2 disabled=no interface=lte1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 domain=\
lan gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.88.0/24 list=LAN
add address=X.X.X.X list=secure
/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input dst-port=8291 protocol=tcp src-address=\
X.X.X.X
add action=accept chain=input comment="Allow LAN DNS queries-UDP" dst-port=53 \
in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries - TCP" dst-port=\
53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=accept chain=prerouting dst-address-list=Connected \
src-address-list=Connected
add action=mark-connection chain=input connection-mark=no-mark in-interface=\
ether1 new-connection-mark=WAN1->ROS passthrough=yes
add action=mark-connection chain=input connection-mark=no-mark in-interface=\
lte1 new-connection-mark=WAN2->ROS passthrough=yes
add action=accept chain=output connection-mark=WAN1->ROS
add action=mark-routing chain=output comment=WAN1>ROS connection-mark=\
WAN1->ROS new-routing-mark=ISP1_Route passthrough=yes
add action=mark-routing chain=output comment=WAN2>ROS connection-mark=\
WAN2>ROS new-routing-mark=ISP2_Route passthrough=yes
add action=mark-connection chain=forward comment=WAN1>LANs connection-mark=\
no-mark in-interface=ether1 new-connection-mark=WAN1->LANs passthrough=\
yes
add action=mark-connection chain=forward comment=WAN2>LANs connection-mark=\
no-mark in-interface=lte1 new-connection-mark=WAN2->LANs passthrough=yes
add action=mark-routing chain=prerouting comment=WAN1>LAN connection-mark=\
WAN1->LANs new-routing-mark=ISP1_Route passthrough=yes src-address-list=\
LAN
add action=mark-routing chain=prerouting comment=WAN2>LAN connection-mark=\
WAN2->LANs new-routing-mark=ISP2_Route passthrough=yes src-address-list=\
LAN
add action=mark-connection chain=prerouting comment=LAN>WAN connection-mark=\
no-mark dst-address-list=!Connected dst-address-type=!local \
new-connection-mark=LAN->WAN passthrough=yes src-address-list=LAN
add action=mark-routing chain=prerouting comment="Load-Balancing here" \
connection-mark=LAN->WAN new-routing-mark=ISP1_Route passthrough=yes \
src-address-list=192.168.88.236
add action=mark-routing chain=prerouting comment="Load-Balancing here" \
connection-mark=LAN->WAN new-routing-mark=ISP1_Route passthrough=yes \
src-address-list=LAN
add action=mark-connection chain=prerouting comment=\
"Sticky_ISP1 mark connection" connection-mark=LAN->WAN \
new-connection-mark=Sticky_ISP1 passthrough=yes routing-mark=ISP1_Route
add action=mark-connection chain=prerouting comment=\
"Sticky_ISP2 mark connection" connection-mark=LAN->WAN \
new-connection-mark=Sticky_ISP2 passthrough=yes routing-mark=ISP2_Route
add action=mark-routing chain=prerouting comment="Sticky_ISP1 mark routing" \
connection-mark=Sticky_ISP1 new-routing-mark=ISP1_Route passthrough=yes \
src-address-list=LAN
add action=mark-routing chain=prerouting comment="Sticky_ISP2 mark routing" \
connection-mark=Sticky_ISP2 new-routing-mark=ISP2_Route passthrough=yes \
src-address-list=LAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add comment=ISP1_Route distance=1 gateway=x.x.x.x routing-mark=\
ISP1_Route
add comment=ISP2_Route distance=1 gateway=192.168.8.1 routing-mark=ISP2_Route
add check-gateway=ping distance=2 gateway=192.168.8.1
/system clock
set time-zone-name=Asia/Jerusalem
/system package update
set channel=long-term
/tool graphing interface
add interface=ether1
add interface=lte1
/tool mac-server
set allowed-interface-list=LAN
/tool traffic-monitor
add interface=ether1 name=LB1 on-event=":log warning \"LB Debug: ISP1 overload\
ed, switching to ISP2\";\r\
\n/ip firewall mangle set [find comment=\"Load-Balancing here\"] new-routi\
ng-mark=ISP2_Route" threshold=199000000 traffic=received
add interface=ether1 name=LB2 on-event=":log warning \"LB Debug: ISP1 back to \
normal\";\r\
\n/ip firewall mangle set [find comment=\"Load-Balancing here\"] new-routi\
ng-mark=ISP1_Route" threshold=5000000 traffic=received trigger=below