# may/30/2016 17:50:47 by RouterOS 6.35.2
# software id = 89JL-PKSG
#
/interface bridge
add admin-mac=D4:CA:6D:2F:86:F7 arp=proxy-arp auto-mac=no mtu=1500 name="Bridge HOTSPOT"
add mtu=1500 name="Bridge SOUKR CAM"
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] arp=proxy-arp name="ether2-WIFI Restaurace"
set [ find default-name=ether3 ] comment="VYPNOUT PROXY ARP POKUD SE NEPOUZIVA VPNka, pristup do site" name=ether3-IPCAM
set [ find default-name=ether4 ] arp=proxy-arp name="ether4-WIFI Umyvarky"
set [ find default-name=ether5 ] arp=proxy-arp comment=\
    "Pokud nejde port - zkontrolovat funk\E8nost injektoru, switche, bleskojistky, konektro\F9, kabelov\E9 cesty, za\F8\EDzen\ED. Pro dostupnost kamer ze site 192.168.1.0 je nutne nastavit routovani na vdsl modemu na gateway mikrotiku." name=\
    "ether5-WIFI Kiosek"
/interface pptp-server
add name=pptp-in1 user=""
/ip neighbor discovery
set ether3-IPCAM comment="VYPNOUT PROXY ARP POKUD SE NEPOUZIVA VPNka, pristup do site"
set "ether5-WIFI Kiosek" comment=\
    set pptp-in1 discover=no
/interface ethernet switch port
set 1 vlan-mode=disabled
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-eap management-protection-key=******* mode=dynamic-keys radius-mac-mode=as-username-and-password supplicant-identity="" wpa-pre-shared-key=****** wpa2-pre-shared-key=********
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=profile1 supplicant-identity="" wpa2-pre-shared-key=******
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country="czech republic" disabled=no distance=indoors frequency=2422 mode=ap-bridge security-profile=profile1 ssid=LogMK
/ip neighbor discovery
set wlan1 discover=no
/ip hotspot profile
add dns-name=oasa.network hotspot-address=192.168.77.1 http-cookie-lifetime=2d name=pouzivany use-radius=yes
/ip hotspot user profile
add keepalive-timeout=1h name=1h
add keepalive-timeout=1d name=1d shared-users=2
add keepalive-timeout=3d name=3d shared-users=2
add keepalive-timeout=1w name=1w shared-users=2
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name="Mikrotik 88" ranges=192.168.88.10-192.168.88.254
add name="WIFI 2" ranges=192.168.2.100-192.168.2.254
add name="IPCAM 3" ranges=192.168.3.100-192.168.3.254
add name="WIFI 77" ranges=192.168.77.20-192.168.77.254
add name=VPN ranges=192.168.3.95-192.168.3.99
add name="Soukrom\E1 s\ED\9D" ranges=192.168.1.100-192.168.1.199
/ip dhcp-server
add add-arp=yes address-pool="IPCAM 3" interface=ether3-IPCAM lease-time=3d name="dhcp ipcam"
add add-arp=yes address-pool="WIFI 77" disabled=no interface="Bridge HOTSPOT" lease-time=12h name="dhcp wifi hotspot"
add add-arp=yes address-pool="Mikrotik 88" disabled=no interface=wlan1 lease-time=3d name="Inegrovana wifi admin"
add add-arp=yes address-pool="Soukrom\E1 s\ED\9D" interface=ether1-gateway lease-time=3d name="dhcp Soukrom\FD"
add add-arp=yes address-pool="Soukrom\E1 s\ED\9D" disabled=no interface="Bridge SOUKR CAM" lease-time=3d name="DHCP 192.168.1.0"
/ip hotspot
add address-pool="WIFI 77" addresses-per-mac=1 interface="Bridge HOTSPOT" name=hotspot1 profile=pouzivany
/port
set 0 name=serial0
/ppp profile
add change-tcp-mss=yes comment="PYpojen\ED do s\EDt\1B WIF'I" dns-server=192.168.77.1 local-address=192.168.77.1 name=profile1 remote-address="WIFI 77" use-encryption=yes
add dns-server=192.168.1.1 local-address=192.168.3.1 name=profile2 use-encryption=yes
set *FFFFFFFE comment="PYipojen\ED do s\EDt\1B LAN" dns-server=192.168.1.1 local-address=192.168.3.1 remote-address="IPCAM 3"
/queue simple
add disabled=yes name="Hotspot server bez limitu" target=192.168.77.1/32
add name=queue1
add disabled=yes max-limit=3M/1M name="Zpomalen\ED hotspotu" queue=hotspot-default/hotspot-default target=\
    "192.168.77.0/24,Bridge HOTSPOT" time=0s-1d,sun,mon,tue,wed,thu,fri,sat
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge filter
add action=drop chain=forward disabled=yes in-interface="ether5-WIFI Kiosek" out-interface=ether3-IPCAM
add action=drop chain=forward disabled=yes in-interface="ether2-WIFI Restaurace" out-interface=ether3-IPCAM
add action=drop chain=forward disabled=yes in-interface="ether4-WIFI Umyvarky" out-interface=ether3-IPCAM
add action=passthrough chain=forward disabled=yes in-interface="ether4-WIFI Umyvarky" out-interface=ether1-gateway
/interface bridge port
add bridge="Bridge HOTSPOT" interface="ether5-WIFI Kiosek"
add bridge="Bridge HOTSPOT" interface="ether4-WIFI Umyvarky"
add bridge="Bridge HOTSPOT" interface="ether2-WIFI Restaurace"
add bridge="Bridge SOUKR CAM" interface=ether3-IPCAM
add bridge="Bridge SOUKR CAM" interface=ether1-gateway
/interface pptp-server server
set authentication=mschap2 enabled=yes max-mru=1460 max-mtu=1460
/ip address
add address=192.168.88.1/24 comment="default configuration" interface=wlan1 network=192.168.88.0
add address=192.168.3.1/24 disabled=yes interface=ether3-IPCAM network=192.168.3.0
add address=192.168.77.1/24 interface="Bridge HOTSPOT" network=192.168.77.0
add address=192.168.1.3 disabled=yes interface=ether1-gateway network=192.168.1.0
add address=192.168.1.7/24 interface=ether1-gateway network=192.168.1.0
add address=192.168.2.1/24 disabled=yes interface=ether3-IPCAM network=192.168.2.0
add address=192.168.1.3/24 interface="Bridge SOUKR CAM" network=192.168.1.0
add address=192.168.77.1/24 disabled=yes interface="ether2-WIFI Restaurace" network=192.168.77.0
add address=192.168.77.1/24 disabled=yes interface="ether4-WIFI Umyvarky" network=192.168.77.0
add address=192.168.77.1/24 disabled=yes interface="ether5-WIFI Kiosek" network=192.168.77.0
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid interface=ether1-gateway
/ip dhcp-server config
set store-leases-disk=immediately
/ip dhcp-server lease
add address=192.168.3.2 disabled=yes mac-address=00:1F:D0:D5:6B:97 server="dhcp ipcam"
add address=192.168.3.57 always-broadcast=yes disabled=yes mac-address=80:1F:02:2A:EA:9D server="dhcp ipcam"
add address=192.168.3.55 always-broadcast=yes disabled=yes mac-address=80:1F:02:2A:EA:A4 server="dhcp ipcam"
add address=192.168.3.58 always-broadcast=yes disabled=yes mac-address=80:1F:02:2D:B7:EF server="dhcp ipcam"
add address=192.168.3.53 always-broadcast=yes disabled=yes mac-address=80:1F:02:2A:E0:E5 server="dhcp ipcam"
add address=192.168.77.4 mac-address=DC:9F:DB:94:6E:A6 server="dhcp wifi hotspot"
add address=192.168.77.3 mac-address=DC:9F:DB:94:6F:AD server="dhcp wifi hotspot"
add address=192.168.77.5 always-broadcast=yes mac-address=DC:9F:DB:5A:A5:AC server="dhcp wifi hotspot"
add address=192.168.77.2 always-broadcast=yes mac-address=F4:DC:F9:ED:74:F0 server="dhcp wifi hotspot"
add address=192.168.3.51 disabled=yes mac-address=80:1F:02:2E:B3:C7 server="dhcp ipcam"
add address=192.168.3.52 disabled=yes mac-address=80:1F:02:2A:EA:D3 server="dhcp ipcam"
add address=192.168.3.56 disabled=yes mac-address=00:27:22:60:A1:8F server="dhcp ipcam"
add address=192.168.3.50 client-id=1:80:1f:2:2e:b4:3e disabled=yes mac-address=80:1F:02:2E:B4:3E server="dhcp ipcam"
add address=192.168.3.61 disabled=yes mac-address=00:27:22:61:46:BB server="dhcp ipcam"
add address=192.168.1.5 comment="Raspberry PI" mac-address=B8:27:EB:5B:9D:37 server="DHCP 192.168.1.0"
add address=192.168.1.10 comment="Kamera web" mac-address=00:27:22:61:47:87 server="DHCP 192.168.1.0"
add address=192.168.1.11 comment=Prodesk mac-address=EC:B1:D7:72:91:7A server="DHCP 192.168.1.0"
add address=192.168.3.60 disabled=yes mac-address=00:27:22:61:46:E3 server="dhcp ipcam"
add address=192.168.1.50 client-id=1:80:1f:2:2e:b4:3e mac-address=80:1F:02:2E:B4:3E server="DHCP 192.168.1.0"
add address=192.168.1.51 mac-address=80:1F:02:2E:B3:C7 server="DHCP 192.168.1.0"
add address=192.168.1.52 mac-address=80:1F:02:2A:EA:D3 server="DHCP 192.168.1.0"
add address=192.168.1.53 always-broadcast=yes mac-address=80:1F:02:2A:E0:E5 server="DHCP 192.168.1.0"
add address=192.168.1.55 always-broadcast=yes mac-address=80:1F:02:2A:EA:A4 server="DHCP 192.168.1.0"
add address=192.168.1.56 mac-address=00:27:22:60:A1:8F server="DHCP 192.168.1.0"
add address=192.168.1.57 always-broadcast=yes mac-address=80:1F:02:2A:EA:9D server="DHCP 192.168.1.0"
add address=192.168.1.58 always-broadcast=yes mac-address=80:1F:02:2D:B7:EF server="DHCP 192.168.1.0"
add address=192.168.1.60 mac-address=00:27:22:61:46:E3 server="DHCP 192.168.1.0"
add address=192.168.1.61 mac-address=00:27:22:61:46:BB server="DHCP 192.168.1.0"
add address=192.168.1.64 client-id=1:0:27:22:61:79:2b mac-address=00:27:22:61:79:2B server="DHCP 192.168.1.0"
add address=192.168.1.62 client-id=1:0:27:22:61:2f:32 mac-address=00:27:22:61:2F:32 server="DHCP 192.168.1.0"
add address=192.168.1.63 client-id=1:0:27:22:61:2e:a5 mac-address=00:27:22:61:2E:A5 server="DHCP 192.168.1.0"
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.7 gateway=192.168.1.7
add address=192.168.2.0/24 dns-server=192.168.2.1 gateway=192.168.2.1
add address=192.168.3.0/24 dns-server=192.168.3.1 gateway=192.168.3.1
add address=192.168.77.0/24 comment="hotspot network - zde menim branu a DNS pro modem" dns-server=192.168.77.1 gateway=192.168.77.1
add address=192.168.88.0/24 comment="default configuration" dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.1.1,8.8.4.4,192.168.77.1,192.168.1.7,192.168.1.2
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=passthrough chain=forward disabled=yes dst-address=192.168.77.0/24 src-address=192.168.3.0/24
add action=drop chain=forward comment="Separace ETHER PORT IPCAM a BRIDGE (WIFI) - sm\ECr z IPCAM do WIFI - POZOR pro uplatneni pravidla musi byt vypnuta transparent proxy v user profile hotspotu" disabled=yes in-interface=ether3-IPCAM \
    out-interface="Bridge HOTSPOT"
add action=drop chain=forward comment="Separace ETHER PORT IPCAM a BRIDGE (WIFI)" disabled=yes in-interface="Bridge HOTSPOT" out-interface="Bridge SOUKR CAM"
add action=drop chain=forward comment="Separace ETHER PORT IPCAM a BRIDGE (WIFI) - NEPOU}IVAT" disabled=yes out-interface="Bridge SOUKR CAM"
add action=drop chain=forward comment="Blokovani pristupu na LAN" disabled=yes dst-address=192.168.1.0/24 in-interface="Bridge HOTSPOT"
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=established
add chain=input comment="default configuration" connection-state=related
add action=drop chain=input comment="PRISTUP NA MIKROTIK Z GATEWAY - POZOR BLOKUJE PPTP" disabled=yes in-interface=ether1-gateway
add action=passthrough chain=forward comment="Pristup na WIFI admin ze site IPCAM" disabled=yes dst-address=192.168.77.0/24 in-interface=ether3-IPCAM
/ip firewall mangle
add action=mark-routing chain=prerouting in-interface="Bridge HOTSPOT" new-routing-mark=hotspot
add action=mark-routing chain=prerouting in-interface="Bridge SOUKR CAM" new-routing-mark=soukroma
add action=mark-routing chain=prerouting disabled=yes in-interface=ether1-gateway new-routing-mark=SOUKR
add action=mark-routing chain=prerouting disabled=yes in-interface=ether3-IPCAM new-routing-mark=SOUKR
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes to-addresses=0.0.0.0
add action=masquerade chain=srcnat disabled=yes out-interface=ether1-gateway
add action=masquerade chain=srcnat comment="masquerade IPCAM" disabled=yes out-interface=ether1-gateway src-address=192.168.3.0/24 to-addresses=0.0.0.0
add action=dst-nat chain=dstnat comment="CAM PC - dostupnost z WIFI" disabled=yes dst-address=192.168.2.89 to-addresses=192.168.3.2
add action=src-nat chain=srcnat comment="CAM PC - dostupnost z WIFI" disabled=yes src-address=192.168.3.2 to-addresses=192.168.2.89
add action=masquerade chain=srcnat disabled=yes src-address=192.168.77.0/24 to-addresses=0.0.0.0
add action=masquerade chain=srcnat disabled=yes out-interface="Bridge SOUKR CAM" src-address=192.168.77.0/24 \
    to-addresses=0.0.0.0
/ip hotspot ip-binding
add address=192.168.77.4 mac-address=DC:9F:DB:94:6E:A6 type=bypassed
add address=192.168.77.5 mac-address=DC:9F:DB:5A:A5:AC type=bypassed
add address=192.168.77.6 mac-address=00:22:B0:99:E6:01 type=bypassed
add address=192.168.77.3 mac-address=DC:9F:DB:94:6F:AD type=bypassed
add address=192.168.77.2 mac-address=F4:DC:F9:ED:74:F0 type=bypassed
/ip hotspot user
/ip hotspot walled-garden
add disabled=yes server=\
    hotspot1
/ip proxy
set cache-path=web-proxy1 max-cache-size=none parent-proxy=0.0.0.0
/ip route
add distance=1 gateway=192.168.1.2 routing-mark=hotspot
add distance=1 gateway=192.168.1.1 routing-mark=soukroma
add distance=1 gateway=192.168.1.1
/ip service
set api disabled=yes
/ppp secret
add name=ondrej22 password=******** profile=default-encryption service=\
    pptp
add name=ondrej23 password=******** profile=profile1 service=pptp
/radius
add address=127.0.0.1 secret=******* service=hotspot
/snmp
set enabled=yes
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Prague
/system leds
set 0 interface="Bridge HOTSPOT" type=interface-activity
/system logging
add topics=l2tp
add topics=pptp
/system ntp client
set enabled=yes primary-ntp=193.55.167.1 secondary-ntp=129.70.132.37
/system routerboard settings
set cpu-frequency=360MHz
/tool graphing interface
add interface="Bridge HOTSPOT"
/tool graphing queue
add allow-target=no simple-queue="Zpomalen\ED hotspotu"
/tool graphing resource
add
/tool mac-server
set [ find default=yes ] disabled=yes
add interface="ether2-WIFI Restaurace"
add interface=ether3-IPCAM
add interface="ether4-WIFI Umyvarky"
add interface="ether5-WIFI Kiosek"
add interface=wlan1
add interface="Bridge HOTSPOT"
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface="ether2-WIFI Restaurace"
add interface=ether3-IPCAM
add interface="ether4-WIFI Umyvarky"
add interface="ether5-WIFI Kiosek"
add interface=wlan1
add interface="Bridge HOTSPOT"
/tool traffic-monitor
add disabled=yes interface="Bridge HOTSPOT" name="WiFi OASA" threshold=0