/interface ethernet
set [ find default-name=ether1 ] advertise=\
    10M-half,10M-full,100M-half,100M-full
/interface pptp-client
add connect-to=test.com disabled=no name=pptp-out1 password=\
    test user=test
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1 ranges=10.0.0.1-10.0.0.254
/port
set 0 name=serial0
/ppp profile
set *FFFFFFFE dns-server=8.8.8.8 local-address=pool1 remote-address=pool1
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,passw\
    ord,web,sniff,sensitive,api,romon,dude,tikapp"
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface pptp-server server
set authentication=pap,chap,mschap1,mschap2 enabled=yes
/interface sstp-server server
set enabled=yes verify-client-certificate=yes
/ip address
add address=10.0.0.1/24 interface=ether1 network=10.0.0.0
/ip cloud
set update-time=no
/ip dhcp-client
add disabled=no interface=ether1
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=vpn passthrough=yes \
    src-address=10.0.0.0/24
/ip firewall nat
add action=masquerade chain=srcnat src-address=10.0.0.0/24
/ip route
add distance=1 gateway=pptp-out1 routing-mark=vpn

/ip socks
set auth-method=password enabled=yes version=5
/ip socks users
add name=test password=test
/ppp secret
add name=test password=test profile=default-encryption

/ip firewall mangle
add chain=output connection-state=new action=jump jump-target=new-output
add chain=new-output dst-address=x.x.x.x/x action=return comment="exclude target address or subnet"
add chain=new-output protocol=tcp dst-port=12345 action=return comment="exclude target port"
...
add chain=new-output action=mark-connection new-connection-mark=to-vpn passthrough=yes
add chain=output connection-mark=to-vpn action=mark-routing new-routing-mark=vpn