Did anything change lately regarding wireguard in latest OS? I did an upgrade and it seems I can't come from the outside anymore to connect to the wireguard. If I am internally I can connect to it and handshake is established ok.
I have the same settings from before and nothing change from my side as far as I can tell beside upgrading the OS.
I also tried to do an nmap to see the 2 wireguard configured ports open but I couldn't see the ports open using nmap.
I am adding below the configuration so maybe it can give a clue cause at this moment I am clueless why it changed and doesn't work now anymore
Thank you lots in advance
Code: Select all
# 2024-04-01 15:31:22 by RouterOS 7.14.2
# software id = WCPF-BHYF
#
# model = RB5009UG+S+
# serial number = ECXXX
/caps-man channel
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2437 name=ch6 tx-power=10
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2412 name=ch1 tx-power=20
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2462 name=ch11 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2427 name=ch4 tx-power=10
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2417 name=ch2 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2422 name=ch3 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2432 name=ch5 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2437 name=ch6 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2442 name=ch7 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2447 name=ch8 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2452 name=ch9 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2457 name=ch10 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2467 name=ch12 tx-power=15
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2472 name=ch13 tx-power=15
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5180 name=ch38 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5220 name=ch46 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5260 name=ch54 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5300 name=ch62 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5500 name=ch102 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5540 name=ch110 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5580 name=ch118 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5620 name=ch126 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5660 name=ch134 tx-power=40
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5180 name=ch42 tx-power=40
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5260 name=ch58 tx-power=40
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5500 name=ch106 tx-power=40
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5580 name=ch122 tx-power=40
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5660 name=ch138 tx-power=40
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5745 name=ch155 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5700 name=ch142 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5745 name=ch151 tx-power=40
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5785 name=ch159 tx-power=40
/interface bridge
add ageing-time=5m arp=enabled arp-timeout=auto auto-mac=yes dhcp-snooping=no disabled=no fast-forward=yes forward-delay=15s igmp-snooping=no max-message-age=20s mtu=auto name=bridge-dmz port-cost-mode=short priority=0x8000 protocol-mode=rstp transmit-hold-count=6 \
vlan-filtering=no
add ageing-time=5m arp=enabled arp-timeout=auto auto-mac=yes dhcp-snooping=no disabled=no fast-forward=yes forward-delay=15s igmp-snooping=no max-message-age=20s mtu=auto name=bridge-guest port-cost-mode=short priority=0x8000 protocol-mode=rstp transmit-hold-count=6 \
vlan-filtering=no
add ageing-time=5m arp=enabled arp-timeout=auto auto-mac=yes dhcp-snooping=no disabled=no fast-forward=yes forward-delay=15s igmp-snooping=no max-message-age=20s mtu=auto name=bridge-lan port-cost-mode=short priority=0x8000 protocol-mode=rstp transmit-hold-count=6 \
vlan-filtering=no
/interface ethernet
set [ find default-name=ether1 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full,2.5G-baseT arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \
loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:E9 mtu=1500 name=eth1-wan orig-mac-address=2C:C8:1B:FF:D5:E9 rx-flow-control=off tx-flow-control=off
set [ find default-name=ether2 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \
loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EA mtu=1500 name=eth2-lan orig-mac-address=2C:C8:1B:FF:D5:EA rx-flow-control=off tx-flow-control=off
set [ find default-name=ether3 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \
loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EB mtu=1500 name=eth3-lan orig-mac-address=2C:C8:1B:FF:D5:EB rx-flow-control=off tx-flow-control=off
set [ find default-name=ether4 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \
loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EC mtu=1500 name=eth4-lan orig-mac-address=2C:C8:1B:FF:D5:EC rx-flow-control=off tx-flow-control=off
set [ find default-name=ether5 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \
loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:ED mtu=1500 name=eth5-lan orig-mac-address=2C:C8:1B:FF:D5:ED rx-flow-control=off tx-flow-control=off
set [ find default-name=ether6 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \
loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EE mtu=1500 name=eth6-lan orig-mac-address=2C:C8:1B:FF:D5:EE rx-flow-control=off tx-flow-control=off
set [ find default-name=ether7 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \
loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EF mtu=1500 name=eth7-lan orig-mac-address=2C:C8:1B:FF:D5:EF rx-flow-control=off tx-flow-control=off
set [ find default-name=ether8 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \
loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:F0 mtu=1500 name=eth8-lan orig-mac-address=2C:C8:1B:FF:D5:F0 rx-flow-control=off tx-flow-control=off
set [ find default-name=sfp-sfpplus1 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full,1G-baseX,2.5G-baseT,2.5G-baseX,5G-baseT,10G-baseT,10G-baseSR-LR,10G-baseCR arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=\
unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:F1 mtu=1500 name=sfp-sfpplus1 orig-mac-address=2C:C8:1B:FF:D5:F1 rx-flow-control=off sfp-rate-select=high \
sfp-shutdown-temperature=95C tx-flow-control=off
/interface wireguard
add disabled=no listen-port=51821 mtu=1420 name=Wireguard_piVPN
add disabled=no listen-port=51820 mtu=1420 name=Wireguard_wg0
/queue interface
set Wireguard_piVPN queue=no-queue
set Wireguard_wg0 queue=no-queue
set bridge-dmz queue=no-queue
set bridge-guest queue=no-queue
set bridge-lan queue=no-queue
/interface vlan
add arp=enabled arp-timeout=auto disabled=no interface=eth2-lan loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mtu=1500 name=eth2-vlan-dmz use-service-tag=no vlan-id=20
add arp=enabled arp-timeout=auto disabled=no interface=eth2-lan loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mtu=1500 name=eth2-vlan-guest use-service-tag=no vlan-id=15
add arp=enabled arp-timeout=auto disabled=no interface=eth8-lan loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mtu=1500 name=eth8-vlan-dmz use-service-tag=no vlan-id=20
add arp=enabled arp-timeout=auto disabled=no interface=eth8-lan loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mtu=1500 name=eth8-vlan-guest use-service-tag=no vlan-id=15
/caps-man datapath
add bridge=bridge-guest local-forwarding=yes name=SSD_guest_path vlan-id=15 vlan-mode=use-tag
add bridge=bridge-lan client-to-client-forwarding=yes local-forwarding=yes name=SSD_path
add bridge=bridge-dmz local-forwarding=yes name=SSD_dmz_path vlan-id=20 vlan-mode=use-tag
/queue interface
set eth2-vlan-dmz queue=no-queue
set eth2-vlan-guest queue=no-queue
set eth8-vlan-dmz queue=no-queue
set eth8-vlan-guest queue=no-queue
/caps-man rates
add basic=6Mbps name=gn_only_no_b_rates supported=6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps
/caps-man security
add authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=SSD_sec
add authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=SSD_guest_sec
add authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=SSD_dmz_sec
/caps-man configuration
add channel=ch6 country=romania datapath=SSD_path mode=ap name=SSD_2g4 rates=gn_only_no_b_rates security=SSD_sec ssid=SSD
add channel=ch62 country=romania datapath=SSD_path mode=ap name=SSD_5g_ch62 security=SSD_sec ssid=SSD
add country=romania datapath=SSD_guest_path mode=ap name=SSD_guest security=SSD_guest_sec ssid=SSD_guest
add channel=ch62 country=romania datapath=SSD_path mode=ap name=SSD_5g_ch52 security=SSD_sec ssid=SSD
add channel=ch110 country=romania datapath=SSD_path mode=ap name=SSD_5g_ch110 security=SSD_sec ssid=SSD
add channel=ch11 country=romania datapath=SSD_path mode=ap name=SSD_2g4_ch11 rates=gn_only_no_b_rates security=SSD_sec ssid=SSD
add channel=ch4 country=romania datapath=SSD_path mode=ap name=SSD_2g4_ch4 rates=gn_only_no_b_rates security=SSD_sec ssid=SSD
add channel=ch118 country=romania datapath=SSD_path mode=ap name=SSD_5g_ch118 security=SSD_sec ssid=SSD
add channel.band=5ghz-n/ac .control-channel-width=20mhz .extension-channel=XXXX country=romania datapath.client-to-client-forwarding=yes .local-forwarding=yes name=cfg-5ghz-ac security=SSD_sec ssid=""
add channel.band=5ghz-onlyn .control-channel-width=20mhz .extension-channel=XX country=romania datapath.client-to-client-forwarding=yes .local-forwarding=yes name=cfg-5ghz-an security=SSD_sec ssid=""
add channel=ch10 country=romania datapath=SSD_path mode=ap name=SSD_2g4_ch10 security=SSD_sec ssid=SSD
add country=romania datapath=SSD_dmz_path mode=ap name=SSD_dmz security=SSD_dmz_sec ssid=SSD_dmz
/interface ethernet switch
set 0 cpu-flow-control=yes mirror-egress-target=none name=switch1
/interface ethernet switch port
set 0 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 1 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 2 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 3 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 4 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 5 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 6 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 7 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 8 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
set 9 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none
/interface ethernet switch port-isolation
set 0 !forwarding-override
set 1 !forwarding-override
set 2 !forwarding-override
set 3 !forwarding-override
set 4 !forwarding-override
set 5 !forwarding-override
set 6 !forwarding-override
set 7 !forwarding-override
set 8 !forwarding-override
set 9 !forwarding-override
/interface list
set [ find name=all ] comment="contains all interfaces" exclude="" include="" name=all
set [ find name=none ] comment="contains no interfaces" exclude="" include="" name=none
set [ find name=dynamic ] comment="contains dynamic interfaces" exclude="" include="" name=dynamic
set [ find name=static ] comment="contains static interfaces" exclude="" include="" name=static
add exclude="" include="" name=WAN
add exclude="" include="" name=LAN
add exclude="" include="" name=MULLVAN-VPN
/interface lte apn
set [ find default=yes ] add-default-route=yes apn=internet authentication=none default-route-distance=2 ip-type=auto name=default use-network-apn=yes use-peer-dns=yes
/interface macsec profile
set [ find default-name=default ] name=default server-priority=10
/interface wireless security-profiles
set [ find default=yes ] authentication-types="" disable-pmkid=no eap-methods=passthrough group-ciphers=aes-ccm group-key-update=5m interim-update=0s management-protection=disabled mode=none mschapv2-username="" name=default radius-called-format=mac:ssid radius-eap-accounting=no \
radius-mac-accounting=no radius-mac-authentication=no radius-mac-caching=disabled radius-mac-format=XX:XX:XX:XX:XX:XX radius-mac-mode=as-username static-algo-0=none static-algo-1=none static-algo-2=none static-algo-3=none static-sta-private-algo=none static-transmit-key=\
key-0 supplicant-identity=MikroTik tls-certificate=none tls-mode=no-certificates unicast-ciphers=aes-ccm
/ip dhcp-client option
set clientid_duid code=61 name=clientid_duid value="0xff\$(CLIENT_DUID)"
set clientid code=61 name=clientid value="0x01\$(CLIENT_MAC)"
set hostname code=12 name=hostname value="\$(HOSTNAME)"
/ip hotspot profile
set [ find default=yes ] dns-name="" hotspot-address=0.0.0.0 html-directory=hotspot html-directory-override="" http-cookie-lifetime=3d http-proxy=0.0.0.0:0 install-hotspot-queue=yes login-by=cookie,http-chap name=default rate-limit="" smtp-server=0.0.0.0 split-user-domain=no \
use-radius=no
/ip hotspot user profile
set [ find default=yes ] add-mac-cookie=yes address-list="" idle-timeout=none !insert-queue-before keepalive-timeout=2m mac-cookie-timeout=3d name=default !parent-queue !queue-type shared-users=1 status-autorefresh=1m transparent-proxy=no
/ip ipsec mode-config
set [ find default=yes ] name=request-only responder=no use-responder-dns=exclusively
/ip ipsec policy group
set [ find default=yes ] name=default
/ip ipsec profile
set [ find default=yes ] dh-group=modp2048,modp1024 dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=aes-128,3des hash-algorithm=sha1 lifetime=1d name=default nat-traversal=yes proposal-check=obey
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc lifetime=30m name=default pfs-group=modp1024
/ip pool
add name=dhcp ranges=192.168.200.150-192.168.200.200
add name=pool-guest ranges=50.0.0.2-50.0.0.100
add name=pool-vpn ranges=10.10.10.2-10.10.10.7
add name=vpn ranges=192.168.89.2-192.168.89.255
add name=pool-dmz ranges=51.0.0.2-51.0.0.200
/ip dhcp-server
add address-pool=dhcp authoritative=yes disabled=no interface=bridge-lan lease-script="" lease-time=10m name=dhcp-lan use-radius=no
add address-pool=pool-guest authoritative=yes disabled=no interface=bridge-guest lease-script="" lease-time=10m name=dhcp-guest use-radius=no
add address-pool=pool-dmz authoritative=yes disabled=no interface=bridge-dmz lease-script="" lease-time=10m name=dhcp-dmz use-radius=no
/ip smb users
set [ find default=yes ] disabled=yes name=guest read-only=yes
/ppp profile
set *0 address-list="" !bridge !bridge-horizon bridge-learning=default !bridge-path-cost !bridge-port-priority change-tcp-mss=yes !dns-server !idle-timeout !incoming-filter !insert-queue-before !interface-list !local-address name=default on-down="" on-up="" only-one=default \
!outgoing-filter !parent-queue !queue-type !rate-limit !remote-address !session-timeout use-compression=default use-encryption=default use-ipv6=yes use-mpls=default use-upnp=default !wins-server
set *FFFFFFFE address-list="" !bridge !bridge-horizon bridge-learning=default !bridge-path-cost !bridge-port-priority change-tcp-mss=yes !dns-server !idle-timeout !incoming-filter !insert-queue-before !interface-list local-address=192.168.89.1 name=default-encryption on-down="" \
on-up="" only-one=default !outgoing-filter !parent-queue !queue-type !rate-limit remote-address=vpn !session-timeout use-compression=default use-encryption=yes use-ipv6=yes use-mpls=default use-upnp=default !wins-server
/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 default-route-distance=1 dial-on-demand=no disabled=no interface=eth1-wan keepalive-timeout=10 max-mru=auto max-mtu=1500 mrru=disabled name=digi profile=default service-name="" use-peer-dns=no user=TMxxx
/queue interface
set digi queue=no-queue
/queue type
set 0 kind=pfifo name=default pfifo-limit=50
set 1 kind=pfifo name=ethernet-default pfifo-limit=50
set 2 kind=sfq name=wireless-default sfq-allot=1514 sfq-perturb=5
set 3 kind=red name=synchronous-default red-avg-packet=1000 red-burst=20 red-limit=60 red-max-threshold=50 red-min-threshold=10
set 4 kind=sfq name=hotspot-default sfq-allot=1514 sfq-perturb=5
set 5 kind=pcq name=pcq-upload-default pcq-burst-rate=0 pcq-burst-threshold=0 pcq-burst-time=10s pcq-classifier=src-address pcq-dst-address-mask=32 pcq-dst-address6-mask=128 pcq-limit=50KiB pcq-rate=0 pcq-src-address-mask=32 pcq-src-address6-mask=128 pcq-total-limit=2000KiB
set 6 kind=pcq name=pcq-download-default pcq-burst-rate=0 pcq-burst-threshold=0 pcq-burst-time=10s pcq-classifier=dst-address pcq-dst-address-mask=32 pcq-dst-address6-mask=128 pcq-limit=50KiB pcq-rate=0 pcq-src-address-mask=32 pcq-src-address6-mask=128 pcq-total-limit=2000KiB
set 7 kind=none name=only-hardware-queue
set 8 kind=mq-pfifo mq-pfifo-limit=50 name=multi-queue-ethernet-default
set 9 kind=pfifo name=default-small pfifo-limit=10
/queue interface
set eth1-wan queue=only-hardware-queue
set eth2-lan queue=only-hardware-queue
set eth3-lan queue=only-hardware-queue
set eth4-lan queue=only-hardware-queue
set eth5-lan queue=only-hardware-queue
set eth6-lan queue=only-hardware-queue
set eth7-lan queue=only-hardware-queue
set eth8-lan queue=only-hardware-queue
set sfp-sfpplus1 queue=only-hardware-queue
/queue simple
add bucket-size=0.1/0.1 burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s disabled=no dst=digi limit-at=0/0 max-limit=50M/50M name=guest_traffic packet-marks="" parent=none priority=8/8 queue=default/default target=50.0.0.0/24,2a02:2f09:3418:f303::/64 !time total-queue=\
default
add bucket-size=0.1/0.1 burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s disabled=no dst=digi limit-at=0/0 max-limit=50M/50M name=dmz_traffic packet-marks="" parent=none priority=8/8 queue=default/default target=51.0.0.0/24,2a02:2f09:3418:f303::/64 !time total-queue=default
/routing bgp template
set default as=65530 name=default
/snmp community
set [ find default=yes ] addresses=::/0 authentication-protocol=MD5 disabled=no encryption-protocol=DES name=public read-access=yes security=none write-access=no
/system logging action
set 0 memory-lines=5000 memory-stop-on-full=no name=memory target=memory
set 1 disk-file-count=2 disk-file-name=log disk-lines-per-file=1000 disk-stop-on-full=no name=disk target=disk
set 2 name=echo remember=yes target=echo
set 3 bsd-syslog=no name=remote remote=0.0.0.0 remote-port=514 src-address=0.0.0.0 syslog-facility=daemon syslog-severity=auto syslog-time-format=bsd-syslog target=remote
add email-start-tls=no email-to=samuellazea1990@gmail.com name=GMAIL target=email
add email-start-tls=no email-to=samuellazea@yahoo.com name=YAHOO target=email
/user group
set read name=read policy=local,telnet,ssh,reboot,read,test,winbox,password,web,sniff,sensitive,api,romon,rest-api,!ftp,!write,!policy skin=default
set write name=write policy=local,telnet,ssh,reboot,read,write,test,winbox,password,web,sniff,sensitive,api,romon,rest-api,!ftp,!policy skin=default
set full name=full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,rest-api skin=default
add name=prometheus policy=read,test,winbox,api,!local,!telnet,!ssh,!ftp,!reboot,!write,!policy,!password,!web,!sniff,!sensitive,!romon,!rest-api skin=default
/caps-man aaa
set called-format=mac:ssid interim-update=disabled mac-caching=disabled mac-format=XX:XX:XX:XX:XX:XX mac-mode=as-username
/caps-man manager
# bad package path
set ca-certificate=none certificate=none enabled=yes package-path=/downloads/ require-peer-certificate=no upgrade-policy=suggest-same-version
/caps-man manager interface
set [ find default=yes ] disabled=no forbid=yes interface=all
add disabled=no forbid=no interface=bridge-lan
/caps-man provisioning
add action=create-dynamic-enabled comment=2g4_802.11g_capable_radios common-name-regexp="" disabled=no hw-supported-modes=g identity-regexp=CAPac_Etaj ip-address-ranges="" master-configuration=SSD_2g4_ch11 name-format=prefix-identity name-prefix=2g4_ch11 radio-mac=\
00:00:00:00:00:00 slave-configurations=SSD_guest,SSD_dmz
add action=create-dynamic-enabled comment=2g4_802.11g_capable_radios common-name-regexp="" disabled=no hw-supported-modes=g identity-regexp=CAPac_Parter ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch4 radio-mac=\
00:00:00:00:00:00 slave-configurations=SSD_guest,SSD_dmz
add action=create-dynamic-enabled comment=5g_ch118_802.11ac_capable_radios common-name-regexp="" disabled=no hw-supported-modes=ac identity-regexp=CAPac_Etaj ip-address-ranges="" master-configuration=SSD_5g_ch118 name-format=prefix-identity name-prefix=5g_ch118 radio-mac=\
00:00:00:00:00:00 slave-configurations=SSD_guest,SSD_dmz
add action=create-dynamic-enabled comment=5g_ch110_802.11ac_capable_radios common-name-regexp="" disabled=no hw-supported-modes=ac identity-regexp=CAPac_Parter ip-address-ranges="" master-configuration=SSD_5g_ch110 name-format=prefix-identity name-prefix=5g_ch110 radio-mac=\
00:00:00:00:00:00 slave-configurations=SSD_dmz,SSD_guest
add action=create-dynamic-enabled common-name-regexp="" disabled=no hw-supported-modes=g identity-regexp=HAP ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch4 radio-mac=00:00:00:00:00:00 slave-configurations=SSD_guest,SSD_dmz
add action=create-dynamic-enabled comment=5g_ch60_802.11ac_capable_radios common-name-regexp="" disabled=yes hw-supported-modes="" identity-regexp=Mikrotik ip-address-ranges="" master-configuration=SSD_2g4_ch11 name-format=prefix-identity name-prefix=2g_ch11 radio-mac=\
00:00:00:00:00:00 slave-configurations=""
add action=create-dynamic-enabled comment=5g_ch116_802.11ac_capable_radios common-name-regexp="" disabled=yes hw-supported-modes=ac identity-regexp=CAPac_Parter ip-address-ranges="" master-configuration=SSD_5g_ch118 name-format=prefix-identity name-prefix=5g_ch116 radio-mac=\
00:00:00:00:00:00 slave-configurations=""
add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes=gn identity-regexp="" ip-address-ranges="" master-configuration=SSD_5g_ch118 name-format=prefix-identity name-prefix=2ghz radio-mac=00:00:00:00:00:00 slave-configurations=""
add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes=ac identity-regexp="" ip-address-ranges="" master-configuration=cfg-5ghz-ac name-format=prefix-identity name-prefix=5ghz-ac radio-mac=00:00:00:00:00:00 slave-configurations=""
add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes=an identity-regexp="" ip-address-ranges="" master-configuration=cfg-5ghz-an name-format=prefix-identity name-prefix=5ghz-an radio-mac=00:00:00:00:00:00 slave-configurations=""
add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes="" identity-regexp=HAP ip-address-ranges="" master-configuration=SSD_2g4_ch11 name-format=cap name-prefix="" radio-mac=00:00:00:00:00:00 slave-configurations=""
add action=create-dynamic-enabled comment=2g4_802.11g_capable_radios common-name-regexp="" disabled=yes hw-supported-modes=g identity-regexp=CAPac_Etaj ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch11 radio-mac=\
00:00:00:00:00:00 slave-configurations=SSD_dmz
add action=create-dynamic-enabled comment=2g4_802.11g_capable_radios common-name-regexp="" disabled=yes hw-supported-modes=g identity-regexp=CAPac_Parter ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch4 radio-mac=\
00:00:00:00:00:00 slave-configurations=SSD_dmz
add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes=g identity-regexp=HAP ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch4 radio-mac=00:00:00:00:00:00 slave-configurations=SSD_dmz
/certificate settings
set crl-download=no crl-store=ram crl-use=no
/container config
set layer-dir="" ram-high=0 registry-url="" tmpdir="" username=""
/disk settings
set auto-smb-sharing=no auto-smb-user=guest
/ip smb
set comment=MikrotikSMB domain=MSHOME enabled=auto interfaces=all
/interface bridge port
add auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth2-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
add auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth3-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
add auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth4-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
add auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth5-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
add auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth6-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
add auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth7-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
add auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth8-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
add auto-isolate=no bpdu-guard=no bridge=bridge-guest broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none ingress-filtering=yes interface=eth2-vlan-guest internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=15 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
add auto-isolate=no bpdu-guard=no bridge=bridge-dmz broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none ingress-filtering=yes interface=eth2-vlan-dmz internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \
point-to-point=auto priority=0x80 pvid=20 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes
/interface bridge port-controller
# disabled
set bridge=none cascade-ports="" switch=none
/interface bridge port-extender
# disabled
set control-ports="" excluded-ports="" switch=none
/interface bridge settings
set allow-fast-path=yes use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=no
/ip firewall connection tracking
set enabled=auto generic-timeout=10m icmp-timeout=10s loose-tcp-tracking=yes tcp-close-timeout=10s tcp-close-wait-timeout=10s tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s tcp-max-retrans-timeout=5m tcp-syn-received-timeout=5s tcp-syn-sent-timeout=\
5s tcp-time-wait-timeout=10s tcp-unacked-timeout=5m udp-stream-timeout=3m udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=!dynamic lldp-med-net-policy-vlan=disabled mode=tx-and-rx protocol=cdp,lldp,mndp
/ip settings
set accept-redirects=no accept-source-route=no allow-fast-path=yes arp-timeout=30s icmp-rate-limit=10 icmp-rate-mask=0x1818 ip-forward=yes max-neighbor-entries=16384 rp-filter=no secure-redirects=yes send-redirects=yes tcp-syncookies=no
/ipv6 settings
set accept-redirects=yes-if-forwarding-disabled accept-router-advertisements=yes disable-ipv6=no forward=yes max-neighbor-entries=16384
/interface detect-internet
set detect-interface-list=none internet-interface-list=none lan-interface-list=none wan-interface-list=none
/interface l2tp-server server
set accept-proto-version=all accept-pseudowire-type=all allow-fast-path=no authentication=pap,chap,mschap1,mschap2 caller-id-type=ip-address default-profile=default-encryption enabled=no keepalive-timeout=30 l2tpv3-circuit-id="" l2tpv3-cookie-length=0 l2tpv3-digest-hash=md5 \
!l2tpv3-ether-interface-list max-mru=1450 max-mtu=1450 max-sessions=unlimited mrru=disabled one-session-per-host=no use-ipsec=yes
/interface list member
add disabled=no interface=eth1-wan list=LAN
add disabled=no interface=digi list=WAN
add disabled=no interface=eth1-wan list=WAN
add disabled=no interface=bridge-lan list=LAN
/interface lte settings
set firmware-path=firmware mode=auto
/interface ovpn-server server
set auth=sha1,md5 certificate=*0 cipher=blowfish128,aes128-cbc default-profile=default enable-tun-ipv6=no enabled=no ipv6-prefix-len=64 keepalive-timeout=60 mac-address=FE:3A:DF:FE:EA:CE max-mtu=1500 mode=ip netmask=24 port=1194 protocol=tcp push-routes="" redirect-gateway=\
disabled reneg-sec=3600 require-client-certificate=no tls-version=any tun-server-ipv6=::
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead
set authentication=mschap1,mschap2 default-profile=default-encryption enabled=no keepalive-timeout=30 max-mru=1450 max-mtu=1450 mrru=disabled
/interface sstp-server server
set authentication=pap,chap,mschap1,mschap2 certificate=none ciphers=aes256-sha,aes256-gcm-sha384 default-profile=default-encryption enabled=no keepalive-timeout=60 max-mru=1500 max-mtu=1500 mrru=disabled pfs=no port=443 tls-version=any verify-client-certificate=no
/interface wifi cap
set enabled=no
/interface wifi capsman
set enabled=no
/interface wireguard peers
add allowed-address=192.168.201.3/32 client-endpoint="" comment="Sami's S22+" disabled=no endpoint-address="" endpoint-port=0 interface=Wireguard_wg0 preshared-key="" private-key="" public-key="gDSOxxx"
add allowed-address=192.168.202.2/32,192.168.200.11/32,192.168.200.92/32,192.168.200.93/32,192.168.200.31/32,192.168.201.2/32,192.168.201.3/32,192.168.8.0/24,192.168.202.1/32 client-endpoint="" comment="piVPN " disabled=no endpoint-address="" endpoint-port=0 interface=\
Wireguard_piVPN preshared-key="" private-key="" public-key="jgL7xxx"
add allowed-address=192.168.201.2/32 client-endpoint="" comment="HP Laptop" disabled=no endpoint-address="" endpoint-port=0 interface=Wireguard_wg0 preshared-key="" private-key="" public-key="/p3Ym6xxx"
/interface wireless align
set active-mode=yes audio-max=-20 audio-min=-100 audio-monitor=00:00:00:00:00:00 filter-mac=00:00:00:00:00:00 frame-size=300 frames-per-second=25 receive-all=no ssid-all=no
/interface wireless cap
set bridge=none caps-man-addresses="" caps-man-certificate-common-names="" caps-man-names="" certificate=none discovery-interfaces="" enabled=no interfaces="" lock-to-caps-man=no static-virtual=no
/interface wireless sniffer
set channel-time=200ms file-limit=10 file-name="" memory-limit=10 multiple-channels=no only-headers=no receive-errors=no streaming-enabled=no streaming-max-rate=0 streaming-server=0.0.0.0
/interface wireless snooper
set channel-time=200ms multiple-channels=yes receive-errors=no
/ip address
add address=192.168.200.1/24 disabled=no interface=bridge-lan network=192.168.200.0
add address=50.0.0.1/24 disabled=no interface=bridge-guest network=50.0.0.0
add address=192.168.201.1/24 disabled=no interface=Wireguard_wg0 network=192.168.201.0
add address=51.0.0.1/24 disabled=no interface=bridge-dmz network=51.0.0.0
add address=192.168.202.1/24 disabled=no interface=Wireguard_piVPN network=192.168.202.0
/ip arp
add address=192.168.200.11 disabled=yes interface=bridge-lan mac-address=FF:FF:FF:FF:FF:FF published=no
add address=192.168.200.25 disabled=yes interface=bridge-lan mac-address=68:A4:0E:1C:AB:7D published=no
/ip cloud
set back-to-home-vpn=revoked-and-disabled ddns-enabled=yes ddns-update-interval=none update-time=yes
/ip cloud advanced
set use-local-address=no
/ip dhcp-server config
set accounting=yes interim-update=0s radius-password=empty store-leases-disk=5m
/ip dhcp-server lease
add address=192.168.200.31 address-lists="" client-id=1:70:85:c2:a7:d5:73 comment=RTX dhcp-option="" disabled=no !insert-queue-before mac-address=70:85:C2:A7:D5:73 server=dhcp-lan
add address=192.168.200.2 address-lists="" comment=Switch dhcp-option="" disabled=no !insert-queue-before mac-address=0C:80:63:3A:14:01 server=dhcp-lan
/ip dhcp-server network
add address=50.0.0.0/24 caps-manager="" comment=dhcp-guest dhcp-option="" dns-server=50.0.0.1,8.8.8.8 gateway=50.0.0.1 !next-server ntp-server="" wins-server=""
add address=51.0.0.0/24 caps-manager="" comment=dhcp-dmz dhcp-option="" dns-server=51.0.0.1,8.8.8.8 gateway=51.0.0.1 !next-server ntp-server="" wins-server=""
add address=192.168.200.0/24 boot-file-name=netboot.xyz.kpxe caps-manager="" comment=dhcp-lan dhcp-option="" dns-server=192.168.200.1 gateway=192.168.200.1 next-server=192.168.200.11 ntp-server="" wins-server=""
/ip dns
set address-list-extra-time=0s allow-remote-requests=yes cache-max-ttl=1w cache-size=6048KiB doh-max-concurrent-queries=50 doh-max-server-connections=5 doh-timeout=5s max-concurrent-queries=200 max-concurrent-tcp-sessions=40 max-udp-packet-size=4096 query-server-timeout=2s \
query-total-timeout=10s servers=8.8.8.8,8.8.4.4 use-doh-server="" verify-doh-cert=no
/ip firewall address-list
add address=192.168.200.0/24 comment=Management disabled=no dynamic=no list=LANs
add address=something.no-ip.org disabled=no dynamic=no list=WANs
/ip firewall filter
add action=accept chain=forward comment=Wireguard_DELL !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port \
!fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list in-interface=Wireguard_piVPN !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=accept chain=forward !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot \
!icmp-options !in-bridge-port !in-bridge-port-list in-interface=bridge-lan !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=Wireguard_wg0 \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=accept chain=forward comment="Allow Wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit \
!dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.201.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=accept chain=forward comment="Allow Wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.201.0/24 !dst-address-list !dst-address-type \
!dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=accept chain=forward comment="Wireguard piVPN Production" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type \
!dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=192.168.202.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=accept chain=forward comment="Wireguard piVPN Production" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.202.0/24 !dst-address-list \
!dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \
!out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host \
!ttl
add action=accept chain=forward comment="no fasttrack for dmz traffic upload" connection-state=established,related src-address=51.0.0.0/24
add action=accept chain=forward comment="no fasttrack for guest traffic upload" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=established,related !connection-type !content disabled=no !dscp !dst-address \
!dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \
!out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=50.0.0.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \
!tcp-mss !time !tls-host !ttl
add action=accept chain=forward comment="no fasttrack for dmz traffic download" connection-state=established,related dst-address=51.0.0.0/24
add action=accept chain=forward comment="no fasttrack for guest traffic download" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=established,related !connection-type !content disabled=no !dscp dst-address=50.0.0.0/24 \
!dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \
!out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time \
!tls-host !ttl
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=established,related !connection-type !content disabled=no !dscp !dst-address !dst-address-list \
!dst-address-type !dst-limit !dst-port !fragment !hotspot hw-offload=yes !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \
!out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time \
!tls-host !ttl
add action=accept chain=forward comment="defconf: accept in ipsec policy" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type \
!dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority ipsec-policy=in,ipsec !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list \
!out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=accept chain=forward comment="defconf: accept out ipsec policy" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type \
!dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority ipsec-policy=out,ipsec !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list \
!out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=accept chain=forward comment="defconf: accept established,related, untracked" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=established,related,untracked !connection-type !content disabled=no !dscp \
!dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth \
!out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \
!tcp-mss !time !tls-host !ttl
add action=reject chain=forward comment="drop dmz traffic" in-interface=bridge-dmz out-interface=bridge-lan reject-with=icmp-network-unreachable
add action=reject chain=forward comment="drop guest traffic" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit \
!dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list in-interface=bridge-guest !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=\
bridge-lan !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm reject-with=icmp-network-unreachable !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \
!tcp-mss !time !tls-host !ttl
add action=drop chain=forward comment="defconf: drop invalid" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=invalid !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type \
!dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" !connection-bytes !connection-limit !connection-mark connection-nat-state=!dstnat !connection-rate connection-state=new !connection-type !content disabled=yes !dscp !dst-address !dst-address-list \
!dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \
!out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time \
!tls-host !ttl
add action=log chain=forward !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp dst-address=192.168.200.11 !dst-address-list !dst-address-type !dst-limit !dst-port !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="DS1816XS connection: " !nth !out-bridge-port !out-bridge-port-list !out-interface \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=!192.168.200.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=log chain=forward !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=80,443,5000,5001 !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="DS Photo Connection" !nth !out-bridge-port !out-bridge-port-list !out-interface \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=accept chain=input comment="allow IPsec NAT" disabled=no dst-port=4500 protocol=udp
add action=accept chain=input comment="allow IKE" disabled=no dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" disabled=no dst-port=1701 protocol=udp
add action=drop chain=input in-interface-list=!LAN
/ip firewall mangle
add action=mark-connection chain=prerouting comment="Mark connections for hairpin NAT" dst-address-list=WANs new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LANs
add action=mark-routing chain=prerouting comment=Mullvad !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit \
!dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" new-routing-mark=*4000 !nth !out-bridge-port !out-bridge-port-list \
!out-interface !out-interface-list !packet-mark !packet-size passthrough=no !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.200.9 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss \
!time !tls-host !ttl
add action=log chain=prerouting comment="Logging for wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.200.0/24 !dst-address-list \
!dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \
!out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.202.20 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \
!tcp-mss !time !tls-host !ttl
add action=log chain=forward comment="Logging for wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.200.0/24 !dst-address-list !dst-address-type \
!dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \
!out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.202.20 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttl
add action=log chain=postrouting comment="Logging for wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.200.0/24 !dst-address-list \
!dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \
!out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.202.20 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \
!tcp-mss !time !tls-host !ttl
/ip firewall nat
add action=masquerade chain=srcnat comment="Hairpin NAT" !connection-bytes !connection-limit connection-mark="Hairpin NAT" !connection-rate !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot \
!icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \
!packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host !to-addresses !to-ports !ttl
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN !to-addresses !to-ports
add action=dst-nat chain=dstnat comment="Wireguard hairpin nat" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address dst-address-list=WANs !dst-address-type !dst-limit dst-port=51820 !fragment !hotspot \
!icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \
!packet-size !per-connection-classifier !port !priority protocol=udp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.1 to-ports=51820 !ttl
add action=dst-nat chain=dstnat comment="Web NAS" disabled=yes dst-port=5001 in-interface-list=WAN log=yes protocol=tcp to-addresses=192.168.200.9 to-ports=5001
add action=masquerade chain=srcnat comment="Camere Dahua internal" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp dst-address=192.168.200.4 !dst-address-list !dst-address-type !dst-limit dst-port=5013 !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=bridge-lan !out-interface-list \
!packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark src-address=192.168.200.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host !to-addresses !to-ports !ttl
add action=dst-nat chain=dstnat comment="Camere Dahua internal" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address !dst-address-list dst-address-type=local !dst-limit dst-port=5013 !fragment !hotspot \
!icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \
!packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.4 to-ports=5013 !ttl
add action=dst-nat chain=dstnat comment="Plex NAS" disabled=no dst-port=32400 !in-interface in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=32400
add action=dst-nat chain=dstnat comment="SSH RPi" disabled=yes dst-port=63333 !in-interface in-interface-list=WAN protocol=tcp to-addresses=192.168.200.6 to-ports=63333
add action=masquerade chain=srcnat comment="SSH RPi internal" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp dst-address=192.168.200.6 !dst-address-list !dst-address-type !dst-limit dst-port=63333 !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=bridge-lan !out-interface-list \
!packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !routing-mark src-address=192.168.200.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses !to-ports !ttl
add action=dst-nat chain=dstnat comment="SSH RPi internal" disabled=yes dst-port=63333 in-interface=bridge-lan protocol=tcp to-addresses=192.168.200.6 to-ports=63333
add action=dst-nat chain=dstnat comment="FTP NAS" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=2123 !fragment !hotspot !icmp-options \
!in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size \
!per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=2123 !ttl
add action=dst-nat chain=dstnat comment="Paradox IP Module" dst-port=5005 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.3 to-ports=5005
add action=dst-nat chain=dstnat comment="Camere Dahua" dst-port=5013 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.4 to-ports=5013
add action=dst-nat chain=dstnat comment="Temp LetsEncrypt NAS" disabled=yes dst-port=80 !in-interface in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=80
add action=dst-nat chain=dstnat comment="Certificate NAS " disabled=yes dst-port=80 in-interface-list=WAN log=yes protocol=tcp to-addresses=192.168.200.9 to-ports=80
add action=dst-nat chain=dstnat comment=Grafana disabled=yes dst-port=3000 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=3000
add action=dst-nat chain=dstnat comment="Web PDU" disabled=yes dst-port=9876 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.10 to-ports=9876
add action=dst-nat chain=dstnat comment="SSH NAS" disabled=yes dst-port=64444 !in-interface in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=64444
add action=dst-nat chain=dstnat comment="SSH Mikrotik" disabled=yes dst-port=4040 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.1 to-ports=4040
add action=dst-nat chain=dstnat comment="SSH Switch" disabled=yes dst-port=62222 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.2 to-ports=22
add action=dst-nat chain=dstnat comment="Web Switch" disabled=yes dst-port=8090 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.2 to-ports=8090
add action=dst-nat chain=dstnat comment="Web Paradox" disabled=yes dst-port=5004 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.3 to-ports=80
add action=redirect chain=dstnat disabled=yes dst-port=53 protocol=udp !to-addresses to-ports=53
add action=redirect chain=dstnat comment="proxy dns" disabled=yes dst-port=53 protocol=tcp !to-addresses to-ports=53
add action=masquerade chain=srcnat comment="Paradox IP Module internal" dst-address=192.168.200.3 dst-port=5005 out-interface=bridge-lan protocol=tcp src-address=192.168.200.0/24 !to-addresses !to-ports
add action=dst-nat chain=dstnat comment="Paradox IP Module internal" dst-port=5005 in-interface=bridge-lan protocol=tcp to-addresses=192.168.200.3 to-ports=5005
add action=dst-nat chain=dstnat comment="Web NAS internal" disabled=yes dst-port=5001 in-interface=bridge-lan protocol=tcp to-addresses=192.168.200.9 to-ports=5001
add action=masquerade chain=srcnat comment="Web NAS internal" disabled=yes dst-address=192.168.200.9 dst-port=5001 out-interface=bridge-lan protocol=tcp src-address=192.168.200.0/24 !to-addresses !to-ports
add action=dst-nat chain=dstnat comment="Mikrotik Winbox" disabled=yes dst-port=8291 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.1 to-ports=8291
add action=dst-nat chain=dstnat comment=Plex disabled=no dst-port=32400 in-interface=bridge-lan !in-interface-list protocol=tcp to-addresses=192.168.200.11 to-ports=32400
add action=masquerade chain=srcnat comment="Plex Intern" dst-address=192.168.200.9 dst-port=32400 out-interface=bridge-lan protocol=tcp src-address=192.168.200.0/24 !to-addresses !to-ports
add action=netmap chain=dstnat comment="RTX WOL" disabled=yes dst-port=8099 protocol=udp to-addresses=192.168.200.11 !to-ports
add action=dst-nat chain=dstnat comment="RTX RDP" disabled=yes dst-port=9000 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=3389
add action=dst-nat chain=dstnat comment=Rsync disabled=yes dst-port=2222 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.9 to-ports=2222
add action=masquerade chain=srcnat comment="masq. vpn traffic" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot \
!icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \
!packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.201.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host !to-addresses !to-ports !ttl
add action=dst-nat chain=dstnat comment=Bitwarden dst-port=44445 in-interface-list=WAN log=yes protocol=tcp to-addresses=192.168.200.11 to-ports=44445
add action=masquerade chain=srcnat comment="Bitwarden internal" dst-address=192.168.200.11 dst-port=44445 out-interface=bridge-lan protocol=tcp src-address=192.168.200.0/24 !to-addresses !to-ports
add action=dst-nat chain=dstnat comment="Bitwarden internal" dst-port=44445 in-interface=bridge-lan protocol=tcp to-addresses=192.168.200.11 to-ports=44445
add action=dst-nat chain=dstnat comment=Octopi disabled=yes dst-port=6000 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.26 to-ports=80
add action=dst-nat chain=dstnat comment="Octopi 2" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=6001 !fragment !hotspot !icmp-options \
!in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size \
!per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.26 to-ports=8081 !ttl
add action=dst-nat chain=dstnat comment=Wireguard !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=51820 !fragment !hotspot !icmp-options \
!in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size \
!per-connection-classifier !port !priority protocol=udp !psd !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time to-addresses=192.168.200.11 to-ports=51820 !ttl
add action=dst-nat chain=dstnat comment="Test connection Filme Qbittorent" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=32700 !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \
!packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=32700 !ttl
add action=dst-nat chain=dstnat comment="Test connection Filme Qbittorent UDP" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=32700 !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \
!packet-mark !packet-size !per-connection-classifier !port !priority protocol=udp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=32700 !ttl
add action=dst-nat chain=dstnat comment="Test connection DownloadStation UDP" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=16881 !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \
!packet-mark !packet-size !per-connection-classifier !port !priority protocol=udp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=16881 !ttl
add action=dst-nat chain=dstnat comment="Test connection DownloadStation" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=16881 !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \
!packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=16881 !ttl
add action=dst-nat chain=dstnat comment="Test connection DownloadStation DS916" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=16882 !fragment \
!hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \
!packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.9 to-ports=16882 !ttl
add action=dst-nat chain=dstnat comment="Test connection DownloadStation UDP DS916" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=16882 \
!fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \
!packet-mark !packet-size !per-connection-classifier !port !priority protocol=udp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.9 to-ports=16882 !ttl
add action=masquerade chain=srcnat comment=Wireguard_DELL !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options \
!in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=eth1-wan !out-interface-list !packet-mark !packet-size \
!per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=192.168.202.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses !to-ports !ttl
add action=masquerade chain=srcnat comment="Wireguard piVPN" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options \
!in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size \
!per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=192.168.202.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses !to-ports !ttl
add action=masquerade chain=srcnat comment="masq. vpn traffic" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot \
!icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \
!packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=192.168.89.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses !to-ports !ttl
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=yes ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061 sip-direct-media=yes sip-timeout=1h
set pptp disabled=no
set rtsp disabled=yes ports=554
set udplite disabled=no
set dccp disabled=no
set sctp disabled=no
/ip hotspot service-port
set ftp disabled=no ports=21
/ip hotspot user
set [ find default=yes ] comment="counters and limits for trial users" disabled=no name=default-trial
/ip ipsec policy
set 0 disabled=no dst-address=::/0 group=default proposal=default protocol=all src-address=::/0 template=yes
/ip ipsec settings
set accounting=yes interim-update=0s xauth-use-radius=no
/ip nat-pmp
set enabled=no
/ip proxy
set always-from-cache=no anonymous=no cache-administrator=webmaster cache-hit-dscp=4 cache-on-disk=no cache-path=web-proxy enabled=no max-cache-object-size=2048KiB max-cache-size=unlimited max-client-connections=600 max-fresh-time=3d max-server-connections=600 parent-proxy=:: \
parent-proxy-port=0 port=8080 serialize-connections=no src-address=::
/ip route
add disabled=yes distance=1 gateway=eth1-wan
add comment="Wireguard range" disabled=yes distance=1 dst-address=192.168.201.0/24 gateway=bridge-lan pref-src=192.168.200.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=192.168.202.2 pref-src="" routing-table=main suppress-hw-offload=no
/ip service
set telnet address=192.168.200.0/24 disabled=yes port=23 vrf=main
set ftp address=192.168.200.0/24 disabled=yes port=21
set www address=192.168.200.0/24,192.168.201.3/32,192.168.201.2/32 disabled=no port=80 vrf=main
set ssh address=192.168.200.0/24,192.168.201.3/32 disabled=no port=4040 vrf=main
set www-ssl address="" certificate=none disabled=yes port=443 tls-version=any vrf=main
set api address=192.168.200.0/24 disabled=no port=8728 vrf=main
set winbox address=192.168.200.0/24,192.168.201.3/32,192.168.201.2/32 disabled=no port=8291 vrf=main
set api-ssl address="" certificate=none disabled=yes port=8729 tls-version=any vrf=main
/ip smb shares
set [ find default=yes ] comment="default share" directory=/pub disabled=yes invalid-users="" name=pub read-only=no require-encryption=no valid-users=""
/ip socks
set auth-method=none connection-idle-timeout=2m enabled=no max-connections=200 port=1080 version=4 vrf=main
/ip ssh
set allow-none-crypto=no always-allow-password-login=no forwarding-enabled=no host-key-size=2048 host-key-type=rsa strong-crypto=no
/ip tftp settings
set max-block-size=4096
/ip traffic-flow
set active-flow-timeout=30m cache-entries=512k enabled=yes inactive-flow-timeout=15s interfaces=all packet-sampling=no sampling-interval=0 sampling-space=0
/ip traffic-flow ipfix
set bytes=yes dst-address=yes dst-address-mask=yes dst-mac-address=yes dst-port=yes first-forwarded=yes gateway=yes icmp-code=yes icmp-type=yes igmp-type=yes in-interface=yes ip-header-length=yes ip-total-length=yes ipv6-flow-label=yes is-multicast=yes last-forwarded=yes \
nat-dst-address=yes nat-dst-port=yes nat-events=no nat-src-address=yes nat-src-port=yes out-interface=yes packets=yes protocol=yes src-address=yes src-address-mask=yes src-mac-address=yes src-port=yes sys-init-time=yes tcp-ack-num=yes tcp-flags=yes tcp-seq-num=yes \
tcp-window-size=yes tos=yes ttl=yes udp-length=yes
/ip traffic-flow target
add disabled=no dst-address=192.168.200.11 port=2055 src-address=192.168.200.1 v9-template-refresh=20 v9-template-timeout=30m version=9
/ip upnp
set allow-disable-external-interface=no enabled=no show-dummy-rule=yes
/ipv6 address
add address=::2ec8:1bff:feff:d5ea/64 advertise=yes disabled=no eui-64=yes from-pool=myipv6 interface=bridge-lan no-dad=no
add address=::2ec8:1bff:feff:d5ea/64 advertise=yes disabled=no eui-64=yes from-pool=myipv6 interface=bridge-guest no-dad=no
add address=::2ec8:1bff:feff:d5ea/64 advertise=yes disabled=no eui-64=yes from-pool=myipv6 interface=bridge-dmz no-dad=no
/ipv6 dhcp-client
add add-default-route=no dhcp-options="" dhcp-options="" disabled=no interface=digi pool-name=myipv6 pool-prefix-length=64 prefix-hint=::/0 request=prefix use-peer-dns=yes
/ipv6 firewall filter
add action=drop chain=input comment="defconf: rfc4890 drop ll if hop-limit!=255" dst-address=fe80::/10 hop-limit=not-equal:255 protocol=icmpv6
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/16
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment=openvpn dst-port=443 in-interface=eth1-wan protocol=tcp
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface=!bridge-lan
add action=drop chain=forward disabled=yes in-interface=bridge-lan src-address=2a02:1810:480c:4600:70f4:5102:9fab:c901/128
add action=reject chain=forward comment="reject dmz to lan traffic" in-interface=bridge-dmz out-interface=bridge-lan reject-with=icmp-address-unreachable
add action=reject chain=forward comment="reject guest to lan traffic" in-interface=bridge-guest out-interface=bridge-lan reject-with=icmp-address-unreachable
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
/ipv6 nd
set [ find default=yes ] advertise-dns=no advertise-mac-address=yes disabled=no dns="" hop-limit=unspecified interface=all managed-address-configuration=no mtu=unspecified other-configuration=no pref64="" ra-delay=3s ra-interval=3m20s-10m ra-lifetime=30m ra-preference=medium \
reachable-time=unspecified retransmit-interval=unspecified
/ipv6 nd prefix default
set autonomous=yes preferred-lifetime=1w valid-lifetime=4w2d
/mpls settings
set allow-fast-path=yes dynamic-label-range=16-1048575 propagate-ttl=yes
/ppp aaa
set accounting=yes interim-update=0s use-circuit-id-in-nas-port-id=no use-radius=no
/ppp secret
add caller-id="" disabled=no ipv6-routes="" limit-bytes-in=0 limit-bytes-out=0 !local-address name=vpn profile=default !remote-address !remote-ipv6-prefix routes="" service=any
/radius incoming
set accept=no port=3799 vrf=main
/routing igmp-proxy
set query-interval=2m5s query-response-interval=10s quick-leave=no
/routing settings
set single-process=no
/snmp
set contact= enabled=yes engine-id-suffix="" location="" src-address=:: trap-community=public trap-generators=temp-exception trap-target="" trap-version=1 vrf=main
/system clock
set time-zone-autodetect=yes time-zone-name=Europe/Bucharest
/system clock manual
set dst-delta=+00:00 dst-end="1970-01-01 00:00:00" dst-start="1970-01-01 00:00:00" time-zone=+00:00
/system identity
set name=Mikrotik_router
/system leds
set 0 disabled=no interface=sfp-sfpplus1 leds=sfp-sfpplus1-led type=interface-activity
/system leds settings
set all-leds-off=never
/system logging
set 0 action=memory disabled=no prefix="" topics=info
set 1 action=memory disabled=no prefix="" topics=error
set 2 action=memory disabled=no prefix="" topics=warning
set 3 action=echo disabled=no prefix="" topics=critical
add action=memory disabled=yes prefix="" topics=!ssh
add action=memory disabled=yes prefix="" topics=wireless
add action=memory disabled=yes prefix="" topics=dhcp
add action=memory disabled=yes prefix="" topics=debug
add action=memory disabled=yes prefix="" topics=dns
add action=memory disabled=no prefix="" topics=script
add action=memory disabled=yes prefix="" topics=dhcp
add action=memory disabled=yes prefix="" topics=ovpn
add action=memory disabled=yes prefix="" topics=!snmp
add action=GMAIL disabled=no prefix="" topics=critical,!ovpn
add action=GMAIL disabled=yes prefix="<addr 7" topics=pppoe
add action=YAHOO disabled=no prefix="" topics=critical,!ovpn
add action=memory disabled=no prefix="" topics=wireguard
add action=memory disabled=no prefix="" topics=firewall
add action=GMAIL disabled=no prefix="" topics=ssh
/system note
set note="" show-at-cli-login=no show-at-login=no
/system ntp client
set enabled=yes mode=unicast servers=ro.pool.ntp.org vrf=main
/system ntp server
set auth-key=none broadcast=no broadcast-addresses="" enabled=no local-clock-stratum=5 manycast=no multicast=no use-local-clock=no vrf=main
/system ntp client servers
add address=ro.pool.ntp.org auth-key=none disabled=no iburst=yes max-poll=10 min-poll=6
/system resource irq
set 0 cpu=auto
set 1 cpu=auto
set 2 cpu=auto
set 3 cpu=auto
set 4 cpu=auto
set 5 cpu=auto
set 6 cpu=auto
set 7 cpu=auto
set 8 cpu=auto
set 9 cpu=auto
set 10 cpu=auto
set 11 cpu=auto
set 12 cpu=auto
set 13 cpu=auto
set 14 cpu=auto
set 15 cpu=auto
set 16 cpu=auto
/system resource irq rps
set eth1-wan disabled=yes
set eth2-lan disabled=yes
set eth3-lan disabled=yes
set eth4-lan disabled=yes
set eth5-lan disabled=yes
set eth6-lan disabled=yes
set eth7-lan disabled=yes
set eth8-lan disabled=yes
set sfp-sfpplus1 disabled=yes
/system resource usb settings
set authorization=no
/system routerboard settings
set auto-upgrade=no boot-device=nand-if-fail-then-ethernet boot-protocol=bootp force-backup-booter=no preboot-etherboot=disabled preboot-etherboot-server=any protected-routerboot=disabled reformat-hold-button=20s reformat-hold-button-max=10m silent-boot=no
/system routerboard reset-button
set enabled=no hold-time=0s..1m on-event=""
/system scheduler
add comment=" Update No-IP DDNS" disabled=no interval=3m name=no-ip_ddns on-event=no-ip_ddns_update policy=read,write,test start-date=2019-06-01 start-time=02:31:50
add disabled=yes interval=2m name="ISP-check using script IPS-reconnect" on-event=" /system script run ISP-reconnect" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2019-08-08 start-time=05:34:11
add disabled=yes interval=0s name=static_dns_entries_script on-event="" policy=read,write,policy,test,password,sensitive,romon start-time=startup
/system upgrade mirror
set check-interval=1d enabled=no primary-server=0.0.0.0 secondary-server=0.0.0.0 user=""
/system watchdog
set auto-send-supout=no automatic-supout=yes ping-start-after-boot=5m ping-timeout=1m watch-address=none watchdog-timer=yes
/tool bandwidth-server
set allocate-udp-ports-from=2000 authenticate=no enabled=yes max-sessions=100
/tool graphing
set page-refresh=300 store-every=5min
/tool graphing interface
add allow-address=0.0.0.0/0 disabled=no interface=all store-on-disk=yes
add allow-address=0.0.0.0/0 disabled=no interface=eth1-wan store-on-disk=yes
/tool mac-server
set allowed-interface-list=all
/tool mac-server mac-winbox
set allowed-interface-list=all
/tool mac-server ping
set enabled=yes
