Микротик L2TP

# apr/09/2018 08:38:03 by RouterOS 6.41
# software id = 9BTC-63XE
#
# model = 951G-2HnD
# serial number = 4184023D006B
/interface l2tp-server
add name=Fedino user=fedino =============  Пользователь для подключения рабочего роутера
add name=Marsel user=marsel
add name=Sclad user=sclad
add name=l2tp-in1 user=""
/interface bridge
add admin-mac=D4:CA:6D:93:F8:62 arp=proxy-arp auto-mac=no comment=\
    defconf igmp-snooping=yes name=bridge
/interface ethernet
set [ find default-name=ether1 ] arp=proxy-arp
set [ find default-name=ether2 ] arp=proxy-arp name=ether2-master
set [ find default-name=ether3 ] arp=proxy-arp tx-flow-control=auto
set [ find default-name=ether4 ] arp=proxy-arp
set [ find default-name=ether5 ] arp=proxy-arp
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=999999999 arp=\
    proxy-arp band=2ghz-b/g/n channel-width=20/40mhz-eC \
    default-authentication=no disabled=no distance=indoors \
    frequency=2437 mode=ap-bridge multicast-helper=full ssid=Web \
    tx-power=30 tx-power-mode=all-rates-fixed wireless-protocol=\
    802.11
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] group-ciphers=tkip,aes-ccm \
    supplicant-identity=MikroTik unicast-ciphers=tkip,aes-ccm \
    wpa-pre-shared-key=******************* wpa2-pre-shared-key=\
    **********************
/ip ipsec policy group
set [ find default=yes ] name=group1
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=\
    aes-256-cbc,aes-256-ctr,3des
/ip pool
add name=dhcp ranges=10.5.50.10-10.5.50.254
add name=vpn_pool ranges=20.5.50.1-20.5.50.254
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay disabled=no \
    interface=bridge name=defconf
/ipv6 dhcp-server
add address-pool=pool1 interface=ether2-master name=server1
/ipv6 pool
add name=pool1 prefix-length=63
/port
set 0 baud-rate=9600 data-bits=8 flow-control=none name=usb1 \
    parity=none stop-bits=1
/ppp profile
add change-tcp-mss=yes local-address=vpn_pool name=profile1 \
    remote-address=vpn_pool use-ipv6=default use-upnp=yes
set *FFFFFFFE use-encryption=default use-ipv6=default use-upnp=yes
/queue simple
add max-limit=50M/50M name=queue1 target=10.5.50.14/32
add max-limit=100M/100M name=queue2 target=10.5.50.20/32
/tool user-manager customer
set admin access=\
    own-routers,own-users,own-profiles,own-limits,config-payment-gw
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge hw=no interface=wlan1
add bridge=bridge hw=no interface=ether3
add bridge=bridge hw=no interface=ether4
add bridge=bridge interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=discover
/ipv6 settings
set accept-router-advertisements=yes
/interface l2tp-server server
set authentication=mschap2 enabled=yes ipsec-secret=123
/interface list member
add interface=bridge list=discover
add interface=bridge list=mactel
add interface=bridge list=mac-winbox
add interface=ether1 list=WAN
/interface sstp-server server
set authentication=mschap2
/interface wireless access-list
add mac-address=00:73:8D:36:6A:FB vlan-mode=no-tag
add mac-address=50:56:BF:05:20:F3 vlan-mode=no-tag
add mac-address=00:1A:79:11:CF:01 vlan-mode=no-tag
add mac-address=00:1A:79:12:90:1E vlan-mode=no-tag
add mac-address=BC:8C:CD:7A:01:7F vlan-mode=no-tag
add mac-address=E8:99:C4:87:63:FD vlan-mode=no-tag
add mac-address=54:E4:BD:DA:15:AE vlan-mode=no-tag
add mac-address=EC:9A:74:31:4F:28 vlan-mode=no-tag
add mac-address=84:7A:88:21:31:D5 vlan-mode=no-tag
add mac-address=E8:03:9A:C9:00:19 vlan-mode=no-tag
add mac-address=C4:B3:01:5A:3E:0A vlan-mode=no-tag
add mac-address=00:6C:FD:54:29:56 vlan-mode=no-tag
add mac-address=4A:58:D7:3C:02:C4 vlan-mode=no-tag
add mac-address=B8:27:EB:58:9D:FE vlan-mode=no-tag
add mac-address=80:7A:BF:74:E2:EE vlan-mode=no-tag
add mac-address=38:EA:A7:39:83:E6 vlan-mode=no-tag
add mac-address=5C:BA:82:E0:CF:B9 vlan-mode=no-tag
add mac-address=9C:2A:70:17:53:5B vlan-mode=no-tag
add mac-address=68:AE:20:92:86:C3 vlan-mode=no-tag
add mac-address=00:15:AF:D1:73:14 vlan-mode=no-tag
add mac-address=00:41:24:22:05:58 vlan-mode=no-tag
add mac-address=08:ED:B9:40:BE:8E vlan-mode=no-tag
add mac-address=78:F7:BE:A6:F2:13 vlan-mode=no-tag
add mac-address=9C:2A:70:42:93:4B vlan-mode=no-tag
add mac-address=74:DE:2B:E6:A2:7E vlan-mode=no-tag
add mac-address=4C:49:E3:DE:AE:B1 vlan-mode=no-tag
add mac-address=8C:79:67:C5:EB:64 vlan-mode=no-tag
/interface wireless connect-list
add interface=wlan1 mac-address=54:E4:BD:DA:15:AE security-profile=\
    default
add interface=wlan1 mac-address=00:73:8D:36:6A:FB security-profile=\
    default
add interface=wlan1 mac-address=E8:03:9A:C9:00:19 security-profile=\
    default
add interface=wlan1 mac-address=84:7A:88:21:31:D5 security-profile=\
    default
/ip address
add address=10.5.50.1/24 comment=1 interface=ether2-master network=\
    10.5.50.0
add address=172.20.88.0/24 disabled=yes interface=Fedino network=\
    172.20.88.0
add address=10.5.50.1 comment=2 interface=Fedino network=\
    172.20.88.1
add address=10.5.50.1 comment=2_1 disabled=yes interface=Fedino \
    network=172.20.88.10
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no \
    interface=ether1
/ip dhcp-server lease
add address=10.5.50.11 always-broadcast=yes client-id=\
    1:84:7a:88:21:31:d5 mac-address=84:7A:88:21:31:D5 server=\
    defconf
add address=10.5.50.13 always-broadcast=yes client-id=\
    1:54:e4:bd:da:15:ae mac-address=54:E4:BD:DA:15:AE server=\
    defconf
add address=10.5.50.17 always-broadcast=yes client-id="49:6e:66:6f:6\
    d:69:72:4d:41:47:32:35:30:2d:30:30:3a:31:61:3a:37:39:3a:31:31:3a\
    :63:66:3a:30:31" comment=MAG250 mac-address=00:1A:79:11:CF:01 \
    server=defconf
add address=10.5.50.16 always-broadcast=yes client-id="49:6e:66:6f:6\
    d:69:72:4d:41:47:32:35:30:2d:30:30:3a:31:61:3a:37:39:3a:31:32:3a\
    :39:30:3a:31:65" mac-address=00:1A:79:12:90:1E server=defconf
add address=10.5.50.15 always-broadcast=yes client-id=\
    1:bc:8c:cd:7a:1:7f comment="\D2\E5\EB\E5\E2\E8\E7\EE\F0" \
    mac-address=BC:8C:CD:7A:01:7F server=defconf
add address=10.5.50.18 always-broadcast=yes client-id=\
    1:50:56:bf:5:20:f3 comment="\D2\E5\EB\E5\E2\E8\E7\EE\F0" \
    mac-address=50:56:BF:05:20:F3 server=defconf
add address=10.5.50.19 always-broadcast=yes comment=\
    "\D2\E5\EB\E5\F4\EE\ED \C2\E8\EA\E0" mac-address=\
    00:73:8D:36:6A:FB server=defconf
add address=10.5.50.100 always-broadcast=yes client-id=\
    1:0:e:b5:2:81:f4 comment=DVR mac-address=00:0E:B5:02:81:F4 \
    server=defconf
add address=10.5.50.21 always-broadcast=yes client-id=\
    1:4a:58:d7:3c:2:c4 comment="Camera LAN" mac-address=\
    4A:58:D7:3C:02:C4 server=defconf use-src-mac=yes
add address=10.5.50.23 always-broadcast=yes client-id=\
    1:b8:27:eb:d:c8:ab comment=Raspberry mac-address=\
    B8:27:EB:0D:C8:AB server=defconf
add address=10.5.50.24 client-id=1:a0:d3:c1:5e:37:c9 comment=\
    "\C2\E8\EA\E0 \ED\EE\F3\F2\E1\F3\EA \CB\C0\CD" mac-address=\
    A0:D3:C1:5E:37:C9 server=defconf
add address=10.5.50.26 always-broadcast=yes comment="\D2\B8\F9\E0" \
    mac-address=80:7A:BF:74:E2:EE server=defconf
add address=10.5.50.27 client-id=1:0:19:6c:60:51:12 mac-address=\
    00:19:6C:60:51:12 server=defconf
add address=10.5.50.28 client-id=1:0:19:6c:60:45:87 mac-address=\
    00:19:6C:60:45:87 server=defconf
add address=10.5.50.25 always-broadcast=yes client-id=\
    1:38:ea:a7:39:83:e6 comment=\
    "\D6\E2\E5\F2\ED\EE\E9 \EF\F0\E8\ED\F2\E5\F0" mac-address=\
    38:EA:A7:39:83:E6 server=defconf
add address=10.5.50.29 always-broadcast=yes mac-address=\
    5C:BA:82:E0:CF:B9 server=defconf
add address=10.5.50.2 always-broadcast=yes client-id=\
    2c23.3a20.bdc0-Vlan-interface1 mac-address=2C:23:3A:20:BD:C0 \
    server=defconf
add address=10.5.50.30 always-broadcast=yes client-id=\
    1:68:ae:20:92:86:c3 comment=\
    "\CC\EE\E9 \E3\EE\E2\ED\EE\F4\EE\ED" mac-address=\
    68:AE:20:92:86:C3 server=defconf
add address=10.5.50.31 always-broadcast=yes client-id=\
    1:0:15:af:d1:73:14 comment=\
    "\C2\E8\EA\E0 \ED\EE\F3\F2\E1\F3\EA \C2\CB\C0\CD" mac-address=\
    00:15:AF:D1:73:14 server=defconf
add address=10.5.50.32 always-broadcast=yes comment=\
    "\CC\EE\E9 \C8\F0\E1\E8\F1" mac-address=00:41:24:22:05:58 \
    server=defconf
add address=10.5.50.33 always-broadcast=yes client-id=\
    1:0:22:15:37:18:af comment=\
    "\C2\E8\EA\E0 \ED\EE\F3\F2\E1\F3\EA \CB\C0\CD" mac-address=\
    00:22:15:37:18:AF server=defconf
add address=10.5.50.35 always-broadcast=yes comment=Ubuntu-server \
    mac-address=C8:CB:B8:1E:35:B9 server=defconf
add address=10.5.50.10 always-broadcast=yes client-id=\
    1:8:ed:b9:40:be:8e comment="\CC\EE\E9 \ED\EE\F3\F2\E1\F3\EA" \
    mac-address=08:ED:B9:40:BE:8E server=defconf
add address=10.5.50.34 always-broadcast=yes client-id=\
    1:38:ea:a7:e7:97:cb mac-address=38:EA:A7:E7:97:CB server=\
    defconf
add address=10.5.50.37 always-broadcast=yes client-id=\
    1:78:f7:be:a6:f2:13 comment="Samsung Tab 2" mac-address=\
    78:F7:BE:A6:F2:13 server=defconf
add address=10.5.50.14 always-broadcast=yes client-id=\
    1:4:7d:7b:32:26:98 mac-address=04:7D:7B:32:26:98 server=defconf
add address=10.5.50.12 client-id=1:74:de:2b:e6:a2:7e mac-address=\
    74:DE:2B:E6:A2:7E server=defconf
add address=10.5.50.20 always-broadcast=yes client-id=\
    1:4c:49:e3:de:ae:b1 mac-address=4C:49:E3:DE:AE:B1 server=\
    defconf
add address=10.5.50.22 always-broadcast=yes client-id=\
    1:8c:79:67:c5:eb:64 mac-address=8C:79:67:C5:EB:64 server=\
    defconf
/ip dhcp-server network
add address=10.5.50.0/24 comment=defconf gateway=10.5.50.1 netmask=\
    24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=10.5.50.1 name=router
add address=10.5.50.1 name=time.windows.com
add address=10.5.50.1 name=koch.net
/ip firewall address-list
add address=0.0.0.0/8 list=BOGON
add address=10.0.0.0/8 disabled=yes list=BOGON
add address=100.64.0.0/10 disabled=yes list=BOGON
add address=127.0.0.0/8 list=BOGON
add address=169.254.0.0/16 list=BOGON
add address=172.16.0.0/12 disabled=yes list=BOGON
add address=192.0.0.0/24 list=BOGON
add address=192.0.2.0/24 list=BOGON
add address=192.168.0.0/16 list=BOGON
add address=198.18.0.0/15 list=BOGON
add address=198.51.100.0/24 list=BOGON
add address=203.0.113.0/24 list=BOGON
add address=224.0.0.0/4 list=BOGON
add address=240.0.0.0/4 list=BOGON
add address=218.236.19.111 list=BOGON
/ip firewall filter
add action=accept chain=input port=1701,500,4500 protocol=udp
add action=accept chain=forward comment="allow vpn to lan" \
    in-interface=!ether1 out-interface=bridge src-address=\
    20.5.50.0/24
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=forward comment="IPTV UDP forwarding" \
    protocol=udp
add action=accept chain=input comment="IPTV UDP incoming" dst-port=\
    0-65000 in-interface=ether1 protocol=udp
add action=accept chain=input comment="Allow IGMP" protocol=igmp
add action=accept chain=forward comment=DVR dst-address=10.5.50.100 \
    dst-port=7620-7624 protocol=tcp src-mac-address=\
    !E8:99:C4:87:63:FD
add action=accept chain=forward comment=DVR dst-address=10.5.50.100 \
    dst-port=7620-7624 protocol=udp src-mac-address=\
    !E8:03:9A:C9:00:19
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=accept chain=input connection-state=new dst-port=8291 \
    protocol=tcp
add action=accept chain=input protocol=icmp
add action=drop chain=input connection-state=new in-interface=\
    !bridge
add action=jump chain=forward connection-state=new jump-target=\
    block-ddos
add action=drop chain=forward connection-state=new \
    dst-address-list=ddosed src-address-list=ddoser
add action=return chain=block-ddos dst-limit=\
    50,50,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddosed \
    address-list-timeout=10m chain=block-ddos
add action=add-src-to-address-list address-list=ddoser \
    address-list-timeout=10m chain=block-ddos
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=all-ppp
add action=netmap chain=dstnat comment=Samba disabled=yes \
    dst-address=93.81.245.89 dst-port=445 in-interface=ether1 \
    protocol=tcp to-addresses=10.5.50.23 to-ports=445
add action=netmap chain=dstnat disabled=yes dst-address=\
    93.81.245.89 dst-port=139 in-interface=ether1 protocol=tcp \
    to-addresses=10.5.50.23 to-ports=139
add action=netmap chain=dstnat comment=DVR disabled=yes dst-port=\
    7620-7624 in-interface=ether1 protocol=tcp src-mac-address=\
    !E8:99:C4:87:63:FD to-addresses=10.5.50.100 to-ports=7620-7624
add action=netmap chain=dstnat comment=Samba disabled=yes \
    dst-address=93.81.245.89 dst-port=1509 in-interface=ether1 \
    protocol=tcp to-addresses=10.5.50.23 to-ports=1509
add action=accept chain=dstnat disabled=yes dst-port=1723 protocol=\
    tcp
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set pptp disabled=yes
/ip ipsec peer
add address=0.0.0.0/0 dh-group=modp1024 enc-algorithm=\
    aes-256,aes-128,3des exchange-mode=main-l2tp passive=yes \
    secret=12345
/ip route
add comment=1 distance=1 dst-address=172.20.88.0/24 gateway=\
    20.5.50.2 pref-src=10.5.50.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip smb
set allow-guests=no comment=Koch_NET_SMB domain=koch.net
/ip smb shares
set [ find default=yes ] disabled=yes
add directory=/10.5.50.23 disabled=yes name=koch.net
/ip smb users
add name=************ password=************ read-only=no
/ip upnp
set allow-disable-external-interface=yes enabled=yes
/ipv6 address
add address=::d6ca:6dff:fe93:f861 eui-64=yes from-pool=pool1 \
    interface=ether1
/ipv6 dhcp-client
add add-default-route=yes interface=bridge pool-name=pool1 request=\
    address,prefix
/ipv6 dhcp-relay
add dhcp-server=:: disabled=yes interface=ether1 name=relay1
/ipv6 firewall filter
add chain=forward comment="Incoming ICMP - Ping" protocol=icmpv6
add chain=forward comment="Current traffic" connection-state=\
    established
add chain=forward connection-state=related
add action=drop chain=forward comment="Block any other traffic" \
    disabled=yes in-interface=ether1
/ppp aaa
set accounting=no
/ppp secret
add name=shura password=************** profile=profile1
add name=vicka password=************** profile=profile1
add local-address=20.5.50.1 name=fedino password=*********** profile=\
    profile1 remote-address=20.5.50.2
add local-address=20.5.50.3 name=marsel password=*********** profile=\
    profile1 remote-address=20.5.50.4
add local-address=20.5.50.5 name=sclad password=*********** profile=\
    profile1 remote-address=20.5.50.6
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=0.0.0.0/0 interface=ether1 upstream=yes
add interface=bridge
/routing ospf network
add area=backbone network=10.5.50.0/24
add area=backbone network=20.5.50.0/24
add area=backbone network=172.20.88.0/24
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system lcd
set contrast=0 enabled=no port=parallel type=24x4
/system lcd page
set time disabled=yes display-time=5s
set resources disabled=yes display-time=5s
set uptime disabled=yes display-time=5s
set packets disabled=yes display-time=5s
set bits disabled=yes display-time=5s
set version disabled=yes display-time=5s
set identity disabled=yes display-time=5s
set Sclad disabled=yes display-time=5s
set Fedino disabled=yes display-time=5s
set l2tp-in1 disabled=yes display-time=5s
set Marsel disabled=yes display-time=5s
set wlan1 disabled=yes display-time=5s
set ether1 disabled=yes display-time=5s
set ether2-master disabled=yes display-time=5s
set ether3 disabled=yes display-time=5s
set ether4 disabled=yes display-time=5s
set ether5 disabled=yes display-time=5s
set <l2tp-shura> disabled=yes display-time=5s
set bridge disabled=yes display-time=5s
/system leds
set 0 interface=wlan1
/system ntp client
set enabled=yes mode=multicast primary-ntp=88.147.254.232 \
    secondary-ntp=88.147.254.230
/system ntp server
set broadcast=yes enabled=yes multicast=yes
/system routerboard settings
set cpu-frequency=650MHz
/tool mac-server
set allowed-interface-list=mactel
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
/tool user-manager database
set db-path=user-manager

# apr/09/2018 08:50:34 by RouterOS 6.41.2
# software id = LB05-XYSG
#
# model = RouterBOARD 952Ui-5ac2nD
# serial number = 7C30082755DB
/interface bridge
add admin-mac=CC:2D:E0:24:75:FF auto-mac=no comment=defconf \
    igmp-snooping=yes name=bridge
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
/interface l2tp-client
add allow=mschap2 connect-to=93.81.245.89 disabled=no ipsec-secret=123 \
    name=l2tp-out1 password=fedino user=**********
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=\
    20/40mhz-Ce disabled=no distance=indoors frequency=auto mode=\
    ap-bridge ssid=Indastrial_NetWork wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-Ceee disabled=no distance=indoors frequency=auto mode=\
    ap-bridge ssid=Indastrial_NetWork_5 wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=\
    1234512345 wpa2-pre-shared-key=1234512345
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec policy group
set [ find default=yes ] name=123
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-256-ctr,3des
/ip pool
add name=dhcp ranges=172.20.88.2-172.20.88.254
add name=vpn-pool ranges=173.20.88.10-173.20.88.254 =================== Этот пул не используется
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/port
set 0 name=usb1
/interface ppp-client
add apn=internet disabled=no info-channel=1 name=ppp-out1 port=usb1
/ppp profile
add local-address=dhcp name=vpn_prof remote-address=dhcp
set *FFFFFFFE change-tcp-mss=default use-encryption=default
/interface bridge port
add bridge=bridge comment=defconf hw=no interface=ether2-master
add bridge=bridge comment=defconf hw=no interface=wlan1
add bridge=bridge comment=defconf hw=no interface=wlan2
add bridge=bridge hw=no interface=ether3
add bridge=bridge hw=no interface=ether4
add bridge=bridge hw=no interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=discover
/interface l2tp-server server
set authentication=mschap2 default-profile=vpn_prof enabled=yes \
    ipsec-secret=123
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf list=WAN
add interface=wlan1 list=discover
add interface=wlan2 list=discover
add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=bridge list=discover
add list=discover
add list=discover
add interface=ether2-master list=mactel
add interface=ether3 list=mactel
add interface=ether2-master list=mac-winbox
add interface=ether4 list=mactel
add interface=ether3 list=mac-winbox
add interface=ether5 list=mactel
add interface=wlan2 list=mactel
add interface=ether4 list=mac-winbox
add interface=wlan1 list=mactel
add interface=ether5 list=mac-winbox
add interface=wlan2 list=mac-winbox
add interface=wlan1 list=mac-winbox
/ip address
add address=172.20.88.1/24 comment=1 interface=ether2-master network=\
    172.20.88.0
add address=172.20.88.1/24 interface=l2tp-out1 network=172.20.88.0
add address=172.20.88.1 comment=2 interface=l2tp-out1 network=10.5.50.1
add address=172.20.88.10 comment=2_1 disabled=yes interface=l2tp-out1 \
    network=10.5.50.1
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no \
    interface=ether1
/ip dhcp-server lease
add address=172.20.88.4 client-id=1:a0:88:b4:71:11:50 mac-address=\
    A0:88:B4:71:11:50 server=defconf
add address=172.20.88.5 client-id=1:9c:8e:99:3e:bc:7c mac-address=\
    9C:8E:99:3E:BC:7C server=defconf
add address=172.20.88.3 client-id=1:8:ed:b9:40:be:8e mac-address=\
    08:ED:B9:40:BE:8E server=defconf
add address=172.20.88.178 mac-address=00:41:24:22:05:58 server=defconf
add address=172.20.88.10 always-broadcast=yes mac-address=\
    28:63:36:C6:20:90 server=defconf
add address=172.20.88.20 always-broadcast=yes mac-address=\
    28:63:36:C6:20:4C server=defconf
add address=172.20.88.30 always-broadcast=yes mac-address=\
    28:63:36:9A:44:CE server=defconf
/ip dhcp-server network
add address=172.20.88.0/24 comment=defconf gateway=172.20.88.1
/ip dns
set allow-remote-requests=yes servers=10.5.50.1
/ip dns static
add address=172.20.88.1 name=router.lan
/ip firewall filter
add action=accept chain=input dst-port=1701 port="" protocol=udp
add action=accept chain=forward in-interface=!all-ppp out-interface=\
    bridge src-address=20.5.50.0/24
add action=accept chain=forward protocol=icmp src-address=172.20.88.0/24
add action=accept chain=forward protocol=udp src-address=172.20.88.0/24
add action=accept chain=forward protocol=tcp src-address=172.20.88.0/24
add action=accept chain=input connection-state=related disabled=yes
add action=accept chain=input connection-state=established disabled=yes
add action=accept chain=input disabled=yes protocol=icmp
add action=accept chain=input disabled=yes port=1701,500,4500 protocol=\
    udp
add action=accept chain=input disabled=yes protocol=ipsec-esp
add action=accept chain=forward disabled=yes protocol=udp
add action=accept chain=input disabled=yes dst-port=0-65000 \
    in-interface=*9 protocol=udp
add action=accept chain=input disabled=yes protocol=igmp
add action=accept chain=input disabled=yes dst-port=1701,500,4500 \
    protocol=udp
add action=accept chain=input disabled=yes dst-port=0-65000 \
    in-interface=ppp-out1 protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=l2tp-out1
add action=masquerade chain=srcnat out-interface=ppp-out1
/ip ipsec peer
add address=0.0.0.0/0 dh-group=modp1024 enc-algorithm=\
    aes-256,aes-128,3des generate-policy=port-override secret=123
/ip route
add comment=1 distance=1 dst-address=10.5.50.0/24 gateway=20.5.50.1 \
    pref-src=172.20.88.1
add disabled=yes distance=1 dst-address=10.5.50.0/24 gateway=20.5.50.1 \
    pref-src=172.20.88.10
add distance=1 dst-address=172.20.88.0/24 gateway=bridge pref-src=\
    172.20.88.1 scope=10
/ip upnp
set allow-disable-external-interface=yes enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ppp secret
add name=ppp1 password=ppp1 profile=default-encryption service=l2tp
add name=ppp2 password=ppp2 profile=default-encryption service=l2tp
/routing igmp-proxy interface
add interface=bridge
add alternative-subnets=0.0.0.0/0 upstream=yes
/routing ospf network
add area=backbone network=172.20.88.0/24
add area=backbone network=20.5.50.0/24
add area=backbone network=10.5.50.0/24
/system clock
set time-zone-name=Europe/Moscow
/system lcd
set contrast=0 enabled=no port=parallel type=24x4
/system lcd page
set time disabled=yes display-time=5s
set resources disabled=yes display-time=5s
set uptime disabled=yes display-time=5s
set packets disabled=yes display-time=5s
set bits disabled=yes display-time=5s
set version disabled=yes display-time=5s
set identity disabled=yes display-time=5s
set bridge disabled=yes display-time=5s
set ppp-out1 disabled=yes display-time=5s
set l2tp-out1 disabled=yes display-time=5s
set wlan1 disabled=yes display-time=5s
set wlan2 disabled=yes display-time=5s
set ether1 disabled=yes display-time=5s
set ether2-master disabled=yes display-time=5s
set ether3 disabled=yes display-time=5s
set ether4 disabled=yes display-time=5s
set ether5 disabled=yes display-time=5s
/tool mac-server
set allowed-interface-list=mactel
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox