# may/31/2024 22:36:40 by RouterOS 6.48.1
# software id = Q7UY-TG8N
#
# model = RouterBOARD 750 r2
# serial number = 8B3909xxx
/interface bridge
add admin-mac=B8:69:F4:4xxx auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] advertise=10M-full,100M-full speed=1Gbps
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=pool55 ranges=192.168.55.20-192.168.55.250
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=pool55 disabled=no interface=bridge name=server55
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=ether1 \
    network=192.168.88.0
add address=192.168.55.1/24 interface=bridge network=192.168.55.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server lease
add address=192.168.55.250 client-id=\
    ff:67:f:4f:59:0:4:fd:4f:7b:d5:cf:97:42:xxx \
    mac-address=00:E0:67:0F:4F:59 server=server55
add address=192.168.55.249 client-id=1:b8:70:xxx mac-address=\
    B8:70:F4:xxx server=server55
add address=192.168.55.248 client-id=1:0:e0:67:xxx mac-address=\
    00:E0:67:xxx server=server55
add address=192.168.55.247 client-id=1:0:e0:67:xxx mac-address=\
    00:E0:67:xxx server=server55
add address=192.168.55.246 mac-address=00:E0:4C:xxx server=server55
/ip dhcp-server network
add address=192.168.55.0/24 dns-server=192.168.88.1 gateway=192.168.55.1 \
    netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" in-interface=\
    ether1 protocol=icmp
add action=accept chain=input comment="defconf: accept ICMP" in-interface=\
    bridge protocol=icmp
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    connection-nat-state="" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment=": accept  mfrom 88.244" \
    out-interface=bridge src-address=192.168.88.244
add action=accept chain=forward comment=": accept  to 88.0" dst-address=\
    192.168.88.0/24 out-interface=ether1 protocol=icmp
add action=accept chain=forward comment="accept ICMP" in-interface=bridge \
    protocol=icmp
add action=accept chain=forward comment="icmp to eth1" out-interface=ether1 \
    protocol=icmp
add action=accept chain=forward in-interface=bridge protocol=icmp
add action=accept chain=forward comment="drop new DNS from ..55." \
    connection-state=new dst-port=53 in-interface=ether1 protocol=tcp
add action=accept chain=forward comment="drop new DNS from ..55." dst-port=53 \
    out-interface=ether1 protocol=tcp
add action=accept chain=forward comment="accept dst-nat" \
    connection-nat-state=dstnat protocol=tcp
add action=accept chain=forward comment="accept ICMP" out-interface=bridge \
    protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    disabled=yes ipsec-policy=out,ipsec
add action=accept chain=output disabled=yes protocol=icmp
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=accept chain=output out-interface=ether1
add action=accept chain=output out-interface=bridge
/ip firewall mangle
add action=passthrough chain=prerouting dst-port=22 protocol=tcp
add action=passthrough chain=prerouting comment="pass icmp from Br" \
    in-interface=bridge protocol=icmp
add action=passthrough chain=forward comment="pass icmp to eth1" \
    out-interface=ether1 protocol=icmp
add action=passthrough chain=postrouting comment="pass icmp from Br" \
    out-interface=ether1 protocol=icmp
add action=passthrough chain=input in-interface=bridge protocol=icmp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat disabled=yes dst-port=xxx2 in-interface=\
    ether1 protocol=tcp to-addresses=192.168.55.247 to-ports=22
add action=dst-nat chain=dstnat disabled=yes dst-port=xxx2 in-interface=\
    ether1 protocol=tcp to-addresses=192.168.55.248 to-ports=22
add action=dst-nat chain=dstnat comment="to Linshiba on ..55." dst-port=449 \
    in-interface=ether1 protocol=tcp to-addresses=192.168.55.249 to-ports=22
/ip firewall service-port
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip route
add distance=1 dst-address=192.168.2.0/24 gateway=bridge
add check-gateway=arp distance=1 dst-address=192.168.88.0/24 gateway=\
    10.10.10.1
/ip service
set api disabled=yes
/system clock
set time-zone-name=America/New_York
/system identity
set name=MikroTik-demo
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-interface=bridge only-headers=yes