model = RB760iGS
# serial number = -
/interface bridge
add admin-mac=- auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] mac-address=-
/interface wireguard
add comment=WireGuard listen-port=- mtu=1420 name=wg
/interface vlan
add interface=ether2 name=vlan24 vlan-id=24
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan24 keepalive-timeout=\
disabled max-mru=1492 max-mtu=1492 name=pppoe-out-fibra user=\
pass lowi
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.100-192.168.88.200
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-script="/ip dhcp-server lease\r\
\n:if (\$leaseBound = 1 && [ get [ find where mac-address=\$leaseActMAC ] \
dynamic ] = true) do={\r\
# script telegram dchp
/port
set 0 name=serial0
/user group
add name=ha policy="read,write,policy,test,api,!local,!telnet,!ssh,!ftp,!reboo\
t,!winbox,!password,!web,!sniff,!sensitive,!romon,!dude,!rest-api"
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether2 list=WAN
add comment=fibra interface=pppoe-out-fibra list=WAN
add comment=WireGuard interface=wg list=LAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=192.168.55.2/32 comment="-" interface=wg \
public-key="-"
add allowed-address=192.168.55.3/32 comment="-" interface=wg \
public-key="-"
add allowed-address=192.168.55.4/32 comment="..." interface=\
wg-ma public-key="-"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.55.1/24 interface=wg network=192.168.55.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server lease
add address=192.168....
/ip dhcp-server network
add address=192.168.88.0/24 comment="Adg" dns-server=\
192.168.88.x,1.1.1.1,8.8.8.8 gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=192.168.88.x
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=urlddns list=public-ip
add address=192.168.88.x list=bloq
add address=192.168.88.x list=bloq
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="vpn: allow WireGuard" dst-port=#portwg \
protocol=udp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=reject chain=forward comment="bloq int" \
reject-with=icmp-network-unreachable src-address-list=bloq
/ip firewall nat
add action=masquerade chain=srcnat comment="x" \
dst-address=192.168.88.x ipsec-policy=out,none out-interface-list=LAN \
src-address=192.168.88.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface-list=WAN
add action=dst-nat chain=dstnat comment="x" dst-address-list=public-ip \
dst-port=xx protocol=tcp to-addresses=192.168.88.x to-ports=xxx
add action=dst-nat chain=dstnat comment="x" dst-address-list=\
public-ip dst-port=xxx protocol=tcp to-addresses=192.168.88.x to-ports=\
xxx
add action=dst-nat chain=dstnat comment=x dst-port=xxx protocol=tcp \
to-addresses=192.168.88.x to-ports=xxx
add action=dst-nat chain=dstnat comment=x dst-port=xxx protocol=udp \
to-addresses=192.168.88.x to-ports=xxx
/ip service
set www disabled=yes
/system clock
set time-zone-name=Europe/Madrid
/system identity
set name=x
/system scheduler
add interval=1d name=MikroTikSystemStatus on-event=\
"/system script run MikroTikSystemStatus" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/02/2022 start-time=10:00:00
add interval=1d name=UpgradePackagesRouterOS on-event=\
"/system script run UpgradePackagesRouterOS" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/02/2022 start-time=10:00:00
/system script
add dont-require-permissions=no name=MikroTikSystemSta...
add dont-require-permissions=no name=UpgradePac...
add dont-require-permissions=yes name=MyT...
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
