# jun/26/2019 10:35:27 by RouterOS 6.43.11
# software id = TWFP-HUMG
#
# model = 951G-2HnD
# serial number = 642E075756E5
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=XX \
    frequency=2417 name=channel2 tx-power=22
/interface bridge
add admin-mac=64:D1:54:44:92:C9 auto-mac=no fast-forward=no name=bridge_lan
add fast-forward=no name=bridge_wifi
/interface wireless
# managed by CAPsMAN
# channel: 2417/20-Ce/gn(20dBm), SSID: Delta-Agro, local forwarding
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode \
    band=2ghz-b/g/n basic-rates-b="" country=russia2 disabled=no distance=\
    indoors frequency-mode=regulatory-domain hw-protection-mode=rts-cts mode=\
    ap-bridge radio-name=Slave1 ssid=Delta-Agro supported-rates-b="" \
    tx-power-mode=all-rates-fixed wmm-support=enabled wps-mode=disabled
/interface ethernet
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] disabled=yes speed=100Mbps
set [ find default-name=ether4 ] disabled=yes speed=100Mbps
set [ find default-name=ether5 ] disabled=yes speed=100Mbps
/interface wireless nstreme
# managed by CAPsMAN
# channel: 2417/20-Ce/gn(20dBm), SSID: Delta-Agro, local forwarding
set wlan1 enable-polling=no
/interface vlan
add interface=bridge_wifi name=vlan10 vlan-id=10
add interface=bridge_lan name=vlan168 vlan-id=168
/caps-man datapath
add bridge=bridge_wifi local-forwarding=yes name=datapath2 vlan-id=10
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
    name=security2 passphrase=Delta777
/caps-man configuration
add channel=channel2 country=russia3 datapath=datapath2 mode=ap name=cfg1 \
    rx-chains=0,1,2 security=security2 ssid=Delta-Agro tx-chains=0,1,2
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=\
    Delta777 wpa2-pre-shared-key=Delta777
/ip pool
add name=pool_lan ranges=192.168.0.7-192.168.0.250
add name=pool_wifi ranges=10.10.0.2-10.10.0.254
/ip dhcp-server
add add-arp=yes address-pool=pool_lan disabled=no interface=bridge_lan \
    lease-time=5d10h name=dhcp_lan
add add-arp=yes address-pool=pool_wifi disabled=no interface=bridge_wifi \
    name=dhcp_wifi
/queue type
add kind=pcq name=kachan_download pcq-burst-rate=10M pcq-burst-threshold=6M \
    pcq-burst-time=1m10s pcq-classifier=dst-address pcq-dst-address6-mask=64 \
    pcq-rate=5M pcq-src-address6-mask=64
/queue simple
add name=queue1 queue=default/kachan_download target=192.168.0.0/24
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=cfg1
/interface bridge port
add bridge=bridge_lan interface=ether2
add bridge=bridge_lan interface=ether3
add bridge=bridge_lan interface=ether4
add bridge=bridge_lan interface=ether5
add bridge=bridge_wifi interface=wlan1
add bridge=bridge_wifi interface=cap2
add bridge=bridge_wifi interface=cap3
add bridge=bridge_wifi interface=cap4
add bridge=bridge_wifi interface=cap5
/ip firewall connection tracking
set enabled=yes
/interface pptp-server server
set authentication=pap,chap default-profile=test enabled=yes
/interface wireless cap
# 
set bridge=bridge_lan caps-man-addresses=192.168.0.1 enabled=yes interfaces=\
    wlan1
/ip address
add address=192.168.0.1/24 interface=bridge_lan network=192.168.0.0
add address=194.49.127.13/24 interface=ether1 network=194.49.127.0
add address=10.10.0.1/24 interface=bridge_wifi network=10.10.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-server network
add address=10.10.0.0/24 dns-server=10.10.0.1 gateway=10.10.0.1 netmask=24
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1 \
    netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall filter
add action=reject chain=forward comment=VK content=vk.com protocol=tcp \
    reject-with=tcp-reset
add action=reject chain=forward comment=OK content=ok.ru protocol=tcp \
    reject-with=tcp-reset
add action=drop chain=forward comment=FC:14 src-mac-address=3C:DC:BC:58:FC:14
add action=drop chain=forward comment=F0:CD src-mac-address=8C:25:05:26:F0:CD
add action=drop chain=forward comment=4F:13 src-mac-address=00:1A:4D:F9:4F:13
add action=drop chain=forward comment=9B:2F src-mac-address=60:F4:45:A8:9B:2F
add action=drop chain=forward comment=2C:21 src-mac-address=5C:03:39:AA:2C:21
add action=drop chain=forward comment=B9:4A src-mac-address=F4:6D:04:5A:B9:4A
add action=drop chain=forward comment=6E:E8 src-mac-address=72:4F:56:A8:6E:E8
add action=drop chain=forward comment=06:32 src-mac-address=A0:56:F3:B1:06:32
add action=drop chain=forward comment=AC:22 src-mac-address=8C:F5:A3:06:AC:22
add action=drop chain=forward comment=A0:5E src-mac-address=20:89:84:5F:A0:5E
add action=drop chain=forward comment=D3:8B src-mac-address=EC:AD:B8:30:D3:8B
add action=drop chain=forward comment=1F:CC src-mac-address=74:04:2B:AE:1F:CC
add action=drop chain=forward comment=57:18 src-mac-address=3C:57:6C:2C:57:18
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.0.0/24
add action=masquerade chain=srcnat src-address=10.10.0.0/24
add action=netmap chain=dstnat comment=RDP dst-port=3389 in-interface=ether1 \
    protocol=tcp to-addresses=192.168.0.251 to-ports=3389
add action=netmap chain=dstnat comment=FTP_NAS dst-port=21 in-interface=\
    ether1 protocol=tcp to-addresses=192.168.0.253 to-ports=21
add action=netmap chain=dstnat comment=Samba dst-port=4010 in-interface=\
    ether1 protocol=tcp to-addresses=192.168.0.252 to-ports=4010
add action=netmap chain=dstnat comment=Urist_Marina dst-port=59217 \
    in-interface=ether1 protocol=tcp to-addresses=192.168.0.217 to-ports=\
    59217
add action=netmap chain=dstnat comment=Work_VNC dst-port=40247 in-interface=\
    ether1 protocol=tcp to-addresses=192.168.0.247 to-ports=40247
add action=netmap chain=dstnat comment=Work_VNC_wi-fi dst-port=40247 \
    in-interface=ether1 protocol=tcp src-port="" to-addresses=192.168.0.58 \
    to-ports=40247
/ip proxy access
add action=deny comment=sysadminpxy
/ip route
add distance=1 gateway=194.49.127.1
/ip service
set telnet disabled=yes port=65001
set ftp disabled=yes port=61000
set www disabled=yes port=64890
set ssh disabled=yes port=62000
set www-ssl port=65002
set api disabled=yes port=64000
set winbox address=192.168.0.0/24 port=8560
set api-ssl disabled=yes port=63000
/ppp aaa
set interim-update=1m use-circuit-id-in-nas-port-id=yes use-radius=yes
/ppp profile
add change-tcp-mss=yes dns-server=8.8.8.8 local-address=10.1.1.1 name=test \
    remote-address=*7 use-encryption=yes
/radius incoming
set accept=yes
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=1FM
/system leds
set 0 interface=wlan1
/system ntp client
set enabled=yes primary-ntp=88.147.254.230 secondary-ntp=88.147.254.235
/system scheduler
add interval=1d name=Auto113 on-event=\
    "/system scheduler remove [find name=upd111]\r\
    \n/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    sep/28/2018 start-time=03:11:00
/system script
add dont-require-permissions=no name=ip owner=admin policy=\
    reboot,read,write,policy,test,password,sniff,sensitive source="{/tool fetc\
    h url=(\"http://www.boss-ip.com/Core/Update.ashx\\\?key=5bc24d5c0d21bf27&a\
    ction=upload&sncode=9B32E835AA3D826CCC153843BB240B3E&dynamic=static\")  ke\
    ep-result=no}"
/tool sniffer
set filter-interface=bridge_lan filter-ip-address=192.168.0.20/32 \
    streaming-server=192.168.0.74