# aug/04/2020 18:20:26 by RouterOS 6.46.2
# software id = 4S6A-P0XL
#
# model = CCR1009-7G-1C-1S+
# serial number = 914F0B5D7C91

/ip firewall filter
add action=accept chain=input comment="ACCEPT ERU" connection-state=established,related,untracked
add action=reject chain=input comment="DROP invalid" connection-state=invalid reject-with=icmp-network-unreachable
add action=jump chain=input comment="JUMP SSH WINBOX" dst-port=*****,*****,*****,*****,***** in-interface-list=!LAN jump-target=SSH,WINBOX protocol=tcp
add action=accept chain=SSH,WINBOX comment="ACCEPT LAN ssh winbox" dst-port=*****,***** protocol=tcp src-address-list=LAN_max
add action=accept chain=SSH,WINBOX comment="ACCEPT ssh winbox knock open" dst-port=*****,***** in-interface-list=WAN protocol=tcp src-address-list=Knock3_OPEN
add action=add-src-to-address-list address-list=Knock3_OPEN address-list-timeout=3h chain=SSH,WINBOX comment=Knock3 connection-state=new dst-port=***** in-interface-list=WAN log=yes log-prefix="KNOCK3 - " protocol=tcp src-address-list=Knock2
add action=add-src-to-address-list address-list=Knock2 address-list-timeout=5m chain=SSH,WINBOX comment=Knock2 connection-state=new dst-port=***** in-interface-list=WAN log=yes log-prefix="KNOCK2 - " protocol=tcp src-address-list=Knock1
add action=add-src-to-address-list address-list=Knock1 address-list-timeout=5m chain=SSH,WINBOX comment=Knock1 connection-state=new dst-port=***** in-interface-list=WAN log=yes log-prefix="Knock1 - " protocol=tcp
add action=accept chain=input comment="ACCEPT icmp" protocol=icmp
add action=accept chain=input comment="ACCEPT l2tp" in-interface-list=WAN protocol=l2tp
add action=accept chain=input comment="ACCEPT l2tp udp" dst-port=500,1701,4500 in-interface-list=WAN protocol=udp
add action=drop chain=input comment="DROP dns 53" dst-port=53 in-interface-list=WAN protocol=udp
add action=drop chain=input comment="DROP all not comming from LAN" in-interface-list=!LAN src-address-list=!LAN_max
add action=accept chain=input dst-port=*****,***** protocol=tcp
add action=accept chain=forward comment="ACCEPT ERU" connection-state=established,related,untracked
add action=drop chain=forward comment="DROP invalid" connection-state=invalid
add action=fasttrack-connection chain=forward dst-address-list=TServers
add action=fasttrack-connection chain=forward comment="FASTRACK dns 53" dst-port=53 protocol=udp
add action=drop chain=forward comment="DROP BlackList" dst-address-list=Black_list protocol=tcp

/ip firewall mangle
add action=mark-connection chain=prerouting comment=ISP1 in-interface=ether1 new-connection-mark=in-ISP1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=in-ISP1 new-routing-mark=ISP1 passthrough=yes
add action=mark-routing chain=output connection-mark=in-ISP1 new-routing-mark=ISP1 passthrough=yes
add action=mark-routing chain=output new-routing-mark=ISP1 passthrough=yes src-address=******
add action=mark-connection chain=prerouting comment=ISP2 in-interface=ether2 new-connection-mark=in-ISP2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=in-ISP2 new-routing-mark=ISP2 passthrough=yes
add action=mark-routing chain=output connection-mark=in-ISP2 new-routing-mark=ISP2 passthrough=yes
add action=mark-routing chain=output new-routing-mark=ISP2 passthrough=yes src-address=******
add action=mark-connection chain=prerouting comment=ISP3 in-interface=combo1 new-connection-mark=in-ISP3 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=in-ISP3 new-routing-mark=ISP3 passthrough=yes
add action=mark-routing chain=output connection-mark=in-ISP3 new-routing-mark=ISP3 passthrough=yes
add action=mark-routing chain=output new-routing-mark=ISP3 passthrough=yes src-address=******
add action=mark-connection chain=prerouting comment=PCC connection-state=new dst-address-type=!local new-connection-mark=ISP1-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/0
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local new-connection-mark=ISP1-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/1
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local new-connection-mark=ISP1-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/2
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local new-connection-mark=ISP1-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/3
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local new-connection-mark=ISP2-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/4
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local new-connection-mark=ISP2-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/5
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local new-connection-mark=ISP2-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/6
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local new-connection-mark=ISP2-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/7
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local new-connection-mark=ISP3-conn passthrough=no per-connection-classifier=both-addresses-and-ports:9/8
add action=mark-routing chain=prerouting connection-mark=ISP1-conn new-routing-mark=ISP1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP2-conn new-routing-mark=ISP2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP3-conn new-routing-mark=ISP3 passthrough=yes

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
add action=masquerade chain=srcnat out-interface=combo1