# may/09/2020 11:22:35 by RouterOS 6.46.6
# software id = 3BFF-EDF1
#
# model = 951Ui-2nD
# serial number = ***********
/interface bridge
add arp=proxy-arp name=bridge1
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 \
    password=***** use-peer-dns=yes user=*****
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    management-protection=allowed mode=dynamic-keys name=profile1 \
    supplicant-identity="" wpa-pre-shared-key=**** \
    wpa2-pre-shared-key=*****
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=0 band=2ghz-b/g/n country=\
    no_country_set disabled=no frequency=auto frequency-mode=manual-txpower \
    mode=ap-bridge security-profile=profile1 ssid=sakhalin
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp_pool2 ranges=192.168.1.100-192.168.1.200
/ip dhcp-server
add address-pool=dhcp_pool2 disabled=no interface=bridge1 lease-time=1d10m \
    name=dhcp1
/ppp profile
add local-address=192.168.1.1 name=profileVPN remote-address=192.168.1.77
/queue simple
add max-limit=1M/1M name=LAN target=ether3
add max-limit=1M/1M name=SpeedTest.Net packet-marks=Speedtest-conn parent=LAN \
    priority=1/1
add max-limit=1M/1M name=Other packet-marks=Other-conn parent=LAN
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
    sword,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
/interface l2tp-server server
set authentication=mschap2 default-profile=default enabled=yes ipsec-secret=\
    p1exf8c5 use-ipsec=yes
/interface pptp-server server
set default-profile=default
/ip address
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0
add address=192.168.0.22/24 interface=ether1 network=192.168.0.0
/ip dhcp-server lease
add address=192.168.1.116 mac-address=5C:CF:7F:3C:11:43 server=dhcp1
add address=192.168.1.37 allow-dual-stack-queue=no mac-address=\
    38:59:F9:B3:AF:A6
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=77.88.8.8,77.88.8.1,8.8.8.8 gateway=\
    192.168.1.1
/ip dns
set allow-remote-requests=yes servers=77.88.8.8,77.88.8.1,8.8.8.8
/ip firewall filter
add action=accept chain=input dst-port=1723 protocol=tcp
add action=accept chain=input protocol=gre
add action=accept chain=input protocol=ipsec-esp
add action=drop chain=input dst-port=53 in-interface=pppoe-out1 protocol=udp
/ip firewall mangle
add action=change-mss chain=forward new-mss=1360 protocol=tcp tcp-flags=syn \
    tcp-mss=1453-65535
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1
add action=dst-nat chain=dstnat dst-port=3080 protocol=tcp to-addresses=\
    192.168.1.200 to-ports=3080
add action=dst-nat chain=dstnat dst-port=3081 protocol=tcp to-addresses=\
    192.168.1.200 to-ports=3081
add action=dst-nat chain=dstnat dst-port=555 protocol=tcp to-addresses=\
    192.168.1.200 to-ports=555
add action=dst-nat chain=dstnat dst-port=8080 protocol=tcp to-addresses=\
    192.168.1.200 to-ports=8080
add action=dst-nat chain=dstnat disabled=yes dst-port=4899 protocol=tcp \
    to-addresses=192.168.1.37 to-ports=4899
/ip firewall service-port
set irc disabled=yes
set sip disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=pppoe-out1 type=external
add interface=ether1 type=external
/ppp secret
add local-address=192.168.1.1 name=KILLER password=***** profile=\
    profileVPN remote-address=192.168.1.77 service=l2tp
/system clock
set time-zone-name=Asia/Sakhalin
/system scheduler
add interval=3d name=AutoReboot on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-time=startup
/system watchdog
set watch-address=77.88.8.8 watchdog-timer=no