# aug/09/2022 16:51:02 by RouterOS 6.49.6
# software id = PIPP-AWP5
#
# model = CCR1016-12G
# serial number = D5440E22E546
/interface bridge add arp=proxy-arp name=bridge1
/interface ethernet set [ find default-name=ether1 ] arp=proxy-arp
/interface vlan add interface=bridge1 name=vlan672 vlan-id=672
/interface list add name=WAN
/interface list add name=LAN
/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik
/ip pool add name=DHCP_L2TP ranges=192.168.88.50-192.168.88.150
/ppp profile add change-tcp-mss=yes dns-server=192.168.1.1 local-address=DHCP_L2TP name=mercury_l2tp remote-address=DHCP_L2TP wins-server=192.168.1.1
/interface bridge port add bridge=bridge1 interface=ether2
/interface bridge port add bridge=bridge1 interface=ether3
/interface bridge port add bridge=bridge1 interface=ether4
/interface bridge port add bridge=bridge1 interface=ether5
/interface bridge port add bridge=bridge1 interface=vlan672
/ip neighbor discovery-settings set discover-interface-list=!dynamic
/interface bridge vlan add bridge=bridge1 tagged=ether2 vlan-ids=672
/interface l2tp-server server set authentication=mschap2 default-profile=mercury_l2tp enabled=yes ipsec-secret=qwerty use-ipsec=yes
/interface list member add interface=ether1 list=WAN
/interface list member add interface=bridge1 list=LAN
/ip address add address=83.239.109.166/29 interface=ether1 network=83.239.109.160
/ip dhcp-client add disabled=no interface=bridge1
/ip dns set servers=212.96.96.38
/ip firewall address-list add address=192.168.100.0/24 list=VIN100
/ip firewall address-list add address=192.168.101.0/24 list=VIN101
/ip firewall filter add action=accept chain=input dst-port=24789 in-interface-list=WAN protocol=tcp
/ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
/ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
/ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
/ip firewall filter add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
/ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
/ip firewall filter add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
/ip firewall filter add action=accept chain=input connection-state=established,related
/ip firewall filter add action=accept chain=input protocol=icmp
/ip firewall filter add action=accept chain=input comment="Port L2TP" dst-port=500,1701,4500 in-interface=ether1 protocol=udp
/ip firewall filter add action=accept chain=forward comment="allow vpn to lan" in-interface=!ether1 out-interface=bridge1 src-address=192.168.88.0/24
/ip firewall filter add action=accept chain=input protocol=ipsec-esp
/ip firewall filter add action=add-src-to-address-list address-list=Scanners address-list-timeout=4w2d chain=input comment=Scanners in-interface=ether1 protocol=tcp psd=21,3s,3,1
/ip firewall filter add action=add-src-to-address-list address-list=Scanners address-list-timeout=4w2d chain=input in-interface=ether1 protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
/ip firewall filter add action=add-src-to-address-list address-list=Scanners address-list-timeout=4w2d chain=input in-interface=ether1 protocol=tcp tcp-flags=fin,syn
/ip firewall filter add action=add-src-to-address-list address-list=Scanners address-list-timeout=4w2d chain=input in-interface=ether1 protocol=tcp tcp-flags=syn,rst
/ip firewall filter add action=add-src-to-address-list address-list=Scanners address-list-timeout=4w2d chain=input in-interface=ether1 protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
/ip firewall filter add action=add-src-to-address-list address-list=Scanners address-list-timeout=4w2d chain=input in-interface=ether1 protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
/ip firewall filter add action=add-src-to-address-list address-list=Scanners address-list-timeout=4w2d chain=input comment="NMAP NULL scan" in-interface=ether1 protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
/ip firewall filter add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcp
/ip firewall filter add action=accept chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
/ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
/ip firewall filter add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 protocol=tcp src-address-list=ftp_blacklist
/ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall filter add action=drop chain=input connection-state=invalid log=yes
/ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN
/ip firewall nat add action=netmap chain=dstnat comment="Filezila \EA\EE\E3\E4\E0\F2\EE \E4\E0\E2\ED\EE \E1\FB\EB \EE\E1\EC\E5\ED \E2\E8\ED\EE\F2\E5\EA, \F7\F2\EE-\F2\EE \F2\E0\EC \E5\F9\B8 \CF\E0\F8\E0 \EF\EE\EB\FC\E7\F3\E5\F2" dst-port=21 in-interface-list=WAN protocol=tcp to-addresses=192.168.1.17 to-ports=21
/ip firewall nat add action=netmap chain=dstnat comment=TEST dst-port=7777 in-interface-list=WAN protocol=tcp to-addresses=192.168.0.254 to-ports=3389
/ip firewall raw add action=drop chain=prerouting in-interface=ether1 src-address-list=Scanners
/ip route add distance=1 gateway=83.239.109.165
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set www disabled=yes
/ip service set ssh disabled=yes
/ip service set api disabled=yes
/ip service set winbox port=3899
/ip service set api-ssl disabled=yes
/system clock set time-zone-name=Europe/Moscow
/tool bandwidth-server set authenticate=no enabled=no