Hello all,
Did anything change lately regarding wireguard in latest OS? I did an upgrade and it seems I can't come from the outside anymore to connect to the wireguard. If I am internally I can connect to it and handshake is established ok.
I have the same settings from before and nothing change from my side as far as I can tell beside upgrading the OS.
I also tried to do an nmap to see the 2 wireguard configured ports open but I couldn't see the ports open using nmap.
I am adding below the configuration so maybe it can give a clue cause at this moment I am clueless why it changed and doesn't work now anymore
Thank you lots in advance
Did anything change lately regarding wireguard in latest OS? I did an upgrade and it seems I can't come from the outside anymore to connect to the wireguard. If I am internally I can connect to it and handshake is established ok.
I have the same settings from before and nothing change from my side as far as I can tell beside upgrading the OS.
I also tried to do an nmap to see the 2 wireguard configured ports open but I couldn't see the ports open using nmap.
I am adding below the configuration so maybe it can give a clue cause at this moment I am clueless why it changed and doesn't work now anymore
Thank you lots in advance
Code:
# 2024-04-01 15:31:22 by RouterOS 7.14.2# software id = WCPF-BHYF## model = RB5009UG+S+# serial number = ECXXX/caps-man channeladd band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2437 name=ch6 tx-power=10add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2412 name=ch1 tx-power=20add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2462 name=ch11 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2427 name=ch4 tx-power=10add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2417 name=ch2 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2422 name=ch3 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2432 name=ch5 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2437 name=ch6 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2442 name=ch7 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2447 name=ch8 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2452 name=ch9 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2457 name=ch10 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2467 name=ch12 tx-power=15add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2472 name=ch13 tx-power=15add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5180 name=ch38 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5220 name=ch46 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5260 name=ch54 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5300 name=ch62 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5500 name=ch102 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5540 name=ch110 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5580 name=ch118 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5620 name=ch126 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5660 name=ch134 tx-power=40add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5180 name=ch42 tx-power=40add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5260 name=ch58 tx-power=40add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5500 name=ch106 tx-power=40add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5580 name=ch122 tx-power=40add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5660 name=ch138 tx-power=40add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ceee frequency=5745 name=ch155 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5700 name=ch142 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5745 name=ch151 tx-power=40add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ce frequency=5785 name=ch159 tx-power=40/interface bridgeadd ageing-time=5m arp=enabled arp-timeout=auto auto-mac=yes dhcp-snooping=no disabled=no fast-forward=yes forward-delay=15s igmp-snooping=no max-message-age=20s mtu=auto name=bridge-dmz port-cost-mode=short priority=0x8000 protocol-mode=rstp transmit-hold-count=6 \ vlan-filtering=noadd ageing-time=5m arp=enabled arp-timeout=auto auto-mac=yes dhcp-snooping=no disabled=no fast-forward=yes forward-delay=15s igmp-snooping=no max-message-age=20s mtu=auto name=bridge-guest port-cost-mode=short priority=0x8000 protocol-mode=rstp transmit-hold-count=6 \ vlan-filtering=noadd ageing-time=5m arp=enabled arp-timeout=auto auto-mac=yes dhcp-snooping=no disabled=no fast-forward=yes forward-delay=15s igmp-snooping=no max-message-age=20s mtu=auto name=bridge-lan port-cost-mode=short priority=0x8000 protocol-mode=rstp transmit-hold-count=6 \ vlan-filtering=no/interface ethernetset [ find default-name=ether1 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full,2.5G-baseT arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \ loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:E9 mtu=1500 name=eth1-wan orig-mac-address=2C:C8:1B:FF:D5:E9 rx-flow-control=off tx-flow-control=offset [ find default-name=ether2 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \ loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EA mtu=1500 name=eth2-lan orig-mac-address=2C:C8:1B:FF:D5:EA rx-flow-control=off tx-flow-control=offset [ find default-name=ether3 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \ loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EB mtu=1500 name=eth3-lan orig-mac-address=2C:C8:1B:FF:D5:EB rx-flow-control=off tx-flow-control=offset [ find default-name=ether4 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \ loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EC mtu=1500 name=eth4-lan orig-mac-address=2C:C8:1B:FF:D5:EC rx-flow-control=off tx-flow-control=offset [ find default-name=ether5 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \ loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:ED mtu=1500 name=eth5-lan orig-mac-address=2C:C8:1B:FF:D5:ED rx-flow-control=off tx-flow-control=offset [ find default-name=ether6 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \ loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EE mtu=1500 name=eth6-lan orig-mac-address=2C:C8:1B:FF:D5:EE rx-flow-control=off tx-flow-control=offset [ find default-name=ether7 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \ loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:EF mtu=1500 name=eth7-lan orig-mac-address=2C:C8:1B:FF:D5:EF rx-flow-control=off tx-flow-control=offset [ find default-name=ether8 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default \ loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:F0 mtu=1500 name=eth8-lan orig-mac-address=2C:C8:1B:FF:D5:F0 rx-flow-control=off tx-flow-control=offset [ find default-name=sfp-sfpplus1 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full,1G-baseX,2.5G-baseT,2.5G-baseX,5G-baseT,10G-baseT,10G-baseSR-LR,10G-baseCR arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=\ unlimited/unlimited disabled=no l2mtu=1514 loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=2C:C8:1B:FF:D5:F1 mtu=1500 name=sfp-sfpplus1 orig-mac-address=2C:C8:1B:FF:D5:F1 rx-flow-control=off sfp-rate-select=high \ sfp-shutdown-temperature=95C tx-flow-control=off/interface wireguardadd disabled=no listen-port=51821 mtu=1420 name=Wireguard_piVPNadd disabled=no listen-port=51820 mtu=1420 name=Wireguard_wg0/queue interfaceset Wireguard_piVPN queue=no-queueset Wireguard_wg0 queue=no-queueset bridge-dmz queue=no-queueset bridge-guest queue=no-queueset bridge-lan queue=no-queue/interface vlanadd arp=enabled arp-timeout=auto disabled=no interface=eth2-lan loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mtu=1500 name=eth2-vlan-dmz use-service-tag=no vlan-id=20add arp=enabled arp-timeout=auto disabled=no interface=eth2-lan loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mtu=1500 name=eth2-vlan-guest use-service-tag=no vlan-id=15add arp=enabled arp-timeout=auto disabled=no interface=eth8-lan loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mtu=1500 name=eth8-vlan-dmz use-service-tag=no vlan-id=20add arp=enabled arp-timeout=auto disabled=no interface=eth8-lan loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mtu=1500 name=eth8-vlan-guest use-service-tag=no vlan-id=15/caps-man datapathadd bridge=bridge-guest local-forwarding=yes name=SSD_guest_path vlan-id=15 vlan-mode=use-tagadd bridge=bridge-lan client-to-client-forwarding=yes local-forwarding=yes name=SSD_pathadd bridge=bridge-dmz local-forwarding=yes name=SSD_dmz_path vlan-id=20 vlan-mode=use-tag/queue interfaceset eth2-vlan-dmz queue=no-queueset eth2-vlan-guest queue=no-queueset eth8-vlan-dmz queue=no-queueset eth8-vlan-guest queue=no-queue/caps-man ratesadd basic=6Mbps name=gn_only_no_b_rates supported=6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps/caps-man securityadd authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=SSD_secadd authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=SSD_guest_secadd authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=SSD_dmz_sec/caps-man configurationadd channel=ch6 country=romania datapath=SSD_path mode=ap name=SSD_2g4 rates=gn_only_no_b_rates security=SSD_sec ssid=SSDadd channel=ch62 country=romania datapath=SSD_path mode=ap name=SSD_5g_ch62 security=SSD_sec ssid=SSDadd country=romania datapath=SSD_guest_path mode=ap name=SSD_guest security=SSD_guest_sec ssid=SSD_guestadd channel=ch62 country=romania datapath=SSD_path mode=ap name=SSD_5g_ch52 security=SSD_sec ssid=SSDadd channel=ch110 country=romania datapath=SSD_path mode=ap name=SSD_5g_ch110 security=SSD_sec ssid=SSDadd channel=ch11 country=romania datapath=SSD_path mode=ap name=SSD_2g4_ch11 rates=gn_only_no_b_rates security=SSD_sec ssid=SSDadd channel=ch4 country=romania datapath=SSD_path mode=ap name=SSD_2g4_ch4 rates=gn_only_no_b_rates security=SSD_sec ssid=SSDadd channel=ch118 country=romania datapath=SSD_path mode=ap name=SSD_5g_ch118 security=SSD_sec ssid=SSDadd channel.band=5ghz-n/ac .control-channel-width=20mhz .extension-channel=XXXX country=romania datapath.client-to-client-forwarding=yes .local-forwarding=yes name=cfg-5ghz-ac security=SSD_sec ssid=""add channel.band=5ghz-onlyn .control-channel-width=20mhz .extension-channel=XX country=romania datapath.client-to-client-forwarding=yes .local-forwarding=yes name=cfg-5ghz-an security=SSD_sec ssid=""add channel=ch10 country=romania datapath=SSD_path mode=ap name=SSD_2g4_ch10 security=SSD_sec ssid=SSDadd country=romania datapath=SSD_dmz_path mode=ap name=SSD_dmz security=SSD_dmz_sec ssid=SSD_dmz/interface ethernet switchset 0 cpu-flow-control=yes mirror-egress-target=none name=switch1/interface ethernet switch portset 0 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 1 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 2 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 3 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 4 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 5 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 6 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 7 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 8 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=noneset 9 !egress-rate !ingress-rate mirror-egress=no mirror-ingress=no mirror-ingress-target=none/interface ethernet switch port-isolationset 0 !forwarding-overrideset 1 !forwarding-overrideset 2 !forwarding-overrideset 3 !forwarding-overrideset 4 !forwarding-overrideset 5 !forwarding-overrideset 6 !forwarding-overrideset 7 !forwarding-overrideset 8 !forwarding-overrideset 9 !forwarding-override/interface listset [ find name=all ] comment="contains all interfaces" exclude="" include="" name=allset [ find name=none ] comment="contains no interfaces" exclude="" include="" name=noneset [ find name=dynamic ] comment="contains dynamic interfaces" exclude="" include="" name=dynamicset [ find name=static ] comment="contains static interfaces" exclude="" include="" name=staticadd exclude="" include="" name=WANadd exclude="" include="" name=LANadd exclude="" include="" name=MULLVAN-VPN/interface lte apnset [ find default=yes ] add-default-route=yes apn=internet authentication=none default-route-distance=2 ip-type=auto name=default use-network-apn=yes use-peer-dns=yes/interface macsec profileset [ find default-name=default ] name=default server-priority=10/interface wireless security-profilesset [ find default=yes ] authentication-types="" disable-pmkid=no eap-methods=passthrough group-ciphers=aes-ccm group-key-update=5m interim-update=0s management-protection=disabled mode=none mschapv2-username="" name=default radius-called-format=mac:ssid radius-eap-accounting=no \ radius-mac-accounting=no radius-mac-authentication=no radius-mac-caching=disabled radius-mac-format=XX:XX:XX:XX:XX:XX radius-mac-mode=as-username static-algo-0=none static-algo-1=none static-algo-2=none static-algo-3=none static-sta-private-algo=none static-transmit-key=\ key-0 supplicant-identity=MikroTik tls-certificate=none tls-mode=no-certificates unicast-ciphers=aes-ccm/ip dhcp-client optionset clientid_duid code=61 name=clientid_duid value="0xff\$(CLIENT_DUID)"set clientid code=61 name=clientid value="0x01\$(CLIENT_MAC)"set hostname code=12 name=hostname value="\$(HOSTNAME)"/ip hotspot profileset [ find default=yes ] dns-name="" hotspot-address=0.0.0.0 html-directory=hotspot html-directory-override="" http-cookie-lifetime=3d http-proxy=0.0.0.0:0 install-hotspot-queue=yes login-by=cookie,http-chap name=default rate-limit="" smtp-server=0.0.0.0 split-user-domain=no \ use-radius=no/ip hotspot user profileset [ find default=yes ] add-mac-cookie=yes address-list="" idle-timeout=none !insert-queue-before keepalive-timeout=2m mac-cookie-timeout=3d name=default !parent-queue !queue-type shared-users=1 status-autorefresh=1m transparent-proxy=no/ip ipsec mode-configset [ find default=yes ] name=request-only responder=no use-responder-dns=exclusively/ip ipsec policy groupset [ find default=yes ] name=default/ip ipsec profileset [ find default=yes ] dh-group=modp2048,modp1024 dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=aes-128,3des hash-algorithm=sha1 lifetime=1d name=default nat-traversal=yes proposal-check=obey/ip ipsec proposalset [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc lifetime=30m name=default pfs-group=modp1024/ip pooladd name=dhcp ranges=192.168.200.150-192.168.200.200add name=pool-guest ranges=50.0.0.2-50.0.0.100add name=pool-vpn ranges=10.10.10.2-10.10.10.7add name=vpn ranges=192.168.89.2-192.168.89.255add name=pool-dmz ranges=51.0.0.2-51.0.0.200/ip dhcp-serveradd address-pool=dhcp authoritative=yes disabled=no interface=bridge-lan lease-script="" lease-time=10m name=dhcp-lan use-radius=noadd address-pool=pool-guest authoritative=yes disabled=no interface=bridge-guest lease-script="" lease-time=10m name=dhcp-guest use-radius=noadd address-pool=pool-dmz authoritative=yes disabled=no interface=bridge-dmz lease-script="" lease-time=10m name=dhcp-dmz use-radius=no/ip smb usersset [ find default=yes ] disabled=yes name=guest read-only=yes/ppp profileset *0 address-list="" !bridge !bridge-horizon bridge-learning=default !bridge-path-cost !bridge-port-priority change-tcp-mss=yes !dns-server !idle-timeout !incoming-filter !insert-queue-before !interface-list !local-address name=default on-down="" on-up="" only-one=default \ !outgoing-filter !parent-queue !queue-type !rate-limit !remote-address !session-timeout use-compression=default use-encryption=default use-ipv6=yes use-mpls=default use-upnp=default !wins-serverset *FFFFFFFE address-list="" !bridge !bridge-horizon bridge-learning=default !bridge-path-cost !bridge-port-priority change-tcp-mss=yes !dns-server !idle-timeout !incoming-filter !insert-queue-before !interface-list local-address=192.168.89.1 name=default-encryption on-down="" \ on-up="" only-one=default !outgoing-filter !parent-queue !queue-type !rate-limit remote-address=vpn !session-timeout use-compression=default use-encryption=yes use-ipv6=yes use-mpls=default use-upnp=default !wins-server/interface pppoe-clientadd ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 default-route-distance=1 dial-on-demand=no disabled=no interface=eth1-wan keepalive-timeout=10 max-mru=auto max-mtu=1500 mrru=disabled name=digi profile=default service-name="" use-peer-dns=no user=TMxxx/queue interfaceset digi queue=no-queue/queue typeset 0 kind=pfifo name=default pfifo-limit=50set 1 kind=pfifo name=ethernet-default pfifo-limit=50set 2 kind=sfq name=wireless-default sfq-allot=1514 sfq-perturb=5set 3 kind=red name=synchronous-default red-avg-packet=1000 red-burst=20 red-limit=60 red-max-threshold=50 red-min-threshold=10set 4 kind=sfq name=hotspot-default sfq-allot=1514 sfq-perturb=5set 5 kind=pcq name=pcq-upload-default pcq-burst-rate=0 pcq-burst-threshold=0 pcq-burst-time=10s pcq-classifier=src-address pcq-dst-address-mask=32 pcq-dst-address6-mask=128 pcq-limit=50KiB pcq-rate=0 pcq-src-address-mask=32 pcq-src-address6-mask=128 pcq-total-limit=2000KiBset 6 kind=pcq name=pcq-download-default pcq-burst-rate=0 pcq-burst-threshold=0 pcq-burst-time=10s pcq-classifier=dst-address pcq-dst-address-mask=32 pcq-dst-address6-mask=128 pcq-limit=50KiB pcq-rate=0 pcq-src-address-mask=32 pcq-src-address6-mask=128 pcq-total-limit=2000KiBset 7 kind=none name=only-hardware-queueset 8 kind=mq-pfifo mq-pfifo-limit=50 name=multi-queue-ethernet-defaultset 9 kind=pfifo name=default-small pfifo-limit=10/queue interfaceset eth1-wan queue=only-hardware-queueset eth2-lan queue=only-hardware-queueset eth3-lan queue=only-hardware-queueset eth4-lan queue=only-hardware-queueset eth5-lan queue=only-hardware-queueset eth6-lan queue=only-hardware-queueset eth7-lan queue=only-hardware-queueset eth8-lan queue=only-hardware-queueset sfp-sfpplus1 queue=only-hardware-queue/queue simpleadd bucket-size=0.1/0.1 burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s disabled=no dst=digi limit-at=0/0 max-limit=50M/50M name=guest_traffic packet-marks="" parent=none priority=8/8 queue=default/default target=50.0.0.0/24,2a02:2f09:3418:f303::/64 !time total-queue=\ defaultadd bucket-size=0.1/0.1 burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s disabled=no dst=digi limit-at=0/0 max-limit=50M/50M name=dmz_traffic packet-marks="" parent=none priority=8/8 queue=default/default target=51.0.0.0/24,2a02:2f09:3418:f303::/64 !time total-queue=default/routing bgp templateset default as=65530 name=default/snmp communityset [ find default=yes ] addresses=::/0 authentication-protocol=MD5 disabled=no encryption-protocol=DES name=public read-access=yes security=none write-access=no/system logging actionset 0 memory-lines=5000 memory-stop-on-full=no name=memory target=memoryset 1 disk-file-count=2 disk-file-name=log disk-lines-per-file=1000 disk-stop-on-full=no name=disk target=diskset 2 name=echo remember=yes target=echoset 3 bsd-syslog=no name=remote remote=0.0.0.0 remote-port=514 src-address=0.0.0.0 syslog-facility=daemon syslog-severity=auto syslog-time-format=bsd-syslog target=remoteadd email-start-tls=no email-to=samuellazea1990@gmail.com name=GMAIL target=emailadd email-start-tls=no email-to=samuellazea@yahoo.com name=YAHOO target=email/user groupset read name=read policy=local,telnet,ssh,reboot,read,test,winbox,password,web,sniff,sensitive,api,romon,rest-api,!ftp,!write,!policy skin=defaultset write name=write policy=local,telnet,ssh,reboot,read,write,test,winbox,password,web,sniff,sensitive,api,romon,rest-api,!ftp,!policy skin=defaultset full name=full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,rest-api skin=defaultadd name=prometheus policy=read,test,winbox,api,!local,!telnet,!ssh,!ftp,!reboot,!write,!policy,!password,!web,!sniff,!sensitive,!romon,!rest-api skin=default/caps-man aaaset called-format=mac:ssid interim-update=disabled mac-caching=disabled mac-format=XX:XX:XX:XX:XX:XX mac-mode=as-username/caps-man manager# bad package pathset ca-certificate=none certificate=none enabled=yes package-path=/downloads/ require-peer-certificate=no upgrade-policy=suggest-same-version/caps-man manager interfaceset [ find default=yes ] disabled=no forbid=yes interface=alladd disabled=no forbid=no interface=bridge-lan/caps-man provisioningadd action=create-dynamic-enabled comment=2g4_802.11g_capable_radios common-name-regexp="" disabled=no hw-supported-modes=g identity-regexp=CAPac_Etaj ip-address-ranges="" master-configuration=SSD_2g4_ch11 name-format=prefix-identity name-prefix=2g4_ch11 radio-mac=\ 00:00:00:00:00:00 slave-configurations=SSD_guest,SSD_dmzadd action=create-dynamic-enabled comment=2g4_802.11g_capable_radios common-name-regexp="" disabled=no hw-supported-modes=g identity-regexp=CAPac_Parter ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch4 radio-mac=\ 00:00:00:00:00:00 slave-configurations=SSD_guest,SSD_dmzadd action=create-dynamic-enabled comment=5g_ch118_802.11ac_capable_radios common-name-regexp="" disabled=no hw-supported-modes=ac identity-regexp=CAPac_Etaj ip-address-ranges="" master-configuration=SSD_5g_ch118 name-format=prefix-identity name-prefix=5g_ch118 radio-mac=\ 00:00:00:00:00:00 slave-configurations=SSD_guest,SSD_dmzadd action=create-dynamic-enabled comment=5g_ch110_802.11ac_capable_radios common-name-regexp="" disabled=no hw-supported-modes=ac identity-regexp=CAPac_Parter ip-address-ranges="" master-configuration=SSD_5g_ch110 name-format=prefix-identity name-prefix=5g_ch110 radio-mac=\ 00:00:00:00:00:00 slave-configurations=SSD_dmz,SSD_guestadd action=create-dynamic-enabled common-name-regexp="" disabled=no hw-supported-modes=g identity-regexp=HAP ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch4 radio-mac=00:00:00:00:00:00 slave-configurations=SSD_guest,SSD_dmzadd action=create-dynamic-enabled comment=5g_ch60_802.11ac_capable_radios common-name-regexp="" disabled=yes hw-supported-modes="" identity-regexp=Mikrotik ip-address-ranges="" master-configuration=SSD_2g4_ch11 name-format=prefix-identity name-prefix=2g_ch11 radio-mac=\ 00:00:00:00:00:00 slave-configurations=""add action=create-dynamic-enabled comment=5g_ch116_802.11ac_capable_radios common-name-regexp="" disabled=yes hw-supported-modes=ac identity-regexp=CAPac_Parter ip-address-ranges="" master-configuration=SSD_5g_ch118 name-format=prefix-identity name-prefix=5g_ch116 radio-mac=\ 00:00:00:00:00:00 slave-configurations=""add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes=gn identity-regexp="" ip-address-ranges="" master-configuration=SSD_5g_ch118 name-format=prefix-identity name-prefix=2ghz radio-mac=00:00:00:00:00:00 slave-configurations=""add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes=ac identity-regexp="" ip-address-ranges="" master-configuration=cfg-5ghz-ac name-format=prefix-identity name-prefix=5ghz-ac radio-mac=00:00:00:00:00:00 slave-configurations=""add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes=an identity-regexp="" ip-address-ranges="" master-configuration=cfg-5ghz-an name-format=prefix-identity name-prefix=5ghz-an radio-mac=00:00:00:00:00:00 slave-configurations=""add action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes="" identity-regexp=HAP ip-address-ranges="" master-configuration=SSD_2g4_ch11 name-format=cap name-prefix="" radio-mac=00:00:00:00:00:00 slave-configurations=""add action=create-dynamic-enabled comment=2g4_802.11g_capable_radios common-name-regexp="" disabled=yes hw-supported-modes=g identity-regexp=CAPac_Etaj ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch11 radio-mac=\ 00:00:00:00:00:00 slave-configurations=SSD_dmzadd action=create-dynamic-enabled comment=2g4_802.11g_capable_radios common-name-regexp="" disabled=yes hw-supported-modes=g identity-regexp=CAPac_Parter ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch4 radio-mac=\ 00:00:00:00:00:00 slave-configurations=SSD_dmzadd action=create-dynamic-enabled common-name-regexp="" disabled=yes hw-supported-modes=g identity-regexp=HAP ip-address-ranges="" master-configuration=SSD_2g4_ch4 name-format=prefix-identity name-prefix=2g4_ch4 radio-mac=00:00:00:00:00:00 slave-configurations=SSD_dmz/certificate settingsset crl-download=no crl-store=ram crl-use=no/container configset layer-dir="" ram-high=0 registry-url="" tmpdir="" username=""/disk settingsset auto-smb-sharing=no auto-smb-user=guest/ip smbset comment=MikrotikSMB domain=MSHOME enabled=auto interfaces=all/interface bridge portadd auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth2-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yesadd auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth3-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yesadd auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth4-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yesadd auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth5-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yesadd auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth6-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yesadd auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth7-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yesadd auto-isolate=no bpdu-guard=no bridge=bridge-lan broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none hw=yes ingress-filtering=yes interface=eth8-lan internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=1 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yesadd auto-isolate=no bpdu-guard=no bridge=bridge-guest broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none ingress-filtering=yes interface=eth2-vlan-guest internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=15 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yesadd auto-isolate=no bpdu-guard=no bridge=bridge-dmz broadcast-flood=yes disabled=no edge=auto fast-leave=no frame-types=admit-all horizon=none ingress-filtering=yes interface=eth2-vlan-dmz internal-path-cost=10 learn=auto multicast-router=temporary-query path-cost=10 \ point-to-point=auto priority=0x80 pvid=20 restricted-role=no restricted-tcn=no tag-stacking=no trusted=no unknown-multicast-flood=yes unknown-unicast-flood=yes/interface bridge port-controller# disabledset bridge=none cascade-ports="" switch=none/interface bridge port-extender# disabledset control-ports="" excluded-ports="" switch=none/interface bridge settingsset allow-fast-path=yes use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=no/ip firewall connection trackingset enabled=auto generic-timeout=10m icmp-timeout=10s loose-tcp-tracking=yes tcp-close-timeout=10s tcp-close-wait-timeout=10s tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s tcp-max-retrans-timeout=5m tcp-syn-received-timeout=5s tcp-syn-sent-timeout=\ 5s tcp-time-wait-timeout=10s tcp-unacked-timeout=5m udp-stream-timeout=3m udp-timeout=10s/ip neighbor discovery-settingsset discover-interface-list=!dynamic lldp-med-net-policy-vlan=disabled mode=tx-and-rx protocol=cdp,lldp,mndp/ip settingsset accept-redirects=no accept-source-route=no allow-fast-path=yes arp-timeout=30s icmp-rate-limit=10 icmp-rate-mask=0x1818 ip-forward=yes max-neighbor-entries=16384 rp-filter=no secure-redirects=yes send-redirects=yes tcp-syncookies=no/ipv6 settingsset accept-redirects=yes-if-forwarding-disabled accept-router-advertisements=yes disable-ipv6=no forward=yes max-neighbor-entries=16384/interface detect-internetset detect-interface-list=none internet-interface-list=none lan-interface-list=none wan-interface-list=none/interface l2tp-server serverset accept-proto-version=all accept-pseudowire-type=all allow-fast-path=no authentication=pap,chap,mschap1,mschap2 caller-id-type=ip-address default-profile=default-encryption enabled=no keepalive-timeout=30 l2tpv3-circuit-id="" l2tpv3-cookie-length=0 l2tpv3-digest-hash=md5 \ !l2tpv3-ether-interface-list max-mru=1450 max-mtu=1450 max-sessions=unlimited mrru=disabled one-session-per-host=no use-ipsec=yes/interface list memberadd disabled=no interface=eth1-wan list=LANadd disabled=no interface=digi list=WANadd disabled=no interface=eth1-wan list=WANadd disabled=no interface=bridge-lan list=LAN/interface lte settingsset firmware-path=firmware mode=auto/interface ovpn-server serverset auth=sha1,md5 certificate=*0 cipher=blowfish128,aes128-cbc default-profile=default enable-tun-ipv6=no enabled=no ipv6-prefix-len=64 keepalive-timeout=60 mac-address=FE:3A:DF:FE:EA:CE max-mtu=1500 mode=ip netmask=24 port=1194 protocol=tcp push-routes="" redirect-gateway=\ disabled reneg-sec=3600 require-client-certificate=no tls-version=any tun-server-ipv6=::/interface pptp-server server# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol insteadset authentication=mschap1,mschap2 default-profile=default-encryption enabled=no keepalive-timeout=30 max-mru=1450 max-mtu=1450 mrru=disabled/interface sstp-server serverset authentication=pap,chap,mschap1,mschap2 certificate=none ciphers=aes256-sha,aes256-gcm-sha384 default-profile=default-encryption enabled=no keepalive-timeout=60 max-mru=1500 max-mtu=1500 mrru=disabled pfs=no port=443 tls-version=any verify-client-certificate=no/interface wifi capset enabled=no/interface wifi capsmanset enabled=no/interface wireguard peersadd allowed-address=192.168.201.3/32 client-endpoint="" comment="Sami's S22+" disabled=no endpoint-address="" endpoint-port=0 interface=Wireguard_wg0 preshared-key="" private-key="" public-key="gDSOxxx"add allowed-address=192.168.202.2/32,192.168.200.11/32,192.168.200.92/32,192.168.200.93/32,192.168.200.31/32,192.168.201.2/32,192.168.201.3/32,192.168.8.0/24,192.168.202.1/32 client-endpoint="" comment="piVPN " disabled=no endpoint-address="" endpoint-port=0 interface=\ Wireguard_piVPN preshared-key="" private-key="" public-key="jgL7xxx"add allowed-address=192.168.201.2/32 client-endpoint="" comment="HP Laptop" disabled=no endpoint-address="" endpoint-port=0 interface=Wireguard_wg0 preshared-key="" private-key="" public-key="/p3Ym6xxx"/interface wireless alignset active-mode=yes audio-max=-20 audio-min=-100 audio-monitor=00:00:00:00:00:00 filter-mac=00:00:00:00:00:00 frame-size=300 frames-per-second=25 receive-all=no ssid-all=no/interface wireless capset bridge=none caps-man-addresses="" caps-man-certificate-common-names="" caps-man-names="" certificate=none discovery-interfaces="" enabled=no interfaces="" lock-to-caps-man=no static-virtual=no/interface wireless snifferset channel-time=200ms file-limit=10 file-name="" memory-limit=10 multiple-channels=no only-headers=no receive-errors=no streaming-enabled=no streaming-max-rate=0 streaming-server=0.0.0.0/interface wireless snooperset channel-time=200ms multiple-channels=yes receive-errors=no/ip addressadd address=192.168.200.1/24 disabled=no interface=bridge-lan network=192.168.200.0add address=50.0.0.1/24 disabled=no interface=bridge-guest network=50.0.0.0add address=192.168.201.1/24 disabled=no interface=Wireguard_wg0 network=192.168.201.0add address=51.0.0.1/24 disabled=no interface=bridge-dmz network=51.0.0.0add address=192.168.202.1/24 disabled=no interface=Wireguard_piVPN network=192.168.202.0/ip arpadd address=192.168.200.11 disabled=yes interface=bridge-lan mac-address=FF:FF:FF:FF:FF:FF published=noadd address=192.168.200.25 disabled=yes interface=bridge-lan mac-address=68:A4:0E:1C:AB:7D published=no/ip cloudset back-to-home-vpn=revoked-and-disabled ddns-enabled=yes ddns-update-interval=none update-time=yes/ip cloud advancedset use-local-address=no/ip dhcp-server configset accounting=yes interim-update=0s radius-password=empty store-leases-disk=5m/ip dhcp-server leaseadd address=192.168.200.31 address-lists="" client-id=1:70:85:c2:a7:d5:73 comment=RTX dhcp-option="" disabled=no !insert-queue-before mac-address=70:85:C2:A7:D5:73 server=dhcp-lanadd address=192.168.200.2 address-lists="" comment=Switch dhcp-option="" disabled=no !insert-queue-before mac-address=0C:80:63:3A:14:01 server=dhcp-lan/ip dhcp-server networkadd address=50.0.0.0/24 caps-manager="" comment=dhcp-guest dhcp-option="" dns-server=50.0.0.1,8.8.8.8 gateway=50.0.0.1 !next-server ntp-server="" wins-server=""add address=51.0.0.0/24 caps-manager="" comment=dhcp-dmz dhcp-option="" dns-server=51.0.0.1,8.8.8.8 gateway=51.0.0.1 !next-server ntp-server="" wins-server=""add address=192.168.200.0/24 boot-file-name=netboot.xyz.kpxe caps-manager="" comment=dhcp-lan dhcp-option="" dns-server=192.168.200.1 gateway=192.168.200.1 next-server=192.168.200.11 ntp-server="" wins-server=""/ip dnsset address-list-extra-time=0s allow-remote-requests=yes cache-max-ttl=1w cache-size=6048KiB doh-max-concurrent-queries=50 doh-max-server-connections=5 doh-timeout=5s max-concurrent-queries=200 max-concurrent-tcp-sessions=40 max-udp-packet-size=4096 query-server-timeout=2s \ query-total-timeout=10s servers=8.8.8.8,8.8.4.4 use-doh-server="" verify-doh-cert=no/ip firewall address-listadd address=192.168.200.0/24 comment=Management disabled=no dynamic=no list=LANsadd address=something.no-ip.org disabled=no dynamic=no list=WANs/ip firewall filteradd action=accept chain=forward comment=Wireguard_DELL !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port \ !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list in-interface=Wireguard_piVPN !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=accept chain=forward !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot \ !icmp-options !in-bridge-port !in-bridge-port-list in-interface=bridge-lan !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=Wireguard_wg0 \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=accept chain=forward comment="Allow Wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit \ !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.201.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=accept chain=forward comment="Allow Wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.201.0/24 !dst-address-list !dst-address-type \ !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=accept chain=forward comment="Wireguard piVPN Production" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type \ !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=192.168.202.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=accept chain=forward comment="Wireguard piVPN Production" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.202.0/24 !dst-address-list \ !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \ !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host \ !ttladd action=accept chain=forward comment="no fasttrack for dmz traffic upload" connection-state=established,related src-address=51.0.0.0/24add action=accept chain=forward comment="no fasttrack for guest traffic upload" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=established,related !connection-type !content disabled=no !dscp !dst-address \ !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \ !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=50.0.0.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \ !tcp-mss !time !tls-host !ttladd action=accept chain=forward comment="no fasttrack for dmz traffic download" connection-state=established,related dst-address=51.0.0.0/24add action=accept chain=forward comment="no fasttrack for guest traffic download" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=established,related !connection-type !content disabled=no !dscp dst-address=50.0.0.0/24 \ !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \ !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time \ !tls-host !ttladd action=fasttrack-connection chain=forward comment="defconf: fasttrack" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=established,related !connection-type !content disabled=no !dscp !dst-address !dst-address-list \ !dst-address-type !dst-limit !dst-port !fragment !hotspot hw-offload=yes !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \ !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time \ !tls-host !ttladd action=accept chain=forward comment="defconf: accept in ipsec policy" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type \ !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority ipsec-policy=in,ipsec !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list \ !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=accept chain=forward comment="defconf: accept out ipsec policy" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type \ !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority ipsec-policy=out,ipsec !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list \ !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=accept chain=forward comment="defconf: accept established,related, untracked" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=established,related,untracked !connection-type !content disabled=no !dscp \ !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth \ !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \ !tcp-mss !time !tls-host !ttladd action=reject chain=forward comment="drop dmz traffic" in-interface=bridge-dmz out-interface=bridge-lan reject-with=icmp-network-unreachableadd action=reject chain=forward comment="drop guest traffic" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit \ !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list in-interface=bridge-guest !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=\ bridge-lan !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm reject-with=icmp-network-unreachable !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \ !tcp-mss !time !tls-host !ttladd action=drop chain=forward comment="defconf: drop invalid" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate connection-state=invalid !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type \ !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" !connection-bytes !connection-limit !connection-mark connection-nat-state=!dstnat !connection-rate connection-state=new !connection-type !content disabled=yes !dscp !dst-address !dst-address-list \ !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \ !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time \ !tls-host !ttladd action=log chain=forward !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp dst-address=192.168.200.11 !dst-address-list !dst-address-type !dst-limit !dst-port !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="DS1816XS connection: " !nth !out-bridge-port !out-bridge-port-list !out-interface \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=!192.168.200.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=log chain=forward !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=80,443,5000,5001 !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="DS Photo Connection" !nth !out-bridge-port !out-bridge-port-list !out-interface \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=accept chain=input protocol=icmpadd action=accept chain=input connection-state=establishedadd action=accept chain=input connection-state=relatedadd action=accept chain=input comment="allow IPsec NAT" disabled=no dst-port=4500 protocol=udpadd action=accept chain=input comment="allow IKE" disabled=no dst-port=500 protocol=udpadd action=accept chain=input comment="allow l2tp" disabled=no dst-port=1701 protocol=udpadd action=drop chain=input in-interface-list=!LAN/ip firewall mangleadd action=mark-connection chain=prerouting comment="Mark connections for hairpin NAT" dst-address-list=WANs new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LANsadd action=mark-routing chain=prerouting comment=Mullvad !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit \ !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" new-routing-mark=*4000 !nth !out-bridge-port !out-bridge-port-list \ !out-interface !out-interface-list !packet-mark !packet-size passthrough=no !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.200.9 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss \ !time !tls-host !ttladd action=log chain=prerouting comment="Logging for wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.200.0/24 !dst-address-list \ !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \ !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.202.20 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \ !tcp-mss !time !tls-host !ttladd action=log chain=forward comment="Logging for wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.200.0/24 !dst-address-list !dst-address-type \ !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface \ !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.202.20 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host !ttladd action=log chain=postrouting comment="Logging for wireguard" !connection-bytes !connection-limit !connection-mark !connection-nat-state !connection-rate !connection-state !connection-type !content disabled=no !dscp dst-address=192.168.200.0/24 !dst-address-list \ !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \ !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.202.20 !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \ !tcp-mss !time !tls-host !ttl/ip firewall natadd action=masquerade chain=srcnat comment="Hairpin NAT" !connection-bytes !connection-limit connection-mark="Hairpin NAT" !connection-rate !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot \ !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \ !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host !to-addresses !to-ports !ttladd action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN !to-addresses !to-portsadd action=dst-nat chain=dstnat comment="Wireguard hairpin nat" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address dst-address-list=WANs !dst-address-type !dst-limit dst-port=51820 !fragment !hotspot \ !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \ !packet-size !per-connection-classifier !port !priority protocol=udp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.1 to-ports=51820 !ttladd action=dst-nat chain=dstnat comment="Web NAS" disabled=yes dst-port=5001 in-interface-list=WAN log=yes protocol=tcp to-addresses=192.168.200.9 to-ports=5001add action=masquerade chain=srcnat comment="Camere Dahua internal" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp dst-address=192.168.200.4 !dst-address-list !dst-address-type !dst-limit dst-port=5013 !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=bridge-lan !out-interface-list \ !packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark src-address=192.168.200.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host !to-addresses !to-ports !ttladd action=dst-nat chain=dstnat comment="Camere Dahua internal" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address !dst-address-list dst-address-type=local !dst-limit dst-port=5013 !fragment !hotspot \ !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \ !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.4 to-ports=5013 !ttladd action=dst-nat chain=dstnat comment="Plex NAS" disabled=no dst-port=32400 !in-interface in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=32400add action=dst-nat chain=dstnat comment="SSH RPi" disabled=yes dst-port=63333 !in-interface in-interface-list=WAN protocol=tcp to-addresses=192.168.200.6 to-ports=63333add action=masquerade chain=srcnat comment="SSH RPi internal" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp dst-address=192.168.200.6 !dst-address-list !dst-address-type !dst-limit dst-port=63333 !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=bridge-lan !out-interface-list \ !packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !routing-mark src-address=192.168.200.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses !to-ports !ttladd action=dst-nat chain=dstnat comment="SSH RPi internal" disabled=yes dst-port=63333 in-interface=bridge-lan protocol=tcp to-addresses=192.168.200.6 to-ports=63333add action=dst-nat chain=dstnat comment="FTP NAS" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=2123 !fragment !hotspot !icmp-options \ !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size \ !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=2123 !ttladd action=dst-nat chain=dstnat comment="Paradox IP Module" dst-port=5005 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.3 to-ports=5005add action=dst-nat chain=dstnat comment="Camere Dahua" dst-port=5013 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.4 to-ports=5013add action=dst-nat chain=dstnat comment="Temp LetsEncrypt NAS" disabled=yes dst-port=80 !in-interface in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=80add action=dst-nat chain=dstnat comment="Certificate NAS " disabled=yes dst-port=80 in-interface-list=WAN log=yes protocol=tcp to-addresses=192.168.200.9 to-ports=80add action=dst-nat chain=dstnat comment=Grafana disabled=yes dst-port=3000 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=3000add action=dst-nat chain=dstnat comment="Web PDU" disabled=yes dst-port=9876 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.10 to-ports=9876add action=dst-nat chain=dstnat comment="SSH NAS" disabled=yes dst-port=64444 !in-interface in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=64444add action=dst-nat chain=dstnat comment="SSH Mikrotik" disabled=yes dst-port=4040 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.1 to-ports=4040add action=dst-nat chain=dstnat comment="SSH Switch" disabled=yes dst-port=62222 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.2 to-ports=22add action=dst-nat chain=dstnat comment="Web Switch" disabled=yes dst-port=8090 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.2 to-ports=8090add action=dst-nat chain=dstnat comment="Web Paradox" disabled=yes dst-port=5004 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.3 to-ports=80add action=redirect chain=dstnat disabled=yes dst-port=53 protocol=udp !to-addresses to-ports=53add action=redirect chain=dstnat comment="proxy dns" disabled=yes dst-port=53 protocol=tcp !to-addresses to-ports=53add action=masquerade chain=srcnat comment="Paradox IP Module internal" dst-address=192.168.200.3 dst-port=5005 out-interface=bridge-lan protocol=tcp src-address=192.168.200.0/24 !to-addresses !to-portsadd action=dst-nat chain=dstnat comment="Paradox IP Module internal" dst-port=5005 in-interface=bridge-lan protocol=tcp to-addresses=192.168.200.3 to-ports=5005add action=dst-nat chain=dstnat comment="Web NAS internal" disabled=yes dst-port=5001 in-interface=bridge-lan protocol=tcp to-addresses=192.168.200.9 to-ports=5001add action=masquerade chain=srcnat comment="Web NAS internal" disabled=yes dst-address=192.168.200.9 dst-port=5001 out-interface=bridge-lan protocol=tcp src-address=192.168.200.0/24 !to-addresses !to-portsadd action=dst-nat chain=dstnat comment="Mikrotik Winbox" disabled=yes dst-port=8291 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.1 to-ports=8291add action=dst-nat chain=dstnat comment=Plex disabled=no dst-port=32400 in-interface=bridge-lan !in-interface-list protocol=tcp to-addresses=192.168.200.11 to-ports=32400add action=masquerade chain=srcnat comment="Plex Intern" dst-address=192.168.200.9 dst-port=32400 out-interface=bridge-lan protocol=tcp src-address=192.168.200.0/24 !to-addresses !to-portsadd action=netmap chain=dstnat comment="RTX WOL" disabled=yes dst-port=8099 protocol=udp to-addresses=192.168.200.11 !to-portsadd action=dst-nat chain=dstnat comment="RTX RDP" disabled=yes dst-port=9000 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.11 to-ports=3389add action=dst-nat chain=dstnat comment=Rsync disabled=yes dst-port=2222 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.9 to-ports=2222add action=masquerade chain=srcnat comment="masq. vpn traffic" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot \ !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \ !packet-size !per-connection-classifier !port !priority !protocol !psd !random !realm !routing-mark src-address=192.168.201.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host !to-addresses !to-ports !ttladd action=dst-nat chain=dstnat comment=Bitwarden dst-port=44445 in-interface-list=WAN log=yes protocol=tcp to-addresses=192.168.200.11 to-ports=44445add action=masquerade chain=srcnat comment="Bitwarden internal" dst-address=192.168.200.11 dst-port=44445 out-interface=bridge-lan protocol=tcp src-address=192.168.200.0/24 !to-addresses !to-portsadd action=dst-nat chain=dstnat comment="Bitwarden internal" dst-port=44445 in-interface=bridge-lan protocol=tcp to-addresses=192.168.200.11 to-ports=44445add action=dst-nat chain=dstnat comment=Octopi disabled=yes dst-port=6000 in-interface-list=WAN protocol=tcp to-addresses=192.168.200.26 to-ports=80add action=dst-nat chain=dstnat comment="Octopi 2" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=6001 !fragment !hotspot !icmp-options \ !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size \ !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.26 to-ports=8081 !ttladd action=dst-nat chain=dstnat comment=Wireguard !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=51820 !fragment !hotspot !icmp-options \ !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size \ !per-connection-classifier !port !priority protocol=udp !psd !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time to-addresses=192.168.200.11 to-ports=51820 !ttladd action=dst-nat chain=dstnat comment="Test connection Filme Qbittorent" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=32700 !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \ !packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=32700 !ttladd action=dst-nat chain=dstnat comment="Test connection Filme Qbittorent UDP" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=32700 !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \ !packet-mark !packet-size !per-connection-classifier !port !priority protocol=udp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=32700 !ttladd action=dst-nat chain=dstnat comment="Test connection DownloadStation UDP" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=16881 !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \ !packet-mark !packet-size !per-connection-classifier !port !priority protocol=udp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=16881 !ttladd action=dst-nat chain=dstnat comment="Test connection DownloadStation" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=16881 !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \ !packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.11 to-ports=16881 !ttladd action=dst-nat chain=dstnat comment="Test connection DownloadStation DS916" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=16882 !fragment \ !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \ !packet-mark !packet-size !per-connection-classifier !port !priority protocol=tcp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.9 to-ports=16882 !ttladd action=dst-nat chain=dstnat comment="Test connection DownloadStation UDP DS916" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit dst-port=16882 \ !fragment !hotspot !icmp-options !in-bridge-port !in-bridge-port-list !in-interface in-interface-list=WAN !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list \ !packet-mark !packet-size !per-connection-classifier !port !priority protocol=udp !psd !random !realm !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !tls-host to-addresses=192.168.200.9 to-ports=16882 !ttladd action=masquerade chain=srcnat comment=Wireguard_DELL !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options \ !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list out-interface=eth1-wan !out-interface-list !packet-mark !packet-size \ !per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=192.168.202.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses !to-ports !ttladd action=masquerade chain=srcnat comment="Wireguard piVPN" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot !icmp-options \ !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark !packet-size \ !per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=192.168.202.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses !to-ports !ttladd action=masquerade chain=srcnat comment="masq. vpn traffic" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=yes !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !fragment !hotspot \ !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \ !packet-size !per-connection-classifier !port !priority !protocol !psd !random !routing-mark src-address=192.168.89.0/24 !src-address-list !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses !to-ports !ttl/ip firewall service-portset ftp disabled=no ports=21set tftp disabled=no ports=69set irc disabled=yes ports=6667set h323 disabled=noset sip disabled=no ports=5060,5061 sip-direct-media=yes sip-timeout=1hset pptp disabled=noset rtsp disabled=yes ports=554set udplite disabled=noset dccp disabled=noset sctp disabled=no/ip hotspot service-portset ftp disabled=no ports=21/ip hotspot userset [ find default=yes ] comment="counters and limits for trial users" disabled=no name=default-trial/ip ipsec policyset 0 disabled=no dst-address=::/0 group=default proposal=default protocol=all src-address=::/0 template=yes/ip ipsec settingsset accounting=yes interim-update=0s xauth-use-radius=no/ip nat-pmpset enabled=no/ip proxyset always-from-cache=no anonymous=no cache-administrator=webmaster cache-hit-dscp=4 cache-on-disk=no cache-path=web-proxy enabled=no max-cache-object-size=2048KiB max-cache-size=unlimited max-client-connections=600 max-fresh-time=3d max-server-connections=600 parent-proxy=:: \ parent-proxy-port=0 port=8080 serialize-connections=no src-address=::/ip routeadd disabled=yes distance=1 gateway=eth1-wanadd comment="Wireguard range" disabled=yes distance=1 dst-address=192.168.201.0/24 gateway=bridge-lan pref-src=192.168.200.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=10add disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=192.168.202.2 pref-src="" routing-table=main suppress-hw-offload=no/ip serviceset telnet address=192.168.200.0/24 disabled=yes port=23 vrf=mainset ftp address=192.168.200.0/24 disabled=yes port=21set www address=192.168.200.0/24,192.168.201.3/32,192.168.201.2/32 disabled=no port=80 vrf=mainset ssh address=192.168.200.0/24,192.168.201.3/32 disabled=no port=4040 vrf=mainset www-ssl address="" certificate=none disabled=yes port=443 tls-version=any vrf=mainset api address=192.168.200.0/24 disabled=no port=8728 vrf=mainset winbox address=192.168.200.0/24,192.168.201.3/32,192.168.201.2/32 disabled=no port=8291 vrf=mainset api-ssl address="" certificate=none disabled=yes port=8729 tls-version=any vrf=main/ip smb sharesset [ find default=yes ] comment="default share" directory=/pub disabled=yes invalid-users="" name=pub read-only=no require-encryption=no valid-users=""/ip socksset auth-method=none connection-idle-timeout=2m enabled=no max-connections=200 port=1080 version=4 vrf=main/ip sshset allow-none-crypto=no always-allow-password-login=no forwarding-enabled=no host-key-size=2048 host-key-type=rsa strong-crypto=no/ip tftp settingsset max-block-size=4096/ip traffic-flowset active-flow-timeout=30m cache-entries=512k enabled=yes inactive-flow-timeout=15s interfaces=all packet-sampling=no sampling-interval=0 sampling-space=0/ip traffic-flow ipfixset bytes=yes dst-address=yes dst-address-mask=yes dst-mac-address=yes dst-port=yes first-forwarded=yes gateway=yes icmp-code=yes icmp-type=yes igmp-type=yes in-interface=yes ip-header-length=yes ip-total-length=yes ipv6-flow-label=yes is-multicast=yes last-forwarded=yes \ nat-dst-address=yes nat-dst-port=yes nat-events=no nat-src-address=yes nat-src-port=yes out-interface=yes packets=yes protocol=yes src-address=yes src-address-mask=yes src-mac-address=yes src-port=yes sys-init-time=yes tcp-ack-num=yes tcp-flags=yes tcp-seq-num=yes \ tcp-window-size=yes tos=yes ttl=yes udp-length=yes/ip traffic-flow targetadd disabled=no dst-address=192.168.200.11 port=2055 src-address=192.168.200.1 v9-template-refresh=20 v9-template-timeout=30m version=9/ip upnpset allow-disable-external-interface=no enabled=no show-dummy-rule=yes/ipv6 addressadd address=::2ec8:1bff:feff:d5ea/64 advertise=yes disabled=no eui-64=yes from-pool=myipv6 interface=bridge-lan no-dad=noadd address=::2ec8:1bff:feff:d5ea/64 advertise=yes disabled=no eui-64=yes from-pool=myipv6 interface=bridge-guest no-dad=noadd address=::2ec8:1bff:feff:d5ea/64 advertise=yes disabled=no eui-64=yes from-pool=myipv6 interface=bridge-dmz no-dad=no/ipv6 dhcp-clientadd add-default-route=no dhcp-options="" dhcp-options="" disabled=no interface=digi pool-name=myipv6 pool-prefix-length=64 prefix-hint=::/0 request=prefix use-peer-dns=yes/ipv6 firewall filteradd action=drop chain=input comment="defconf: rfc4890 drop ll if hop-limit!=255" dst-address=fe80::/10 hop-limit=not-equal:255 protocol=icmpv6add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untrackedadd action=drop chain=input comment="defconf: drop invalid" connection-state=invalidadd action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udpadd action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/16add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udpadd action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ahadd action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-espadd action=accept chain=input comment=openvpn dst-port=443 in-interface=eth1-wan protocol=tcpadd action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface=!bridge-lanadd action=drop chain=forward disabled=yes in-interface=bridge-lan src-address=2a02:1810:480c:4600:70f4:5102:9fab:c901/128add action=reject chain=forward comment="reject dmz to lan traffic" in-interface=bridge-dmz out-interface=bridge-lan reject-with=icmp-address-unreachableadd action=reject chain=forward comment="reject guest to lan traffic" in-interface=bridge-guest out-interface=bridge-lan reject-with=icmp-address-unreachableadd action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untrackedadd action=drop chain=forward comment="defconf: drop invalid" connection-state=invalidadd action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6add action=accept chain=forward comment="defconf: accept HIP" protocol=139add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udpadd action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ahadd action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp/ipv6 ndset [ find default=yes ] advertise-dns=no advertise-mac-address=yes disabled=no dns="" hop-limit=unspecified interface=all managed-address-configuration=no mtu=unspecified other-configuration=no pref64="" ra-delay=3s ra-interval=3m20s-10m ra-lifetime=30m ra-preference=medium \ reachable-time=unspecified retransmit-interval=unspecified/ipv6 nd prefix defaultset autonomous=yes preferred-lifetime=1w valid-lifetime=4w2d/mpls settingsset allow-fast-path=yes dynamic-label-range=16-1048575 propagate-ttl=yes/ppp aaaset accounting=yes interim-update=0s use-circuit-id-in-nas-port-id=no use-radius=no/ppp secretadd caller-id="" disabled=no ipv6-routes="" limit-bytes-in=0 limit-bytes-out=0 !local-address name=vpn profile=default !remote-address !remote-ipv6-prefix routes="" service=any/radius incomingset accept=no port=3799 vrf=main/routing igmp-proxyset query-interval=2m5s query-response-interval=10s quick-leave=no/routing settingsset single-process=no/snmpset contact= enabled=yes engine-id-suffix="" location="" src-address=:: trap-community=public trap-generators=temp-exception trap-target="" trap-version=1 vrf=main/system clockset time-zone-autodetect=yes time-zone-name=Europe/Bucharest/system clock manualset dst-delta=+00:00 dst-end="1970-01-01 00:00:00" dst-start="1970-01-01 00:00:00" time-zone=+00:00/system identityset name=Mikrotik_router/system ledsset 0 disabled=no interface=sfp-sfpplus1 leds=sfp-sfpplus1-led type=interface-activity/system leds settingsset all-leds-off=never/system loggingset 0 action=memory disabled=no prefix="" topics=infoset 1 action=memory disabled=no prefix="" topics=errorset 2 action=memory disabled=no prefix="" topics=warningset 3 action=echo disabled=no prefix="" topics=criticaladd action=memory disabled=yes prefix="" topics=!sshadd action=memory disabled=yes prefix="" topics=wirelessadd action=memory disabled=yes prefix="" topics=dhcpadd action=memory disabled=yes prefix="" topics=debugadd action=memory disabled=yes prefix="" topics=dnsadd action=memory disabled=no prefix="" topics=scriptadd action=memory disabled=yes prefix="" topics=dhcpadd action=memory disabled=yes prefix="" topics=ovpnadd action=memory disabled=yes prefix="" topics=!snmpadd action=GMAIL disabled=no prefix="" topics=critical,!ovpnadd action=GMAIL disabled=yes prefix="<addr 7" topics=pppoeadd action=YAHOO disabled=no prefix="" topics=critical,!ovpnadd action=memory disabled=no prefix="" topics=wireguardadd action=memory disabled=no prefix="" topics=firewalladd action=GMAIL disabled=no prefix="" topics=ssh/system noteset note="" show-at-cli-login=no show-at-login=no/system ntp clientset enabled=yes mode=unicast servers=ro.pool.ntp.org vrf=main/system ntp serverset auth-key=none broadcast=no broadcast-addresses="" enabled=no local-clock-stratum=5 manycast=no multicast=no use-local-clock=no vrf=main/system ntp client serversadd address=ro.pool.ntp.org auth-key=none disabled=no iburst=yes max-poll=10 min-poll=6/system resource irqset 0 cpu=autoset 1 cpu=autoset 2 cpu=autoset 3 cpu=autoset 4 cpu=autoset 5 cpu=autoset 6 cpu=autoset 7 cpu=autoset 8 cpu=autoset 9 cpu=autoset 10 cpu=autoset 11 cpu=autoset 12 cpu=autoset 13 cpu=autoset 14 cpu=autoset 15 cpu=autoset 16 cpu=auto/system resource irq rpsset eth1-wan disabled=yesset eth2-lan disabled=yesset eth3-lan disabled=yesset eth4-lan disabled=yesset eth5-lan disabled=yesset eth6-lan disabled=yesset eth7-lan disabled=yesset eth8-lan disabled=yesset sfp-sfpplus1 disabled=yes/system resource usb settingsset authorization=no/system routerboard settingsset auto-upgrade=no boot-device=nand-if-fail-then-ethernet boot-protocol=bootp force-backup-booter=no preboot-etherboot=disabled preboot-etherboot-server=any protected-routerboot=disabled reformat-hold-button=20s reformat-hold-button-max=10m silent-boot=no/system routerboard reset-buttonset enabled=no hold-time=0s..1m on-event=""/system scheduleradd comment=" Update No-IP DDNS" disabled=no interval=3m name=no-ip_ddns on-event=no-ip_ddns_update policy=read,write,test start-date=2019-06-01 start-time=02:31:50add disabled=yes interval=2m name="ISP-check using script IPS-reconnect" on-event=" /system script run ISP-reconnect" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2019-08-08 start-time=05:34:11add disabled=yes interval=0s name=static_dns_entries_script on-event="" policy=read,write,policy,test,password,sensitive,romon start-time=startup/system upgrade mirrorset check-interval=1d enabled=no primary-server=0.0.0.0 secondary-server=0.0.0.0 user=""/system watchdogset auto-send-supout=no automatic-supout=yes ping-start-after-boot=5m ping-timeout=1m watch-address=none watchdog-timer=yes/tool bandwidth-serverset allocate-udp-ports-from=2000 authenticate=no enabled=yes max-sessions=100/tool graphingset page-refresh=300 store-every=5min/tool graphing interfaceadd allow-address=0.0.0.0/0 disabled=no interface=all store-on-disk=yesadd allow-address=0.0.0.0/0 disabled=no interface=eth1-wan store-on-disk=yes/tool mac-serverset allowed-interface-list=all/tool mac-server mac-winboxset allowed-interface-list=all/tool mac-server pingset enabled=yesStatistics: Posted by slaz — Mon Apr 01, 2024 6:32 pm