#                   version: 7.14.2 (stable)
#          factory-software: 6.45.9
#              total-memory: 1024.0MiB
#                       cpu: ARM
#                 cpu-count: 2
#           total-hdd-space: 128.0MiB
#         architecture-name: arm
#                board-name: RB3011UiAS
#                  platform: MikroTik
#   installed-version: 7.14.2
# 
# software id = A2UW-QXS8
#
# model = RB3011UiAS
# serial number = HCB08EEMEXS
/interface bridge
add name=LAN port-cost-mode=short
add name=WAN
/interface ethernet
set [ find default-name=ether1 ] name="ether1-REDUNDANCIA MIMOSA"
set [ find default-name=ether2 ] name=ether2-ONU-Vsol
set [ find default-name=ether3 ] name=ether3-Sectorial1-203
set [ find default-name=ether4 ] name=ether4-Sectorial2-204
set [ find default-name=ether5 ] name=ether5-Sectorial3-205
set [ find default-name=ether6 ] disabled=yes name="ether6 - Vecina Rosa Sebastian"
set [ find default-name=ether7 ] name=ether7-TP_LINKcasa
set [ find default-name=ether8 ] name="ether8 Camaras"
set [ find default-name=ether9 ] disabled=yes name="ether9 - Vecina Guadalupe Avil\E9s"
set [ find default-name=sfp1 ] name=sfp1-SNMARTINTOLTEPEC
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1 private-key="CMsooz4p5OgA1co38/GDRwiKfUWhdN4rvtypzKB4Znc="
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/ip pool
add name=dhcp_pool1 ranges=192.168.10.240-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=LAN lease-time=10m name=dhcp1
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
/snmp community
add addresses=::/0 name="{\$SNMP_SOMNET}"
/system logging action
add bsd-syslog=yes name=GrafanaLoki remote=172.20.0.254 remote-port=1514 src-address=172.20.1.96 target=remote
/interface bridge port
add bridge=LAN interface=ether3-Sectorial1-203
add bridge=LAN interface=ether4-Sectorial2-204
add bridge=LAN interface=ether5-Sectorial3-205
add bridge=LAN interface="ether6 - Vecina Rosa Sebastian"
add bridge=LAN interface=ether7-TP_LINKcasa
add bridge=WAN interface=ether2-ONU-Vsol
add bridge=LAN interface=ether10
add bridge=LAN interface="ether8 Camaras"
add bridge=WAN interface=sfp1-SNMARTINTOLTEPEC
add bridge=WAN interface="ether1-REDUNDANCIA MIMOSA"
add bridge=LAN interface="ether9 - Vecina Guadalupe Avil\E9s"
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=all
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface bridge vlan
add bridge=*D tagged="ether6 - Vecina Rosa Sebastian,ether9 - Vecina Guadalupe Avil\E9s" untagged="ether1-REDUNDANCIA MIMOSA,ether2-ONU-Vsol,ether3-Sectorial1-203,ether4-Sectorial2-204,ether5-Sectorial3-205,ether7-TP_LINKcasa,ether8 Camaras,ether10,sfp1-SNMARTINTOLTEPEC" vlan-ids=1
add bridge=*D tagged="ether1-REDUNDANCIA MIMOSA,ether2-ONU-Vsol,ether4-Sectorial2-204,ether3-Sectorial1-203,ether5-Sectorial3-205,sfp1-SNMARTINTOLTEPEC" untagged="ether6 - Vecina Rosa Sebastian,ether9 - Vecina Guadalupe Avil\E9s" vlan-ids=11
add bridge=*D tagged="ether1-REDUNDANCIA MIMOSA,sfp1-SNMARTINTOLTEPEC" untagged="ether6 - Vecina Rosa Sebastian,ether9 - Vecina Guadalupe Avil\E9s" vlan-ids=111
/interface l2tp-server server
set authentication=mschap2 enabled=yes ipsec-secret="AR4(n!9a" use-ipsec=required
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=172.20.1.96/16 comment="IP ADMIN SOMNET" interface=WAN network=172.20.0.0
add address=192.168.10.1/24 comment=LAN interface=LAN network=192.168.10.0
add address=38.58.38.29/24 comment="ASN Somnet" interface=WAN network=38.58.38.0
/ip dhcp-client
# DHCP client can not run on slave or passthrough interface!
add add-default-route=no interface=ether2-ONU-Vsol
/ip dhcp-server lease
add address=192.168.10.253 client-id=1:90:9a:4a:e3:73:61 mac-address=90:9A:4A:E3:73:61 server=dhcp1
add address=192.168.10.251 client-id=1:60:22:32:c8:b7:3b mac-address=60:22:32:C8:B7:3B server=dhcp1
add address=192.168.10.250 client-id=1:a8:42:a1:c:d0:23 mac-address=A8:42:A1:0C:D0:23 server=dhcp1
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.10.1
/ip dns
set servers=1.1.1.2,1.0.0.2
/ip firewall filter
add action=accept chain=input comment=ucrm_accept_input disabled=yes src-address=10.8.1.140
add action=accept chain=forward comment=ucrm_accept_forward disabled=yes src-address=10.8.1.140
add action=jump chain=forward comment=ucrm_forward_first disabled=yes jump-target=ucrm_forward_first
add action=jump chain=forward comment=ucrm_forward_general disabled=yes jump-target=ucrm_forward_general
add action=jump chain=forward comment=ucrm_forward_drop disabled=yes jump-target=ucrm_forward_drop
add action=accept chain=ucrm_forward_general comment=ucrm_blocked_users_allow_dns disabled=yes dst-port=53 protocol=udp src-address-list=BLOCKED_USERS
add action=drop chain=ucrm_forward_drop comment=ucrm_blocked_users_drop disabled=yes dst-address=!10.8.1.140 src-address-list=BLOCKED_USERS
/ip firewall mangle
add action=accept chain=input dst-port=1701,500,4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN
add action=jump chain=dstnat comment=ucrm_first_dstnat disabled=yes jump-target=ucrm_first_dstnat
add action=jump chain=dstnat comment=ucrm_general_dstnat disabled=yes jump-target=ucrm_general_dstnat
add action=jump chain=dstnat comment=ucrm_last_dstnat disabled=yes jump-target=ucrm_last_dstnat
add action=jump chain=srcnat comment=ucrm_first_srcnat disabled=yes jump-target=ucrm_first_srcnat
add action=jump chain=srcnat comment=ucrm_general_srcnat disabled=yes jump-target=ucrm_general_srcnat
add action=jump chain=srcnat comment=ucrm_range_srcnat disabled=yes jump-target=ucrm_range_srcnat
add action=jump chain=srcnat comment=ucrm_last_srcnat disabled=yes jump-target=ucrm_last_srcnat
add action=dst-nat chain=ucrm_first_dstnat comment=ucrm_blocked_user_redirect disabled=yes dst-port=80 protocol=tcp src-address-list=BLOCKED_USERS to-addresses=10.8.1.140 to-ports=10443
/ip route
add check-gateway=ping disabled=no distance=20 dst-address=0.0.0.0/0 gateway=172.20.1.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="ASN Somnet" disabled=no distance=5 dst-address=0.0.0.0/0 gateway=38.58.38.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=8080
set ssh port=46825
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/ppp secret
add local-address=192.168.254.1 name=aalegria password="AR4(n!9a" remote-address=192.168.254.6 service=l2tp
/radius
add address=172.20.6.1 secret=Fr3eR4d!u5 service=login src-address=172.20.1.96
/routing bfd configuration
add disabled=no
/snmp
set contact="SOMNET DE MEXICO SA DE CV" enabled=yes location="TOLUCA DE LERDO" trap-community="{\$SNMP_SOMNET}" trap-interfaces=all trap-version=2
/system clock
set time-zone-name=America/Mexico_City
/system identity
set name=RT-PASEOS-SANMARTIN
/system logging
add action=GrafanaLoki prefix=172.20.1.96 topics=critical
add action=GrafanaLoki prefix=172.20.1.96 topics=error
add action=GrafanaLoki prefix=172.20.1.96 topics=info
add action=GrafanaLoki prefix=172.20.1.96 topics=warning
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.mx.pool.ntp.org
add address=1.mx.pool.ntp.org
/tool graphing interface
add
/tool graphing resource
add
/tool sniffer
set file-name=MLAF.cap filter-direction=rx filter-interface=ether2-ONU-Vsol
/user aaa
set default-group=full use-radius=yes