#              model: 433
#      serial-number: 20A9019A82B0
#      firmware-type: ar7100
#   current-firmware: 6.47.8
#   installed-version: 6.49.6
# Flags: U - undoable, R - redoable, F - floating-undo 
#   ACTION                                   BY               POLICY             
# U user mentes added                        admin            write              
#                                                             policy             
# U user group backup added                  admin            write              
#                                                             policy             
# 
# software id = KEXQ-43JF
#
# model = 433
# serial number = 20A9019A82B0
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode antenna-mode=ant-b basic-rates-a/g="" comment=AGYAGOSSZERGENY country=no_country_set disabled=no frequency=5805 frequency-mode=superchannel mode=bridge nv2-preshared-key=dsjnf999 nv2-security=enabled radio-name=Kapuvar scan-list=5000-6000 ssid=RLAN_KAAG station-roaming=enabled supported-rates-a/g="" supported-rates-b=1Mbps,2Mbps tx-power=22 tx-power-mode=card-rates wireless-protocol=nv2-nstreme
set [ find default-name=wlan2 ] adaptive-noise-immunity=ap-and-client-mode comment=VITNYED country=no_country_set disabled=no frequency=5500 frequency-mode=superchannel mode=bridge nv2-preshared-key=dsjnf999 nv2-security=enabled scan-list=5000-6000 ssid=KV station-roaming=enabled wireless-protocol=nv2
/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=ether1 ] comment=UPLINK speed=10Mbps
set [ find default-name=ether2 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether3 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface wireless nstreme
set wlan1 comment=AGYAGOSSZERGENY enable-nstreme=yes framer-policy=best-fit
set wlan2 comment=VITNYED enable-nstreme=yes framer-policy=best-fit
/interface wireless manual-tx-power-table
set wlan1 comment=AGYAGOSSZERGENY
set wlan2 comment=VITNYED
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/queue simple
add limit-at=512k/2M max-limit=512k/2M name="VITNYED HOTSPOT" target=86.109.66.254/32
add limit-at=30M/30M max-limit=30M/30M name="GG CSAPOD" target=86.109.64.202/32
add limit-at=15M/15M max-limit=15M/15M name="DOLOMIT SZARFOLD" target=86.109.67.230/32
add limit-at=30M/30M max-limit=30M/30M name="ONKORMANYZAT CSAPOD" target=86.109.66.30/32
add limit-at=30M/30M max-limit=30M/30M name="PATONAI Kapuvar " target=86.109.68.112/29
add limit-at=5M/5M max-limit=5M/5M name="INFRAHAUS Kapuvar" target=86.109.66.10/32
/routing ospf instance
set [ find default=yes ] redistribute-connected=as-type-1 redistribute-static=as-type-1
/snmp community
set [ find default=yes ] addresses=86.109.64.0/27,10.0.0.2/32
add addresses=86.109.64.0/27,10.0.0.2/32 name=partnerlogin
/system logging action
set 3 remote=86.109.64.16
/user group
add name=backup policy="ssh,read,sensitive,!local,!telnet,!ftp,!reboot,!write,!policy,!test,!winbox,!password,!web,!sniff,!api,!romon,!dude,!tikapp"
#error exporting /interface bridge calea
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=wlan2
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
/ip neighbor discovery-settings
set discover-interface-list=all
/ip address
add address=10.96.50.10/24 interface=ether2 network=10.96.50.0
/ip dns
set servers=86.109.64.5,193.194.159.224
#error exporting /ip firewall calea
/ip firewall filter
add action=accept chain=input dst-port=21-23 protocol=tcp src-address=86.109.64.0/19
add action=accept chain=input dst-port=21-23 protocol=tcp src-address=10.0.0.0/8
add action=drop chain=input dst-port=21-23 protocol=tcp
add action=accept chain=input comment="==== Estabilished csomagok engedelyezese" connection-state=established
add action=accept chain=input comment="==== Related csomagok engedelyezese" connection-state=related
add action=accept chain=input comment="==== UDP engedelyezese" protocol=udp
add action=drop chain=input comment="==== Invalid csomagok eldobalasa" connection-state=invalid
add action=accept chain=input comment="==== Ping engedelyezese" protocol=icmp
add action=accept chain=input comment="==== SSH engedelyezese" dst-port=22 protocol=tcp
add action=accept chain=input comment="==== HTTP engedelyezese" dst-port=80 protocol=tcp
add action=accept chain=input comment="==== Winbox engedelyezese" dst-port=8291 protocol=tcp
add action=accept chain=input comment="==== Sajat IP-k engedelyezese" src-address=86.109.64.0/19
add action=accept chain=input comment="==== Sajat IP-k engedelyezese" dst-limit=0,5,dst-address/1m40s src-address=10.0.0.0/8
add action=log chain=input comment="==== Minden mas logolasa" disabled=yes log-prefix=drop
add action=drop chain=input comment="==== Minden mas eldobalasa"
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward comment="TARTOZOK POP3 atengedese mail.rlan.hu-ra" connection-mark=tartozo dst-address=86.109.64.10 dst-port=110 protocol=tcp
add action=accept chain=forward comment="TARTOZOK DNS atengedese" connection-mark=tartozo dst-port=53 protocol=udp
add action=accept chain=forward comment="TARTOZOK WEB atengedese NAT-hoz" connection-mark=tartozo dst-port=80 protocol=tcp
add action=accept chain=forward comment="TARTOZOK PROXY atengedese NAT-hoz" connection-mark=tartozo dst-port=3128 protocol=tcp
add action=drop chain=forward comment="TARTOZOK Minden eldobalasa" connection-mark=tartozo src-address=192.168.227.0/24
/ip firewall mangle
add action=change-dscp chain=prerouting new-dscp=4 src-address=86.109.64.18
add action=change-dscp chain=prerouting dst-address=86.109.64.18 new-dscp=4
add action=change-mss chain=forward comment="TCP MSS beallitas" new-mss=1440 protocol=tcp tcp-flags=syn tcp-mss=!536-1460
add action=change-mss chain=forward comment="TCP MSS beallitas" new-mss=1440 protocol=tcp tcp-flags=syn tcp-mss=1453-65535
add action=change-mss chain=forward comment="TCP MSS beallitas" new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
add action=mark-connection chain=prerouting comment="Tartozok megjelolese" new-connection-mark=tartozo passthrough=yes src-address=192.168.227.0/24
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes dst-address=10.96.52.0/24 src-address=10.0.0.0/24
add action=netmap chain=dstnat comment="TARTOZOK WEB atiranyitas" connection-mark=tartozo dst-port=80 protocol=tcp to-addresses=86.109.64.19 to-ports=80
add action=netmap chain=dstnat comment="TARTOZOK proxy atiranyitas" connection-mark=tartozo dst-port=3128 protocol=tcp to-addresses=86.109.64.19 to-ports=80
add action=masquerade chain=srcnat comment="csapod aramszunetfigyelo" dst-address=10.96.53.28 src-address=10.0.0.0/24
add action=masquerade chain=srcnat src-address=10.96.51.0/24
add action=dst-nat chain=dstnat disabled=yes dst-address=86.109.64.150 dst-port=80 protocol=tcp to-addresses=10.96.50.40
add action=dst-nat chain=dstnat disabled=yes dst-address=86.109.64.150 dst-port=443 protocol=tcp to-addresses=10.96.50.40
/ip route
add check-gateway=ping distance=250 gateway=10.96.50.1
/ip service
set www address=86.109.64.20/32
set api address=86.109.64.0/27
set api-ssl address=86.109.64.0/27
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ppp aaa
set interim-update=5m
/ppp profile
set *0 dns-server=86.109.64.5,193.194.159.224 local-address=86.109.64.227 only-one=yes rate-limit=64k remote-address=*2 use-upnp=no
/radius incoming
set port=1700
/snmp
set contact=admin@rlan.hu enabled=yes location=Kapuvar
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Budapest
/system identity
set name=gw-kapuvar2
/system logging
add action=remote topics=info
add action=remote topics=critical
add action=remote topics=warning
add action=remote topics=error
/system ntp client
set enabled=yes primary-ntp=86.109.64.5
/system scheduler
add interval=6d name=mentes on-event=mentes policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=dec/27/2017 start-time=17:55:37
/system script
add dont-require-permissions=no name=mentes owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/export file=export\r\n/tool e-mail send from=\"backup@rlan.hu\" to=\"backup@rlan.hu\" subject=([/system identity get name] . \" export\") file=export.rsc\r\n/system backup save name=backup\r\n/tool e-mail send from=\"backup@rlan.hu\" to=\"backup@rlan.hu\" subject=([/system identity get name] . \" Backup\") file=backup.backup\r\n"
/system watchdog
set ping-start-after-boot=55m watch-address=10.96.50.4
/tool e-mail
set address=86.109.64.10 from=gw-kapuvar2@magicnet.hu
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add