# Mikrotik FW 6.35.4+
:global samberiNum 23
:global ipLoopback "10.30.0.$samberiNum"

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
    disabled=yes distance=indoors frequency=auto mode=ap-bridge wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether5 ] name=ether5-local
/interface bridge
add name=bridge0-lo disabled=no auto-mac=no protocol-mode=none;
add name=bridge1-local disabled=no auto-mac=no protocol-mode=rstp \
    admin-mac=[/interface ethernet get "ether5-local" mac-address];
/interface bridge port 
add bridge=bridge1-local interface=ether5-local;
add bridge=bridge1-local interface=wlan1;

/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des

/ip address
add address=$ipLoopback interface=bridge0-lo comment="Loopback";
add address="10.47.$samberiNum.254/24" interface=bridge1-local comment="Switches - VLAN1";

/routing ospf instance
set [ find default=yes ] redistribute-other-ospf=as-type-1 router-id=$ipLoopback
add name="ospf$samberiNum" router-id=$ipLoopback
/routing ospf area
add area-id="0.0.0.$samberiNum" default-cost=1 inject-summary-lsas=no instance="ospf$samberiNum" name="s$samberiNum" type=stub
/routing ospf interface
add interface=bridge0-lo network-type=broadcast passive=yes cost=1
add interface=bridge1-local network-type=broadcast cost=1
/routing ospf network
add area=backbone network=$ipLoopback
add area=backbone network="10.47.$samberiNum.0/24"

/ip firewall address-list
add address="10.40.$samberiNum.0/24" list="Local_subnets"
add address="10.41.$samberiNum.0/24" list="Local_subnets"
add address="10.42.$samberiNum.0/24" list="Local_subnets"
add address="10.43.$samberiNum.0/24" list="Local_subnets"
add address="10.44.$samberiNum.0/24" list="Local_subnets"
add address="10.45.$samberiNum.0/24" list="Local_subnets"
add address="10.46.$samberiNum.0/24" list="Local_subnets"
add address="10.47.$samberiNum.0/24" list="Local_subnets"
add address="10.48.$samberiNum.0/24" list="Local_subnets"
add address="10.49.$samberiNum.0/24" list="Local_subnets"
add address="10.50.$samberiNum.0/24" list="Local_subnets"
add address="10.51.$samberiNum.0/24" list="Local_subnets"
add address="10.52.$samberiNum.0/24" list="Local_subnets"
add address=10.1.4.252 list="Allow 1C Server Protocol"
add address=192.168.32.10 list="Allow 1C Server Protocol" comment="account"
add address=10.21.11.44 list="Allow 1C Server Protocol" comment="dionis"
add address=10.21.11.21 list="Allow 1C Server Protocol" comment="rn-bd01"
add address="10.40.$samberiNum.6" comment="s$samberiNum-az01" list=Allow_Inet
/ip firewall filter
add chain=input action=accept protocol=icmp
add chain=input action=accept connection-state=established,related
add chain=input action=accept protocol=tcp dst-port=8291
add chain=input action=accept protocol=ospf
add chain=input action=accept protocol=gre
add chain=input action=drop in-interface=ether1
/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade
/ip firewall filter
add action=fasttrack-connection chain=forward comment="default configuration" connection-state=established,related
add chain=forward comment="default configuration" connection-state=established,related
add action=drop chain=forward comment="default configuration" connection-state=invalid
add action=drop chain=forward comment="default configuration" connection-nat-state=!dstnat connection-state=new in-interface=ether1-gateway
add chain=forward action=accept protocol=icmp comment="Ping"
add chain=forward action=accept protocol=tcp dst-port=53 comment="DNS"
add chain=forward action=accept protocol=udp dst-port=53
add chain=forward action=accept protocol=udp dst-port=123 comment="NTP"
add chain=forward action=accept protocol=tcp dst-port=3389 comment="RDP"
add chain=forward action=accept protocol=tcp port=1540,1541,1640,1641 src-address-list="Allow 1C Server Protocol" comment="Block 1C - allow DB Admin"
add chain=forward action=accept protocol=tcp port=1540,1541,1640,1641 dst-address-list="Allow 1C Server Protocol" comment="Block 1C - allow DB Admin"
add chain=forward action=drop protocol=tcp port=1540,1541,1640,1641 comment="Block 1C"
add chain=forward action=accept protocol=tcp dst-port=666,667,670,2800,2805,2905,5100 out-interface=ether1 comment="Sberbank beznal"
add chain=forward comment="Allow Inet for some users" out-interface=ether1 src-address-list=Allow_Inet
add chain=forward comment="diadoc-api.kontur.ru" dst-port=21 protocol=tcp src-address="10.40.$samberiNum.5"
# !!! must set src-address to the ip of proxy (10.7.7.x) !!!
add chain=forward action=accept disabled=yes protocol=tcp dst-port=21,80,443,8080 out-interface=ether1 comment="Allow Inet from Local only via proxy"
add chain=forward action=drop disabled=yes protocol=tcp dst-port=21,80,443,8080 in-interface=bridge1-local out-interface=ether1
add chain=forward action=drop p2p=all-p2p in-interface=bridge1-local out-interface=ether1 comment="Drop P2P"
add chain=forward action=accept src-address-list="Local_subnets" in-interface=bridge1-local out-interface=ether1 comment="Allow Inet from Local"
add chain=forward action=drop out-interface=ether1 comment="Drop Inet from the rest"

/system identity
set name="Mikrotik-S$samberiNum";
/snmp
set enabled=yes trap-interfaces=all
/system clock
set time-zone-name="Asia/Vladivostok"
/system leds
set 0 interface=wlan1
/system logging
add action=echo topics=ospf,error
/system ntp client
set enabled=yes primary-ntp="10.40.$samberiNum.1" secondary-ntp="10.40.$samberiNum.2"
/ip dns
set allow-remote-requests=yes servers="10.40.$samberiNum.1,10.40.$samberiNum.2"

/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether5-local
add interface=wlan1
add interface=bridge1-local
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether5-local
add interface=wlan1
add interface=bridge1-local
/ip neighbor discovery
set "ether1" discover=no
set "ether2" discover=no
set "ether3" discover=no
set "ether4" discover=no

/system scheduler
add interval=1w name=backup+export_conf on-event=backup+export_conf policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    dec/28/2015 start-time=04:31:32
/system script
add name=backup+export_conf owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":global\
    \_thisdate [/system clock get date]\r\
    \n:global filenamestring ([/system identity get name].\"_\".[:pick \$thisd\
    ate 7 11].\"-\".[:pick \$thisdate 0 3].\"-\".[:pick \$thisdate 4 6].\"_\".\
    [/system clock get time])\r\
    \n/system backup save name=\$filenamestring password=mikrotik\r\
    \n/export compact file=\$filenamestring hide-sensitive\r\
    \n/tool fetch address=rn-nas02.samberi.com src-path=(\$filenamestring.\".b\
    ackup\") mode=ftp user=ftp_mikrotik password=mikrotik upload=yes dst-path=\
    (\"/backup_mikrotik/\".\$filenamestring.\".backup\")\r\
    \n/tool fetch address=rn-nas02.samberi.com src-path=(\$filenamestring.\".r\
    sc\") mode=ftp user=ftp_mikrotik password=mikrotik upload=yes dst-path=(\"\
    /backup_mikrotik/\".\$filenamestring.\".rsc\")\r\
    \n/file remove (\$filenamestring.\".backup\")\r\
    \n/file remove (\$filenamestring.\".rsc\")"
