[admin@MikroTik] > /export
# dec/22/2020 11:17:19 by RouterOS 6.47.8
# software id = NT5E-IRVY
#
# model = RB952Ui-5ac2nD
# serial number = 
/interface bridge
add name=bridge
/interface ethernet
set [ find default-name=ether2 ] loop-protect=on
set [ find default-name=ether4 ] loop-protect=on
set [ find default-name=ether5 ] poe-out=off
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik station-roaming=enabled
set [ find default-name=wlan2 ] ssid=MikroTik station-roaming=enabled
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,passw\
    ord,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip dhcp-client
add disabled=no interface=bridge
/system clock
set time-zone-name=Europe/Moscow

[admin@MikroTik] > /export
# dec/22/2020 11:32:08 by RouterOS 6.47.8
# software id = 1XDY-BCKJ
#
# model = RB951Ui-2nD
# serial number = 
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether2 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface l2tp-client
add allow=mschap2 allow-fast-path=yes connect-to= disabled=no ipsec-secret= name=\
    l2tp-out1 password= use-ipsec=yes user=
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=default-dhcp ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/port
set 0 name=usb1
/interface ppp-client
add apn=internet comment=LTE dial-on-demand=no disabled=no info-channel=1 name=lte port=usb1
/system logging action
set 0 memory-lines=100
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=*1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=WAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte list=WAN
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=192.168.1.0
/ip arp
add address=192.168.1.56 comment="\DF\EA\F3\E1\EE\E2" interface=bridge mac-address=E0:CB:4E:0F:D8:E6
add address=192.168.1.84 comment="\C2\E8\E4\E5\EE\F1\E5\F0\E2\E5\F0" interface=bridge mac-address=90:2B:34:23:C8:69
add address=192.168.1.50 comment=Synology interface=bridge mac-address=00:11:32:2C:A7:85
add address=192.168.1.2 comment="\D1\E2\E8\F2\F7" interface=bridge mac-address=EC:CD:6D:21:11:1A
add address=192.168.1.34 comment="\D9\E5\F0\E1\E0\EA\EE\E2" interface=bridge mac-address=40:B0:76:52:28:50
add address=192.168.1.35 comment="HP \F1\E5\F0\E2\E5\F0" interface=bridge mac-address=00:1E:0B:AA:D0:F9
add address=192.168.1.36 comment="\CA\F3\E7\FC\EC\E8\ED" interface=bridge mac-address=50:46:5D:70:3B:16
add address=192.168.1.37 comment="Ubuntu \F1\E5\F0\E2\E5\F0" interface=bridge mac-address=00:15:58:48:E4:F2
add address=192.168.1.38 comment="\D0\EE\F3\F2\E5\F0 \F3 \ED\E0\F7\E0\EB\FC\F1\F2\E2\E0" interface=bridge mac-address=\
    1C:AF:F7:1D:C3:27
add address=192.168.1.39 comment="\C0\D3\C3\CF\D2" interface=bridge mac-address=7C:8B:CA:58:39:2B
add address=192.168.1.40 comment="\DD\EB\E5\EA\F2\F0\E8\EA\E8" interface=bridge mac-address=00:26:18:C5:9C:7A
add address=192.168.1.41 comment="\D0\E0\E4\F7\E5\ED\EA\EE" interface=bridge mac-address=00:23:81:1D:40:F5
add address=192.168.1.43 comment="\CF\EB\EE\F2\ED\E8\EA\E8" interface=bridge mac-address=30:B5:C2:6F:82:F3
add address=192.168.1.44 comment="\D9\E5\F0\E1\E0\EA\EE\E2" interface=bridge mac-address=98:EE:CB:93:54:1A
add address=192.168.1.45 comment="\CA\C4\CF" interface=bridge mac-address=50:46:5D:6F:88:86
add address=192.168.1.46 comment="\CF\F0\E8\ED\F2\E5\F0 HP" interface=bridge mac-address=F4:39:09:F7:FA:DF
add address=192.168.1.33 comment="\CF\EE\EF\EE\E2" interface=bridge mac-address=60:A4:4C:3D:0B:02
add address=192.168.1.51 comment="\CF\F0\E8\ED\F2\E5\F0 \F3 \DF\EA\F3\E1\EE\E2\E0" interface=bridge mac-address=00:23:54:21:D5:1A
add address=192.168.1.15 comment=MOXA interface=bridge mac-address=00:90:E8:09:A6:26
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes
/ip dns static

add address=192.168.88.1 name=router.lan
add address=192.168.1.84 name=trueconf.lan
add address=192.168.1.46 name=printer.lan
/ip firewall address-list
add address=bt2.t-ru.org list=rkn
add address=kino.pub list=rkn
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=drop chain=input comment="defconf: accept ICMP" disabled=yes in-interface=lte protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
    established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=drop chain=input disabled=yes in-interface=lte
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list=rkn new-routing-mark=rkn_mark passthrough=yes src-address=192.168.1.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface=lte
/ip route
add distance=1 gateway=l2tp-out1 routing-mark=rkn_mark
add distance=1 dst-address=10.10.10.0/24 gateway=l2tp-out1
add distance=1 dst-address=192.168.88.0/24 gateway=l2tp-out1
add distance=1 dst-address=192.168.100.0/24 gateway=l2tp-out1
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip upnp interfaces
add interface=bridge type=internal
/system clock
set time-zone-name=Europe/Moscow
/system routerboard settings
set cpu-frequency=750MHz
/tool graphing interface
add store-on-disk=no
/tool graphing resource
add store-on-disk=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool netwatch
add comment="\D0\E5\F1\F2\E0\F0\F2 \EC\EE\E4\E5\EC\E0" disabled=yes down-script="/system routerboard usb power-reset duration=5s" \
    host=8.8.8.8 timeout=5s
/tool sms
set channel=2 port=usb1
/tool traffic-monitor
add interface=ether1 name=tmon1 threshold=0 traffic=received
[admin@MikroTik] >