[XXX@XXX] > export
# dec/20/2019 14:46:47 by RouterOS 6.44.6
# software id = X83V-A1WJ
#
# model = RB941-2nD
# serial number = A1C3099580F1
/interface bridge
add admin-mac=B8:69:F4:8F:C0:F3 arp=proxy-arp auto-mac=no comment=defconf name=bridge
add arp=proxy-arp mtu=1500 name=bridge-name
/interface ethernet
set [ find default-name=ether1 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether2 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether3 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full arp=proxy-arp
set [ find default-name=ether4 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface pptp-server
add name=pptp-in1 user=ppp-name
/interface eoip
add arp=proxy-arp mac-address=02:5B:A9:C3:D6:BC name=eoip-leont remote-address=172.20.88.7 tunnel-id=1547
add mac-address=02:C9:B9:83:DB:A4 name=eoip-name remote-address=172.20.2.135 tunnel-id=2355
/interface vlan
add arp=proxy-arp disabled=yes interface=ether3 name=vlan1 use-service-tag=yes vlan-id=1478
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=openvpn ranges=172.20.19.2-172.20.19.254
add name=name ranges=172.20.18.2-172.20.18.254
add name=name ranges=172.20.17.2-172.20.17.254
add name=XXXserv ranges=172.20.16.0/24
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/ppp profile
add change-tcp-mss=yes local-address=172.20.88.6 name=profile1 remote-address=172.20.88.7 use-encryption=yes
add local-address=172.20.19.1 name=openvpn remote-address=openvpn
add bridge=bridge dns-server=172.20.2.200 local-address=172.20.18.1 name=name remote-address=name
add bridge=bridge dns-server=172.20.2.200 local-address=172.20.17.1 name=name remote-address=name
add bridge=bridge dns-server=172.20.2.200 local-address=172.20.16.1 name=name remote-address=172.20.16.2
/system logging action
add name=ppp target=memory
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge-name comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge-name interface=vlan1
add bridge=bridge-name interface=eoip-leont
add bridge=bridge-name interface=eoip-name
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=bridge-name list=LAN
/interface ovpn-server server
set certificate=mikrot.crt_0 cipher=blowfish128,aes128,aes256 default-profile=name enabled=yes mode=ethernet require-client-certificate=\
    yes
/interface pptp-server server
set enabled=yes
/ip address
add address=172.20.2.1/24 comment=defconf interface=bridge network=172.20.2.0
add address=91.xxx.xxx.xx/24 interface=ether1 network=91.xxx.xxx.0
/ip dhcp-client
add add-default-route=no comment=defconf dhcp-options=hostname,clientid interface=bridge use-peer-dns=no
add add-default-route=no dhcp-options=hostname,clientid disabled=no interface=bridge-name
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=172.20.2.200
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=forward dst-address=172.20.2.0/24 log-prefix=ppp src-address=192.168.1.0/24
add action=accept chain=forward dst-address=192.168.1.0/24 log-prefix=ppp src-address=172.20.2.0/24
add action=accept chain=input protocol=gre
add action=accept chain=input dst-port=1723 protocol=tcp
add action=accept chain=input dst-port=8291 protocol=tcp
add action=accept chain=input dst-port=1194 in-interface=ether1 protocol=tcp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid

add action=accept chain=input comment="defconf: accept ICMP" disabled=yes protocol=icmp
add action=accept chain=forward dst-address=172.20.2.200 src-address=172.20.17.0/24
add action=accept chain=forward dst-address=172.20.2.4 src-address=172.20.17.0/24
add action=drop chain=forward src-address=172.20.17.0/24
add action=accept chain=forward connection-state=new
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new \
    in-interface-list=WAN
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=input src-address=172.20.19.0/24
add action=accept chain=forward src-address=172.20.18.0/24
add action=accept chain=forward src-address=172.20.16.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=6100-6115 in-interface=ether1 protocol=tcp to-addresses=172.20.2.172 to-ports=6100-6115
add action=dst-nat chain=dstnat dst-port=6100-6115 in-interface=ether1 protocol=udp to-addresses=172.20.2.172 to-ports=6100-6115
add action=dst-nat chain=dstnat disabled=yes dst-port=1723 protocol=tcp to-addresses=172.20.2.172 to-ports=1723
add action=dst-nat chain=dstnat disabled=yes protocol=gre to-addresses=172.20.2.172
add action=dst-nat chain=dstnat disabled=yes dst-port=5173 protocol=tcp to-addresses=172.20.2.200 to-ports=3389
add action=dst-nat chain=dstnat disabled=yes dst-port=5171 protocol=tcp to-addresses=172.20.2.171 to-ports=3389
add action=dst-nat chain=dstnat disabled=yes dst-port=5143 protocol=tcp to-addresses=172.20.2.143 to-ports=3389
add action=dst-nat chain=dstnat disabled=yes dst-port=5156 protocol=tcp to-addresses=172.20.2.156 to-ports=3389
add action=dst-nat chain=dstnat disabled=yes dst-port=5109 protocol=tcp to-addresses=172.20.2.109 to-ports=3389
/ip route
add check-gateway=arp distance=1 gateway=91.151.186.1
add check-gateway=arp disabled=yes distance=1 dst-address=192.168.1.0/24 gateway=172.20.2.172
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set forwarding-enabled=remote
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=ether1 type=external
add interface=bridge type=internal
/ppp secret
add local-address=172.20.2.6 name=XXX password=XXX1993lzs4 remote-address=172.20.2.7 routes=172.20.2.200 service=pptp
add name=ppp-name password=3asd profile=profile1 service=pptp
add name=XXXvpn password=sdfgfdh1993 profile=openvpn service=ovpn
add name=name password=password profile=name routes=172.20.18.1 service=ovpn
add name=name password="password" profile=name routes=172.20.17.1 service=ovpn
add local-address=172.20.16.1 name=name password="password" profile=name remote-address=172.20.16.2 service=ovpn
/snmp
set contact=XXX@XXXab.ru enabled=yes location=Server trap-version=2
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system identity
set name=XXX
/system logging
add action=ppp prefix=ppp
/system ntp client
set enabled=yes primary-ntp=194.190.168.1 secondary-ntp=195.122.241.236 server-dns-names=8.8.8.8
/system package update
set channel=long-term
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool netwatch
add host=172.20.2.200 interval=10s
add host=172.20.2.4 interval=10s
add host=91.151.186.1 interval=10s

/tool sniffer
set filter-ip-protocol=icmp