/interface bridge
add name=bridge1
add name=bridge2
/interface ethernet
set [ find default-name=combo1 ] advertise=\
    10M-full,100M-full,1000M-half,1000M-full,10000M-full,2500M-full,5000M-full
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1 ranges=192.168.88.10-192.168.88.254
add name=pool2 ranges=192.168.68.10-192.168.68.254
/ip dhcp-server
add address-pool=pool1 interface=bridge1 name=server1
add address-pool=pool2 interface=bridge2 name=server2
/port
set 0 name=serial0
set 1 name=serial1
/routing ospf instance
add disabled=yes name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/routing table
add disabled=no fib name=vpn
/interface bridge port
add bridge=bridge1 ingress-filtering=no interface=ether1
add bridge=bridge2 ingress-filtering=no interface=ether2
add bridge=bridge1 ingress-filtering=no interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=combo1 list=WAN
add interface=bridge1 list=LAN
add interface=wireguard1 list=WAN
add interface=bridge2 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=pl209.nordvpn.com endpoint-port=\
    51820 interface=wireguard1 persistent-keepalive=25s public-key=\
    "kjAOzXQRVGpmQdqE2zPsITH8QHmFK83AAPktqWed9wM="
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge1 network=\
    192.168.88.0
add address=192.168.68.1/24 interface=bridge2 network=192.168.68.0
/ip dhcp-client
add interface=combo1 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.68.0/24 dns-server=192.168.68.1 gateway=192.168.68.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=94.140.14.14,94.140.15.15 use-doh-server=\
    https://dns.adguard.com/dns-query
/ip dns static
add address=192.168.88.1 disabled=yes name=router.lan
add address=94.140.14.14 name=dns.adguard.com
add address=94.140.15.15 name=dns.adguard.com
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked log=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid log=yes
add action=accept chain=input comment="defconf: accept ICMP" log=yes protocol=\
    icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 log=\
    yes
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes log=yes
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN log=\
    yes
add action=accept chain=forward log=yes out-interface=wireguard1 src-address=\
    192.168.88.0/24
add action=accept chain=forward log=yes out-interface=bridge2 src-address=\
    192.168.68.0/24
/ip firewall nat
add action=masquerade chain=srcnat log=yes log-prefix=wg out-interface=\
    wireguard1
add action=masquerade chain=srcnat disabled=yes out-interface-list=WAN
add action=masquerade chain=srcnat log=yes log-prefix=no_vpn out-interface=\
    bridge2
/ip ipsec policy
set 0 disabled=yes
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wireguard1 pref-src=\
    0.0.0.0 routing-table=vpn scope=30 suppress-hw-offload=no target-scope=10
/ip upnp
set enabled=yes
/routing rule
add action=lookup disabled=yes dst-address=192.168.88.0/24 src-address=\
    192.168.88.0/24 table=main
add action=lookup disabled=no src-address=192.168.88.0/24 table=vpn
add action=lookup disabled=no src-address=192.168.68.0/24 table=main