# 2024-03-04 23:47:44 by RouterOS 7.14
#
#
#
/interface ethernet
set [ find default-name=ether1 ] comment="to ISP1"
set [ find default-name=ether2 ] comment="to ISP2"
set [ find default-name=ether3 ] comment="to ISP3"
set [ find default-name=ether4 ] comment="to LAN1"
set [ find default-name=ether5 ] comment="to LAN2"
set [ find default-name=sfp-sfpplus1 ] disabled=yes
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ac .frequency=5280-5380 \
    .skip-dfs-channels=disabled .width=20/40/80/160mhz \
    configuration.antenna-gain=3 .beacon-interval=100ms .chains=0,1,2,3 \
    .country=Russia .manager=local .mode=ap .ssid=26 .tx-chains=0,1,2,3 \
    security.authentication-types=wpa2-psk,wpa3-psk .management-protection=\
    required .wps=disable
/interface list
add comment="For Internet" name=WAN
add comment="For Local Area" name=LAN
/interface wifi channel
add band=5ghz-ax disabled=yes frequency=5280-5500 name=channel1 \
    skip-dfs-channels=disabled width=20/40/80/160mhz
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no management-protection=\
    required name=sec1 wps=disable
/interface wifi configuration
add beacon-interval=100ms chains=0,1,2,3 channel=channel1 channel.band=\
    5ghz-ax .frequency=5100-5500 .skip-dfs-channels=disabled .width=\
    20/40/80/160mhz country=Russia disabled=yes manager=local mode=ap name=\
    cfg1 security=sec1 security.authentication-types=wpa3-psk,owe,wpa3-eap \
    .disable-pmkid=no .ft=no .management-protection=required .wps=disable \
    ssid=26 tx-chains=0,1,2,3
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
set 1 name=serial1
/routing table
add disabled=no fib name=to_isp1
add disabled=no fib name=to_isp2
add disabled=no fib name=to_isp3
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=!WAN
/interface list member
add comment=ISP1 interface=ether1 list=WAN
add comment=ISP2 interface=ether2 list=WAN
add comment=ISP3 interface=ether3 list=WAN
add comment=LAN1 interface=ether4 list=LAN
add comment=LAN2 interface=ether5 list=LAN
add interface=ether6 list=LAN
/ip address
add address=192.168.88.254/24 comment="LAN1 IP" interface=ether4 network=\
    192.168.88.0
add address=172.16.1.0/23 comment="LAN2 IP" interface=ether5 network=\
    172.16.0.0
/ip dhcp-client
add add-default-route=no dhcp-options=clientid,clientid interface=ether2 \
    script=":if (\$bound=1) do={\r\
    \n   /ip route remove [ find gateway=\"4.2.2.2\" ]; /ip route remove [ fin\
    d where dst-address ~\"4.2.2.2\" ]\r\
    \n   /ip route add check-gateway=ping comment=\"For recursion via ISP2\" d\
    istance=1 dst-address=4.2.2.2/32 gateway=\$\"gateway-address\" scope=11\r\
    \n   /ip route add check-gateway=ping comment=\"Unmarked via ISP2\" distan\
    ce=2 gateway=4.2.2.2 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP2 Main\" distance=1 gateway=4.2\
    .2.2 routing-table=to_isp2 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP1 Backup2\" distance=2 gateway=\
    4.2.2.2 routing-table=to_isp1 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP3 Backup2\" distance=2 gateway=\
    4.2.2.2 routing-table=to_isp3 target-scope=11\r\
    \n   :if [:tobool ([/ip firewall/nat/ find comment=\"NAT via ISP2\"])] do=\
    {\r\
    \n   /ip firewall nat set [find comment=\"NAT via ISP2\"] action=src-nat c\
    hain=srcnat ipsec-policy=out,none out-interface=\$\"interface\" to-address\
    es=\$\"lease-address\" \r\
    \n    } else={/ip firewall nat add action=src-nat chain=srcnat ipsec-polic\
    y=out,none out-interface=\$\"interface\" to-addresses=\$\"lease-address\" \
    comment=\"NAT via ISP2\"}\r\
    \n    :if [:tobool ([/routing/rule find comment=\"From ISP2 IP to Inet\"])\
    ] do={\r\
    \n      /routing/rule/set [find comment=\"From ISP2 IP to Inet\"] action=l\
    ookup src-address=\$\"lease-address\" table=to_isp2\r\
    \n    } else={/routing/rule/add action=lookup comment=\"From ISP2 IP to In\
    et\" src-address=\$\"lease-address\" table=to_isp2 }\r\
    \n} else={\r\
    \n   /ip route remove [find gateway=\"4.2.2.2\"]; /ip route remove [find w\
    here dst-address ~\"4.2.2.2\"]\r\
    \n   /ip firewall nat remove  [find comment=\"NAT via ISP2\"]\r\
    \n   /routing/rule/remove [find comment=\"From ISP2 IP to Inet\"]\r\
    \n}\r\
    \n" use-peer-ntp=no
add add-default-route=no dhcp-options=clientid,clientid disabled=yes \
    interface=ether3 script=":if (\$bound=1) do={\r\
    \n   /ip route remove [ find gateway=\"4.2.2.3\" ]; /ip route remove [ fin\
    d where dst-address ~\"4.2.2.3\" ]\r\
    \n   /ip route add check-gateway=ping comment=\"For recursion via ISP3\" d\
    istance=1 dst-address=4.2.2.3/32 gateway=\$\"gateway-address\" scope=11\r\
    \n   /ip route add check-gateway=ping comment=\"Unmarked via ISP3\" distan\
    ce=3 gateway=4.2.2.3 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP3 Main\" distance=1 gateway=4.2\
    .2.3 routing-table=to_isp3 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP1 Backup3\" distance=3 gateway=\
    4.2.2.3 routing-table=to_isp1 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP2 Backup3\" distance=3 gateway=\
    4.2.2.3 routing-table=to_isp2 target-scope=11\r\
    \n   :if [:tobool ([/ip firewall/nat/ find comment=\"NAT via ISP3\"])] do=\
    {\r\
    \n   /ip firewall nat set [find comment=\"NAT via ISP3\"] action=src-nat c\
    hain=srcnat ipsec-policy=out,none out-interface=\$\"interface\" to-address\
    es=\$\"lease-address\" \r\
    \n    } else={/ip firewall nat add action=src-nat chain=srcnat ipsec-polic\
    y=out,none out-interface=\$\"interface\" to-addresses=\$\"lease-address\" \
    comment=\"NAT via ISP3\"}\r\
    \n    :if [:tobool ([/routing/rule find comment=\"From ISP3 IP to Inet\"])\
    ] do={\r\
    \n      /routing/rule/set [find comment=\"From ISP3 IP to Inet\"] action=l\
    ookup src-address=\$\"lease-address\" table=to_isp3\r\
    \n    } else={/routing/rule/add action=lookup comment=\"From ISP3 IP to In\
    et\" src-address=\$\"lease-address\" table=to_isp3 }\r\
    \n} else={\r\
    \n   /ip route remove [find gateway=\"4.2.2.3\"]; /ip route remove [find w\
    here dst-address ~\"4.2.2.3\"]\r\
    \n   /ip firewall nat remove  [find comment=\"NAT via ISP3\"]\r\
    \n   /routing/rule/remove [find comment=\"From ISP3 IP to Inet\"]\r\
    \n}\r\
    \n" use-peer-ntp=no
add add-default-route=no dhcp-options=clientid,clientid disabled=yes \
    interface=ether1 script=":if (\$bound=1) do={\r\
    \n   /ip route remove [ find gateway=\"4.2.2.1\" ]; /ip route remove [ fin\
    d where dst-address ~\"4.2.2.1\" ]\r\
    \n   /ip route add check-gateway=ping comment=\"For recursion via ISP1\" d\
    istance=1 dst-address=4.2.2.1/32 gateway=\$\"gateway-address\" scope=11\r\
    \n   /ip route add check-gateway=ping comment=\"Unmarked via ISP1\" distan\
    ce=1 gateway=4.2.2.1 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP1 Main\" distance=1 gateway=4.2\
    .2.1 routing-table=to_isp1 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP2 Backup1\" distance=3 gateway=\
    4.2.2.1 routing-table=to_isp2 target-scope=11\r\
    \n   /ip route add comment=\"Marked via ISP3 Backup1\" distance=3 gateway=\
    4.2.2.1 routing-table=to_isp3 target-scope=11\r\
    \n   :if [:tobool ([/ip firewall/nat/ find comment=\"NAT via ISP1\"])] do=\
    {\r\
    \n   /ip firewall nat set [find comment=\"NAT via ISP1\"] action=src-nat c\
    hain=srcnat ipsec-policy=out,none out-interface=\$\"interface\" to-address\
    es=\$\"lease-address\" \r\
    \n    } else={/ip firewall nat add action=src-nat chain=srcnat ipsec-polic\
    y=out,none out-interface=\$\"interface\" to-addresses=\$\"lease-address\" \
    comment=\"NAT via ISP1\"}\r\
    \n    :if [:tobool ([/routing/rule find comment=\"From ISP1 IP to Inet\"])\
    ] do={\r\
    \n      /routing/rule/set [find comment=\"From ISP1 IP to Inet\"] action=l\
    ookup src-address=\$\"lease-address\" table=to_isp1\r\
    \n    } else={/routing/rule/add action=lookup comment=\"From ISP1 IP to In\
    et\" src-address=\$\"lease-address\" table=to_isp1 }\r\
    \n} else={\r\
    \n   /ip route remove [find gateway=\"4.2.2.1\"]; /ip route remove [find w\
    here dst-address ~\"4.2.2.1\"]\r\
    \n   /ip firewall nat remove  [find comment=\"NAT via ISP1\"]\r\
    \n   /routing/rule/remove [find comment=\"From ISP1 IP to Inet\"]\r\
    \n}\r\
    \n" use-peer-ntp=no
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1 use-doh-server=\
    https://1.1.1.1/dns-query verify-doh-cert=yes
/ip firewall address-list
add address=0.0.0.0/8 comment="\"This\" Network" list=BOGONS
add address=10.0.0.0/8 comment="Private-Use Networks" list=BOGONS
add address=100.64.0.0/10 comment="Shared Address Space. RFC 6598" list=\
    BOGONS
add address=127.0.0.0/8 comment=Loopback list=BOGONS
add address=169.254.0.0/16 comment="Link Local" list=BOGONS
add address=172.16.0.0/12 comment="Private-Use Networks" list=BOGONS
add address=192.0.0.0/24 comment="IETF Protocol Assignments" list=BOGONS
add address=192.0.2.0/24 comment=TEST-NET-1 list=BOGONS
add address=192.168.0.0/16 comment="Private-Use Networks" list=BOGONS
add address=198.18.0.0/15 comment=\
    "Network Interconnect Device Benchmark Testing" list=BOGONS
add address=198.51.100.0/24 comment=TEST-NET-2 list=BOGONS
add address=203.0.113.0/24 comment=TEST-NET-3 list=BOGONS
add address=224.0.0.0/4 comment=Multicast list=BOGONS
add address=192.88.99.0/24 comment="6to4 Relay Anycast" list=BOGONS
add address=240.0.0.0/4 comment="Reserved for Future Use" list=BOGONS
add address=255.255.255.255 comment="Limited Broadcast" list=BOGONS
/ip firewall filter
add action=accept chain=input comment="Related Established Untracked Allow" \
    connection-state=established,related,untracked
add action=accept chain=input comment="ICMP from ALL" protocol=icmp
add action=drop chain=input comment="All other WAN Drop" in-interface-list=\
    WAN
add action=accept chain=forward comment=\
    "Established, Related, Untracked allow" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="Invalid drop" connection-state=invalid
add action=drop chain=forward comment="Drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-connection chain=prerouting comment="Connmark in from ISP1" \
    connection-mark=no-mark in-interface=ether1 new-connection-mark=conn_isp1 \
    passthrough=no
add action=mark-connection chain=prerouting comment="Connmark in from ISP2" \
    connection-mark=no-mark in-interface=ether2 new-connection-mark=conn_isp2 \
    passthrough=no
add action=mark-connection chain=prerouting comment="Connmark in from ISP3" \
    connection-mark=no-mark in-interface=ether3 new-connection-mark=conn_isp3 \
    passthrough=no
add action=mark-routing chain=prerouting comment=\
    "Routemark transit out via ISP1" connection-mark=conn_isp1 \
    dst-address-type=!local in-interface-list=!WAN new-routing-mark=to_isp1 \
    passthrough=no
add action=mark-routing chain=prerouting comment=\
    "Routemark transit out via ISP2" connection-mark=conn_isp2 \
    dst-address-type=!local in-interface-list=!WAN new-routing-mark=to_isp2 \
    passthrough=no
add action=mark-routing chain=prerouting comment=\
    "Routemark transit out via ISP3" connection-mark=conn_isp3 \
    dst-address-type=!local in-interface-list=!WAN new-routing-mark=to_isp3 \
    passthrough=no
add action=mark-routing chain=output comment="Routemark local out via ISP1" \
    connection-mark=conn_isp1 dst-address-type=!local new-routing-mark=\
    to_isp1 passthrough=no
add action=mark-routing chain=output comment="Routemark local out via ISP2" \
    connection-mark=conn_isp2 dst-address-type=!local new-routing-mark=\
    to_isp2 passthrough=no
add action=mark-routing chain=output comment="Routemark local out via ISP3" \
    connection-mark=conn_isp3 dst-address-type=!local new-routing-mark=\
    to_isp3 passthrough=no
add action=mark-routing chain=prerouting comment="Address List via ISP1" \
    dst-address-list=!BOGONS new-routing-mark=to_isp1 passthrough=no \
    src-address-list=Via_ISP1
add action=mark-routing chain=prerouting comment="Address List via ISP3" \
    dst-address-list=!BOGONS new-routing-mark=to_isp3 passthrough=no \
    src-address-list=Via_ISP3
add action=mark-routing chain=prerouting comment="Address List via ISP2" \
    dst-address-list=!BOGONS new-routing-mark=to_isp2 passthrough=no \
    src-address-list=Via_ISP2
/ip firewall nat
add action=src-nat chain=srcnat comment="Hairpin to LAN1" out-interface=\
    ether4 src-address=192.168.88.0/24 to-addresses=192.168.88.254
add action=src-nat chain=srcnat comment="Hairpin to LAN2" out-interface=\
    ether5 src-address=172.16.0.0/23 to-addresses=172.16.1.0
add action=src-nat chain=srcnat comment="NAT via ISP2" ipsec-policy=out,none \
    out-interface=ether2 to-addresses=192.168.15.188
/ip route
add comment="Emergency route" distance=254 gateway=lo
add check-gateway=ping comment="For recursion via ISP2" distance=1 \
    dst-address=4.2.2.2/32 gateway=192.168.15.1 scope=11
add check-gateway=ping comment="Unmarked via ISP2" distance=2 gateway=4.2.2.2 \
    target-scope=11
add comment="Marked via ISP2 Main" distance=1 gateway=4.2.2.2 routing-table=\
    to_isp2 target-scope=11
add comment="Marked via ISP1 Backup2" distance=2 gateway=4.2.2.2 \
    routing-table=to_isp1 target-scope=11
add comment="Marked via ISP3 Backup2" distance=2 gateway=4.2.2.2 \
    routing-table=to_isp3 target-scope=11
/ip smb shares
set [ find default=yes ] directory=/pub
/routing rule
add action=lookup comment="to LAN1" dst-address=192.168.88.0/24 table=main
add action=lookup comment="to LAN2" dst-address=172.16.0.0/23 table=main
add action=lookup comment="From ISP2 IP to Inet" src-address=192.168.15.188 \
    table=to_isp2
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=RB4011
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.pool.ntp.org
add address=1.pool.ntp.org
add address=2.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN