add interface=ether4 list="WAN interfaces"
add interface=ether5 list="WAN interfaces"
add interface=ether2 list="Main WAN"
add interface=ether3 list="Main WAN"
add interface=ether4 list="Main WAN"
add interface=it-vlan list="LAN ALL"
add interface=wifi-domru list="LAN ALL"
add interface=ether7 list="LAN Trusted"
add interface=it-vlan list="LAN Trusted"
add interface=ether7 list="LAN ALL"
add interface=wifi-domru list="LAN UnTrusted"
add interface=wi-fi-bridge list="LAN UnTrusted"
/interface pptp-server server
set authentication=mschap2 enabled=yes
/I p address
add address=10.74.0.1/16 interface=ether7 network=10.74.0.0
add address=***.***.***.***/24 interface=ether2 network=***.***.***.0
add address=192.168.***.***/24 interface=SUKA-wifi_loc
network=192.168.***.0
add address=192.168.***.***/24 interface=wifi-domru
network=192.168.***.0
add address=***.**.***.***/30 interface=ether4 network=***.***.***.***
66
add address=***.***.***.***/30 interface=ether5
network=***.***.***.***
add address=192.168.***.1/24 interface=wi-fi-bridge
network=192.168.***.0
add address=172.21.1.1/24 interface=it-vlan network=172.21.1.0
/ip dhcp-client
add add-default-route=no dhcp-options=hostname,clientid disabled=no \
interface=ether3 use-peer-dns=no use-peer-ntp=no
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip firewall address-list
add address=***.***.***.*** comment=filial01 list=rdp
add address=***.***.***.*** comment=filial02 list=rdp
add address=***.***.***.*** comment=filial03 list=rdp
add address=***.***.***.*** comment=filial04 list=rdp
add action=accept chain=input comment="allow winbox from wifi" dst-
port=8291 \
in-interface-list="LAN UnTrusted" protocol=tcp
add action=accept chain=input comment="allow VPN from wifi" dst-port=\
***,***,**** in-interface-list="LAN UnTrusted" protocol=udp
add action=accept chain=input comment="allow VPN from wifi" \
in-interface-list="LAN UnTrusted" protocol=ipsec-esp
67
add action=accept chain=input comment="allow VPN from WAN" dst-
port=**** \
in-interface-list="Main WAN" protocol=tcp
add action=accept chain=input comment="allow VPN from WAN" dst-
port=\
***,***,**** in-interface-list="Main WAN" protocol=udp
add action=accept chain=input comment="allow VPN from WAN" in-
interface-list=\
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether2
add action=masquerade chain=srcnat out-interface=ether3
add action=masquerade chain=srcnat out-interface=ether4
add action=masquerade chain=srcnat out-interface=ether5
add action=masquerade chain=srcnat out-interface=t-vpn routing-mark=vpn
add action=masquerade chain=srcnat dst-address=10.74.0.3-10.74.0.16 \
src-address=172.21.1.0/24
add action=masquerade chain=srcnat dst-address=10.74.1.207 src-address=\
172.21.1.0/24
add action=masquerade chain=srcnat dst-address=10.74.253.0-
10.74.255.254 \
src-address=172.21.1.0/24
add action=dst-nat chain=dstnat comment="creograf ssh" disabled=yes dst-
port=\
68
******* in-interface-list="Main WAN" protocol=tcp to-addresses=\
***.***.***.*** to-ports=22
add action=dst-nat chain=dstnat comment=mail dst-
port=25,110,143,465,993,995 \
in-interface-list="Main WAN" protocol=tcp to-addresses=10.74.1.18
add action=dst-nat chain=dstnat comment="mail from wi-fi" dst-port=\
25,110,143,465,993,995 in-interface=wi-fi-bridge protocol=tcp \
to-addresses=***.***.***.***
add action=dst-nat chain=dstnat comment="rdp-2 (100-199)" dst-
port=3389 \
in-interface-list="Main WAN" log=yes log-prefix=RDP2 protocol=tcp \
src-address-list=rdp-2 to-addresses=10.74.1.19 to-ports=3389
add action=dst-nat chain=dstnat comment="rdp-3 (200-289)" dst-
port=3389 \
in-interface-list="Main WAN" log=yes log-prefix=RDP3 protocol=tcp \
src-address-list=rdp-3 to-addresses=10.74.1.20 to-ports=3389
add action=dst-nat chain=dstnat comment="rdp-4 (290-359)" dst-
port=3389 \
in-interface-list="Main WAN" log=yes log-prefix=RDP4 protocol=tcp \
src-address-list=rdp-4 to-addresses=10.74.1.52 to-ports=3389
/ip route
add distance=1 gateway=***.***.***.*** routing-mark=eth2
add distance=1 gateway=***.***.***.*** routing-mark=eth3
69
add distance=1 gateway=***.***.***.*** routing-mark=eth4
add distance=1 gateway=***.***.***.*** routing-mark=eth5
add distance=10 gateway=t-vpn routing-mark=vpn
add check-gateway=arp distance=11 gateway=***.***.***.*** routing-
mark=office-vip
add check-gateway=arp distance=12 gateway=***.***.***.*** routing-
mark=\
office-vip
add check-gateway=arp distance=13 gateway=***.***.***.*** routing-
mark=\
office-vip
add check-gateway=arp distance=11 gateway=***.***.***.*** routing-
mark=\
office-main
add check-gateway=arp distance=12 gateway=***.***.***.*** routing-
mark=\
office-main
add check-gateway=arp distance=13 gateway=***.***.***.*** routing-
mark=\
office-main
add check-gateway=arp distance=12 gateway=***.***.***.*** routing-
mark=wifi-domru
add check-gateway=arp distance=13 gateway=***.***.***.*** routing-
mark=\
70
wifi-domru
add check-gateway=arp distance=14 gateway=***.***.***.*** routing-
mark=\
wifi-domru
add check-gateway=arp distance=11 gateway=***.***.***.*** routing-
mark=mail
add check-gateway=arp distance=12 gateway=***.***.***.*** routing-
mark=mail
add check-gateway=arp distance=13 gateway=***.***.***.*** routing-
mark=mail
add distance=1 gateway=***.***.***.***
add distance=2 gateway=***.***.***.***
add distance=3 gateway=***.***.***.***
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=*****
set ssh port=*****
set api disabled=yes
set api-ssl disabled=yes
/lcd
set color-scheme=dark default-screen=stat-slideshow read-only-mode=yes \
time-interval=hour
71
/ppp secret
add name=ph
password=*************************************************
profile=ppp_profile \
remote-address=10.74.0.3
add name=filial01 password=***************************
profile=ppp_profile \
remote-address=10.74.***.*** service=l2tp
add name=filial02 password=************** profile=ppp_profile \
remote-address=10.74.***.*** service=l2tp
add name=filial03 password=*************************** profile=\
ppp_profile remote-address=10.74.***.*** service=l2tp
add name=filial04 password=************* profile=ppp_profile \
remote-address=10.74.***.*** service=l2tp
/radius
add address=10.74.***.***
secret=*************************************** service=\
login
/system clock
set time-zone-autodetect=no time-zone-name=Asia/Yekaterinburg
/system identity
set name=MikroTik
/system logging
72
add action=disk topics=critical
add action=disk topics=error
add action=disk topics=warning
add action=diskfirewall topics=info,firewall
add action=diskppp topics=info,ppp,account
add disabled=yes topics=debug,caps
/system ntp client
set enabled=yes primary-ntp=46.8.40.31 secondary-ntp=89.111.182.111 \
server-dns-names=pool.ntp.org
/system scheduler
add interval=1d name="daily conf backup" on-event=\
"/system script run backup_via_mail" policy=\
ftp,read,write,policy,test,password,sensitive start-date=jun/09/2017 \
start-time=03:00:00
/tool bandwidth-server
set authenticate=no enabled=no
/user aaa
set default-group=full use-radius=yes
Конфигурация настройки роутеров в филиалах:
/interface l2tp-client
73
add allow=mschap1,mschap2 connect-to=<ip центрального офиса>
disabled=no ipsec-secret=\
****************** name=office password=********************
use-ipsec=yes \
user=office-kurgan
add allow=mschap1,mschap2 connect-to=<запасной ip центрального
офиса> disabled=no ipsec-secret=\
************ name=office-backup password=*****************
use-ipsec=yes user=filial01
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-
Ce \
disabled=no distance=indoors frequency=auto mode=ap-bridge
ssid=****** \
wireless-protocol=802.11
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods=""
mode=\
74
dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-
key=********* \
wpa2-pre-shared-key=**********
/ip firewall layer7-protocol
add name=<имя домена офиса> regexp=<имя домена офиса>
/ip pool
add name=dhcp ranges=192.168.1.210-192.168.1.250
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=discover
/interface list member
add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
75