# may/08/2026 17:46:02 by RouterOS 6.49.18
# software id = 8XZE-R7EJ
#
# model = CCR2004-1G-12S+2XS
# serial number = C8A70C55A930
/interface bridge
add name=cgnat
add fast-forward=no name=loopback
/interface ethernet
set [ find default-name=ether1 ] rx-flow-control=auto tx-flow-control=auto
set [ find default-name=sfp-sfpplus7 ] auto-negotiation=no name=\
    sfp-sfpplus7-core-direct
set [ find default-name=sfp-sfpplus8 ] name=sfp-sfpplus8-server-switch \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=sfp-sfpplus10 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus11 ] name=sfp-sfpplus11-preseem \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=sfp-sfpplus12 ] l2mtu=1500 name=\
    sfp-sfpplus12-spectrum rx-flow-control=auto tx-flow-control=auto
/interface vlan
add interface=sfp-sfpplus8-server-switch name=vlan9_sfpplus8 vlan-id=9
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-server
add disabled=no interface=vlan9_sfpplus8 name=servers-public
/ip pool
add name=380building ranges=10.0.0.150-10.0.0.239
add name=servers-public ranges=204.110.191.193-204.110.191.217
/ip dhcp-server
add address-pool=380building disabled=no interface=sfp-sfpplus8-server-switch \
    name=380-building
/ppp profile
add name=RWB_sstp_profile
/queue simple
add burst-limit=1M/1M burst-threshold=1M/1M burst-time=1s/1s disabled=yes \
    limit-at=1M/1M max-limit=1M/1M name=Delinquent packet-marks=Delenquent \
    priority=2/2 target=""
add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \
    limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\
    2/2 target=""
/routing bgp instance
set default as=393837 out-filter=twc-out router-id=204.110.191.190
/routing ospf instance
set [ find default=yes ] distribute-default=always-as-type-1 router-id=\
    10.254.254.254
/routing ospf-v3 instance
set [ find default=yes ] distribute-default=always-as-type-1 \
    redistribute-connected=as-type-1 router-id=10.254.254.254
/snmp community
set [ find default=yes ] name=onehuargd4a8974y79a497yi
add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm
/system logging action
add name=logs remote=204.110.191.229 remote-port=1514 src-address=\
    10.254.254.254 target=remote
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
    sword,web,sniff,sensitive,api,romon,dude,tikapp"
/ip firewall connection tracking
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
    tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
    tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
    tcp-time-wait-timeout=2m udp-stream-timeout=2m udp-timeout=30s
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set rp-filter=strict tcp-syncookies=yes
/ip address
add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\
    71.41.226.116
add address=204.110.191.186/30 interface=sfp-sfpplus11-preseem network=\
    204.110.191.184
add address=204.110.191.254/26 interface=vlan9_sfpplus8 network=\
    204.110.191.192
add address=10.254.254.254 interface=loopback network=10.254.254.254
add address=204.110.191.182/30 interface=sfp-sfpplus7-core-direct network=\
    204.110.191.180
add address=10.0.0.254/24 interface=sfp-sfpplus8-server-switch network=\
    10.0.0.0
add address=204.110.190.129/25 interface=cgnat network=204.110.190.128
add address=204.110.190.130/25 interface=cgnat network=204.110.190.128
add address=204.110.190.131/25 interface=cgnat network=204.110.190.128
add address=204.110.190.132/25 interface=cgnat network=204.110.190.128
add address=204.110.190.133/25 interface=cgnat network=204.110.190.128
add address=204.110.190.134/25 interface=cgnat network=204.110.190.128
add address=204.110.190.135/25 interface=cgnat network=204.110.190.128
add address=204.110.190.136/25 interface=cgnat network=204.110.190.128
add address=204.110.190.137/25 interface=cgnat network=204.110.190.128
add address=204.110.190.138/25 interface=cgnat network=204.110.190.128
add address=204.110.190.139/25 interface=cgnat network=204.110.190.128
add address=204.110.190.140/25 interface=cgnat network=204.110.190.128
add address=204.110.190.141/25 interface=cgnat network=204.110.190.128
add address=204.110.190.142/25 interface=cgnat network=204.110.190.128
add address=204.110.190.143/25 interface=cgnat network=204.110.190.128
add address=204.110.190.144/25 interface=cgnat network=204.110.190.128
add address=204.110.190.145/25 interface=cgnat network=204.110.190.128
add address=204.110.190.146/25 interface=cgnat network=204.110.190.128
add address=204.110.190.147/25 interface=cgnat network=204.110.190.128
add address=204.110.190.148/25 interface=cgnat network=204.110.190.128
add address=204.110.190.149/25 interface=cgnat network=204.110.190.128
add address=204.110.190.150/25 interface=cgnat network=204.110.190.128
add address=204.110.190.151/25 interface=cgnat network=204.110.190.128
add address=204.110.190.152/25 interface=cgnat network=204.110.190.128
add address=204.110.190.153/25 interface=cgnat network=204.110.190.128
add address=204.110.190.154/25 interface=cgnat network=204.110.190.128
add address=204.110.190.155/25 interface=cgnat network=204.110.190.128
add address=204.110.190.156/25 interface=cgnat network=204.110.190.128
add address=204.110.190.157/25 interface=cgnat network=204.110.190.128
add address=204.110.190.158/25 interface=cgnat network=204.110.190.128
add address=204.110.190.159/25 interface=cgnat network=204.110.190.128
add address=204.110.190.160/25 interface=cgnat network=204.110.190.128
add address=204.110.190.161/25 interface=cgnat network=204.110.190.128
add address=204.110.190.162/25 interface=cgnat network=204.110.190.128
add address=204.110.190.163/25 interface=cgnat network=204.110.190.128
add address=204.110.190.164/25 interface=cgnat network=204.110.190.128
add address=204.110.190.165/25 interface=cgnat network=204.110.190.128
add address=204.110.190.166/25 interface=cgnat network=204.110.190.128
add address=204.110.190.167/25 interface=cgnat network=204.110.190.128
add address=204.110.190.168/25 interface=cgnat network=204.110.190.128
add address=204.110.190.169/25 interface=cgnat network=204.110.190.128
add address=204.110.190.170/25 interface=cgnat network=204.110.190.128
add address=204.110.190.171/25 interface=cgnat network=204.110.190.128
add address=204.110.190.172/25 interface=cgnat network=204.110.190.128
add address=204.110.190.173/25 interface=cgnat network=204.110.190.128
add address=204.110.190.174/25 interface=cgnat network=204.110.190.128
add address=204.110.190.175/25 interface=cgnat network=204.110.190.128
add address=204.110.190.176/25 interface=cgnat network=204.110.190.128
add address=204.110.190.177/25 interface=cgnat network=204.110.190.128
add address=204.110.190.178/25 interface=cgnat network=204.110.190.128
add address=204.110.190.179/25 interface=cgnat network=204.110.190.128
add address=204.110.190.180/25 interface=cgnat network=204.110.190.128
add address=204.110.190.181/25 interface=cgnat network=204.110.190.128
add address=204.110.190.182/25 interface=cgnat network=204.110.190.128
add address=204.110.190.183/25 interface=cgnat network=204.110.190.128
add address=204.110.190.184/25 interface=cgnat network=204.110.190.128
add address=204.110.190.185/25 interface=cgnat network=204.110.190.128
add address=204.110.190.186/25 interface=cgnat network=204.110.190.128
add address=204.110.190.187/25 interface=cgnat network=204.110.190.128
add address=204.110.190.188/25 interface=cgnat network=204.110.190.128
add address=204.110.190.189/25 interface=cgnat network=204.110.190.128
add address=204.110.190.190/25 interface=cgnat network=204.110.190.128
add address=204.110.190.191/25 interface=cgnat network=204.110.190.128
add address=204.110.190.192/25 interface=cgnat network=204.110.190.128
add address=204.110.190.193/25 interface=cgnat network=204.110.190.128
add address=204.110.190.194/25 interface=cgnat network=204.110.190.128
add address=204.110.190.195/25 interface=cgnat network=204.110.190.128
add address=204.110.190.196/25 interface=cgnat network=204.110.190.128
add address=204.110.190.197/25 interface=cgnat network=204.110.190.128
add address=204.110.190.198/25 interface=cgnat network=204.110.190.128
add address=204.110.190.199/25 interface=cgnat network=204.110.190.128
add address=204.110.190.200/25 interface=cgnat network=204.110.190.128
add address=204.110.190.201/25 interface=cgnat network=204.110.190.128
add address=204.110.190.202/25 interface=cgnat network=204.110.190.128
add address=204.110.190.203/25 interface=cgnat network=204.110.190.128
add address=204.110.190.204/25 interface=cgnat network=204.110.190.128
add address=204.110.190.205/25 interface=cgnat network=204.110.190.128
add address=204.110.190.206/25 interface=cgnat network=204.110.190.128
add address=204.110.190.207/25 interface=cgnat network=204.110.190.128
add address=204.110.190.208/25 interface=cgnat network=204.110.190.128
add address=204.110.190.209/25 interface=cgnat network=204.110.190.128
add address=204.110.190.210/25 interface=cgnat network=204.110.190.128
add address=204.110.190.211/25 interface=cgnat network=204.110.190.128
add address=204.110.190.212/25 interface=cgnat network=204.110.190.128
add address=204.110.190.213/25 interface=cgnat network=204.110.190.128
add address=204.110.190.214/25 interface=cgnat network=204.110.190.128
add address=204.110.190.215/25 interface=cgnat network=204.110.190.128
add address=204.110.190.216/25 interface=cgnat network=204.110.190.128
add address=204.110.190.217/25 interface=cgnat network=204.110.190.128
add address=204.110.190.218/25 interface=cgnat network=204.110.190.128
add address=204.110.190.219/25 interface=cgnat network=204.110.190.128
add address=204.110.190.220/25 interface=cgnat network=204.110.190.128
add address=204.110.190.221/25 interface=cgnat network=204.110.190.128
add address=204.110.190.222/25 interface=cgnat network=204.110.190.128
add address=204.110.190.223/25 interface=cgnat network=204.110.190.128
add address=204.110.190.224/25 interface=cgnat network=204.110.190.128
add address=204.110.190.225/25 interface=cgnat network=204.110.190.128
add address=204.110.190.226/25 interface=cgnat network=204.110.190.128
add address=204.110.190.227/25 interface=cgnat network=204.110.190.128
add address=204.110.190.228/25 interface=cgnat network=204.110.190.128
add address=204.110.190.229/25 interface=cgnat network=204.110.190.128
add address=204.110.190.230/25 interface=cgnat network=204.110.190.128
add address=204.110.190.231/25 interface=cgnat network=204.110.190.128
add address=204.110.190.232/25 interface=cgnat network=204.110.190.128
add address=204.110.190.233/25 interface=cgnat network=204.110.190.128
add address=204.110.190.234/25 interface=cgnat network=204.110.190.128
add address=204.110.190.235/25 interface=cgnat network=204.110.190.128
add address=204.110.190.236/25 interface=cgnat network=204.110.190.128
add address=204.110.190.237/25 interface=cgnat network=204.110.190.128
add address=204.110.190.238/25 interface=cgnat network=204.110.190.128
add address=204.110.190.239/25 interface=cgnat network=204.110.190.128
add address=204.110.190.240/25 interface=cgnat network=204.110.190.128
add address=204.110.190.241/25 interface=cgnat network=204.110.190.128
add address=204.110.190.242/25 interface=cgnat network=204.110.190.128
add address=204.110.190.243/25 interface=cgnat network=204.110.190.128
add address=204.110.190.244/25 interface=cgnat network=204.110.190.128
add address=204.110.190.245/25 interface=cgnat network=204.110.190.128
add address=204.110.190.246/25 interface=cgnat network=204.110.190.128
add address=204.110.190.247/25 interface=cgnat network=204.110.190.128
add address=204.110.190.248/25 interface=cgnat network=204.110.190.128
add address=204.110.190.249/25 interface=cgnat network=204.110.190.128
add address=204.110.190.250/25 interface=cgnat network=204.110.190.128
add address=204.110.190.251/25 interface=cgnat network=204.110.190.128
add address=204.110.190.252/25 interface=cgnat network=204.110.190.128
add address=204.110.190.253/25 interface=cgnat network=204.110.190.128
add address=204.110.190.254/25 interface=cgnat network=204.110.190.128
/ip dhcp-server lease
add address=10.0.0.249 client-id=1:0:21:9b:91:5c:b6 mac-address=\
    00:21:9B:91:5C:B6 server=380-building
add address=204.110.191.205 mac-address=BC:24:11:8B:C0:9C
add address=10.0.0.250 client-id=1:48:a9:8a:38:3b:2d mac-address=\
    48:A9:8A:38:3B:2D server=380-building
add address=10.0.0.253 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:2c:53:dd:b2:c1:50:9a:35 comment=truenas \
    mac-address=BC:24:11:29:2B:5A server=380-building
add address=10.0.0.252 client-id=1:bc:24:11:f5:81:d6 mac-address=\
    BC:24:11:F5:81:D6 server=380-building
add address=10.0.0.251 client-id=1:bc:24:11:6b:73:53 mac-address=\
    BC:24:11:6B:73:53 server=380-building
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=9.9.9.9,1.1.1.1 domain=vntx.net gateway=\
    10.0.0.254 ntp-server=23.150.41.122
add address=204.110.191.192/26 dns-server=\
    204.110.191.240,204.110.191.250,1.1.1.1 gateway=204.110.191.254
/ip dns
set servers=204.110.191.240,204.110.191.250
/ip firewall address-list
add address=204.110.188.0/22 list=trusted
add address=100.64.0.0/10 list=trusted
add address=10.0.0.0/8 list=trusted
add address=35.197.73.77 list=preseem
add address=35.199.29.237 list=preseem
add address=98.97.82.0/24 comment=starlink list=trusted
add address=129.222.72.0/24 comment=starlink list=trusted
add address=129.222.73.0/24 comment=starlink list=trusted
add address=129.222.74.0/24 comment=starlink list=trusted
add address=129.222.75.0/24 comment=starlink list=trusted
add address=129.222.76.0/24 comment=starlink list=trusted
add address=129.222.77.0/24 comment=starlink list=trusted
add address=129.222.78.0/24 comment=starlink list=trusted
add address=129.222.79.0/24 comment=starlink list=trusted
add address=98.97.80.0/24 comment=starlink list=trusted
add address=98.97.81.0/24 comment=starlink list=trusted
add address=98.97.83.0/24 comment=starlink list=trusted
add address=98.97.84.0/24 comment=starlink list=trusted
add address=98.97.85.0/24 comment=starlink list=trusted
add address=98.97.86.0/24 comment=starlink list=trusted
add address=98.97.87.0/24 comment=starlink list=trusted
add address=98.97.88.0/24 comment=starlink list=trusted
add address=98.97.89.0/24 comment=starlink list=trusted
add address=98.97.90.0/24 comment=starlink list=trusted
add address=98.97.91.0/24 comment=starlink list=trusted
add address=98.97.92.0/24 comment=starlink list=trusted
add address=98.97.93.0/24 comment=starlink list=trusted
add address=98.97.94.0/24 comment=starlink list=trusted
add address=98.97.95.0/24 comment=starlink list=trusted
add address=52.158.209.86 list=trusted
add address=3.210.85.72 list=gaiia
add address=3.81.237.51 list=gaiia
add address=3.215.70.188 list=gaiia
add address=3.228.90.246 list=gaiia
add address=47.147.43.145 list=trusted
add address=71.41.226.117 comment=TWC list=BGP-NEIGHBORS
add address=204.110.191.185 comment=Preseem list=BGP-NEIGHBORS
add address=204.110.191.252 comment="Virtual RouterOS" list=BGP-NEIGHBORS
add address=204.110.188.0/22 list=bgp-networks
add address=151.243.11.0/24 list=abusive
add address=172.245.56.83 list=trusted
/ip firewall filter
add action=accept chain=input comment="BGP Input" dst-port=179 protocol=tcp
add action=accept chain=output comment="BGP Output" protocol=tcp src-port=179
add action=accept chain=forward comment="BGP Forward" dst-port=179 protocol=\
    tcp
add action=accept chain=forward comment="BGP Forward Reply" protocol=tcp \
    src-port=179
add action=accept chain=input comment="OSPF Input" protocol=ospf
add action=accept chain=output comment="OSPF Output" protocol=ospf
add action=accept chain=forward comment="OSPF Forward" protocol=ospf
add action=accept chain=input comment="Established Input" connection-state=\
    established,related
add action=accept chain=forward comment="Established Forward" \
    connection-state=established,related
add action=accept chain=input comment="Allow Remote Winbox" disabled=yes \
    in-interface=*18
add action=fasttrack-connection chain=forward comment=\
    "fasttrack established/related" connection-state=established,related
add action=accept chain=forward comment="accept established/related" \
    connection-state=established,related
add action=drop chain=forward dst-address=91.190.98.0/24 log=yes
add action=accept chain=forward dst-port=23 protocol=tcp src-address=\
    204.110.190.208
add action=accept chain=forward dst-address=204.110.191.219
add action=accept chain=forward dst-address=204.110.191.222
add action=accept chain=forward dst-address=204.110.191.252
add action=accept chain=forward dst-address=204.110.191.8
add action=accept chain=forward dst-address=204.110.191.192/26 src-address=\
    52.158.209.86
add action=accept chain=forward dst-address=204.110.191.210
add action=accept chain=forward disabled=yes dst-address=204.110.191.248 \
    dst-port=3306 log=yes protocol=tcp
add action=accept chain=forward dst-address=204.110.191.248 dst-port=3306 \
    protocol=tcp src-address-list=gaiia
add action=accept chain=forward disabled=yes dst-address=204.110.191.248
add action=accept chain=forward dst-address=204.110.191.231
add action=accept chain=forward dst-address=204.110.191.232 in-interface=\
    sfp-sfpplus12-spectrum
add action=tarpit chain=input protocol=tcp src-address-list=abusive
add action=drop chain=forward src-address-list=abusive
add action=accept chain=forward connection-state=established,related \
    disabled=yes
add action=accept chain=input connection-state=established,related,untracked \
    disabled=yes
add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\
    sfp-sfpplus12-spectrum protocol=tcp
add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\
    sfp-sfpplus12-spectrum protocol=udp
add action=drop chain=forward comment="Drop anyone in Black List (SSH)." \
    in-interface=sfp-sfpplus12-spectrum log-prefix="BL_Black List (SSH)" \
    src-address-list="Black List (SSH)"
add action=drop chain=forward comment="block incoming ftp" disabled=yes \
    dst-port=21 in-interface=sfp-sfpplus12-spectrum protocol=tcp
add action=drop chain=forward comment="block incoming telnet" dst-port=23 \
    in-interface=sfp-sfpplus12-spectrum protocol=tcp
add action=drop chain=input comment="Drop all packets from public internet whi\
    ch should not exist in public network" in-interface=\
    sfp-sfpplus12-spectrum src-address-list=NotPublic
add action=drop chain=input disabled=yes dst-port=3784 in-interface=\
    sfp-sfpplus12-spectrum log=yes protocol=udp
add action=drop chain=forward comment=bfd dst-port=3784 in-interface=\
    sfp-sfpplus12-spectrum protocol=udp
add action=drop chain=input comment=bfd dst-port=3784 in-interface=\
    sfp-sfpplus12-spectrum protocol=udp
add action=drop chain=input comment="Drop Invalid connections" \
    connection-state=invalid
add action=add-src-to-address-list address-list=winbox_blacklist \
    address-list-timeout=4w3d chain=input connection-state=new disabled=yes \
    dst-port=8291 log=yes protocol=tcp src-address-list=winbox_stage3
add action=add-src-to-address-list address-list=winbox_stage3 \
    address-list-timeout=1m chain=input connection-state=new disabled=yes \
    dst-port=8291 protocol=tcp src-address-list=winbox_stage2
add action=add-src-to-address-list address-list=winbox_stage2 \
    address-list-timeout=1m chain=input connection-state=new disabled=yes \
    dst-port=8291 protocol=tcp src-address-list=winbox_stage1
add action=add-src-to-address-list address-list=winbox_stage1 \
    address-list-timeout=1m chain=input connection-state=new disabled=yes \
    dst-port=8291 protocol=tcp src-address-list=!vntx
add action=drop chain=forward comment="drop winbox brute downstream" \
    disabled=yes dst-port=8291 protocol=tcp src-address-list=winbox_blacklist
add action=accept chain=input comment="BGP Neighbors" dst-port=179 protocol=\
    tcp src-address-list=BGP-NEIGHBORS
add action=drop chain=input comment="Drop anyone in Black List (SSH)." \
    disabled=yes in-interface=sfp-sfpplus12-spectrum log-prefix=\
    "BL_Black List (SSH)" src-address-list="Black List (SSH)"
add action=jump chain=input comment="Jump to Black List (SSH) chain." \
    dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\
    "Black List (SSH) Chain" protocol=tcp
add action=drop chain=input comment=. dst-port=23 in-interface=\
    sfp-sfpplus12-spectrum protocol=tcp
add action=drop chain=forward comment=. dst-port=23 in-interface=\
    sfp-sfpplus12-spectrum protocol=tcp
add action=jump chain=forward comment="Jump to Black List (SSH) chain." \
    dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\
    "Black List (SSH) Chain" protocol=tcp
add action=add-src-to-address-list address-list="Black List (SSH)" \
    address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\
    \_repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \
    connection-state=new in-interface=sfp-sfpplus12-spectrum log-prefix=\
    "Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add successive attempts to Black List (SSH) Stage 3." connection-state=\
    new in-interface=sfp-sfpplus12-spectrum log-prefix=\
    "Add_Black List (SSH) S3" src-address-list="Black List (SSH) Stage 2"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add successive attempts to Black List (SSH) Stage 2." connection-state=\
    new in-interface=sfp-sfpplus12-spectrum log-prefix=\
    "Add_Black List (SSH) S2" src-address-list="Black List (SSH) Stage 1"
add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \
    address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
    "Add initial attempt to Black List (SSH) Stage 1." connection-state=new \
    in-interface=sfp-sfpplus12-spectrum log-prefix="Add_Black List (SSH) S1" \
    src-address-list=!trusted
add action=return chain="Black List (SSH) Chain" comment=\
    "Return From Black List (SSH) chain."
add action=accept chain=forward disabled=yes dst-address=204.110.191.192/26 \
    dst-port=3306 log=yes protocol=tcp src-address=162.243.131.32
add action=accept chain=forward dst-address=204.110.191.197
add action=accept chain=forward comment=micromirror dst-address=\
    204.110.191.235
add action=accept chain=forward dst-address=204.110.191.219
add action=accept chain=forward dst-address=204.110.191.8
add action=accept chain=forward dst-address=204.110.191.192/26 protocol=icmp
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=80 \
    protocol=tcp
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=443 \
    protocol=tcp
add action=accept chain=forward dst-address=204.110.191.232 dst-port=14580 \
    protocol=tcp
add action=accept chain=forward dst-address=204.110.191.232 dst-port=14501 \
    protocol=tcp
add action=accept chain=forward comment=wireguard dst-address=204.110.191.247 \
    dst-port=51820 protocol=udp
add action=accept chain=forward dst-address=204.110.191.247 dst-port=22 \
    protocol=tcp
add action=drop chain=forward disabled=yes dst-address=204.110.191.192/26 \
    dst-port=3306 log=yes protocol=tcp
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=53 \
    protocol=udp src-address-list=trusted
add action=accept chain=forward comment=ns2 dst-address=204.110.191.239 \
    dst-port=53 protocol=udp
add action=accept chain=forward comment=ns1 dst-address=204.110.191.249 \
    dst-port=53 protocol=udp
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \
    protocol=tcp src-address-list=trusted
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \
    protocol=tcp src-address-list=preseem
add action=accept chain=forward dst-address=204.110.191.192/26 \
    src-address-list=trusted
add action=drop chain=forward dst-address=204.110.191.192/26 \
    src-address-list=!trusted
add action=drop chain=input dst-port=8921 protocol=tcp src-address-list=\
    !trusted
add action=drop chain=forward dst-port=8921 protocol=tcp src-address-list=\
    !trusted
add action=drop chain=input disabled=yes in-interface=sfp-sfpplus12-spectrum \
    src-address=100.64.0.0/10
add action=drop chain=output disabled=yes dst-address=100.64.0.0/10 \
    out-interface=sfp-sfpplus12-spectrum
add action=drop chain=forward disabled=yes in-interface=\
    sfp-sfpplus12-spectrum src-address=100.64.0.0/10
add action=drop chain=forward disabled=yes out-interface=\
    sfp-sfpplus12-spectrum src-address=100.64.0.0/10
add action=drop chain=forward disabled=yes dst-address=100.64.0.0/10 \
    out-interface=sfp-sfpplus12-spectrum
add action=accept chain=input comment="Established Input" connection-state=\
    established,related
add action=accept chain=forward comment="Established Forward" \
    connection-state=established,related
add action=accept chain=input comment=BGP dst-port=179 protocol=tcp
add action=accept chain=output comment=BGP protocol=tcp src-port=179
add action=accept chain=forward comment=BGP dst-port=179 protocol=tcp
add action=accept chain=forward comment=BGP protocol=tcp src-port=179
add action=accept chain=input comment=OSPF protocol=ospf
add action=accept chain=output comment=OSPF protocol=ospf
add action=accept chain=forward comment=OSPF protocol=ospf
add action=drop chain=forward dst-port=23 log-prefix=TELNET protocol=tcp
/ip firewall mangle
add action=mark-packet chain=prerouting disabled=yes new-packet-mark=Inactive \
    passthrough=no src-address-list=Inactive
add action=mark-packet chain=prerouting disabled=yes dst-address-list=\
    Inactive new-packet-mark=Inactive passthrough=no
add action=accept chain=postrouting disabled=yes protocol=tcp tcp-flags=ack
/ip firewall nat
add action=src-nat chain=srcnat comment="Internal NAT catch-all" \
    out-interface=sfp-sfpplus12-spectrum src-address=10.0.0.0/8 to-addresses=\
    204.110.191.190
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \
    src-address=10.0.0.0/24 to-addresses=204.110.190.254
add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\
    sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\
    204.110.191.190
add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\
    sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\
    204.110.191.190
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \
    src-address=10.0.0.0/8 to-addresses=204.110.191.190
add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\
    sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\
    204.110.191.190
add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\
    sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\
    204.110.191.190
add action=src-nat chain=srcnat comment="fallthrough CGNAT" disabled=yes \
    out-interface=sfp-sfpplus12-spectrum src-address=100.64.0.0/10 \
    to-addresses=204.110.190.254
add action=netmap chain=srcnat ipsec-policy=out,none out-interface=\
    sfp-sfpplus12-spectrum src-address=100.64.0.0/10 to-addresses=\
    204.110.190.128/25
add action=netmap chain=dstmap comment=\
    "Port Forwarding Solution for CGNAT (TCP)" dst-address=204.110.190.128/25 \
    dst-port=1024-65535 protocol=tcp to-addresses=100.64.0.0/10
add action=netmap chain=dstmap comment=\
    "Port Forwarding Solution for CGNAT (UDP)" dst-address=204.110.190.128/25 \
    dst-port=1024-65535 protocol=udp to-addresses=100.64.0.0/10
/ip firewall raw
add action=drop chain=prerouting src-address-list="Black List (SSH)"
add action=drop chain=prerouting disabled=yes src-address-list=abusive
add action=drop chain=prerouting disabled=yes src-address-list=\
    winbox_blacklist
/ip proxy
set port=23435
/ip proxy access
add src-address=204.110.188.0/22
/ip route
add distance=1 gateway=71.41.226.117
add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185
add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185
add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185
add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185
add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185
add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253
add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181
add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185
add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=204.110.188.0/22 port=2080
set ssh address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 port=1022
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
set api-ssl address=0.0.0.0/0 certificate=server
/ip ssh
set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\
    yes
/ipv6 address
add address=2605:6000:0:8::f:373/127 advertise=no interface=\
    sfp-sfpplus12-spectrum
add address=2606:1c80::1 interface=vlan9_sfpplus8
add address=2606:1c80:0:1002::1 interface=sfp-sfpplus11-preseem
/ipv6 firewall address-list
add address=2606:1c80::/32 list=bgp-networks
/ipv6 firewall filter
add action=accept chain=input comment="IPv6 BGP Input" dst-port=179 protocol=\
    tcp
add action=accept chain=output comment="IPv6 BGP Output" protocol=tcp \
    src-port=179
add action=accept chain=forward comment="IPv6 BGP Forward" dst-port=179 \
    protocol=tcp
add action=accept chain=forward comment="IPv6 BGP Forward Reply" protocol=tcp \
    src-port=179
add action=accept chain=input comment="IPv6 Established Input" \
    connection-state=established,related
add action=accept chain=forward comment="IPv6 Established Forward" \
    connection-state=established,related
/mpls interface
set [ find default=yes ] mpls-mtu=1530
add interface=sfp-sfpplus8-server-switch mpls-mtu=1530
/mpls ldp
set distribute-for-default-route=yes enabled=yes loop-detect=yes lsr-id=\
    10.254.254.254 transport-address=10.254.254.254
/mpls ldp accept-filter
add
/mpls ldp advertise-filter
add
/mpls ldp interface
add disabled=yes interface=ether1
add disabled=yes interface=sfp-sfpplus11-preseem transport-address=\
    10.254.254.254
add disabled=yes interface=vlan9_sfpplus8 transport-address=10.254.254.254
add interface=sfp-sfpplus8-server-switch
/routing bfd interface
set [ find default=yes ] disabled=yes
add interface=sfp-sfpplus7-core-direct
add interface=sfp-sfpplus11-preseem
/routing bgp network
add network=204.110.188.0/22 synchronize=no
add network=2606:1c80::/32 synchronize=no
/routing bgp peer
add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \
    remote-as=11427 ttl=default
add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \
    remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default
add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\
    BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
    BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\
    mC9LaaOi0P
add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
    BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
    BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\
    mC9LaaOi0P
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
    edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
    remote-address=204.110.191.185 remote-as=393837
/routing filter
add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
    204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
add action=accept chain=twc-in prefix=0.0.0.0/0
add action=accept chain=twc-in prefix=0.0.0.0/0 prefix-length=0
add action=discard chain=twc-in disabled=yes prefix=0.0.0.0 prefix-length=\
    0-32 protocol=""
add action=accept chain=twc-out prefix=204.110.188.0/22
add action=accept chain=twc-out prefix=2606:1c80::/32
add action=discard chain=twc-out
add action=discard chain=BGP-DROP
add action=accept bgp-communities=65333:888 chain=BOGON-SERVER-IN disabled=\
    yes set-type=blackhole
add action=discard chain=BOGON-SERVER-IN disabled=yes
add action=discard chain=BGP-DROP
add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
    prefix-length=0
add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
    prefix-length=0-32
/routing ospf interface
add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
add cost=20 interface=sfp-sfpplus9 network-type=nbma use-bfd=yes
add interface=sfp-sfpplus10 network-type=nbma passive=yes
add cost=20 interface=ether1 network-type=broadcast
add interface=sfp-sfpplus8-server-switch network-type=broadcast
add cost=100 interface=sfp-sfpplus7-core-direct network-type=point-to-point \
    use-bfd=yes
add interface=vlan9_sfpplus8 network-type=nbma
/routing ospf nbma-neighbor
add address=204.110.191.189 poll-interval=10s
add address=10.250.1.94
add address=10.250.1.57
add address=10.250.1.201
add address=10.250.2.1
add address=204.110.191.185 poll-interval=10s
add address=204.110.191.252 poll-interval=10s
/routing ospf network
add area=backbone
/routing ospf-v3 interface
add area=backbone
add area=backbone interface=sfp-sfpplus12-spectrum network-type=broadcast \
    passive=yes
/routing rip
set distribute-default=always redistribute-connected=yes redistribute-ospf=\
    yes
/routing rip interface
add interface=sfp-sfpplus11-preseem
add interface=sfp-sfpplus7-core-direct
add interface=sfp-sfpplus8-server-switch
/routing rip network
add
/snmp
set contact="Verona Networks" enabled=yes location="Verona Networks"
/system clock
set time-zone-name=America/Chicago
/system identity
set name=edge
/system logging
add action=logs topics=info
/system note
set note="__     __\
    \n\\ \\   / /__ _ __ ___  _ __   __ _\
    \n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\
    \n  \\ V /  __/ | | (_) | | | | (_| |\
    \n   \\_/ \\___|_|  \\___/|_| |_|\\__,_|\
    \n _   _      _                      _\
    \n| \\ | | ___| |___      _____  _ __| | _____\
    \n|  \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\
    \n| |\\  |  __/ |_ \\ V  V / (_) | |  |   <\\__ \\\
    \n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_|  |_|\\_\\___/\
    \n\
    \n###############################################################\
    \n#                 Welcome to Verona Networks                  #\
    \n#        All connections are monitored and recorded           #\
    \n# Disconnect IMMEDIATELY if you are not an authorized user!   #\
    \n###############################################################\
    \n\
    \n" show-at-login=no
/system ntp client
set enabled=yes primary-ntp=162.159.200.1 secondary-ntp=45.79.1.70
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add name=reboot on-event="/system reboot\r\
    \n" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=jun/14/2023 start-time=03:00:00
add comment=RWB_IP_RESOLVER interval=5m name=RWB_IP_RESOLVER on-event=\
    RWB_IP_RESOLVER policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=oct/13/2022 start-time=22:59:02
/tool graphing interface
add allow-address=204.110.188.0/22
/tool graphing queue
add allow-address=204.110.188.0/22
/tool graphing resource
add allow-address=204.110.188.0/22
/tool romon
set enabled=yes
/user aaa
set default-group=full
