# 2026-04-18 12:49:26 by RouterOS 7.22.1
# software id = ZGNY-ZJW7
#
# model = RB5009UG+S+
# serial number = HC907QQ15FR
/interface bridge
add admin-mac=74:4D:28:1A:67:0A auto-mac=no comment=defconf mtu=1500 name=\
    bridge port-cost-mode=short
add name=containers
add mtu=1500 name=docker port-cost-mode=short
add mtu=1500 name=dockers port-cost-mode=short
add disabled=yes mtu=1500 name=public
/interface ethernet
set [ find default-name=ether1 ] l2mtu=9578
set [ find default-name=ether2 ] l2mtu=9578
set [ find default-name=ether3 ] l2mtu=9578 name=ether3-servers
set [ find default-name=ether4 ] l2mtu=9578 name=ether4-house-60g
set [ find default-name=ether5 ] l2mtu=9578 name=ether5-vntx-static
set [ find default-name=ether6 ] l2mtu=9578 name=ether6-tmobile
set [ find default-name=ether7 ] l2mtu=9578 name=ether7-starlink
set [ find default-name=ether8 ] disabled=yes l2mtu=9578
set [ find default-name=sfp-sfpplus1 ] l2mtu=9586
/interface pppoe-client
add interface=ether8 max-mtu=1500 name=pppoe-out1 use-peer-dns=yes user=\
    grahammcintire
/interface veth
add address=172.17.0.2/16 container-mac-address=4C:B3:A4:3A:BC:FF dhcp=no \
    gateway=172.17.0.1 gateway6="" mac-address=4C:B3:A4:3A:BC:FE name=veth1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=home ranges=10.0.17.1-10.0.18.249
add name=dhcp_pool1 ranges=10.0.8.1-10.0.14.254
/ip dhcp-server
add add-arp=yes address-pool=home bootp-lease-time=lease-time bootp-support=\
    dynamic interface=bridge lease-time=8h name=server1
add address-pool=dhcp_pool1 interface=ether3-servers name=servers
/ipv6 pool
add name=tunnerbroker prefix=2001:470:ba50::/48 prefix-length=48
/port
set 0 baud-rate=9600
/interface ppp-client
add apn=internet name=ppp-out1 port=usb1
/queue type
set 0 kind=fq-codel
/routing table
add disabled=no fib name=vntx
add disabled=no fib name=tmo
/snmp community
set [ find default=yes ] addresses=10.0.16.0/22,10.0.0.0/8,204.110.188.0/22 \
    name=kdyyJrT0Mm
add addresses=::/0 authentication-protocol=SHA1 encryption-protocol=AES name=\
    testtest security=private
add addresses=10.0.16.0/22 name=testlocal
/system script
add dont-require-permissions=no name=api-ssl-certgen owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    local hostname \"router.example.com\"; :local caName \"local-ca\"; :local \
    certName \"api-ssl-cert\"; :local sanList (\"DNS:\" . \$hostname); :foreac\
    h i in=[/ip/address find] do={ :local addr [/ip/address get \$i address]; \
    :set addr [:pick \$addr 0 [:find \$addr \"/\"]]; :set sanList (\$sanList .\
    \_\",IP:\" . \$addr); }; /certificate add name=\$caName common-name=\$caNa\
    me key-usage=key-cert-sign,crl-sign days-valid=3650; /certificate sign \$c\
    aName; /certificate add name=\$certName common-name=\$hostname subject-alt\
    -name=\$sanList key-usage=digital-signature,key-encipherment,tls-server da\
    ys-valid=825; /certificate sign \$certName ca=\$caName; /certificate set \
    \$certName trusted=yes; /ip/service set api-ssl certificate=\$certName dis\
    abled=no; /ip/service set api disabled=yes;"
/container
add envlists=tailscale interface=veth1 layer-dir="" name=\
    tailscale-mikrotik:latest remote-image=\
    fluent-networks/tailscale-mikrotik:latest root-dir=\
    /disk1/containers/tailscale start-on-boot=yes workdir=/
/container config
set registry-url=https://ghcr.io tmpdir=/disk1/pull
/container envs
add key=ADVERTISE_ROUTES list=tailscale value=10.0.8.0/22,10.0.16.0/22
add key=AUTH_KEY list=tailscale value=\
    tskey-auth-k9B9aH7Cyk11CNTRL-yYzpiX8XThCFiVV3pVMthCUKfN8wKTjBD
add key=CONTAINER_GATEWAY list=tailscale value=172.17.0.1
add key=PASSWORD list=tailscale value=h8xd9tkryg
add key=RUNNING_SCRIPT list=tailscale value=/var/lib/tailscale/running.sh
add key=STARTUP_SCRIPT list=tailscale value=/var/lib/tailscale/startup.sh
add key=TAILSCALE_ARGS list=tailscale value=\
    "--accept-routes --advertise-exit-node"
add key=UPDATE_TAILSCALE list=tailscale value=""
/container mounts
add dst=/var/lib/tailscale list=tailscale src=/tailscale
/ip smb
set enabled=no
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=\
    ether4-house-60g internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus1 \
    internal-path-cost=10 path-cost=10
add bridge=dockers interface=veth1
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=\
    LAN wan-interface-list=WAN
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=ether5-vntx-static list=WAN
add interface=ether6-tmobile list=WAN
add disabled=yes interface=ether8 list=WAN
add interface=ether7-starlink list=WAN
add interface=*14 list=WAN
/interface ovpn-server server
add mac-address=FE:1C:5C:10:15:58 name=ovpn-server1
/ip address
add address=10.0.16.254/24 interface=bridge network=10.0.16.0
add address=172.17.0.1/16 interface=dockers network=172.17.0.0
add address=204.110.191.1/27 interface=ether5-vntx-static network=\
    204.110.191.0
add address=10.0.19.254/22 interface=bridge network=10.0.16.0
add address=10.99.1.1/24 interface=*16 network=10.99.1.0
add address=10.0.101.253/24 disabled=yes interface=ether4-house-60g network=\
    10.0.101.0
add address=10.0.15.254/21 interface=ether3-servers network=10.0.8.0
/ip dhcp-client
add add-default-route=no interface=ether6-tmobile name=client1 use-peer-dns=\
    no use-peer-ntp=no
# Interface not active
add add-default-route=no interface=ether7-starlink name=client2 use-peer-dns=\
    no use-peer-ntp=no
/ip dhcp-server lease
add address=10.0.16.2 client-id=\
    ff:85:d2:82:8a:0:2:0:0:ab:11:cb:63:d8:6c:a1:65:c1:58 comment=unifi \
    mac-address=74:83:C2:1D:4C:51 server=server1
add address=10.0.16.251 client-id=1:34:98:b5:ae:bc:e3 mac-address=\
    34:98:B5:AE:BC:E3 server=server1
add address=10.0.16.1 client-id=1:c8:7f:54:d0:4:2f mac-address=\
    C8:7F:54:D0:04:2F server=server1
add address=10.0.19.250 client-id=\
    ff:11:94:ec:20:0:1:0:1:2d:e2:38:27:bc:24:11:94:ec:20 mac-address=\
    BC:24:11:94:EC:20 server=server1
add address=10.0.16.4 client-id=\
    ff:d8:d6:53:a5:0:2:0:0:ab:11:d0:cc:22:d6:96:fe:cd:b1 comment=g.vntx.net \
    mac-address=8C:AE:4C:DD:84:92 server=server1
add address=10.0.19.136 client-id=1:38:b4:d3:30:3f:4 comment=dishwasher \
    mac-address=38:B4:D3:30:3F:04 server=server1
add address=10.0.19.225 client-id=1:2c:cf:67:d:b9:4c mac-address=\
    2C:CF:67:0D:B9:4C server=server1
add address=10.0.18.4 client-id=1:48:da:35:6f:86:a3 comment=nanokvm \
    mac-address=48:DA:35:6F:86:A3 server=server1
add address=10.0.18.228 client-id=1:e0:63:da:0:70:89 mac-address=\
    E0:63:DA:00:70:89 server=server1
add address=10.0.17.189 client-id=1:c4:e7:ae:17:6d:d3 mac-address=\
    C4:E7:AE:17:6D:D3 server=server1
add address=10.0.15.1 client-id=1:bc:24:11:9b:48:92 mac-address=\
    BC:24:11:9B:48:92 server=servers
add address=10.0.15.2 client-id=1:bc:24:11:62:7b:3f mac-address=\
    BC:24:11:62:7B:3F server=servers
add address=10.0.15.3 client-id=1:bc:24:11:d4:2f:ed mac-address=\
    BC:24:11:D4:2F:ED server=servers
add address=10.0.15.4 client-id=1:bc:24:11:43:3f:ff mac-address=\
    BC:24:11:43:3F:FF server=servers
add address=10.0.15.5 client-id=1:bc:24:11:62:c4:8f mac-address=\
    BC:24:11:62:C4:8F server=servers
add address=10.0.15.6 client-id=1:bc:24:11:3f:8e:1a mac-address=\
    BC:24:11:3F:8E:1A server=servers
add address=10.0.15.20 client-id=1:2c:cf:67:d:b9:4c mac-address=\
    2C:CF:67:0D:B9:4C server=servers
add address=10.0.15.253 client-id=1:78:9a:18:3f:cb:fe mac-address=\
    78:9A:18:3F:CB:FE server=servers
add address=10.0.19.241 client-id=1:f4:92:bf:91:8a:61 mac-address=\
    F4:92:BF:91:8A:61 server=server1
add address=10.0.15.21 mac-address=BC:24:11:98:1C:19 server=servers
add address=10.0.17.185 client-id=1:74:4d:bd:c5:87:cc mac-address=\
    74:4D:BD:C5:87:CC server=server1
add address=10.0.17.17 client-id=1:f0:24:f9:55:b8:94 mac-address=\
    F0:24:F9:55:B8:94 server=server1
add address=10.0.17.184 mac-address=50:02:91:38:EB:98 server=server1
add address=10.0.16.3 client-id=1:52:54:0:5c:f7:36 mac-address=\
    52:54:00:5C:F7:36 server=server1
add address=10.0.17.25 client-id=1:20:f8:3b:9:49:cd mac-address=\
    20:F8:3B:09:49:CD server=server1
add address=10.0.17.51 mac-address=40:F5:20:C5:9B:EE server=server1
add address=10.0.16.5 client-id=\
    ff:ef:a8:c2:c6:0:1:0:1:31:4c:1f:7:b0:dc:ef:a8:c2:c6 mac-address=\
    B0:DC:EF:A8:C2:C6 server=server1
add address=10.0.17.22 mac-address=EC:94:CB:AA:56:A3 server=server1
add address=10.0.15.23 client-id=1:36:4a:9d:b7:36:fc mac-address=\
    36:4A:9D:B7:36:FC server=servers
add address=10.0.15.24 client-id=\
    ff:23:7c:24:3e:0:2:0:0:ab:11:ad:b5:e:a0:e1:d9:51:1a mac-address=\
    F6:86:CC:17:A7:F9 server=servers
add address=10.0.17.42 mac-address=34:AB:95:12:8B:DB server=server1
/ip dhcp-server network
add address=10.0.8.0/21 domain=mcintire.me gateway=10.0.15.254
add address=10.0.16.0/22 dns-server=10.0.19.250,9.9.9.9 domain=w5isp.com \
    gateway=10.0.19.254
/ip dns
set servers=9.9.9.9,149.112.112.112
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
add address=10.0.16.31 comment=dhcp-lease-script_server1_lease-hostname name=\
    Lutron-01f3a316.w5isp.com ttl=15m type=A
add address=10.0.16.31 comment=dhcp-lease-script_server1_lease-hostname name=\
    Lutron-01f3a316 ttl=15m type=A
add address=10.0.16.3 comment=dhcp-lease-script_server1_lease-hostname name=\
    homeassistant.w5isp.com ttl=15m type=A
add address=10.0.16.3 comment=dhcp-lease-script_server1_lease-hostname name=\
    homeassistant ttl=15m type=A
add address=10.0.16.1 comment=dhcp-lease-script_server1_lease-hostname name=\
    Tower.w5isp.com ttl=15m type=A
add address=10.0.16.1 comment=dhcp-lease-script_server1_lease-hostname name=\
    Tower ttl=15m type=A
add address=10.0.16.252 comment=dhcp-lease-script_server1_lease-hostname \
    name=10g-switch-house.w5isp.com ttl=15m type=A
add address=10.0.16.252 comment=dhcp-lease-script_server1_lease-hostname \
    name=10g-switch-house ttl=15m type=A
add address=10.0.16.41 comment=dhcp-lease-script_server1_lease-hostname name=\
    Living-Room.w5isp.com ttl=15m type=A
add address=10.0.16.41 comment=dhcp-lease-script_server1_lease-hostname name=\
    Living-Room ttl=15m type=A
add address=10.0.16.253 comment=dhcp-lease-script_server1_lease-hostname \
    name="Office 2.5G Switch.w5isp.com" ttl=15m type=A
add address=10.0.16.253 comment=dhcp-lease-script_server1_lease-hostname \
    name="Office 2.5G Switch" ttl=15m type=A
add address=10.0.16.36 comment=dhcp-lease-script_server1_lease-hostname name=\
    HallwayAP.w5isp.com ttl=15m type=A
add address=10.0.16.38 comment=dhcp-lease-script_server1_lease-hostname name=\
    LivingRoom.w5isp.com ttl=15m type=A
add address=10.0.16.36 comment=dhcp-lease-script_server1_lease-hostname name=\
    HallwayAP ttl=15m type=A
add address=10.0.16.38 comment=dhcp-lease-script_server1_lease-hostname name=\
    LivingRoom ttl=15m type=A
add address=10.0.16.86 comment=dhcp-lease-script_server1_lease-hostname name=\
    OutsideNE.w5isp.com ttl=15m type=A
add address=10.0.16.86 comment=dhcp-lease-script_server1_lease-hostname name=\
    OutsideNE ttl=15m type=A
add address=10.0.16.43 comment=dhcp-lease-script_server1_lease-hostname name=\
    HousePoESwitch.w5isp.com ttl=15m type=A
add address=10.0.16.43 comment=dhcp-lease-script_server1_lease-hostname name=\
    HousePoESwitch ttl=15m type=A
add address=10.0.16.56 comment=dhcp-lease-script_server1_lease-hostname name=\
    driveway.w5isp.com ttl=15m type=A
add address=10.0.16.56 comment=dhcp-lease-script_server1_lease-hostname name=\
    driveway ttl=15m type=A
add address=10.0.16.44 comment=dhcp-lease-script_server1_lease-hostname name=\
    Garins-MBP.w5isp.com ttl=15m type=A
add address=10.0.16.44 comment=dhcp-lease-script_server1_lease-hostname name=\
    Garins-MBP ttl=15m type=A
add address=10.0.16.64 comment=dhcp-lease-script_server1_lease-hostname name=\
    Apple-Watch.w5isp.com ttl=15m type=A
add address=10.0.16.64 comment=dhcp-lease-script_server1_lease-hostname name=\
    Apple-Watch ttl=15m type=A
add address=10.0.16.37 comment=dhcp-lease-script_server1_lease-hostname name=\
    gmcparallels.w5isp.com ttl=15m type=A
add address=10.0.16.37 comment=dhcp-lease-script_server1_lease-hostname name=\
    gmcparallels ttl=15m type=A
add address=10.0.16.33 comment=dhcp-lease-script_server1_lease-hostname name=\
    mbp14.w5isp.com ttl=15m type=A
add address=10.0.16.33 comment=dhcp-lease-script_server1_lease-hostname name=\
    mbp14 ttl=15m type=A
add address=10.0.16.30 comment=dhcp-lease-script_server1_lease-hostname name=\
    Office.w5isp.com ttl=15m type=A
add address=10.0.16.30 comment=dhcp-lease-script_server1_lease-hostname name=\
    Office ttl=15m type=A
add address=10.0.16.49 comment=dhcp-lease-script_server1_lease-hostname name=\
    openspot2.w5isp.com ttl=15m type=A
add address=10.0.16.49 comment=dhcp-lease-script_server1_lease-hostname name=\
    openspot2 ttl=15m type=A
/ip firewall address-list
add address=10.0.16.0/22 list=local
add address=185.90.196.0/22 list=starlink
add address=10.0.16.78 disabled=yes list=iot-blocked
add address=10.0.16.80 disabled=yes list=iot-blocked
add address=81.171.92.0/23 list=nzb
add address=82.68.15.22 list=nzb
add address=85.12.62.0/24 list=nzb
add address=10.0.17.189 list=iot-blocked
add address=news.eweka.nl list=eweka-tmo
add address=185.90.196.0/22 comment="eweka range" list=eweka-tmo
add address=81.171.92.0/23 comment="eweka range" list=eweka-tmo
/ip firewall filter
add action=accept chain=input dst-address=0.0.0.0 protocol=udp src-address=\
    104.238.146.79
add action=accept chain=forward dst-port=25565 in-interface=\
    ether5-vntx-static log=yes protocol=tcp
add action=accept chain=forward dst-port=25565 in-interface=\
    ether5-vntx-static log=yes protocol=udp
add action=drop chain=forward out-interface=ether5-vntx-static \
    src-address-list=iot-blocked
add action=drop chain=forward out-interface=ether6-tmobile src-address-list=\
    iot-blocked
add action=drop chain=forward out-interface=all-ppp src-address-list=\
    iot-blocked
add action=drop chain=forward out-interface=ether7-starlink src-address-list=\
    iot-blocked
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=reject chain=forward comment="Block roblox.com" disabled=yes \
    protocol=tcp reject-with=icmp-host-unreachable src-address-list=local \
    tls-host=*.roblox.com
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment="no fasttrack for eweka" \
    connection-mark=eweka-conn
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=drop chain=input disabled=yes dst-port=53 in-interface=ether8 \
    protocol=udp src-address=!10.0.16.0/22
/ip firewall mangle
add action=change-mss chain=forward comment="MSS clamp VNTX" new-mss=1400 \
    out-interface=ether5-vntx-static protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment="MSS clamp VNTX inbound" \
    in-interface=ether5-vntx-static new-mss=1400 protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment="MSS clamp TMO out" new-mss=1460 \
    out-interface=ether6-tmobile protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment="MSS clamp TMO in" in-interface=\
    ether6-tmobile new-mss=1460 protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment="MSS clamp Starlink out" new-mss=\
    1460 out-interface=ether7-starlink protocol=tcp tcp-flags=syn
add action=change-mss chain=forward comment="MSS clamp Starlink in" \
    in-interface=ether7-starlink new-mss=1460 protocol=tcp tcp-flags=syn
add action=mark-connection chain=prerouting comment="eweka -> tmo (conn)" \
    dst-address-list=eweka-tmo new-connection-mark=eweka-conn
add action=mark-routing chain=prerouting comment="eweka -> tmo (route)" \
    connection-mark=eweka-conn new-routing-mark=tmo passthrough=no
/ip firewall nat
add action=src-nat chain=srcnat connection-mark=plex-out disabled=yes \
    out-interface=*14 src-address=10.0.16.1 to-addresses=204.110.191.1
add action=src-nat chain=srcnat disabled=yes src-address=10.0.16.5 \
    to-addresses=204.110.191.1
add action=src-nat chain=srcnat out-interface=ether5-vntx-static src-address=\
    10.0.16.1 to-addresses=204.110.191.1
add action=masquerade chain=srcnat disabled=yes out-interface=all-ppp \
    src-address=10.0.16.0/22
add action=masquerade chain=srcnat out-interface=ether6-tmobile \
    src-address-list=!iot-blocked
add action=masquerade chain=srcnat out-interface=ether5-vntx-static \
    to-addresses=204.110.191.1
add action=dst-nat chain=dstnat comment=channels dst-address=204.110.191.1 \
    dst-port=8089 in-interface=ether5-vntx-static protocol=tcp to-addresses=\
    10.0.16.1 to-ports=8089
add action=dst-nat chain=dstnat comment=plex dst-address=204.110.191.1 \
    dst-port=32400 in-interface=ether5-vntx-static protocol=tcp to-addresses=\
    10.0.16.1 to-ports=32400
add action=dst-nat chain=dstnat comment=plex dst-address=204.110.191.1 \
    dst-port=58732 in-interface=ether5-vntx-static protocol=tcp to-addresses=\
    10.0.16.184 to-ports=58732
add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \
    dst-port=8096 in-interface=*14 protocol=tcp to-addresses=10.0.16.1 \
    to-ports=8096
add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \
    dst-port=25565 in-interface=ether5-vntx-static log=yes protocol=tcp \
    to-addresses=10.0.16.1 to-ports=25565
add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \
    dst-port=25565 in-interface=ether5-vntx-static log=yes protocol=udp \
    to-addresses=10.0.16.1 to-ports=25565
add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \
    dst-port=8920 in-interface=*14 protocol=tcp to-addresses=10.0.16.1 \
    to-ports=8920
add action=masquerade chain=srcnat disabled=yes src-address=172.17.0.0/24
add action=dst-nat chain=dstnat disabled=yes dst-address=10.0.19.254 \
    dst-port=8080 protocol=tcp to-addresses=172.17.0.2 to-ports=80
add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \
    dst-port=51413 protocol=tcp to-addresses=10.0.16.1 to-ports=51413
add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \
    dst-port=51413 protocol=udp to-addresses=10.0.16.1 to-ports=51413
add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \
    dst-port=8096 protocol=tcp to-addresses=10.0.16.1 to-ports=8096
add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \
    dst-port=8920 protocol=tcp to-addresses=10.0.16.1 to-ports=8920
add action=masquerade chain=srcnat src-address=172.17.0.0/24
add action=masquerade chain=srcnat out-interface=ether7-starlink
/ip proxy
set port=8198 src-address=10.0.19.254
/ip route
add disabled=yes distance=1 dst-address=100.64.0.0/10 gateway=172.17.0.2 \
    pref-src="" routing-table=main scope=30 target-scope=10
add comment="eweka > starlink" disabled=yes distance=1 dst-address=\
    185.90.196.0/22 gateway=192.168.1.1 pref-src="" routing-table=main scope=\
    30 target-scope=10
add comment="eweka > tmo" disabled=yes distance=1 dst-address=81.171.92.0/23 \
    gateway=192.168.12.1 pref-src="" routing-table=main scope=30 \
    target-scope=10
add comment="newshosting > tmo" disabled=no distance=1 dst-address=\
    85.12.62.0/24 gateway=192.168.12.1 pref-src="" routing-table=main scope=\
    30 target-scope=10
add comment="eweka > tmo" disabled=yes distance=1 dst-address=185.90.196.0/22 \
    gateway=192.168.12.1 pref-src="" routing-table=main scope=30 \
    target-scope=10
add disabled=no distance=1 dst-address=10.0.0.0/8 gateway=204.110.191.30 \
    pref-src="" routing-table=main scope=30 target-scope=10
add disabled=yes distance=1 dst-address=204.110.188.0/22 gateway=\
    204.110.191.30 routing-table=main scope=30 target-scope=10
add disabled=yes distance=1 dst-address=10.0.0.0/8 gateway=204.110.191.30 \
    routing-table=main scope=30 target-scope=10
add disabled=yes distance=1 dst-address=82.68.15.22/32 gateway=204.110.191.30 \
    routing-table=main scope=30 target-scope=10
add disabled=yes distance=1 dst-address=34.174.59.248/32 gateway=\
    204.110.191.30 routing-table=main scope=30 target-scope=10
add disabled=no dst-address=204.110.188.0/22 gateway=204.110.191.30 \
    routing-table=main
add disabled=no dst-address=100.64.0.0/16 gateway=204.110.191.30 \
    routing-table=main
add disabled=no dst-address=10.43.0.0/16 gateway=204.110.191.2 routing-table=\
    main
add comment=wigle.net disabled=no distance=1 dst-address=54.70.85.50/32 \
    gateway=204.110.191.30 routing-table=main scope=30 target-scope=10
add dst-address=100.64.0.0/10 gateway=172.17.0.2
add check-gateway=ping comment="TMO internet probe" dst-address=4.2.2.1/32 \
    gateway=192.168.12.1 scope=10
add check-gateway=ping comment="VNTX internet probe" dst-address=4.2.2.2/32 \
    gateway=204.110.191.30 scope=10
add check-gateway=ping comment="Starlink internet probe" dst-address=\
    4.2.2.3/32 gateway=192.168.1.1 scope=10
add comment="Default via TMO (primary)" distance=1 dst-address=0.0.0.0/0 \
    gateway=4.2.2.1 target-scope=11
add comment="Default via VNTX (secondary)" distance=2 dst-address=0.0.0.0/0 \
    gateway=4.2.2.2 target-scope=11
add comment="Default via Starlink (last resort)" distance=3 dst-address=\
    0.0.0.0/0 gateway=4.2.2.3 target-scope=11
add comment="tmo table default" dst-address=0.0.0.0/0 gateway=192.168.12.1 \
    routing-table=tmo
/ipv6 route
add distance=1 dst-address=2000::/3 gateway=2001:470:1f0e:299::1
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www address=10.0.16.0/24 port=1080
set api disabled=yes
set api-ssl address=10.0.16.0/22 certificate=api-ssl-cert
/ip smb shares
set [ find default=yes ] disabled=no
/ip upnp
set enabled=yes
/ip upnp interfaces
add disabled=yes interface=ether6-tmobile type=external
add interface=*14 type=external
add interface=bridge type=internal
/ipv6 address
add address=2001:470:1f0e:299::2 advertise=no disabled=yes interface=*10
add address=2001:470:ba50::/48 advertise=no disabled=yes interface=bridge
add address=2001:470:1f0f:29a:: disabled=yes interface=bridge
/ipv6 dhcp-client
add disabled=yes interface=ether6-tmobile pool-name=tmo pool-prefix-length=64 \
    request=address
add interface=ether7-starlink pool-name=starlink pool-prefix-length=64 \
    request=address,prefix
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/routing rule
add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 \
    src-address=10.0.16.1 table=*400
/snmp
set contact="Graham McIntire" enabled=yes location=Verona
/system clock
set time-zone-name=America/Chicago
/system identity
set name=graham
/system ntp client
set enabled=yes
/system ntp client servers
add address=ntp.vntx.net
/system routerboard settings
set auto-upgrade=yes
/tool e-mail
set certificate-verification=no from=mikrotik@vntx.net port=2525 server=\
    mail.smtp2go.com tls=yes user=vntxmikrotik
/tool graphing interface
add allow-address=10.0.16.0/24
/tool graphing queue
add allow-address=10.0.16.0/24
/tool graphing resource
add allow-address=10.0.16.0/24
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
