# 2026-05-08 17:47:56 by RouterOS 7.21.4
# software id = 5HTF-YFWV
#
# model = CCR1009-7G-1C-1S+
# serial number = 6F5006EA1923
/interface bridge
add name=bridge_cpe_mgmt port-cost-mode=short
add name=newhope port-cost-mode=short
/interface ethernet
set [ find default-name=combo1 ] l2mtu=9000 rx-flow-control=auto \
    tx-flow-control=auto
set [ find default-name=ether1 ] l2mtu=9000 rx-flow-control=auto \
    tx-flow-control=auto
set [ find default-name=ether2 ] l2mtu=9000 name=ether2-380 rx-flow-control=\
    auto tx-flow-control=auto
set [ find default-name=ether3 ] disabled=yes l2mtu=2024 name=\
    ether3-lowrycrossing-old rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether4 ] disabled=yes l2mtu=2024 rx-flow-control=auto \
    tx-flow-control=auto
set [ find default-name=ether5 ] l2mtu=9000 name=ether5-switch \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether6 ] l2mtu=9000 name=ether6-lowrycrossing \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether7 ] l2mtu=9000 name=ether7-tower \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=sfp-sfpplus1 ] l2mtu=9000 loop-protect=off name=\
    sfp-sfpplus1-edgepoint rx-flow-control=auto tx-flow-control=auto
/interface vlan
add interface=ether5-switch name=mgmt_ether5 vlan-id=10
add interface=sfp-sfpplus1-edgepoint name=mgmt_sfp+ vlan-id=10
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
add dns-name=newhope.vntx.net hotspot-address=100.64.19.254 login-by=\
    mac,http-chap mac-auth-mode=mac-as-username-and-password name=hsprof1 \
    use-radius=yes
/ip hotspot
add addresses-per-mac=unlimited idle-timeout=none interface=\
    sfp-sfpplus1-edgepoint name=hotspot1 profile=hsprof1
/ip hotspot user profile
set [ find default=yes ] add-mac-cookie=no on-logout="/ip hotspot host remove \
    [find where address=\94\$address\94 and !authorized and !bypassed]" \
    session-timeout=1h shared-users=2
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=\
    aes-256-cbc,aes-128-cbc pfs-group=modp2048
/ip pool
add name=dhcp_pool1 ranges=10.100.128.1-10.100.142.254
add name=dhcp_pool2 ranges=172.16.128.1-172.16.143.253
add name=dhcp_pool3 ranges=10.10.128.1-10.10.142.253
add name=cgnat ranges=100.64.19.1-100.64.19.249
add name=public-temp ranges=204.110.189.1-204.110.189.125
add name=cgnat-full ranges=100.64.16.1-100.64.19.249
add name=dhcp_pool6 ranges=10.0.108.1-10.0.108.249
/ip dhcp-server
add address-pool=dhcp_pool3 interface=bridge_cpe_mgmt lease-script="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
    c24944-c947-4e01-9c54-07a1653d2e3e\"\
    \n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
    \n:local max 1\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n  :if (\$leaseBound = 0) do {\
    \n    # Try url2 (iptrack.vntx.net) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
    t for \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
    on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    # Try url (gaiia) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
    or \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
    attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 3s;\
    \n    }\
    \n  } else {\
    \n    :delay 1s;\
    \n    :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
    seActIP] agent-remote-id];\
    \n\
    \n    # Try url2 (iptrack.vntx.net) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
    for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
    \_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
    ;\
    \n    }\
    \n\
    \n    # Try url (gaiia) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP assignment successfully sent to gaiia AWS API for\
    \_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
    tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 30s;\
    \n    }\
    \n  }\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" lease-time=1h name=management
add address-pool=dhcp_pool6 interface=ether7-tower lease-time=1h name=\
    newhope-tower
/ip smb users
set [ find default=yes ] disabled=yes
/ipv6 pool
add name=newhope-v6 prefix=2606:1c80:1:5000::/52 prefix-length=64
/ppp profile
set *0 remote-address=dhcp_pool3
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
    local-address=100.64.19.253 name=newhope on-down="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
    7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
    \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
    \n:local max 1\
    \n\
    \n:local localAddr \$\"local-address\"\
    \n:local remoteAddr \$\"remote-address\"\
    \n:local callerId \$\"caller-id\"\
    \n:local calledId \$\"called-id\"\
    \n:local interfaceName [/interface get \$interface name]\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n\
    \n  # Try url2 (iptrack.vntx.net)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
    http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
    d\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
    \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success1 1;\
    \n    :log info \"PPPoE deassignment successfully sent to iptrack.vntx.net\
    \_for \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send deassignment to iptrack.vntx.net o\
    n attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  # Try url (AWS API)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
    ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
    \\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
    \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success2 1;\
    \n    :log info \"PPPoE deassignment successfully sent to gaiia AWS API fo\
    r \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoPoE FAILED to send deassignment to gaiia AWS API on\
    \_attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  } else {\
    \n    :delay 3s;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" on-up="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
    7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
    \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
    \n:local max 5\
    \n\
    \n:local localAddr \$\"local-address\"\
    \n:local remoteAddr \$\"remote-address\"\
    \n:local callerId \$\"caller-id\"\
    \n:local calledId \$\"called-id\"\
    \n:local interfaceName [/interface get \$interface name]\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n\
    \n  # Try url2 (iptrack.vntx.net)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
    http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
    d\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
    \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success1 1;\
    \n    :log info \"PPPoE assignment successfully sent to iptrack.vntx.net f\
    or \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send assignment to iptrack.vntx.net on \
    attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  # Try url (gaiia)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
    ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
    \\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
    \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success2 1;\
    \n    :log info \"PPPoE assignment successfully sent to gaiia AWS API for \
    \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send assignment to gaiia AWS API on att\
    empt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  } else {\
    \n    :delay 3s;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" remote-address=cgnat use-upnp=no
/queue type
add kind=pcq name=delinquent_download pcq-classifier=dst-address \
    pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \
    pcq-total-limit=250000KiB
add kind=pcq name=delinquent_upload pcq-classifier=src-address \
    pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \
    pcq-total-limit=250000KiB
add kind=fq-codel name=fq-codel
/queue interface
set combo1 queue=fq-codel
set ether1 queue=fq-codel
set ether2-380 queue=fq-codel
set ether3-lowrycrossing-old queue=fq-codel
set ether4 queue=fq-codel
set ether5-switch queue=fq-codel
set ether6-lowrycrossing queue=fq-codel
set ether7-tower queue=fq-codel
set sfp-sfpplus1-edgepoint queue=fq-codel
/routing bgp template
set default as=393837 disabled=yes output.network=bgp-networks .redistribute=\
    connected
/routing id
add disabled=no id=10.254.254.108 name=id-1 select-dynamic-id=""
/routing ospf instance
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
    ospf-out redistribute=connected,rip router-id=id-1
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
    ospf-out router-id=id-1 version=3
/routing ospf area
add disabled=no instance=default-v2 name=backbone-v2
add disabled=no instance=default-v3 name=backbone-v3
/snmp community
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
    kdyyJrT0Mm
/system logging action
set 3 remote=10.240.1.250 src-address=10.254.254.108
add name=logs remote=204.110.191.229 src-address=10.254.254.108 target=remote
/interface bridge port
add bridge=bridge_cpe_mgmt ingress-filtering=no interface=mgmt_ether5 \
    internal-path-cost=10 path-cost=10
add bridge=bridge_cpe_mgmt ingress-filtering=no interface=mgmt_sfp+ \
    internal-path-cost=10 path-cost=10
add bridge=newhope ingress-filtering=no interface=combo1 internal-path-cost=\
    10 path-cost=10
add bridge=newhope interface=ether5-switch
add bridge=newhope interface=sfp-sfpplus1-edgepoint
/ip firewall connection tracking
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
    tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
    tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
    tcp-time-wait-timeout=2m udp-stream-timeout=2m
/ip settings
set tcp-syncookies=yes
/interface pppoe-server server
add authentication=mschap2 default-profile=newhope disabled=no interface=\
    newhope max-mru=1492 max-mtu=1492 one-session-per-host=yes service-name=\
    newhope
/interface sstp-server server
set certificate=vntx.net.pem_0
/ip address
add address=10.254.254.108 interface=lo network=10.254.254.108
add address=10.250.1.110/29 interface=ether6-lowrycrossing network=\
    10.250.1.104
add address=10.10.143.254/20 interface=bridge_cpe_mgmt network=10.10.128.0
add address=100.64.19.254/22 interface=sfp-sfpplus1-edgepoint network=\
    100.64.16.0
add address=204.110.188.190/27 interface=sfp-sfpplus1-edgepoint network=\
    204.110.188.160
add address=10.250.1.57/29 interface=ether2-380 network=10.250.1.56
add address=10.0.108.254/24 interface=ether7-tower network=10.0.108.0
/ip dhcp-client
add add-default-route=no disabled=yes interface=ether1
/ip dhcp-relay
add dhcp-server=38.86.38.250 interface=*A local-address=10.254.254.108 name=\
    relay1
/ip dhcp-server
add address-pool=cgnat dhcp-option-set=vntx interface=newhope lease-script="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
    c24944-c947-4e01-9c54-07a1653d2e3e\"\
    \n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
    \n:local max 1\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n  :if (\$leaseBound = 0) do {\
    \n    # Try url2 (iptrack.vntx.net) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
    t for \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
    on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    # Try url (gaiia) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
    or \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
    attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 3s;\
    \n    }\
    \n  } else {\
    \n    :delay 1s;\
    \n    :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
    seActIP] agent-remote-id];\
    \n\
    \n    # Try url2 (iptrack.vntx.net) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
    for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
    \_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
    ;\
    \n    }\
    \n\
    \n    # Try url (gaiia) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP assignment successfully sent to gaiia AWS API for\
    \_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
    tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 30s;\
    \n    }\
    \n  }\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" lease-time=1h name=newhope
/ip dhcp-server lease
add address=100.64.19.250 mac-address=0C:73:EB:B0:BB:5B server=newhope
add address=100.64.19.252 client-id=1:dc:2c:6e:b4:77:0 mac-address=\
    DC:2C:6E:B4:77:00 server=newhope
add address=100.64.19.251 mac-address=74:AC:B9:A3:E0:5C
/ip dhcp-server network
add address=10.0.108.0/24 dns-server=204.110.191.240,204.110.191.20 gateway=\
    10.0.108.254 ntp-server=204.110.191.19
add address=10.10.128.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
    vntx.net gateway=10.10.143.254 ntp-server=204.110.191.19
add address=100.64.16.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\
    vntx.net gateway=100.64.19.254 ntp-server=204.110.191.19
add address=204.110.188.160/27 dns-server=204.110.191.240,204.110.191.20 \
    domain=vntx.net gateway=204.110.188.190 ntp-server=204.110.191.19
/ip dhcp-server option sets
add name=vntx options=*1
/ip dns
set servers=9.9.9.9,1.1.1.1
/ip firewall filter
add action=accept chain=forward comment=\
    "bypass fasttrack for MPLS spine (out)" out-interface=\
    ether6-lowrycrossing
add action=accept chain=forward comment=\
    "bypass fasttrack for MPLS spine (in)" in-interface=ether6-lowrycrossing
add action=accept chain=forward comment=\
    "bypass fasttrack for MPLS spine (out)" out-interface=ether2-380
add action=accept chain=forward comment=\
    "bypass fasttrack for MPLS spine (in)" in-interface=ether2-380
add action=fasttrack-connection chain=forward comment=\
    "fasttrack established/related" connection-state=established,related
add action=accept chain=forward comment="accept established/related" \
    connection-state=established,related
/ip firewall nat
add action=masquerade chain=srcnat src-address=10.0.108.0/24
/ip hotspot ip-binding
add address=100.64.19.251 type=bypassed
add address=100.64.19.250 type=bypassed
add address=204.110.188.0/24
add address=100.64.19.253 type=bypassed
add address=100.64.19.254 type=bypassed
add address=100.64.0.0/10
add address=10.100.128.1-10.100.142.254
add address=10.100.143.0/24 type=bypassed
add address=0.0.0.0/0 type=blocked
/ip hotspot user
add name=admin
/ip hotspot walled-garden
add comment="place hotspot rules here" disabled=yes
add comment="place hotspot rules here" disabled=yes
/ip hotspot walled-garden ip
add action=accept disabled=no dst-address=204.110.191.195 !dst-address-list \
    !dst-port !protocol !src-address !src-address-list
add action=accept disabled=no dst-address=204.110.191.207 !dst-address-list \
    !dst-port !protocol !src-address !src-address-list
add action=accept disabled=no !dst-address !dst-address-list dst-host=\
    provision.vntx.net !dst-port !protocol !src-address !src-address-list
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/ip ipsec profile
set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
    dpd-maximum-failures=5 enc-algorithm=aes-256,aes-128 hash-algorithm=\
    sha256
/ip proxy
set cache-path=web-proxy1 port=33443
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.62
add disabled=yes dst-address=0.0.0.0/0 gateway=10.250.1.105
add disabled=no dst-address=10.254.254.109/32 gateway=10.250.1.105 \
    routing-table=main
add disabled=no dst-address=204.110.188.192/27 gateway=10.250.1.105 \
    routing-table=main
add disabled=no dst-address=100.64.20.0/22 gateway=10.250.1.105 \
    routing-table=main
add disabled=no dst-address=10.10.144.0/20 gateway=10.250.1.105 \
    routing-table=main
/ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set www address=204.110.188.0/22,10.0.0.0/8 disabled=yes port=81
set www-ssl address=204.110.188.0/22,10.0.0.0/8 certificate=vntx.net.pem_0
set ssh address=204.110.188.0/22,10.0.0.0/8 port=1022
set winbox address=204.110.188.0/22,10.0.0.0/8
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
set api-ssl certificate=vntx.net.pem_0
/ip ssh
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
/ip traffic-flow
set cache-entries=256k enabled=yes
/ipv6 address
add address=2606:1c80:0:1001::2 interface=ether2-380
/ipv6 dhcp-server
add disabled=yes interface=sfp-sfpplus1-edgepoint name=server1 prefix-pool=\
    newhope-v6
/mpls interface
add interface=ether2-380 mpls-mtu=1508
add interface=ether6-lowrycrossing mpls-mtu=1508
/mpls ldp
add disabled=no lsr-id=10.254.254.108 transport-addresses=10.254.254.108 vrf=\
    main
/mpls ldp interface
add interface=ether2-380
add interface=ether6-lowrycrossing
/ppp aaa
set interim-update=1h use-radius=yes
/radius
add address=204.110.191.248 require-message-auth=no service=ppp,hotspot,dhcp \
    src-address=204.110.188.190 timeout=3s
add address=204.110.191.2 require-message-auth=no service=ppp,hotspot,dhcp \
    src-address=204.110.188.190 timeout=3s
add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
    ppp,hotspot,dhcp src-address=204.110.188.190 timeout=3s
/radius incoming
set accept=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing filter rule
add chain=ospf-in disabled=no rule="accept;"
add chain=ospf-out disabled=no rule="accept;"
add chain=bgp-in disabled=no rule="accept;"
add chain=bgp-out disabled=no rule="accept;"
/routing ospf interface-template
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
    ether4 priority=1 type=ptp use-bfd=yes
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
    ether6-lowrycrossing priority=1 type=ptp use-bfd=yes
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
    ether2-380 priority=1 type=ptp use-bfd=yes
add area=backbone-v3 cost=10 disabled=no priority=1 use-bfd=no
add area=backbone-v2 disabled=no passive
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=ether4 \
    type=ptp
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=ether2-380 \
    type=ptp
/routing rip static-neighbor
add address="" disabled=no instance=*1
/snmp
set contact=graham@vntx.net enabled=yes location="33.207391, -96.537840"
/system clock
set time-zone-name=America/Chicago
/system identity
set name=NewHope
/system logging
add action=logs topics=info
add disabled=yes topics=!debug,!dns,!snmp,!hotspot
/system note
set note="__     __\
    \n\\ \\   / /__ _ __ ___  _ __   __ _\
    \n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\
    \n  \\ V /  __/ | | (_) | | | | (_| |\
    \n   \\_/ \\___|_|  \\___/|_| |_|\\__,_|\
    \n _   _      _                      _\
    \n| \\ | | ___| |___      _____  _ __| | _____\
    \n|  \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\
    \n| |\\  |  __/ |_ \\ V  V / (_) | |  |   <\\__ \\\
    \n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_|  |_|\\_\\___/\
    \n\
    \n###############################################################\
    \n#                 Welcome to Verona Networks                  #\
    \n#        All connections are monitored and recorded           #\
    \n# Disconnect IMMEDIATELY if you are not an authorized user!   #\
    \n###############################################################\
    \n\
    \n" show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=ntp.vntx.net
add address=0.us.pool.ntp.org
/system package update
set channel=long-term
/system routerboard settings
# Firmware upgraded successfully, please reboot for changes to take effect!
set auto-upgrade=yes
/system scheduler
add interval=5m name=remove_hotspot on-event=\
    "/ip hotspot host remove [/ip hotspot host find where !authorized]" \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \
    start-time=startup
add name=reboot on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    2025-01-21 start-time=03:25:00
add interval=1d name="disable proxy" on-event="/ip proxy set enabled=no\r\
    \n" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2020-04-11 start-time=04:00:00
/system script
add dont-require-permissions=no name=backup owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive source="/export\
    \_file=backup.rsc\
    \n\
    \n;\r\
    \n/tool e-mail send to=\"graham@vntx.net\" subject=(\"mtik backup \" . [/s\
    ystem identity get name]) file=backup.rsc;\r\
    \n\
    \n:log info \"Backup email sent.\";\
    \n"
add dont-require-permissions=no name=rogue-dhcp owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
    ":log warning message=\"Rogue DHCP server detected!\""
/system watchdog
set auto-send-supout=yes ping-start-after-boot=1h send-email-from=\
    support@vntx.net send-email-to=graham@vntx.net send-smtp-server=\
    204.110.191.236 watchdog-timer=no
/tool e-mail
set certificate-verification=no from=NewHope@vntx.net server=\
    smtp.sendgrid.net tls=starttls user=veronanetworks
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add
