# 2026-05-14 09:37:53 by RouterOS 7.21.4
# software id = Y1CT-1WB1
#
# model = CCR2004-16G-2S+
# serial number = HF109012G8D
/interface bridge
add fast-forward=no name=cpe_vlan_10 port-cost-mode=short
add fast-forward=no mtu=1500 name=public_vlan_100 port-cost-mode=short \
    protocol-mode=none
add add-dhcp-option82=yes dhcp-snooping=yes mtu=1500 name=verona \
    port-cost-mode=short protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1500
set [ find default-name=ether2 ] l2mtu=1500
set [ find default-name=ether3 ] l2mtu=2024 name=ether3-climax-11ghz \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether4 ] l2mtu=9582 name=ether4-verona-tower
set [ find default-name=ether5 ] l2mtu=9582
set [ find default-name=ether6 ] l2mtu=9582 name=ether6-switch
set [ find default-name=ether7 ] l2mtu=9582
set [ find default-name=ether8 ] l2mtu=9582
set [ find default-name=ether9 ] l2mtu=9582
set [ find default-name=ether10 ] l2mtu=1500 name=ether10-powerswitch
set [ find default-name=ether11 ] l2mtu=9582
set [ find default-name=ether12 ] l2mtu=9582
set [ find default-name=ether13 ] l2mtu=9582
set [ find default-name=ether14 ] l2mtu=9582
set [ find default-name=ether15 ] l2mtu=9582 mtu=9000 name=ether15_wave_n
set [ find default-name=ether16 ] l2mtu=9582
set [ find default-name=sfp-sfpplus1 ] l2mtu=9586 name=\
    sfp-sfpplus1-verona-tower-switch
set [ find default-name=sfp-sfpplus2 ] l2mtu=9586 name=sfp-sfpplus2-switch
/interface vlan
add interface=sfp-sfpplus1-verona-tower-switch name=vlan9_sfpplus1 vlan-id=9
add interface=ether15_wave_n name=vlan10_ether15 vlan-id=10
add interface=sfp-sfpplus2-switch name=vlan10_sfpplus2 vlan-id=10
add interface=verona name=vlan_10_ether6 vlan-id=10
add interface=ether6-switch name=vlan_19_ether6 vlan-id=19
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
add dns-name=verona.tx.vntx.net hotspot-address=100.64.3.254 login-by="" \
    name=hsprof1
/ip hotspot user profile
set [ find default=yes ] add-mac-cookie=no
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=\
    aes-256-cbc,aes-128-cbc pfs-group=modp2048
/ip pool
add name=verona-cpe ranges=10.10.0.1-10.10.14.254
add name=altoga-old ranges=10.100.80.1-10.100.94.254
add name=altoga-cpe ranges=10.10.80.1-10.10.94.254
add name=verona-cgnat ranges=100.64.0.1-100.64.3.249
add name=altoga-cgnat ranges=100.64.12.1-100.64.15.253
add name=verona-tower-pool ranges=10.0.101.1-10.0.101.249
/ip dhcp-server
add address-pool=altoga-cpe authoritative=after-2sec-delay disabled=yes \
    interface=vlan_10_ether6 lease-script=":global username \"6aYoFE5Pw8ky1JyO\
    \"\r\
    \n:global password \"aZLnmeROsUYfUNGw\"\r\
    \n:global url \"204.110.191.244\"\r\
    \n:global mode \"http\"\r\
    \n\r\
    \n:if (\$leaseBound = 0) do={\r\
    \n   /tool fetch url=\"\$mode://\$url/api/dhcp_assignments\?ip_address=\$l\
    easeActIP&leased_mac_address=\$leaseActMAC&expired=1\" mode=\$mode keep-re\
    sult=no user=\$username password=\$password\r\
    \n} else={\r\
    \n   { :delay 1 };\r\
    \n   :local remoteID\r\
    \n   :set remoteID [/ip dhcp-server lease get [find where address=\$leaseA\
    ctIP] agent-remote-id]\r\
    \n   /tool fetch url=\"\$mode://\$url/api/dhcp_assignments\?ip_address=\$l\
    easeActIP&leased_mac_address=\$leaseActMAC&remote_id=\$remoteID&expired=0\
    \" mode=\$mode keep-result=no user=\$username password=\$password\r\
    \n};" lease-time=1h name=altoga-cpe
add add-arp=yes address-pool=verona-tower-pool interface=\
    sfp-sfpplus1-verona-tower-switch lease-time=1h name=verona-tower
add add-arp=yes address-pool=verona-cgnat interface=verona lease-script="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
    c24944-c947-4e01-9c54-07a1653d2e3e\"\
    \n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
    \n:local max 1\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n  :if (\$leaseBound = 0) do {\
    \n    # Try url2 (iptrack.vntx.net) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
    t for \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
    on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    # Try url (gaiia) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
    or \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
    attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 3s;\
    \n    }\
    \n  } else {\
    \n    :delay 1s;\
    \n    :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
    seActIP] agent-remote-id];\
    \n\
    \n    # Try url2 (iptrack.vntx.net) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
    for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
    \_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
    ;\
    \n    }\
    \n\
    \n    # Try url (gaiia) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP assignment successfully sent to gaiia AWS API for\
    \_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
    tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 30s;\
    \n    }\
    \n  }\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" lease-time=1h name="verona cgnat" use-radius=accounting
/ip hotspot
add address-pool=verona-cgnat addresses-per-mac=unlimited interface=verona \
    name=hotspot1 profile=hsprof1
/ip smb users
set [ find default=yes ] disabled=yes
/ipv6 dhcp-server option
add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
/ipv6 pool
add name=verona-cust-pd-1 prefix=2606:1c80:1001::/48 prefix-length=56
add name=altoga-cust-pd-1 prefix=2606:1c80:1501::/48 prefix-length=56
/ppp profile
add change-tcp-mss=yes dhcpv6-pd-pool=verona-cust-pd-1 dns-server=\
    204.110.191.240,204.110.191.250 idle-timeout=1h local-address=\
    100.64.15.253 name=pppoe-verona on-down="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
    7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
    \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
    \n:local max 1\
    \n\
    \n:local localAddr \$\"local-address\"\
    \n:local remoteAddr \$\"remote-address\"\
    \n:local callerId \$\"caller-id\"\
    \n:local calledId \$\"called-id\"\
    \n:local interfaceName [/interface get \$interface name]\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n\
    \n  # Try url2 (iptrack.vntx.net)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
    http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
    d\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
    \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success1 1;\
    \n    :log info \"PPPoE deassignment successfully sent to iptrack.vntx.net\
    \_for \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send deassignment to iptrack.vntx.net o\
    n attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  # Try url (AWS API)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
    ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
    \\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
    \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success2 1;\
    \n    :log info \"PPPoE deassignment successfully sent to gaiia AWS API fo\
    r \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoPoE FAILED to send deassignment to gaiia AWS API on\
    \_attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  } else {\
    \n    :delay 3s;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" on-up="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
    7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
    \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
    \n:local max 5\
    \n\
    \n:local localAddr \$\"local-address\"\
    \n:local remoteAddr \$\"remote-address\"\
    \n:local callerId \$\"caller-id\"\
    \n:local calledId \$\"called-id\"\
    \n:local interfaceName [/interface get \$interface name]\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n\
    \n  # Try url2 (iptrack.vntx.net)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
    http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
    d\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
    \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success1 1;\
    \n    :log info \"PPPoE assignment successfully sent to iptrack.vntx.net f\
    or \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send assignment to iptrack.vntx.net on \
    attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  # Try url (gaiia)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
    ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
    \\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
    \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success2 1;\
    \n    :log info \"PPPoE assignment successfully sent to gaiia AWS API for \
    \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send assignment to gaiia AWS API on att\
    empt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  } else {\
    \n    :delay 3s;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" remote-address=verona-cgnat remote-ipv6-prefix-pool=verona-cust-pd-1 \
    use-upnp=no
add change-tcp-mss=yes dhcpv6-pd-pool=altoga-cust-pd-1 dns-server=\
    204.110.191.240,204.110.191.250 idle-timeout=1h local-address=\
    100.64.15.253 name=pppoe-altoga on-down="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
    7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
    \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
    \n:local max 1\
    \n\
    \n:local localAddr \$\"local-address\"\
    \n:local remoteAddr \$\"remote-address\"\
    \n:local callerId \$\"caller-id\"\
    \n:local calledId \$\"called-id\"\
    \n:local interfaceName [/interface get \$interface name]\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n\
    \n  # Try url2 (iptrack.vntx.net)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
    http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
    d\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
    \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success1 1;\
    \n    :log info \"PPPoE deassignment successfully sent to iptrack.vntx.net\
    \_for \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send deassignment to iptrack.vntx.net o\
    n attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  # Try url (AWS API)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
    ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
    \\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
    \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success2 1;\
    \n    :log info \"PPPoE deassignment successfully sent to gaiia AWS API fo\
    r \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoPoE FAILED to send deassignment to gaiia AWS API on\
    \_attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  } else {\
    \n    :delay 3s;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" on-up="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
    7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
    \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
    \n:local max 5\
    \n\
    \n:local localAddr \$\"local-address\"\
    \n:local remoteAddr \$\"remote-address\"\
    \n:local callerId \$\"caller-id\"\
    \n:local calledId \$\"called-id\"\
    \n:local interfaceName [/interface get \$interface name]\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n\
    \n  # Try url2 (iptrack.vntx.net)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
    http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
    d\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
    \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success1 1;\
    \n    :log info \"PPPoE assignment successfully sent to iptrack.vntx.net f\
    or \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send assignment to iptrack.vntx.net on \
    attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  # Try url (gaiia)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
    ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
    \\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
    \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success2 1;\
    \n    :log info \"PPPoE assignment successfully sent to gaiia AWS API for \
    \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send assignment to gaiia AWS API on att\
    empt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  } else {\
    \n    :delay 3s;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" remote-address=altoga-cgnat remote-ipv6-prefix-pool=altoga-cust-pd-1 \
    use-upnp=no
/queue type
add kind=fq-codel name=FQ_Codel
/queue interface
set ether1 queue=FQ_Codel
set ether2 queue=FQ_Codel
set ether3-climax-11ghz queue=FQ_Codel
set ether4-verona-tower queue=FQ_Codel
set ether5 queue=FQ_Codel
set ether6-switch queue=FQ_Codel
set ether7 queue=FQ_Codel
set ether8 queue=FQ_Codel
set ether9 queue=FQ_Codel
set ether10-powerswitch queue=FQ_Codel
set ether11 queue=FQ_Codel
set ether12 queue=FQ_Codel
set ether13 queue=FQ_Codel
set ether14 queue=FQ_Codel
set ether15_wave_n queue=FQ_Codel
set ether16 queue=FQ_Codel
set sfp-sfpplus1-verona-tower-switch queue=FQ_Codel
set sfp-sfpplus2-switch queue=FQ_Codel
/routing bgp instance
add as=393837 name=bgp-instance-1 router-id=10.254.254.101
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing id
add disabled=no id=10.254.254.101 name=id-1 select-dynamic-id=""
/routing ospf instance
add disabled=no in-filter-chain=ospf-in name=default-v2 originate-default=\
    never out-filter-chain=ospf-out redistribute=connected router-id=id-1
/routing ospf area
add disabled=no instance=default-v2 name=backbone-v2
/snmp community
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
    kdyyJrT0Mm
/system logging action
set 3 remote=204.110.191.208 src-address=10.254.254.101
add name=logs remote=204.110.191.229 src-address=10.254.254.101 target=remote
/interface bridge port
add bridge=verona ingress-filtering=no interface=ether6-switch \
    internal-path-cost=10 path-cost=10
add bridge=verona interface=sfp-sfpplus2-switch internal-path-cost=10 \
    path-cost=10
add bridge=verona interface=ether15_wave_n internal-path-cost=10 path-cost=10
add bridge=cpe_vlan_10 interface=vlan_10_ether6 internal-path-cost=10 \
    path-cost=10
add bridge=cpe_vlan_10 interface=vlan10_sfpplus2 internal-path-cost=10 \
    path-cost=10
add bridge=*1F interface=*23 internal-path-cost=10 path-cost=10
add bridge=cpe_vlan_10 interface=vlan10_ether15
add bridge=cpe_vlan_10 interface=ether10-powerswitch
/ip firewall connection tracking
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
    tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
    tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
    tcp-time-wait-timeout=2m udp-stream-timeout=2m
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set tcp-syncookies=yes
/ipv6 settings
set accept-router-advertisements=no
/interface pppoe-server server
add default-profile=pppoe-verona disabled=no interface=verona max-mru=1500 \
    max-mtu=1500 one-session-per-host=yes service-name=verona
add default-profile=pppoe-altoga disabled=no interface=vlan_19_ether6 \
    max-mru=1500 max-mtu=1500 one-session-per-host=yes service-name=altoga
add authentication=mschap2 default-profile=pppoe-verona interface=ether1 \
    max-mru=1492 max-mtu=1492 one-session-per-host=yes service-name=\
    veronatest
/ip address
add address=10.250.1.25/29 interface=ether3-climax-11ghz network=10.250.1.24
add address=10.254.254.101 interface=lo network=10.254.254.101
add address=100.64.3.254/22 interface=verona network=100.64.0.0
add address=204.110.188.254/27 interface=verona network=204.110.188.224
add address=100.64.15.254/22 interface=ether6-switch network=100.64.12.0
add address=10.10.95.254/20 interface=vlan_10_ether6 network=10.10.80.0
add address=10.10.15.254/20 interface=vlan_10_ether6 network=10.10.0.0
add address=10.0.101.254/24 interface=sfp-sfpplus1-verona-tower-switch \
    network=10.0.101.0
add address=10.250.1.145/29 interface=ether6-switch network=10.250.1.144
add address=204.110.191.30/27 interface=vlan9_sfpplus1 network=204.110.191.0
add address=10.25.1.254/24 interface=ether1 network=10.25.1.0
/ip dhcp-server
add add-arp=yes address-pool=verona-cpe authoritative=after-2sec-delay \
    dhcp-option-set=vntx interface=cpe_vlan_10 lease-script="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
    c24944-c947-4e01-9c54-07a1653d2e3e\"\
    \n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
    \n:local max 1\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n  :if (\$leaseBound = 0) do {\
    \n    # Try url2 (iptrack.vntx.net) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
    t for \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
    on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    # Try url (gaiia) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
    or \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
    attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 3s;\
    \n    }\
    \n  } else {\
    \n    :delay 1s;\
    \n    :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
    seActIP] agent-remote-id];\
    \n\
    \n    # Try url2 (iptrack.vntx.net) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
    for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
    \_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
    ;\
    \n    }\
    \n\
    \n    # Try url (gaiia) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP assignment successfully sent to gaiia AWS API for\
    \_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
    tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 30s;\
    \n    }\
    \n  }\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" lease-time=1h name=verona-cpe use-radius=accounting
/ip dhcp-server config
set interim-update=5m
/ip dhcp-server lease
add address=10.0.101.11 client-id=1:58:8a:5a:ef:f:a0 comment="temp exclusion" \
    mac-address=58:8A:5A:EF:0F:AA server=verona-tower
add address=10.0.101.8 comment="exclusion for dell server" mac-address=\
    00:00:00:00:00:08 server=verona-tower
add address=100.64.3.250 client-id=1:48:a9:8a:9d:9b:8a mac-address=\
    48:A9:8A:9D:9B:8A server="verona cgnat"
add address=10.0.101.12 client-id=1:c4:ad:34:1a:ca:96 mac-address=\
    C4:AD:34:1A:CA:96 server=verona-tower
/ip dhcp-server network
add address=10.0.101.0/24 dns-server=204.110.191.240,204.110.191.250 gateway=\
    10.0.101.254 ntp-server=204.110.191.19
add address=10.10.0.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
    vntx.net gateway=10.10.15.254 ntp-server=204.110.191.19
add address=10.10.80.0/20 dns-server=204.110.191.240,204.110.191.250 domain=\
    vntx.net gateway=10.10.95.254 ntp-server=204.110.191.19
add address=100.64.0.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\
    vntx.net gateway=100.64.3.254 ntp-server=204.110.191.19
add address=100.64.12.0/22 dns-server=204.110.191.240,204.110.191.250 domain=\
    vntx.net gateway=100.64.15.254 ntp-server=204.110.191.19
add address=192.168.99.0/24 dns-server=204.110.191.240,204.110.191.250 \
    gateway=192.168.99.254
add address=204.110.188.224/27 dns-server=204.110.191.240,204.110.191.250 \
    domain=vntx.net gateway=204.110.188.254 ntp-server=204.110.191.19
/ip dhcp-server option sets
add name=vntx options=*1
/ip dns
set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
/ip firewall address-list
add address=204.110.188.225 comment="Graham McIntire (1)" list=VeronaEmployee
add address=204.110.188.231 comment="James Hardin (1475)" list=VeronaEmployee
add address=100.64.0.38 comment="Brad Wilson (1491)" list=VeronaEmployee
add address=100.64.0.62 comment="James Hardin (1475)" list=VeronaEmployee
add address=100.64.0.19 comment="TJ Banschbach (1676)" list=50
add address=100.64.0.8 comment="Alma Acosta (28)" list=ResidentialBasic
add address=100.64.0.31 comment="Scott Armstrong (315)" list=ResidentialBasic
add address=100.64.0.29 comment="Beverly Erwin (48)" list=ResidentialBasic
add address=100.64.0.18 comment="Karen Stewart (2050)" list=ResidentialBasic
add address=100.64.0.17 comment="Nathan McTee (273)" list=ResidentialBasic
add address=100.64.0.16 comment="Doug Stowe (1807)" list=ResidentialBasic
add address=100.64.0.45 comment="Debra Vega (112)" list=ResidentialBasic
add address=100.64.0.50 comment="Steven Spurgers (1211)" list=\
    ResidentialBasic
add address=100.64.0.46 comment="Chrissy Eagle 2 (1530)" list=\
    ResidentialBasic
add address=100.64.0.22 comment="Steve Christiaens (329)" list=\
    ResidentialBasic
add address=100.64.0.23 comment="Ryan McTee (306)" list=ResidentialBasic
add address=100.64.0.9 comment="Krysta Bates (218)" list=ResidentialBasic
add address=10.10.0.63 comment="Alicia Torres (1938)" list=ResidentialBasic
add address=10.10.0.47 comment="Alma Acosta (28)" list=ResidentialBasic
add address=10.10.0.17 comment="Judy Devine (277)" list=ResidentialBasic
add address=10.10.0.24 comment="Scott Armstrong (315)" list=ResidentialBasic
add address=100.64.0.14 comment="Teresa Robinson (376)" list=BusinessBasic
add address=10.10.0.59 comment="Teresa Robinson (376)" list=BusinessBasic
add address=204.110.188.226 comment="James Genneken (160)" list=\
    ResidentialAdvanced
add address=204.110.188.233 comment="Joey Whitfield (187)" list=\
    ResidentialAdvanced
add address=204.110.188.229 comment="Vance Peltonen (356)" list=\
    ResidentialAdvanced
add address=204.110.188.234 comment="Sonya McTee (324)" list=\
    ResidentialAdvanced
add address=204.110.188.235 comment="Austin Watkins (769)" list=\
    ResidentialAdvanced
add address=100.64.0.48 comment="Pablo Hernandez (2083)" list=\
    ResidentialAdvanced
add address=204.110.188.237 comment="Ron Lewis (302)" list=\
    ResidentialAdvanced
add address=100.64.0.39 comment="Dana Nance (89)" list=ResidentialAdvanced
add address=100.64.0.30 comment="Chand Parvathaneni (2396)" list=\
    ResidentialAdvanced
add address=100.64.0.28 comment="Mark Fisher (242)" list=ResidentialAdvanced
add address=100.64.0.13 comment="CLAY GILBERT (1839)" list=\
    ResidentialAdvanced
add address=100.64.0.2 comment="JoleneDon Nance (118)" list=\
    ResidentialAdvanced
add address=100.64.0.44 comment="Brad  Sherry Slate (1334)" list=\
    ResidentialAdvanced
add address=100.64.0.47 comment="Eric Barrett (2386)" list=\
    ResidentialAdvanced
add address=100.64.0.49 comment="David Lanman (2486)" list=\
    ResidentialAdvanced
add address=100.64.0.37 comment="Rebekah Moore (386)" list=\
    ResidentialAdvanced
add address=100.64.0.69 comment="Yolanda Medrano (2461)" list=\
    ResidentialAdvanced
add address=100.64.0.6 comment="Jennifer Little (1343)" list=\
    ResidentialAdvanced
add address=100.64.0.5 comment="Amber Krings (1273)" list=ResidentialAdvanced
add address=100.64.0.4 comment="Cherie Eshelman (1153)" list=\
    ResidentialAdvanced
add address=100.64.0.61 comment="Rachel Fuller (286)" list=\
    ResidentialAdvanced
add address=100.64.0.25 comment="Maria Trejo (2284)" list=ResidentialAdvanced
add address=100.64.0.7 comment="Carla Kimberling (1959)" list=\
    ResidentialAdvanced
add address=100.64.0.33 comment="Carmen Lopez (2409)" list=\
    ResidentialAdvanced
add address=100.64.0.51 comment="Kimberly Richards (1726)" list=\
    ResidentialAdvanced
add address=100.64.0.21 comment="Jacqueline Wilder (892)" list=\
    ResidentialAdvanced
add address=100.64.0.3 comment="Derek Rodriguez (2402)" list=\
    ResidentialAdvanced
add address=100.64.0.52 comment="Jonny Taylor (190)" list=ResidentialAdvanced
add address=204.110.188.236 comment="Deja Dodson (2320)" list=\
    ResidentialAdvanced
add address=10.10.0.6 comment="Pablo Hernandez (2083)" list=\
    ResidentialAdvanced
add address=10.10.0.49 comment="Cherie Eshelman (1153)" list=\
    ResidentialAdvanced
add address=10.10.0.54 comment="Jennifer Little (1343)" list=\
    ResidentialAdvanced
add address=10.10.0.58 comment="Rebekah Moore (386)" list=ResidentialAdvanced
add address=10.10.0.70 comment="Vance Peltonen (356)" list=\
    ResidentialAdvanced
add address=10.10.0.62 comment="Carla Kimberling (1959)" list=\
    ResidentialAdvanced
add address=10.10.0.25 comment="Yolanda Medrano (2461)" list=\
    ResidentialAdvanced
add address=10.10.0.15 comment="Maria Trejo (2284)" list=ResidentialAdvanced
add address=10.10.0.69 comment="Rachel Fuller (286)" list=ResidentialAdvanced
add address=10.10.0.73 comment="Carmen Lopez (2409)" list=ResidentialAdvanced
add address=10.10.0.68 comment="Amber Krings (1273)" list=ResidentialAdvanced
add address=10.10.0.91 comment="Anthony Schmoker (1577)" list=\
    ResidentialAdvanced
add address=204.110.188.226 comment="James Genneken (160)" list=Inactive
add address=204.110.188.227 comment="Mike Villa (269)" list=Inactive
add address=204.110.188.232 comment="Tammy Kinser (738)" list=Inactive
add address=204.110.188.234 comment="Sonya McTee (324)" list=Inactive
add address=100.64.0.23 comment="Ryan McTee (306)" list=Inactive
add address=10.10.0.91 comment="Anthony Schmoker (1577)" list=Inactive
add address=100.64.0.60 comment="Allen Taylor (26)" list=BusinessUltra
add address=204.110.188.230 comment="Kirk Vanmeter (216)" list=BusinessUltra
add address=10.10.0.64 comment="Allen Taylor (26)" list=BusinessUltra
add address=100.64.0.12 comment="Penney Warner (70)" list=\
    ResidentialBasic6months
add address=100.64.0.40 comment="Chrissy Eagle (74)" list=\
    ResidentialBasic6months
add address=100.64.0.41 comment="Keith Crank (209)" list=\
    ResidentialBasic6months
add address=100.64.0.36 comment="Mary Hopper (245)" list=\
    ResidentialBasic6months
add address=100.64.0.32 comment="Michael Talbot (262)" list=\
    ResidentialBasic6months
add address=100.64.0.27 comment="Whitey White (303)" list=\
    ResidentialBasic6months
add address=100.64.0.1 comment="Sherrye Richardson (321)" list=\
    ResidentialBasic6months
add address=10.10.0.75 comment="Mary Hopper (245)" list=\
    ResidentialBasic6months
add address=100.64.0.26 comment="Sri Reddy (514)" list=ResidentialCore
add address=204.110.188.225 comment="Graham McIntire (1)" list=Active
add address=204.110.188.230 comment="Kirk Vanmeter (216)" list=Active
add address=204.110.188.233 comment="Joey Whitfield (187)" list=Active
add address=204.110.188.229 comment="Vance Peltonen (356)" list=Active
add address=204.110.188.231 comment="James Hardin (1475)" list=Active
add address=100.64.0.53 comment="William Armstrong (362)" list=Active
add address=204.110.188.235 comment="Austin Watkins (769)" list=Active
add address=100.64.0.48 comment="Pablo Hernandez (2083)" list=Active
add address=204.110.188.237 comment="Ron Lewis (302)" list=Active
add address=100.64.0.8 comment="Alma Acosta (28)" list=Active
add address=100.64.0.41 comment="Keith Crank (209)" list=Active
add address=100.64.0.39 comment="Dana Nance (89)" list=Active
add address=100.64.0.36 comment="Mary Hopper (245)" list=Active
add address=100.64.0.32 comment="Michael Talbot (262)" list=Active
add address=100.64.0.31 comment="Scott Armstrong (315)" list=Active
add address=100.64.0.30 comment="Chand Parvathaneni (2396)" list=Active
add address=100.64.0.29 comment="Beverly Erwin (48)" list=Active
add address=100.64.0.28 comment="Mark Fisher (242)" list=Active
add address=100.64.0.20 comment="Pam Banschbach (383)" list=Active
add address=100.64.0.18 comment="Karen Stewart (2050)" list=Active
add address=100.64.0.17 comment="Nathan McTee (273)" list=Active
add address=100.64.0.16 comment="Doug Stowe (1807)" list=Active
add address=100.64.0.13 comment="CLAY GILBERT (1839)" list=Active
add address=100.64.0.12 comment="Penney Warner (70)" list=Active
add address=100.64.0.2 comment="JoleneDon Nance (118)" list=Active
add address=100.64.0.44 comment="Brad  Sherry Slate (1334)" list=Active
add address=100.64.0.45 comment="Debra Vega (112)" list=Active
add address=100.64.0.47 comment="Eric Barrett (2386)" list=Active
add address=100.64.0.49 comment="David Lanman (2486)" list=Active
add address=100.64.0.26 comment="Sri Reddy (514)" list=Active
add address=100.64.0.50 comment="Steven Spurgers (1211)" list=Active
add address=100.64.0.37 comment="Rebekah Moore (386)" list=Active
add address=100.64.0.14 comment="Teresa Robinson (376)" list=Active
add address=100.64.0.69 comment="Yolanda Medrano (2461)" list=Active
add address=100.64.0.6 comment="Jennifer Little (1343)" list=Active
add address=100.64.0.5 comment="Amber Krings (1273)" list=Active
add address=100.64.0.4 comment="Cherie Eshelman (1153)" list=Active
add address=100.64.0.61 comment="Rachel Fuller (286)" list=Active
add address=100.64.0.25 comment="Maria Trejo (2284)" list=Active
add address=100.64.0.7 comment="Carla Kimberling (1959)" list=Active
add address=100.64.0.60 comment="Allen Taylor (26)" list=Active
add address=100.64.0.33 comment="Carmen Lopez (2409)" list=Active
add address=100.64.0.46 comment="Chrissy Eagle 2 (1530)" list=Active
add address=100.64.0.22 comment="Steve Christiaens (329)" list=Active
add address=100.64.0.1 comment="Sherrye Richardson (321)" list=Active
add address=100.64.0.51 comment="Kimberly Richards (1726)" list=Active
add address=100.64.0.21 comment="Jacqueline Wilder (892)" list=Active
add address=100.64.0.38 comment="Brad Wilson (1491)" list=Active
add address=100.64.0.3 comment="Derek Rodriguez (2402)" list=Active
add address=100.64.0.27 comment="Whitey White (303)" list=Active
add address=100.64.0.9 comment="Krysta Bates (218)" list=Active
add address=100.64.0.52 comment="Jonny Taylor (190)" list=Active
add address=100.64.0.40 comment="Chrissy Eagle (74)" list=Active
add address=204.110.188.236 comment="Deja Dodson (2320)" list=Active
add address=100.64.0.19 comment="TJ Banschbach (1676)" list=Active
add address=10.10.0.63 comment="Alicia Torres (1938)" list=Active
add address=10.10.0.6 comment="Pablo Hernandez (2083)" list=Active
add address=10.10.0.49 comment="Cherie Eshelman (1153)" list=Active
add address=10.10.0.59 comment="Teresa Robinson (376)" list=Active
add address=10.10.0.47 comment="Alma Acosta (28)" list=Active
add address=10.10.0.17 comment="Judy Devine (277)" list=Active
add address=10.10.0.75 comment="Mary Hopper (245)" list=Active
add address=10.10.0.54 comment="Jennifer Little (1343)" list=Active
add address=10.10.0.58 comment="Rebekah Moore (386)" list=Active
add address=10.10.0.70 comment="Vance Peltonen (356)" list=Active
add address=10.10.0.62 comment="Carla Kimberling (1959)" list=Active
add address=10.10.0.25 comment="Yolanda Medrano (2461)" list=Active
add address=10.10.0.15 comment="Maria Trejo (2284)" list=Active
add address=10.10.0.69 comment="Rachel Fuller (286)" list=Active
add address=10.10.0.73 comment="Carmen Lopez (2409)" list=Active
add address=10.10.0.68 comment="Amber Krings (1273)" list=Active
add address=10.10.0.24 comment="Scott Armstrong (315)" list=Active
add address=10.10.0.64 comment="Allen Taylor (26)" list=Active
add address=100.64.0.62 comment="James Hardin (1475)" list=Active
add address=100.64.0.34 comment="America  Trejo (1693)" list=\
    ResidentialAdvanced
add address=100.64.0.34 comment="America  Trejo (1693)" list=Active
add address=100.64.0.15 comment="Bill McTee (373)" list=Active
add address=100.64.0.35 comment="Judy Devine (277)" list=ResidentialBasic
add address=100.64.0.35 comment="Judy Devine (277)" list=Active
/ip firewall filter
add action=accept chain=forward comment=\
    "bypass fasttrack for MPLS spine (out)" out-interface=ether3-climax-11ghz
add action=accept chain=forward comment=\
    "bypass fasttrack for MPLS spine (in)" in-interface=ether3-climax-11ghz
add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes
add action=fasttrack-connection chain=forward comment=\
    "fasttrack established/related" connection-state=established,related
add action=accept chain=forward comment="accept established/related" \
    connection-state=established,related
add action=fasttrack-connection chain=forward connection-state=\
    established,related
add action=fasttrack-connection chain=forward connection-state=new
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat out-interface=vlan9_sfpplus1 src-address=\
    100.64.0.0/22
/ip hotspot ip-binding
add address=10.250.1.146 type=bypassed
add mac-address=48:A9:8A:9D:9B:8A type=bypassed
add address=204.110.188.224/27 type=bypassed
add address=100.64.0.70 disabled=yes mac-address=5C:62:8B:10:0D:5F server=\
    hotspot1 to-address=100.64.0.70 type=bypassed
add address=0.0.0.0/0 disabled=yes
add address=100.64.0.0/22
add address=204.110.188.0/22
add address=100.64.0.70 comment="test router" disabled=yes mac-address=\
    5C:62:8B:10:0D:5F server=hotspot1 to-address=100.64.0.70 type=bypassed
add address=0.0.0.0/0 type=blocked
add address=204.110.191.0/27 comment="graham home /27" type=bypassed
/ip hotspot walled-garden
add dst-host=use1-tauc-mqtt-broker.tplinkcloud.com server=hotspot1
add dst-host=*tplinknbu.com server=hotspot1
add dst-host=*tplinkcloud.com server=hotspot1
add dst-host=*tp-link.com server=hotspot1
add dst-host=vntx.unmsapp.com server=hotspot1
add dst-port=123
add dst-port=8883
add comment="place hotspot rules here" disabled=yes
/ip hotspot walled-garden ip
add action=accept disabled=no dst-address=204.110.191.240 !dst-address-list \
    !dst-port !protocol !src-address !src-address-list
add action=accept disabled=no dst-address=204.110.191.250 !dst-address-list \
    !dst-port !protocol !src-address !src-address-list
add action=accept disabled=no !dst-address !dst-address-list dst-port=8883 \
    protocol=tcp !src-address !src-address-list
/ip ipsec profile
set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
    dpd-maximum-failures=5 enc-algorithm=aes-256,aes-128 hash-algorithm=\
    sha256
/ip proxy
set port=23435
/ip proxy access
add src-address=204.110.188.0/22
add src-address=10.0.0.0/8
add src-address=100.64.0.0/10
add action=deny src-address=0.0.0.0/0
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.30
add disabled=no dst-address=10.43.0.0/16 gateway=204.110.191.1
add disabled=no dst-address=10.0.16.1/32 gateway=204.110.188.225
add disabled=no dst-address=10.0.16.10/32 gateway=204.110.188.225
add disabled=no dst-address=10.0.16.84/32 gateway=204.110.188.225
/ipv6 route
add comment="default via climax P2P" distance=1 dst-address=::/0 gateway=\
    2606:1c80:0:20::2
add blackhole comment="verona /44 aggregate (iBGP origin)" distance=200 \
    dst-address=2606:1c80:1000::/44
add blackhole comment="altoga /44 aggregate (iBGP origin)" distance=200 \
    dst-address=2606:1c80:1500::/44
add comment="core loopback via climax" dst-address=2606:1c80:0:10::253/128 \
    gateway=2606:1c80:0:20::2
/ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set www address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set www-ssl address=204.110.188.0/22,10.0.0.0/8
set ssh address=204.110.188.0/22,10.0.0.0/8 port=1022
set winbox address=204.110.188.0/22,10.0.0.0/8
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
set api-ssl certificate=myCa
/ip ssh
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
/ipv6 address
add address=2606:1c80:0:10::101/128 advertise=no comment=loopback interface=\
    lo
add address=2606:1c80:0:20::1 advertise=no comment="P2P verona<->climax" \
    interface=ether3-climax-11ghz
add address=2606:1c80:1000::1 comment="verona mgmt LAN" interface=verona
add address=2606:1c80:1500::1 comment="altoga mgmt LAN" interface=\
    ether6-switch
add address=2606:1c80:0:30::1 advertise=no comment="P2P verona<->graham home" \
    interface=vlan9_sfpplus1
/ipv6 dhcp-server
add address-pool=verona-cust-pd-1 dhcp-option=v6-dns interface=verona name=\
    verona-cust-pd-server
add address-pool=altoga-cust-pd-1 dhcp-option=v6-dns interface=ether6-switch \
    name=altoga-cust-pd-server
add dhcp-option=v6-dns interface=vlan9_sfpplus1 name=verona-wired-pd \
    prefix-pool=verona-cust-pd-1
/ipv6 firewall filter
add action=accept chain=input comment=established connection-state=\
    established,related
add action=drop chain=input comment=invalid connection-state=invalid
add action=accept chain=input comment=icmpv6 protocol=icmpv6
add action=accept chain=input comment=link-local src-address=fe80::/10
add action=accept chain=input comment=internal src-address=2606:1c80::/32
add action=drop chain=input comment="default deny"
add action=accept chain=forward comment=established connection-state=\
    established,related
add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
    icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
    src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
add advertise-dns=yes interface=verona managed-address-configuration=yes \
    other-configuration=yes
add advertise-dns=yes interface=ether6-switch other-configuration=yes
add advertise-dns=yes interface=vlan9_sfpplus1 other-configuration=yes
/ipv6 nd prefix
add interface=ether6-switch prefix=2606:1c80:1500::/64
add autonomous=no interface=vlan9_sfpplus1 prefix=2606:1c80:0:30::/64
/mpls interface
add interface=ether3-climax-11ghz mpls-mtu=1508
/mpls ldp
add disabled=no lsr-id=10.254.254.101 transport-addresses=10.254.254.101 vrf=\
    main
/mpls ldp interface
add interface=ether3-climax-11ghz
/mpls settings
set propagate-ttl=no
/ppp aaa
set interim-update=15m use-radius=yes
/radius
add address=204.110.191.248 require-message-auth=no service=ppp,hotspot,dhcp \
    src-address=204.110.188.254 timeout=3s
add accounting-backup=yes address=104.238.144.172 disabled=yes \
    require-message-auth=no service=ppp,hotspot,dhcp src-address=\
    204.110.188.254 timeout=3s
add address=204.110.191.2 disabled=yes require-message-auth=no service=\
    ppp,hotspot,dhcp src-address=204.110.188.254 timeout=3s
/radius incoming
set accept=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing bgp connection
add afi=ip,ipv6 as=393837 comment="iBGP to core (v6 RR), v6 transport" \
    instance=bgp-instance-1 local.address=2606:1c80:0:10::101 .role=ibgp \
    multihop=yes name=ibgp-rr-core nexthop-choice=force-self \
    output.filter-chain=v6-ibgp-out .redistribute=connected,static \
    remote.address=2606:1c80:0:10::253 .as=393837 templates=default
/routing filter rule
add chain=ospf-in disabled=no rule="accept;"
add chain=ospf-out disabled=no rule="accept;"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2\
    606:1c80:1500::/44 || dst==2606:1c80:0:10::101/128 || (dst-len==64 && (dst\
    ==2606:1c80:0:20::/64 || dst==2606:1c80:0:30::/64))) { accept; } else { re\
    ject; }"
/routing ospf interface-template
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
    ether3-climax-11ghz priority=1 type=ptp use-bfd=no
add area=backbone-v2 disabled=no passive
/routing ospf static-neighbor
add address=10.250.1.30%ether3-climax-11ghz area=backbone-v2 disabled=no \
    poll-interval=10s
/snmp
set contact=graham@vntx.net enabled=yes location="33.246181, -96.426516"
/system clock
set time-zone-name=America/Chicago
/system identity
set name=Verona
/system logging
add action=remote topics=info
add disabled=yes topics=ospf
add action=disk prefix=gtemp topics=firewall
add action=logs topics=info
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=ntp.vntx.net
add address=0.us.pool.ntp.org
/system package update
set channel=long-term
/system routerboard settings
set auto-upgrade=yes enter-setup-on=delete-key
/system scheduler
add name=reboot on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2025-02-16 start-time=03:00:00
/tool e-mail
set certificate-verification=no from=mikrotik@vntx.net server=10.0.0.250
/tool sniffer
set file-name=sniffer
