# 2026-07-17 08:45:20 by RouterOS 7.23.2 # software id = ZGNY-ZJW7 # # model = RB5009UG+S+ # serial number = HC907QQ15FR /interface bridge add admin-mac=74:4D:28:1A:67:0A auto-mac=no comment=defconf mtu=1500 name=\ bridge port-cost-mode=short add name=containers add mtu=1500 name=docker port-cost-mode=short add mtu=1500 name=dockers port-cost-mode=short /interface ethernet set [ find default-name=ether1 ] l2mtu=9578 set [ find default-name=ether2 ] l2mtu=9578 set [ find default-name=ether3 ] l2mtu=9578 name=ether3-servers set [ find default-name=ether4 ] l2mtu=9578 name=ether4-house-60g set [ find default-name=ether5 ] l2mtu=9578 name=ether5-vntx-static set [ find default-name=ether6 ] l2mtu=9578 name=ether6-tmobile set [ find default-name=ether7 ] l2mtu=9578 name=ether7-starlink set [ find default-name=ether8 ] disabled=yes l2mtu=9578 set [ find default-name=sfp-sfpplus1 ] l2mtu=9586 /interface veth add address=172.17.0.2/16 container-mac-address=4C:B3:A4:3A:BC:FF dhcp=no \ gateway=172.17.0.1 gateway6="" mac-address=4C:B3:A4:3A:BC:FE name=veth1 /container add envlists=tailscale interface=veth1 layer-dir="" logging=yes name=\ tailscale-mikrotik:latest remote-image=\ fluent-networks/tailscale-mikrotik:latest root-dir=\ /disk1/containers/tailscale start-on-boot=yes workdir=/ /interface list add comment=defconf name=WAN add comment=defconf name=LAN /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip pool add name=home ranges=10.0.17.1-10.0.18.249 add name=dhcp_pool1 ranges=10.0.8.1-10.0.14.254 /ip dhcp-server add add-arp=yes address-pool=home bootp-lease-time=lease-time bootp-support=\ dynamic interface=bridge lease-time=8h name=server1 add address-pool=dhcp_pool1 interface=ether3-servers name=servers /ipv6 dhcp-server option add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" /port set 0 baud-rate=9600 /ppp profile set *0 dns-server=204.110.191.240,204.110.191.250 set *FFFFFFFE dns-server=204.110.191.240,204.110.191.250 /queue type set 0 kind=fq-codel /routing table add disabled=no fib name=vntx add disabled=no fib name=tmo add comment="vntx v6 /56 egress via verona" disabled=no fib name=v6-verona /snmp community set [ find default=yes ] addresses=10.0.16.0/22,10.0.0.0/8,204.110.188.0/22 \ name=kdyyJrT0Mm add addresses=::/0 authentication-password=testtest authentication-protocol=\ SHA1 encryption-password=testtest encryption-protocol=AES name=testtest \ security=private add addresses=10.0.16.0/22 name=testlocal /system script add dont-require-permissions=no name=api-ssl-certgen owner=admin policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\ local hostname \"router.example.com\"; :local caName \"local-ca\"; :local \ certName \"api-ssl-cert\"; :local sanList (\"DNS:\" . \$hostname); :foreac\ h i in=[/ip/address find] do={ :local addr [/ip/address get \$i address]; \ :set addr [:pick \$addr 0 [:find \$addr \"/\"]]; :set sanList (\$sanList .\ \_\",IP:\" . \$addr); }; /certificate add name=\$caName common-name=\$caNa\ me key-usage=key-cert-sign,crl-sign days-valid=3650; /certificate sign \$c\ aName; /certificate add name=\$certName common-name=\$hostname subject-alt\ -name=\$sanList key-usage=digital-signature,key-encipherment,tls-server da\ ys-valid=825; /certificate sign \$certName ca=\$caName; /certificate set \ \$certName trusted=yes; /ip/service set api-ssl certificate=\$certName dis\ abled=no; /ip/service set api disabled=yes;" /zerotier set zt1 identity="a5f13ab687:0:487e3dd9982223e1aa0b13752a061609180dd3926b46be2\ 7527a299db6fb1959bc79f486a0e8e70a50a1c0c81c5048ced502f97a4db2cac167551339d\ 137d3c2:8620c195d88a8ccd49c6264419b9bfcb9af6456cb1c0a35c83f7ed3396375fe446\ e18897162866ebcadb374304f379a5ab006e4f0c0e3bb59438fccfcccef0c1" /app set HA-otbr-matter required-hw-devices=ttyACM0:usb1:default:/dev/ttyACM0 set cinny firewall-redirects=8094:80:tcp:web set goaway container-command-lines=goaway:none:docker.io/pommee/goaway:latest set home-assistant container-command-lines=\ home-assistant:none:lscr.io/linuxserver/homeassistant set lorawan-stack secrets="lorawan-stack__admin_password:=" set n8n firewall-redirects=5678:5678:tcp:web set nextcloud container-command-lines="db:none:docker.io/postgres:17,redis:non\ e:docker.io/valkey/valkey:/bin/sh -c 'valkey-server --port 6379 --appendon\ ly yes --requirepass \$VALKEY_PASSWORD',server:none:docker.io/nextcloud:ap\ ache" set otbr required-hw-devices=ttyACM0:usb1:default:/dev/ttyACM0 set pihole environment="pihole:FTLCONF_dns_listeningMode=all,pihole:FTLCONF_we\ bserver_api_password=password" set redlib firewall-redirects=8087:8080:tcp:web set solr container-command-lines=solr:none:docker.io/solr:latest set uptime-kuma container-command-lines=\ uptime-kuma:none:docker.io/louislam/uptime-kuma:1 set zulip secrets="zulip__postgres_password:=,zulip__memcached_password:=,zuli\ p__rabbitmq_password:=,zulip__redis_password:=,zulip__secret_key:=,zulip__\ email_password:=" /container config set registry-url=https://ghcr.io tmpdir=/disk1/pull /container envs add key=ADVERTISE_ROUTES list=tailscale value=10.0.8.0/22,10.0.16.0/22 add key=AUTH_KEY list=tailscale value=\ tskey-auth-kBDB2uu3ms11CNTRL-2hFgTg5bzqeASw8XAx1prepozbPFVsYoc add key=CONTAINER_GATEWAY list=tailscale value=172.17.0.1 add key=PASSWORD list=tailscale value=h8xd9tkryg add key=RUNNING_SCRIPT list=tailscale value=/var/lib/tailscale/running.sh add key=STARTUP_SCRIPT list=tailscale value=/var/lib/tailscale/startup.sh add key=TAILSCALE_ARGS list=tailscale value=\ "--accept-routes --advertise-exit-node" add key=UPDATE_TAILSCALE list=tailscale value="" /container mounts add dst=/var/lib/tailscale list=tailscale src=/tailscale /ip smb set enabled=no /interface bridge port add bridge=bridge comment=defconf ingress-filtering=no interface=\ ether4-house-60g internal-path-cost=10 path-cost=10 add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus1 \ internal-path-cost=10 path-cost=10 add bridge=dockers interface=veth1 /ipv6 settings set accept-router-advertisements=yes /interface detect-internet set detect-interface-list=all internet-interface-list=all lan-interface-list=\ LAN wan-interface-list=WAN /interface list member add comment=defconf interface=bridge list=LAN add interface=ether5-vntx-static list=WAN add interface=ether6-tmobile list=WAN add disabled=yes interface=ether8 list=WAN add interface=ether7-starlink list=WAN add interface=*14 list=WAN /interface ovpn-server server add mac-address=FE:1C:5C:10:15:58 name=ovpn-server1 /ip address add address=10.0.16.254/24 interface=bridge network=10.0.16.0 add address=172.17.0.1/16 interface=dockers network=172.17.0.0 add address=204.110.191.1/27 interface=ether5-vntx-static network=\ 204.110.191.0 add address=10.0.19.254/22 interface=bridge network=10.0.16.0 add address=10.0.15.254/21 interface=ether3-servers network=10.0.8.0 /ip dhcp-client # Interface not active add add-default-route=no interface=ether6-tmobile name=client1 use-peer-dns=\ no use-peer-ntp=no # Interface not active add add-default-route=no interface=ether7-starlink name=client2 use-peer-dns=\ no use-peer-ntp=no /ip dhcp-server lease add address=10.0.16.2 client-id=\ ff:85:d2:82:8a:0:2:0:0:ab:11:cb:63:d8:6c:a1:65:c1:58 comment=unifi \ mac-address=74:83:C2:1D:4C:51 server=server1 add address=10.0.16.1 client-id=1:c8:7f:54:d0:4:2f mac-address=\ C8:7F:54:D0:04:2F server=server1 add address=10.0.19.250 client-id=\ ff:11:94:ec:20:0:1:0:1:2d:e2:38:27:bc:24:11:94:ec:20 mac-address=\ BC:24:11:94:EC:20 server=server1 add address=10.0.16.4 client-id=\ ff:d8:d6:53:a5:0:2:0:0:ab:11:d0:cc:22:d6:96:fe:cd:b1 comment=g.vntx.net \ mac-address=8C:AE:4C:DD:84:92 server=server1 add address=10.0.19.136 client-id=1:38:b4:d3:30:3f:4 comment=dishwasher \ mac-address=38:B4:D3:30:3F:04 server=server1 add address=10.0.18.4 client-id=1:48:da:35:6f:86:a3 comment=nanokvm \ mac-address=48:DA:35:6F:86:A3 server=server1 add address=10.0.18.228 client-id=1:e0:63:da:0:70:89 mac-address=\ E0:63:DA:00:70:89 server=server1 add address=10.0.17.189 client-id=1:c4:e7:ae:17:6d:d3 mac-address=\ C4:E7:AE:17:6D:D3 server=server1 add address=10.0.15.1 client-id=1:bc:24:11:9b:48:92 mac-address=\ BC:24:11:9B:48:92 server=servers add address=10.0.15.2 client-id=1:bc:24:11:62:7b:3f mac-address=\ BC:24:11:62:7B:3F server=servers add address=10.0.15.3 client-id=1:bc:24:11:d4:2f:ed mac-address=\ BC:24:11:D4:2F:ED server=servers add address=10.0.15.4 client-id=1:bc:24:11:43:3f:ff mac-address=\ BC:24:11:43:3F:FF server=servers add address=10.0.15.5 client-id=1:bc:24:11:62:c4:8f mac-address=\ BC:24:11:62:C4:8F server=servers add address=10.0.15.6 client-id=1:bc:24:11:3f:8e:1a mac-address=\ BC:24:11:3F:8E:1A server=servers add address=10.0.15.20 client-id=1:2c:cf:67:d:b9:4c mac-address=\ 2C:CF:67:0D:B9:4C server=servers add address=10.0.15.253 client-id=1:78:9a:18:3f:cb:fe mac-address=\ 78:9A:18:3F:CB:FE server=servers add address=10.0.19.241 client-id=1:f4:92:bf:91:8a:61 mac-address=\ F4:92:BF:91:8A:61 server=server1 add address=10.0.15.21 mac-address=BC:24:11:98:1C:19 server=servers add address=10.0.16.11 client-id=1:74:4d:bd:c5:87:cc mac-address=\ 74:4D:BD:C5:87:CC server=server1 add address=10.0.16.14 client-id=1:f0:24:f9:55:b8:94 mac-address=\ F0:24:F9:55:B8:94 server=server1 add address=10.0.16.3 client-id=1:52:54:0:5c:f7:36 mac-address=\ 52:54:00:5C:F7:36 server=server1 add address=10.0.16.15 client-id=1:20:f8:3b:9:49:cd mac-address=\ 20:F8:3B:09:49:CD server=server1 add address=10.0.16.5 client-id=\ ff:ef:a8:c2:c6:0:1:0:1:31:4c:1f:7:b0:dc:ef:a8:c2:c6 mac-address=\ B0:DC:EF:A8:C2:C6 server=server1 add address=10.0.16.13 mac-address=EC:94:CB:AA:56:A3 server=server1 add address=10.0.15.24 client-id=\ ff:23:7c:24:3e:0:2:0:0:ab:11:ad:b5:e:a0:e1:d9:51:1a mac-address=\ F6:86:CC:17:A7:F9 server=servers add address=10.0.17.42 mac-address=34:AB:95:12:8B:DB server=server1 add address=10.0.15.7 comment=talos4 mac-address=7C:D3:0A:12:C8:7E server=\ servers add address=10.0.15.30 mac-address=94:C6:91:A4:19:80 server=servers add address=10.0.15.31 client-id=\ ff:a:12:17:11:0:1:0:1:31:8f:72:ff:7c:d3:a:12:17:11 mac-address=\ 7C:D3:0A:12:17:11 server=servers add address=10.0.16.10 mac-address=40:F5:20:C5:C7:5E server=server1 add address=10.0.16.12 client-id=1:40:4c:ca:69:9:6c mac-address=\ 40:4C:CA:69:09:6C server=server1 add address=10.0.16.6 client-id=1:e8:f6:a:e0:c4:4 mac-address=\ E8:F6:0A:E0:C4:04 server=server1 add address=10.0.15.25 mac-address=BC:24:11:FB:42:B0 server=servers add address=10.0.19.253 client-id=1:b8:69:f4:9f:b7:12 mac-address=\ B8:69:F4:9F:B7:12 server=server1 /ip dhcp-server network add address=10.0.8.0/21 dns-server=204.110.191.240,204.110.191.250 domain=\ mcintire.me gateway=10.0.15.254 add address=10.0.16.0/22 dns-server=1.1.1.1,204.110.191.250 domain=w5isp.com \ gateway=10.0.19.254 /ip dns set servers=9.9.9.9,204.110.191.250 /ip dns static add address=192.168.88.1 comment=defconf name=router.lan type=A add address=10.0.16.31 comment=dhcp-lease-script_server1_lease-hostname name=\ Lutron-01f3a316.w5isp.com ttl=15m type=A add address=10.0.16.31 comment=dhcp-lease-script_server1_lease-hostname name=\ Lutron-01f3a316 ttl=15m type=A add address=10.0.16.3 comment=dhcp-lease-script_server1_lease-hostname name=\ homeassistant.w5isp.com ttl=15m type=A add address=10.0.16.3 comment=dhcp-lease-script_server1_lease-hostname name=\ homeassistant ttl=15m type=A add address=10.0.16.1 comment=dhcp-lease-script_server1_lease-hostname name=\ Tower.w5isp.com ttl=15m type=A add address=10.0.16.1 comment=dhcp-lease-script_server1_lease-hostname name=\ Tower ttl=15m type=A add address=10.0.16.252 comment=dhcp-lease-script_server1_lease-hostname \ name=10g-switch-house.w5isp.com ttl=15m type=A add address=10.0.16.252 comment=dhcp-lease-script_server1_lease-hostname \ name=10g-switch-house ttl=15m type=A add address=10.0.16.41 comment=dhcp-lease-script_server1_lease-hostname name=\ Living-Room.w5isp.com ttl=15m type=A add address=10.0.16.41 comment=dhcp-lease-script_server1_lease-hostname name=\ Living-Room ttl=15m type=A add address=10.0.16.253 comment=dhcp-lease-script_server1_lease-hostname \ name="Office 2.5G Switch.w5isp.com" ttl=15m type=A add address=10.0.16.253 comment=dhcp-lease-script_server1_lease-hostname \ name="Office 2.5G Switch" ttl=15m type=A add address=10.0.16.36 comment=dhcp-lease-script_server1_lease-hostname name=\ HallwayAP.w5isp.com ttl=15m type=A add address=10.0.16.38 comment=dhcp-lease-script_server1_lease-hostname name=\ LivingRoom.w5isp.com ttl=15m type=A add address=10.0.16.36 comment=dhcp-lease-script_server1_lease-hostname name=\ HallwayAP ttl=15m type=A add address=10.0.16.38 comment=dhcp-lease-script_server1_lease-hostname name=\ LivingRoom ttl=15m type=A add address=10.0.16.86 comment=dhcp-lease-script_server1_lease-hostname name=\ OutsideNE.w5isp.com ttl=15m type=A add address=10.0.16.86 comment=dhcp-lease-script_server1_lease-hostname name=\ OutsideNE ttl=15m type=A add address=10.0.16.43 comment=dhcp-lease-script_server1_lease-hostname name=\ HousePoESwitch.w5isp.com ttl=15m type=A add address=10.0.16.43 comment=dhcp-lease-script_server1_lease-hostname name=\ HousePoESwitch ttl=15m type=A add address=10.0.16.56 comment=dhcp-lease-script_server1_lease-hostname name=\ driveway.w5isp.com ttl=15m type=A add address=10.0.16.56 comment=dhcp-lease-script_server1_lease-hostname name=\ driveway ttl=15m type=A add address=10.0.16.44 comment=dhcp-lease-script_server1_lease-hostname name=\ Garins-MBP.w5isp.com ttl=15m type=A add address=10.0.16.44 comment=dhcp-lease-script_server1_lease-hostname name=\ Garins-MBP ttl=15m type=A add address=10.0.16.64 comment=dhcp-lease-script_server1_lease-hostname name=\ Apple-Watch.w5isp.com ttl=15m type=A add address=10.0.16.64 comment=dhcp-lease-script_server1_lease-hostname name=\ Apple-Watch ttl=15m type=A add address=10.0.16.37 comment=dhcp-lease-script_server1_lease-hostname name=\ gmcparallels.w5isp.com ttl=15m type=A add address=10.0.16.37 comment=dhcp-lease-script_server1_lease-hostname name=\ gmcparallels ttl=15m type=A add address=10.0.16.33 comment=dhcp-lease-script_server1_lease-hostname name=\ mbp14.w5isp.com ttl=15m type=A add address=10.0.16.33 comment=dhcp-lease-script_server1_lease-hostname name=\ mbp14 ttl=15m type=A add address=10.0.16.30 comment=dhcp-lease-script_server1_lease-hostname name=\ Office.w5isp.com ttl=15m type=A add address=10.0.16.30 comment=dhcp-lease-script_server1_lease-hostname name=\ Office ttl=15m type=A add address=10.0.16.49 comment=dhcp-lease-script_server1_lease-hostname name=\ openspot2.w5isp.com ttl=15m type=A add address=10.0.16.49 comment=dhcp-lease-script_server1_lease-hostname name=\ openspot2 ttl=15m type=A /ip firewall address-list add address=10.0.16.0/22 list=local add address=185.90.196.0/22 list=starlink add address=10.0.16.78 disabled=yes list=iot-blocked add address=10.0.16.80 disabled=yes list=iot-blocked add address=81.171.92.0/23 list=nzb add address=82.68.15.22 list=nzb add address=85.12.62.0/24 list=nzb add address=10.0.17.189 list=iot-blocked add address=news.eweka.nl list=eweka-tmo add address=185.90.196.0/22 comment="eweka range" list=eweka-tmo add address=81.171.92.0/23 comment="eweka range" list=eweka-tmo add address=204.110.188.0/22 comment="VNTX public IPs" list=trusted add address=100.64.0.0/10 comment="CGNAT pools" list=trusted add address=10.0.0.0/8 comment="RFC 1918 private" list=trusted add address=192.168.0.0/16 comment="RFC 1918 private" list=trusted /ip firewall filter add action=accept chain=input comment="allow trusted to management services" \ dst-port=8728-8729,8291,22 protocol=tcp src-address-list=trusted add action=drop chain=input comment="drop untrusted to management services" \ dst-port=8728-8729,8291,22 protocol=tcp add action=accept chain=input dst-address=0.0.0.0 protocol=udp src-address=\ 104.238.146.79 add action=accept chain=forward dst-port=25565 in-interface=\ ether5-vntx-static log=yes protocol=tcp add action=accept chain=forward dst-port=25565 in-interface=\ ether5-vntx-static log=yes protocol=udp add action=drop chain=forward out-interface=ether5-vntx-static \ src-address-list=iot-blocked add action=drop chain=forward out-interface=ether6-tmobile src-address-list=\ iot-blocked add action=drop chain=forward out-interface=all-ppp src-address-list=\ iot-blocked add action=drop chain=forward out-interface=ether7-starlink src-address-list=\ iot-blocked add action=accept chain=input comment=\ "defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=\ invalid add action=reject chain=forward comment="Block roblox.com" disabled=yes \ protocol=tcp reject-with=icmp-host-unreachable src-address-list=local \ tls-host=*.roblox.com add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp add action=accept chain=input comment=\ "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept in ipsec policy" \ ipsec-policy=in,ipsec add action=accept chain=forward comment="defconf: accept out ipsec policy" \ ipsec-policy=out,ipsec add action=accept chain=forward comment="no fasttrack for eweka" \ connection-mark=eweka-conn add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ connection-state=established,related add action=accept chain=forward comment=\ "defconf: accept established,related, untracked" connection-state=\ established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" \ connection-state=invalid add action=drop chain=forward comment=\ "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \ connection-state=new in-interface-list=WAN add action=drop chain=input disabled=yes dst-port=53 in-interface=ether8 \ protocol=udp src-address=!10.0.16.0/22 /ip firewall mangle add action=change-mss chain=forward comment="MSS clamp VNTX" new-mss=1400 \ out-interface=ether5-vntx-static protocol=tcp tcp-flags=syn add action=change-mss chain=forward comment="MSS clamp VNTX inbound" \ in-interface=ether5-vntx-static new-mss=1400 protocol=tcp tcp-flags=syn add action=change-mss chain=forward comment="MSS clamp TMO out" new-mss=1460 \ out-interface=ether6-tmobile protocol=tcp tcp-flags=syn add action=change-mss chain=forward comment="MSS clamp TMO in" in-interface=\ ether6-tmobile new-mss=1460 protocol=tcp tcp-flags=syn add action=change-mss chain=forward comment="MSS clamp Starlink out" new-mss=\ 1460 out-interface=ether7-starlink protocol=tcp tcp-flags=syn add action=change-mss chain=forward comment="MSS clamp Starlink in" \ in-interface=ether7-starlink new-mss=1460 protocol=tcp tcp-flags=syn add action=mark-connection chain=prerouting comment="eweka -> tmo (conn)" \ dst-address-list=eweka-tmo new-connection-mark=eweka-conn add action=mark-routing chain=prerouting comment="eweka -> tmo (route)" \ connection-mark=eweka-conn new-routing-mark=tmo passthrough=no /ip firewall nat add action=src-nat chain=srcnat connection-mark=plex-out disabled=yes \ out-interface=*14 src-address=10.0.16.1 to-addresses=204.110.191.1 add action=src-nat chain=srcnat disabled=yes src-address=10.0.16.5 \ to-addresses=204.110.191.1 add action=src-nat chain=srcnat out-interface=ether5-vntx-static src-address=\ 10.0.16.1 to-addresses=204.110.191.1 add action=masquerade chain=srcnat disabled=yes out-interface=all-ppp \ src-address=10.0.16.0/22 add action=masquerade chain=srcnat out-interface=ether6-tmobile \ src-address-list=!iot-blocked add action=masquerade chain=srcnat out-interface=ether5-vntx-static \ to-addresses=204.110.191.1 add action=dst-nat chain=dstnat comment=channels dst-address=204.110.191.1 \ dst-port=8089 in-interface=ether5-vntx-static protocol=tcp to-addresses=\ 10.0.16.1 to-ports=8089 add action=dst-nat chain=dstnat comment=plex dst-address=204.110.191.1 \ dst-port=32400 in-interface=ether5-vntx-static protocol=tcp to-addresses=\ 10.0.16.1 to-ports=32400 add action=dst-nat chain=dstnat comment=plex dst-address=204.110.191.1 \ dst-port=58732 in-interface=ether5-vntx-static protocol=tcp to-addresses=\ 10.0.16.184 to-ports=58732 add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ dst-port=8096 in-interface=*14 protocol=tcp to-addresses=10.0.16.1 \ to-ports=8096 add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ dst-port=25565 in-interface=ether5-vntx-static log=yes protocol=tcp \ to-addresses=10.0.16.1 to-ports=25565 add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ dst-port=25565 in-interface=ether5-vntx-static log=yes protocol=udp \ to-addresses=10.0.16.1 to-ports=25565 add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ dst-port=8920 in-interface=*14 protocol=tcp to-addresses=10.0.16.1 \ to-ports=8920 add action=masquerade chain=srcnat disabled=yes src-address=172.17.0.0/24 add action=dst-nat chain=dstnat disabled=yes dst-address=10.0.19.254 \ dst-port=8080 protocol=tcp to-addresses=172.17.0.2 to-ports=80 add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ dst-port=51413 protocol=tcp to-addresses=10.0.16.1 to-ports=51413 add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ dst-port=51413 protocol=udp to-addresses=10.0.16.1 to-ports=51413 add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ dst-port=8096 protocol=tcp to-addresses=10.0.16.1 to-ports=8096 add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ dst-port=8920 protocol=tcp to-addresses=10.0.16.1 to-ports=8920 add action=masquerade chain=srcnat src-address=172.17.0.0/24 add action=masquerade chain=srcnat disabled=yes out-interface=ether7-starlink /ip proxy set port=8198 src-address=10.0.19.254 /ip route add disabled=yes distance=1 dst-address=100.64.0.0/10 gateway=172.17.0.2 \ pref-src="" routing-table=main scope=30 target-scope=10 add comment="eweka > starlink" disabled=yes distance=1 dst-address=\ 185.90.196.0/22 gateway=192.168.1.1 pref-src="" routing-table=main scope=\ 30 target-scope=10 add comment="eweka > tmo" disabled=yes distance=1 dst-address=81.171.92.0/23 \ gateway=192.168.12.1 pref-src="" routing-table=main scope=30 \ target-scope=10 add comment="newshosting > tmo" disabled=no distance=1 dst-address=\ 85.12.62.0/24 gateway=192.168.12.1 pref-src="" routing-table=main scope=\ 30 target-scope=10 add comment="eweka > tmo" disabled=yes distance=1 dst-address=185.90.196.0/22 \ gateway=192.168.12.1 pref-src="" routing-table=main scope=30 \ target-scope=10 add disabled=no distance=1 dst-address=10.0.0.0/8 gateway=204.110.191.30 \ pref-src="" routing-table=main scope=30 target-scope=10 add disabled=yes distance=1 dst-address=204.110.188.0/22 gateway=\ 204.110.191.30 routing-table=main scope=30 target-scope=10 add disabled=yes distance=1 dst-address=10.0.0.0/8 gateway=204.110.191.30 \ routing-table=main scope=30 target-scope=10 add disabled=yes distance=1 dst-address=82.68.15.22/32 gateway=204.110.191.30 \ routing-table=main scope=30 target-scope=10 add disabled=yes distance=1 dst-address=34.174.59.248/32 gateway=\ 204.110.191.30 routing-table=main scope=30 target-scope=10 add disabled=no dst-address=204.110.188.0/22 gateway=204.110.191.30 \ routing-table=main add disabled=no dst-address=100.64.0.0/16 gateway=204.110.191.30 \ routing-table=main add comment=wigle.net disabled=no distance=1 dst-address=54.70.85.50/32 \ gateway=204.110.191.30 routing-table=main scope=30 target-scope=10 add dst-address=100.64.0.0/10 gateway=172.17.0.2 add check-gateway=ping comment="Default via TMO (primary)" disabled=no \ distance=1 dst-address=0.0.0.0/0 gateway=4.2.2.1 target-scope=11 add check-gateway=ping comment="Default via VNTX (secondary)" disabled=no \ distance=2 dst-address=0.0.0.0/0 gateway=4.2.2.2 target-scope=11 add check-gateway=ping comment="Default via Starlink (last\ \n resort)" disabled=yes distance=3 dst-address=0.0.0.0/0 gateway=\ 4.2.2.3 target-scope=11 add check-gateway=ping comment="tmo table default" disabled=no dst-address=\ 0.0.0.0/0 gateway=4.2.2.1 routing-table=tmo add check-gateway=none comment="TMO probe pin" distance=1 dst-address=\ 4.2.2.1/32 gateway=192.168.12.1%ether6-tmobile scope=10 add check-gateway=none comment="VNTX probe pin" distance=1 dst-address=\ 4.2.2.2/32 gateway=204.110.191.30%ether5-vntx-static scope=10 add check-gateway=none comment="Starlink probe pin" disabled=yes distance=1 \ dst-address=4.2.2.3/32 gateway=192.168.1.1%ether7-starlink scope=10 add disabled=yes distance=1 dst-address=192.168.100.0/24 gateway=\ ether7-starlink routing-table=main scope=30 target-scope=10 /ip service set ftp disabled=yes set telnet disabled=yes set www address=10.0.16.0/24 port=1080 set api disabled=yes set api-ssl address=10.0.16.0/22 certificate=api-ssl-cert /ip smb shares set [ find default=yes ] disabled=no /ip upnp set enabled=yes /ip upnp interfaces add disabled=yes interface=ether6-tmobile type=external add interface=*14 type=external add interface=bridge type=internal /ipv6 address add address=::1 comment="home LAN (verona PD /64)" from-pool=home-pd-vntx \ interface=bridge add address=::1:0:0:0:1 comment="servers LAN (verona PD /64)" from-pool=\ home-pd-vntx interface=ether3-servers /ipv6 dhcp-client add add-default-route=yes comment="DHCPv6-PD /56 from verona" \ default-route-distance=2 default-route-tables=v6-verona interface=\ ether5-vntx-static pool-name=home-pd-vntx pool-prefix-length=64 request=\ prefix /ipv6 dhcp-server add dhcp-option=v6-dns interface=bridge name=home-bridge-stateless add dhcp-option=v6-dns interface=ether3-servers name=home-servers-stateless /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related add action=drop chain=input comment=invalid connection-state=invalid add action=accept chain=input comment=icmpv6 protocol=icmpv6 add action=accept chain=input comment=link-local src-address=fe80::/10 add action=accept chain=input comment="vntx internal" src-address=\ 2606:1c80::/32 add action=drop chain=input comment="default deny input" add action=accept chain=forward comment=established connection-state=\ established,related add action=drop chain=forward comment=invalid connection-state=invalid add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\ icmpv6 add action=accept chain=forward comment=icmpv6 protocol=icmpv6 add action=accept chain=forward comment="home outbound (bridge)" \ in-interface=bridge add action=accept chain=forward comment="home outbound (servers)" \ in-interface=ether3-servers add action=drop chain=forward comment="default deny forward" /ipv6 nd set [ find default=yes ] advertise-dns=yes add advertise-dns=yes interface=bridge other-configuration=yes add advertise-dns=yes interface=ether3-servers other-configuration=yes /routing rule add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 \ src-address=10.0.16.1 table=*400 add action=lookup-only-in-table comment=\ "vntx-sourced to home /56 stays local" dst-address=\ 2606:1c80:1001:e00::/56 src-address=2606:1c80::/32 table=main add action=lookup-only-in-table comment="vntx /56 egress via verona only" \ src-address=2606:1c80::/32 table=v6-verona /snmp set contact="Graham McIntire" enabled=yes location=Verona /system clock set time-zone-name=America/Chicago /system identity set name=graham /system ntp client set enabled=yes /system ntp client servers add address=ntp.vntx.net /system routerboard settings set auto-upgrade=yes /tool e-mail set certificate-verification=no from=mikrotik@vntx.net port=2525 server=\ mail.smtp2go.com tls=yes user=vntxmikrotik /tool graphing interface add allow-address=10.0.16.0/24 /tool graphing queue add allow-address=10.0.16.0/24 /tool graphing resource add allow-address=10.0.16.0/24 /tool mac-server set allowed-interface-list=LAN /tool mac-server mac-winbox set allowed-interface-list=LAN