--- /dev/null
+# 2026-08-17 22:39:29 by RouterOS 7.23.3\r
+# software id = 2961-C4ZZ\r
+#\r
+# model = RBD52G-5HacD2HnD\r
+# serial number = HCX084RAVFA\r
+/interface bridge\r
+add name=Bridge-Lan\r
+/interface wireless\r
+# managed by CAPsMAN\r
+# channel: 2422/20-Ce/gn(17dBm), SSID: vados, local forwarding\r
+set [ find default-name=wlan1 ] disabled=no mode=ap-bridge ssid=vados \\r
+ wireless-protocol=802.11\r
+# managed by CAPsMAN\r
+# channel: 5200/20-eCee/ac/P(20dBm), SSID: vados5g, local forwarding\r
+set [ find default-name=wlan2 ] disabled=no mode=ap-bridge ssid=vados5g \\r
+ wireless-protocol=802.11\r
+/interface ethernet\r
+set [ find default-name=ether1 ] mac-address=48:8F:5A:8E:1A:BC name=\\r
+ "ether1 - Unet"\r
+/interface list\r
+add comment=defconf name=WAN\r
+add comment=defconf name=LAN\r
+add exclude=LAN include=WAN name=Internet\r
+/interface wireless security-profiles\r
+set [ find default=yes ] supplicant-identity=MikroTik\r
+/ip dhcp-server option\r
+add code=12 name=HostName\r
+add code=119 force=yes name=domain-search-list value="0x03'WORKGROUP'0x00"\r
+/ip dhcp-server option sets\r
+add name=HP1505n options=HostName\r
+add name=StartLife1 options=HostName\r
+add name=amsterDev options=HostName\r
+add name=MiTV options=HostName\r
+add name=miller options=HostName\r
+add name=amster options=HostName\r
+add name=garage options=HostName\r
+add name=domain-search-set options=domain-search-list\r
+add name=VADOS-LEN options=HostName\r
+add name=VADOS-NUC options=HostName\r
+add name=MikroNUC options=HostName\r
+add name=master options=HostName\r
+add name=MikroYellow options=HostName\r
+add name="=\"Client ID\"" options=HostName\r
+/ip dns forwarders\r
+add dns-servers=1.1.1.1,1.0.0.1 name=blsp.at verify-doh-cert=no\r
+add comment=Kra dns-servers=1.0.0.1,1.1.1.1 name=slon2.to verify-doh-cert=no\r
+add dns-servers=1.1.1.1,1.0.0.1 name=slon3.at verify-doh-cert=no\r
+add dns-servers=1.0.0.1,1.1.1.1 name=slon3.cc verify-doh-cert=no\r
+add dns-servers=1.1.1.1,1.0.0.1 name=bs2web.at verify-doh-cert=no\r
+add dns-servers=1.1.1.1,1.0.0.1 name=bs2best.at verify-doh-cert=no\r
+add dns-servers=1.0.0.1,1.1.1.1 name=psrms.is verify-doh-cert=no\r
+/ip pool\r
+add name=dhcp ranges=10.30.30.150-10.30.30.200\r
+/ip dhcp-server\r
+add address-pool=dhcp bootp-support=dynamic dhcp-option-set=domain-search-set \\r
+ interface=Bridge-Lan name=masterDHCP server-address=10.30.30.81\r
+/ip smb users\r
+set [ find default=yes ] disabled=yes\r
+add disabled=yes name=vados\r
+/routing table\r
+add disabled=yes fib name=To-VPN\r
+/system script\r
+add dont-require-permissions=no name=fetchCustom owner=admin policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ \n\\r
+ \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@10\\r
+ .30.30.10.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.10.pub\";\\r
+ \n\\r
+ \n\\r
+ \n#\\r
+ \n\\r
+ \n#root.mnuc.backuper\\r
+ \n\\r
+ \n\\r
+ \n\\r
+ \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@10\\r
+ .30.30.81.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.81.pub\";\\r
+ \n\\r
+ \n\\r
+ \n#:local Script AM-GlobalConfig;\\r
+ \n\\r
+ \n#/system/script/add name=\$Script owner=\$Script source=([ /tool/fetch c\\r
+ heck-certificate=yes-without-crl url=(\$GlobalScriptsUrl . \$Script . \".r\\r
+ sc\") output=user as-value ]->\"data\");\\r
+ \n\\r
+ \n#/usb1/mikro_bak_rsa.pub\\r
+ \n\\r
+ \n\\r
+ \n#:local FetchFile AM-DOHCert.rsc\\r
+ \n\\r
+ \n\\r
+ \n\\r
+ \n:global GlobalScriptsUrl \"https://ros.vados.ru/tmp/\";\\r
+ \n\\r
+ \n:global MkDir;\\r
+ \n\\r
+ \n\\r
+ \n:local FetchFile Manager@id_rsa.pub\\r
+ \n:local localDir \"/\";\\r
+ \n\\r
+ \n\\r
+ \n\\r
+ \n\$MkDir \$localDir;\\r
+ \n\\r
+ \n\\r
+ \n\\r
+ \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \$FetchFile) dst-path=(\\r
+ \$localDir . \$FetchFile);\\r
+ \n"\r
+add comment="Global Config Script" dont-require-permissions=no name=\\r
+ AM-GlobalConfig owner=AM-GlobalConfig policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ !rsc by Vados\r\\r
+ \n# RouterOS script: AM-GlobalConfig\r\\r
+ \n# Script comment: Global Config Script\r\\r
+ \n# Copyright (c) 2007-2026 Vados <vados@vados.ru>\r\\r
+ \n#\r\\r
+ \n#\r\\r
+ \n# Warning: Dont touch this line!\r\\r
+ \n:global Identity [/system/identity/get name];\r\\r
+ \n:global GlobalConfReady false;\r\\r
+ \n#\r\\r
+ \n#\r\\r
+ \n# Global Url For Amster scripts to fetch\r\\r
+ \n# most be defined in AM-Init-Script or AM-setup scripts\r\\r
+ \n:global GlobalScriptsUrl \"https://ros.vados.ru/\";\r\\r
+ \n:global ScriptsUrlSuffix (a);\r\\r
+ \n:global CheckSumsVerify true;\r\\r
+ \n\r\\r
+ \n:global ScriptUpdatesCRLF true;\r\\r
+ \n:global CommentsInScripts true;\r\\r
+ \n\r\\r
+ \n# Debug output:\r\\r
+ \n:global PrintDebug true; #false;\r\\r
+ \n\r\\r
+ \n# Debug output for specific script:\r\\r
+ \n#:set (\$PrintDebugOverride->\"AM-GlobalFunc\") true;\r\\r
+ \n\r\\r
+ \n# Debug logs\r\\r
+ \n# Other actions (disk, email, remote or support) can be used as well.\r\\r
+ \n# I do not recommend using echo - use debug output instead (https://rsc.\\r
+ eworm.de/main/DEBUG.html#debug-output).\r\\r
+ \n#/system/logging/add topics=script,debug action=memory;\r\\r
+ \n\r\\r
+ \n:global MikrotikUpgradeUrl \"https://upgrade.mikrotik.com/routeros\";\r\\r
+ \n:global Domain \"WORKGROUP\";\r\\r
+ \n\r\\r
+ \n:global EmailGeneralTo \"vados@vados.ru\";\r\\r
+ \n#:global EmailGeneralCc \"\";\r\\r
+ \n\r\\r
+ \n# \$ScriptInstallUpdate mod/notification-telegram\r\\r
+ \n:global TelegramTokenId \"8390868324:AAG3_d1hfVR2M6pGAgDK6ZvhOe4J97nyopw\\r
+ \";\r\\r
+ \n:global TelegramChatId \"-1003631309063\"; #\"454403445\";\r\\r
+ \n# Use this to send notifications to a specific topic in group.\r\\r
+ \n#:global TelegramThreadId \"30\";\r\\r
+ \n# Using telegram-chat you have to define trusted chat ids (not group ids\\r
+ !)\r\\r
+ \n# or user names. Groups allow to chat with devices simultaneously.\r\\r
+ \n:global TelegramChatIdsTrusted {\r\\r
+ \n \"454403445\"\r\\r
+ \n \"-1003631309063\"\r\\r
+ \n \"-5124482807\"\r\\r
+ \n \"1087968824\";\r\\r
+ \n};\r\\r
+ \n# \"-5294757340\";\r\\r
+ \n\r\\r
+ \n:global TelegramChatGroups \"(all)\";\r\\r
+ \n#:global TelegramChatGroups \"(all|home|office)\";\r\\r
+ \n\r\\r
+ \n:global NotificationFunctions {\r\\r
+ \n \"email\"\r\\r
+ \n \"telegram\";\r\\r
+ \n};\r\\r
+ \n# Toggle this to disable symbols in notifications.\r\\r
+ \n:global NotificationsWithSymbols true;\r\\r
+ \n:global TerminalColorOutput true;\r\\r
+ \n\r\\r
+ \n:global DetectIpAddrDefault \"https://ipv4.mikrotik.ovh/\";\r\\r
+ \n:global DetectIpAddrFallback \"https://api.ipify.org/\";\r\\r
+ \n\r\\r
+ \n## Update channel. Possible values: stable, long-term, testing, developm\\r
+ ent\r\\r
+ \n:global updateChannel \"stable\";\r\\r
+ \n\r\\r
+ \n:global CertRenewUrl (\$GlobalScriptsUrl . \"certs/\" . \$Identity . \"/\\r
+ \");\r\\r
+ \n:global CertRenewTime 2w;\r\\r
+ \n:global CertRenewPass (a); #{\r\\r
+ \n# \"\";\r\\r
+ \n# \"v3ry-s3cr3t\";\r\\r
+ \n# \"4n0th3r-s3cr3t\";\r\\r
+ \n#};\r\\r
+ \n:global CertWarnTime 1w;\r\\r
+ \n:global CertIssuedExportPass (a); # {\r\\r
+ \n# \"\";\r\\r
+ \n# \"cert1-cn\"=\"v3ry-s3cr3t\";\r\\r
+ \n# \"cert2-cn\"=\"4n0th3r-s3cr3t\";\r\\r
+ \n#};\r\\r
+ \n\r\\r
+ \n# Script BackupAndUpdate mode, possible values: backup,\r\\r
+ \n# updateOnce - Update once as \"osnotify\" and back \"osnotify\" mode (i\\r
+ n terminal run :set OSUpdateMode updateOnce; \$OSUpdateMode;). \r\\r
+ \n# osupdate - Update if available and creates backups before/after update\\r
+ \_(ignores `forceBackup`)\r\\r
+ \n# Set `forceBackup` to true to always create backups, even\\r
+ \_without updates\r\\r
+ \n# osnotify - Set `forceBackup` to always create backups on every run\r\\r
+ \n:global DevInfoIncludeIP true;\r\\r
+ \n:global BackupAndUpdateMode \"osnotify\"\r\\r
+ \n\r\\r
+ \n:global forceBackup true;\r\\r
+ \n:global BackupPassword \"Peskar55\";\r\\r
+ \n\r\\r
+ \n# SFTP Backup Variables\r\\r
+ \n:global BackupRandomDelay 0;\r\\r
+ \n:global BackupUploadUrl \"sftp://amster.vados.ru/upload/\";\r\\r
+ \n:global BackupUploadUser \$Identity;\r\\r
+ \n:global BackupUploadPass \"root.mnuc.backuper\";\r\\r
+ \n\r\\r
+ \n:global BackupSendBinary true;\r\\r
+ \n:global BackupSendExport true;\r\\r
+ \n:global BackupSendGlobalConfig true;\r\\r
+ \n:global BackupSendScripts true;\r\\r
+ \n\r\\r
+ \n# Remove local file after uploading if no errors\r\\r
+ \n:global BackupRmLocal true;\r\\r
+ \n\r\\r
+ \n# Local Backups Root Directory \r\\r
+ \n:global BackupLocalRoot \"tmpfs\";\r\\r
+ \n\r\\r
+ \n# Encrypt Backup\r\\r
+ \n:global BackupEncrypt true;\r\\r
+ \n\r\\r
+ \n# Sensitive information in Backups\r\\r
+ \n:global BackupSens true;\r\\r
+ \n\r\\r
+ \n# User Export\r\\r
+ \n:global BackupUser true;\r\\r
+ \n\r\\r
+ \n# License Export (not for CHR, will silently skip)\r\\r
+ \n:global BackupLicense false;\r\\r
+ \n\r\\r
+ \n# SSH Keys\r\\r
+ \n:global BackupSshKeys true;\r\\r
+ \n\r\\r
+ \n# Certificate Export\r\\r
+ \n:global BackupCerts true;\r\\r
+ \n\r\\r
+ \n# Certificate Password\r\\r
+ \n:global BackupCertsPasswd \"\";\r\\r
+ \n\r\\r
+ \n# User-Manager Export\r\\r
+ \n:global BackupUserMan false;\r\\r
+ \n\r\\r
+ \n# The Dude Export\r\\r
+ \n:global BackupDude false;\r\\r
+ \n\r\\r
+ \n# User Files to export, comma-separated string or array of strings\r\\r
+ \n# User Files are not removed on backup\r\\r
+ \n# Any directory paths will be removed (/ -> _) on remote file\r\\r
+ \n# Nonpresent files are silently skipped\r\\r
+ \n:global BackupUserList \"autosupout.rif,autosupout.old.rif\";\r\\r
+ \n\r\\r
+ \n# load functions and any custom scripts\r\\r
+ \n# [ /system/script/find where name=\"global-config-ov\\r
+ erlay\" ], \\\r\\r
+ \n# [ /system/script/find where name~\"^global-config-o\\r
+ verlay\\\\.d/.\" ]\r\\r
+ \n#\r\\r
+ \n#:foreach Script in=([ /system/script/find where name=\"Amster-TGglobalV\\r
+ ars\" ], [ /system/script/find where name=\"Amster-TGglobalFunc\" ]) do={\\r
+ \r\\r
+ \n# :onerror Err {\r\\r
+ \n# /system/script/run \$Script;\r\\r
+ \n# } do={\r\\r
+ \n# :log error (\"Loading configuration from configs and functions\"\\r
+ \_. [ /system/script/get \$Script name ] . \" failed: \" . \$Err);\r\\r
+ \n# }\r\\r
+ \n#}\r\\r
+ \n#:log info \"\\ndevMode = \$devMode\";\r\\r
+ \n#:log info \"\\ndevRunning = \$devRunning\";\r\\r
+ \n:foreach Script in=[ /system/script/find where source~\"^#!rsc by Vados \\r
+ GlobalRUN\\r\?\\n\" ] do={\r\\r
+ \n :onerror Err {\r\\r
+ \n /system/script/run \$Script;\r\\r
+ \n } do={\r\\r
+ \n :log error (\"Run script \" . [ /system/script/get \$Script name \\r
+ ] . \" width marker \\\" GlobalRUN\\\" failed: \" . \$Err);\r\\r
+ \n }\r\\r
+ \n}\r\\r
+ \n\r\\r
+ \n# signal we are ready\r\\r
+ \n:set GlobalConfReady true;\r\\r
+ \n:while (\$GlobalConfReady != true) do={:delay 500ms};\r\\r
+ \n"\r
+add dont-require-permissions=no name=AM-Fetch-Generator owner=vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\\r
+ \n:local srcFile \"AM-Awg-Generator.rsc\";\\r
+ \n:local dstFile \$srcFile;\\r
+ \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \"/\$srcFile\") dst-pat\\r
+ h=\"/\$dstFile\";\\r
+ \n\\r
+ \nexit 0\\r
+ \n#\\r
+ \n\\r
+ \n#root.mnuc.backuper\\r
+ \n\\r
+ \n\\r
+ \n\\r
+ \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \".bak/mikro_bak_rsa@10\\r
+ .30.30.81.pub\") dst-path=\"/mikro_bak_rsa@10.30.30.81.pub\";\\r
+ \n\\r
+ \n\\r
+ \n#:local Script AM-GlobalConfig;\\r
+ \n\\r
+ \n#/system/script/add name=\$Script owner=\$Script source=([ /tool/fetch c\\r
+ heck-certificate=yes-without-crl url=(\$GlobalScriptsUrl . \$Script . \".r\\r
+ sc\") output=user as-value ]->\"data\");\\r
+ \n\\r
+ \n#/usb1/mikro_bak_rsa.pub\\r
+ \n\\r
+ \n\\r
+ \n#:local FetchFile AM-DOHCert.rsc\\r
+ \n\\r
+ \n\\r
+ \n\\r
+ \n:global GlobalScriptsUrl \"https://ros.vados.ru/tmp/\";\\r
+ \n\\r
+ \n:global MkDir;\\r
+ \n\\r
+ \n\\r
+ \n:local FetchFile Manager@id_rsa.pub\\r
+ \n:local localDir \"/\";\\r
+ \n\\r
+ \n\\r
+ \n\\r
+ \n\$MkDir \$localDir;\\r
+ \n\\r
+ \n\\r
+ \n\\r
+ \n/tool/fetch mode=https url=(\$GlobalScriptsUrl . \$FetchFile) dst-path=(\\r
+ \$localDir . \$FetchFile);\\r
+ \n"\r
+add comment=awg2vds dont-require-permissions=no name=awg2vds-uninstall owner=\\r
+ vados policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\\r
+ \n :put \"Uninstallimg AmneziaWG...\"\\r
+ \n :log info \"Uninstallimg AmneziaWG...\"\\r
+ \n :local prevDNS \"\"\\r
+ \n :do { :set prevDNS [/container/envs/get [find where list=\"awg2vds-env\\r
+ \" key=\"AWG_PREV_DNS\"] value] } on-error={}\\r
+ \n :local prevTmpdir \"\"\\r
+ \n :do { :set prevTmpdir [/container/envs/get [find where list=\"awg2vds-\\r
+ env\" key=\"AWG_PREV_TMPDIR\"] value] } on-error={}\\r
+ \n /ip/route/remove [find where comment=awg2vds-tunnel]\\r
+ \n /ip/route/remove [find where comment=awg2vds-dns]\\r
+ \n /container/stop [find where interface=veth-awg2vds]\\r
+ \n :delay 7s\\r
+ \n /container/remove [find where interface=veth-awg2vds]\\r
+ \n /container/envs/remove [find where list=\"awg2vds-env\"]\\r
+ \n :if (\$prevDNS != \"\") do={\\r
+ \n :do { /ip/dns/set servers=\"\$prevDNS\" } on-error={}\\r
+ \n :put (\"DNS restored to: \$prevDNS\")\\r
+ \n }\\r
+ \n /container/config set tmpdir=\$prevTmpdir\\r
+ \n :put (\"Container tmpdir restored to: \$prevTmpdir\")\\r
+ \n /ip/firewall/nat/remove [find where out-interface=\"wg-awg2vds\"]\\r
+ \n /ip/firewall/nat/remove [find where src-address=\"172.20.200.68/30\"]\\r
+ \n /ip/address/remove [find where address=\"172.20.200.69/30\"]\\r
+ \n /interface/veth/remove [find where name=\"veth-awg2vds\"]\\r
+ \n /interface/wireguard/peers/remove [find where interface=\"wg-awg2vds\"\\r
+ ]\\r
+ \n /ip/address/remove [find where interface=\"wg-awg2vds\"]\\r
+ \n /interface/wireguard/remove [find where name=\"wg-awg2vds\"]\\r
+ \n :do { /file/remove [find where name~\"awg2vds.+tar\"] } on-error={}\\r
+ \n :do { /file/remove [find where name=\"usb1/awg2vds\"] } on-error={}\\r
+ \n :do { /file/remove [find where name=\"usb1/ru_ranges_timeout.rsc\"] } \\r
+ on-error={}\\r
+ \n :do { /file/remove [find where name~\"usb1/pull\"] } on-error={}\\r
+ \n :put \"Uninstall AmneziaWG Proxy complete!\"\\r
+ \n :log info \"Uninstall AmneziaWG Proxy complete!\"\\r
+ \n /system/script/remove [find where name=awg2vds-uninstall]\\r
+ \n"\r
+/user group\r
+add name=backup policy="telnet,ssh,ftp,read,write,policy,test,sniff,sensitive,\\r
+ !local,!reboot,!winbox,!password,!web,!api,!romon,!rest-api"\r
+add name=manager policy="local,ssh,ftp,read,write,policy,api,rest-api,!telnet,\\r
+ !reboot,!test,!winbox,!password,!web,!sniff,!sensitive,!romon"\r
+/certificate settings\r
+set builtin-trust-store=all crl-use=yes\r
+/container config\r
+set memory-high=200.0MiB tmpdir=/usb1/pull\r
+/disk settings\r
+set auto-media-interface=Bridge-Lan\r
+/ip smb\r
+set domain=WORKGROUP enabled=no interfaces=lo\r
+/interface bridge port\r
+add bridge=Bridge-Lan interface=ether2\r
+add bridge=Bridge-Lan interface=ether3\r
+add bridge=Bridge-Lan interface=ether4\r
+add bridge=Bridge-Lan interface=ether5\r
+add bridge=Bridge-Lan interface=wlan1\r
+add bridge=Bridge-Lan interface=wlan2\r
+/interface bridge settings\r
+set allow-fast-path=no use-ip-firewall=yes\r
+/ip neighbor discovery-settings\r
+set discover-interface-list=LAN\r
+/ip settings\r
+set accept-redirects=yes allow-fast-path=no\r
+/ipv6 settings\r
+set accept-router-advertisements-on=none allow-fast-path=no disable-ipv6=yes \\r
+ disable-link-local-address=yes\r
+/interface detect-internet\r
+set detect-interface-list=static internet-interface-list=WAN \\r
+ lan-interface-list=LAN wan-interface-list=WAN\r
+/interface list member\r
+add interface="ether1 - Unet" list=Internet\r
+add interface=Bridge-Lan list=LAN\r
+/interface wireless cap\r
+# \r
+set bridge=Bridge-Lan caps-man-addresses=10.30.30.10 \\r
+ caps-man-certificate-common-names=CAPsMAN-2C900E832E04 certificate=\\r
+ CAP-18FD746E5814 discovery-interfaces=Bridge-Lan enabled=yes interfaces=\\r
+ wlan1,wlan2 lock-to-caps-man=yes\r
+/ip address\r
+add address=10.30.30.81/24 interface=Bridge-Lan network=10.30.30.0\r
+/ip cloud\r
+set ddns-enabled=yes\r
+/ip dhcp-client\r
+add add-default-route=special-classless default-route-distance=2 \\r
+ default-route-tables=main:2 dhcp-options=clientid,clientid_duid \\r
+ interface="ether1 - Unet" name=client1 use-peer-dns=no use-peer-ntp=no\r
+/ip dhcp-server config\r
+set accounting=no\r
+/ip dhcp-server lease\r
+add address=10.30.30.101 client-id=1:48:8f:5a:8e:ee:a8 mac-address=\\r
+ 48:8F:5A:8E:EE:A8 server=masterDHCP\r
+add address=10.30.30.107 client-id=1:f0:de:f1:91:d:1e mac-address=\\r
+ F0:DE:F1:91:0D:1E server=masterDHCP\r
+add address=10.30.30.83 client-id=1:0:80:77:ec:43:86 mac-address=\\r
+ 00:80:77:EC:43:86 server=masterDHCP\r
+add address=10.30.30.50 client-id=1:4:7c:16:36:f5:37 mac-address=\\r
+ 04:7C:16:36:F5:37 server=masterDHCP\r
+add address=10.30.30.71 client-id=1:10:2d:41:2c:20:c2 mac-address=\\r
+ 10:2D:41:2C:20:C2 server=masterDHCP\r
+add address=10.30.30.61 client-id=1:10:8:c1:81:59:5f mac-address=\\r
+ 10:08:C1:81:59:5F server=masterDHCP\r
+add address=10.30.30.72 client-id=1:10:38:1f:d2:5f:13 mac-address=\\r
+ 10:38:1F:D2:5F:13 server=masterDHCP\r
+add address=10.30.30.99 client-id=1:10:b1:df:e9:d0:d5 mac-address=\\r
+ 10:B1:DF:E9:D0:D5 server=masterDHCP\r
+add address=10.30.30.111 client-id=1:fe:2:52:be:3f:16 mac-address=\\r
+ FE:02:52:BE:3F:16 server=masterDHCP\r
+add address=10.30.30.92 client-id=1:d4:6d:6d:fd:e5:49 mac-address=\\r
+ D4:6D:6D:FD:E5:49 server=masterDHCP\r
+add address=10.30.30.93 client-id=1:7e:8b:1e:cb:b8:cb mac-address=\\r
+ CC:42:10:12:46:94 server=masterDHCP\r
+add address=10.30.30.94 client-id=1:50:cc:f8:85:96:a mac-address=\\r
+ 50:CC:F8:85:96:0A server=masterDHCP\r
+add address=10.30.30.82 client-id=1:e4:18:6b:58:34:ab mac-address=\\r
+ E4:18:6B:58:34:AB server=masterDHCP\r
+add address=10.30.30.75 client-id=1:0:27:15:41:97:a9 mac-address=\\r
+ 00:27:15:41:97:A9 server=masterDHCP\r
+add address=10.30.30.77 dhcp-option=HostName dhcp-option-set=StartLife1 \\r
+ mac-address=C4:82:E1:03:49:10 server=masterDHCP\r
+add address=10.30.30.73 client-id=1:10:38:1f:82:81:f2 mac-address=\\r
+ 10:38:1F:82:81:F2 server=masterDHCP\r
+add address=10.30.30.96 client-id=iPhone mac-address=4A:91:ED:0E:1F:39 \\r
+ server=masterDHCP\r
+add address=10.30.30.74 client-id=MiTV dhcp-option=HostName dhcp-option-set=\\r
+ MiTV mac-address=20:72:A9:D3:34:36 server=masterDHCP\r
+/ip dhcp-server network\r
+add address=10.30.30.0/24 caps-manager=10.30.30.10 dhcp-option=\\r
+ domain-search-list dhcp-option-set=domain-search-set dns-server=\\r
+ 10.30.30.81 domain=WORKGROUP gateway=10.30.30.81 netmask=24 ntp-server=\\r
+ 10.30.30.81,10.30.30.10 wins-server=10.30.30.95,10.30.30.98\r
+/ip dns\r
+set allow-remote-requests=yes servers=10.30.30.33,89.110.101.17\r
+/ip dns static\r
+add address=10.30.30.81 comment=defconf name=router.lan type=A\r
+add address=10.30.30.81 comment=defconf name=master type=A\r
+add address=10.30.30.33 comment=amster name=amster.vados.ru type=A\r
+add address=8.8.8.8 name=dns.google type=A\r
+add address=8.8.4.4 name=dns.google type=A\r
+add address=1.0.0.1 comment="CloudFlare-doh IPv4 2" name=\\r
+ security.cloudflare-dns.com type=A\r
+add address=1.1.1.1 comment="CloudFlare-doh IPv4 1" name=\\r
+ security.cloudflare-dns.com type=A\r
+add address=149.112.112.112 comment="Cuad9-dns IPv4 2" disabled=yes name=\\r
+ dns.quad9.net type=A\r
+add address=9.9.9.9 comment="Cuad9-dns IPv4 1" disabled=yes name=\\r
+ dns.quad9.net type=A\r
+add address=91.192.189.2 comment=Unet-DNS disabled=yes name=ns1.unet.ws type=\\r
+ A\r
+add address=91.192.189.2 comment=Unet-DNS disabled=yes name=ns1.unet.ws type=\\r
+ A\r
+/ip firewall address-list\r
+add address=10.0.0.0/8 list=RFC1918\r
+add address=172.16.0.0/12 list=RFC1918\r
+add address=192.168.0.0/16 list=RFC1918\r
+add address=91.215.120.206 list=TRUSTED\r
+add address=185.71.70.78 disabled=yes list=TRUSTED\r
+add address=176.53.203.171 disabled=yes list=TRUSTED\r
+add address=176.53.203.170 disabled=yes list=TRUSTED\r
+add address=176.53.202.194 disabled=yes list=TRUSTED\r
+add address=8.8.4.4 disabled=yes list=to_vpn\r
+add address=10.30.30.98 comment=vados-len list=Local2Vpn\r
+add address=89.110.101.17 list=VDS\r
+add address=109.107.177.79 list=TRUSTED\r
+add address=185.71.70.78 disabled=yes list=TRUSTED\r
+add address=176.53.203.171 disabled=yes list=TRUSTED\r
+add address=176.53.203.170 disabled=yes list=TRUSTED\r
+add address=176.53.202.194 disabled=yes list=TRUSTED\r
+add address=2ip.ru list=Test\r
+add address=89.110.101.17 comment=VDSIna list=TRUSTED\r
+add address=10.8.0.0/24 comment="WG VDSIna" list=TRUSTED\r
+add address=ikus.pesc.ru comment=ikus.pesc.ru list=NoVdsina\r
+add address=love.ru comment=love.ru list=NoVdsina\r
+add address=gosuslugi.ru comment=gosuslugi.ru list=NoVdsina\r
+add address=pochta.ru comment=pochta.ru list=NoVdsina\r
+add address=vdsina.com comment=vdsina.com list=NoVdsina\r
+add address=vdsina.ru comment=vdsina.ru list=NoVdsina\r
+add address=youla.ru comment=youla.ru list=NoVdsina\r
+add address=kupiprodai.ru comment=kupiprodai.ru list=NoVdsina\r
+add address=myip.ru list=Test\r
+add address=geoip.co comment=geoip.co list=NoVdsina\r
+add address=x.com list=Twitter\r
+add address=facebook.com list=facebook\r
+add address=fbcd.net list=facebook\r
+add address=comp-lenta.ru comment=comp-lenta.ru list=NoVdsina\r
+add address=128.85.102.70 comment=update.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=wu-b-net.trafficmanager.net. comment=\\r
+ ctldl.windowsupdate.com.delivery.microsoft.com list=windowsupdateslist\r
+add address=ctldl.windowsupdate.com.delivery.microsoft.com. comment=\\r
+ ctldl.windowsupdate.com list=windowsupdateslist\r
+add address=redir.update.msft.com.trafficmanager.net. comment=\\r
+ update.microsoft.com list=windowsupdateslist\r
+add address=geo.prod.do.dsp.trafficmanager.net. comment=\\r
+ geo.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=13.74.139.29 comment=array605.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=kv801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ kv801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=e12437.d.akamaiedge.net. comment=\\r
+ kv801.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=displaycatalog-rp.md.mp.microsoft.com.akadns.net. comment=\\r
+ displaycatalog.mp.microsoft.com list=windowsupdateslist\r
+add address=rp-consumer-prod-displaycatalog-geomap.trafficmanager.net. \\r
+ comment=displaycatalog-rp.md.mp.microsoft.com.akadns.net list=\\r
+ windowsupdateslist\r
+add address=sls.update.microsoft.com. comment=slscr.update.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=glb.sls.prod.dcat.dsp.trafficmanager.net. comment=\\r
+ sls.update.microsoft.com list=windowsupdateslist\r
+add address=fe3.delivery.mp.microsoft.com. comment=\\r
+ fe3cr.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=glb.cws.prod.dcat.dsp.trafficmanager.net. comment=\\r
+ fe3.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=fe2cr.update.msft.com.trafficmanager.net. comment=\\r
+ fe2cr.update.microsoft.com list=windowsupdateslist\r
+add address=download.windowsupdate.com.delivery.microsoft.com. comment=\\r
+ download.windowsupdate.com list=windowsupdateslist\r
+add address=wu-f-net.trafficmanager.net. comment=\\r
+ download.windowsupdate.com.delivery.microsoft.com list=windowsupdateslist\r
+add address=tsfe.trafficmanager.net. comment=\\r
+ tsfe.trafficshaping.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com. \\r
+ comment=9.au.download.windowsupdate.com list=windowsupdateslist\r
+add address=52.158.227.125 comment=array812.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=au.download.windowsupdate.com.delivery.microsoft.com. comment=\\r
+ au.download.windowsupdate.com list=windowsupdateslist\r
+add address=a767.dspw65.akamai.net. comment=\\r
+ download.windowsupdate.com.edgesuite.net list=windowsupdateslist\r
+add address=52.151.58.88 comment=array810.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net. \\r
+ comment=licensing.mp.microsoft.com list=windowsupdateslist\r
+add address=licensing-prod-frontdoor-geomap.trafficmanager.net. comment=\\r
+ consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net list=\\r
+ windowsupdateslist\r
+add address=star.f.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedge.f.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=cdp-f-nlu-net.trafficmanager.net. comment=\\r
+ star.f.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedge.b.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=cdp-f-tlu-net.trafficmanager.net. comment=\\r
+ star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=storeedgefd.xbetservices.akadns.net. comment=\\r
+ storeedgefd.dsx.mp.microsoft.com list=windowsupdateslist\r
+add address=\\r
+ storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net. \\r
+ comment=storeedgefd.dsx.mp.microsoft.com.edgekey.net list=\\r
+ windowsupdateslist\r
+add address=e16646.dscg.akamaiedge.net. comment=\\r
+ storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net list=\\r
+ windowsupdateslist\r
+add address=40.69.76.189 comment=array621.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=bg.microsoft.map.fastly.net. comment=\\r
+ 3.au.download.windowsupdate.com list=windowsupdateslist\r
+add list=windowsupdateslist\r
+add address=40.69.75.33 comment=array613.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=cdp-f-ssl-tlu-net.trafficmanager.net. comment=\\r
+ star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=a2033.dscd.akamai.net. comment=\\r
+ star.sb.tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=\\r
+ windowsupdateslist\r
+add address=13.74.138.242 comment=array602.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=dl.delivery.mp.microsoft.com.delivery.microsoft.com. comment=\\r
+ dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=dcat-f-nlu-net.trafficmanager.net. comment=\\r
+ dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=1d.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=1D.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=dcat-b-tlu-net.trafficmanager.net. comment=\\r
+ 1d.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=a122.dscg3.akamai.net. comment=\\r
+ tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=windowsupdateslist\r
+add address=geover.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ geover.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=e10370.d.akamaiedge.net. comment=\\r
+ geover.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=52.232.182.21 comment=array511.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.70.77.95 comment=array519.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=a1683.dscd.akamai.net. comment=\\r
+ dl.delivery.mp.microsoft.com-c.edgesuite.net list=windowsupdateslist\r
+add address=consumer-collections-aks2eap.md.mp.microsoft.com.akadns.net. \\r
+ comment=collections.mp.microsoft.com list=windowsupdateslist\r
+add address=a1847.dscd.akamai.net. comment=\\r
+ wildcard.f.tlu.dl.delivery.mp.microsoft.com.edgesuite.net list=\\r
+ windowsupdateslist\r
+add address=13.74.142.6 comment=array607.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=au.download.windowsupdate.com.edgesuite.net. comment=\\r
+ 2.au.download.windowsupdate.com list=windowsupdateslist\r
+add address=a767.dscg3.akamai.net. comment=\\r
+ au.download.windowsupdate.com.edgesuite.net list=windowsupdateslist\r
+add address=52.156.123.84 comment=array818.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.78.254 comment=array610.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=4.au.download.windowsupdate.com.delivery.microsoft.com. comment=\\r
+ 4.au.download.windowsupdate.com list=windowsupdateslist\r
+add address=cl-glcb907925.gcdn.co. comment=\\r
+ 4.au.download.windowsupdate.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.167.111 comment=array510.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=40.69.70.43 comment=array623.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=tsfe.trafficshaping.dsp.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=tsfe.trafficshaping.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=ts-frontend.trafficmanager.net. comment=\\r
+ tsfe.trafficshaping.dsp.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.75.248 comment=array616.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.74.84 comment=array615.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=sds.trafficmanager.net. comment=software-download.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=40.69.74.80 comment=array611.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.175.242.182 comment=array804.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=dlc-shim.trafficmanager.net. comment=download.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=e12671.dscd.akamaiedge.net. comment=\\r
+ download.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=20.187.55.34 comment=array808.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.167.231 comment=array513.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=52.167.222.13 comment=array518.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=kv601.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ kv601.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=e12358.d.akamaiedge.net. comment=\\r
+ kv601.prod.do.dsp.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. comment=\\r
+ tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=dcat-f-tlu-net.trafficmanager.net. comment=\\r
+ tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=a1856.dspw65.akamai.net. comment=\\r
+ tlu.dl.delivery.mp.microsoft.com-c.edgesuite.net list=windowsupdateslist\r
+add address=52.167.164.252 comment=array506.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=13.74.137.54 comment=array601.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=kv501.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ kv501.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=collections-prod-frontdoor-geomap.trafficmanager.net. comment=\\r
+ consumer-collections-aks2eap.md.mp.microsoft.com.akadns.net list=\\r
+ windowsupdateslist\r
+add address=52.167.160.173 comment=array509.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=40.70.77.148 comment=array516.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.200.126 comment=array507.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=52.167.167.59 comment=array508.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.76.172 comment=array620.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=82.202.162.184 comment=comp-lenta.ru list=NoWG\r
+add address=smtp.mail.me.com.akadns.net. comment=smtp.mail.me.com list=NoWG\r
+add address=17.57.155.37 comment=smtp.mail.me.com.akadns.net list=NoWG\r
+add address=smtp.mail.me.com comment=smtp.mail.me.com list=NoVdsina\r
+add address=40.70.76.5 comment=array514.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.186.119 comment=array618.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.177.176.186 comment=array520.prod.do.dsp.mp.microsoft.com \\r
+ list=windowsupdateslist\r
+add address=40.70.76.27 comment=array515.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.160.43 comment=array503.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.110 comment=array817.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.142.8 comment=array614.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.138.254 comment=array603.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.167.96 comment=array501.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.69.76.215 comment=array622.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.143.200 comment=array606.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.111 comment=array818.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.112 comment=array819.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=13.74.137.53 comment=array608.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.98 comment=array805.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.96 comment=array803.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.104 comment=array811.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.101 comment=array808.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.99 comment=array806.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.17 comment=array802.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.97 comment=array804.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.103 comment=array810.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.16 comment=array801.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=40.70.77.177 comment=array517.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.164.84 comment=array512.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.105 comment=array812.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.107 comment=array814.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.232.161.82 comment=array502.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.108 comment=array815.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=52.167.161.91 comment=array505.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.102 comment=array809.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.109 comment=array816.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.106 comment=array813.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.117 comment=array622.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.107 comment=array612.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.108 comment=array613.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.105 comment=array610.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.113 comment=array618.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.116 comment=array621.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.98 comment=array603.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.114 comment=array619.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.111 comment=array616.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.97 comment=array602.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.106 comment=array611.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.110 comment=array615.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.119 comment=array624.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.135 comment=array514.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.97 comment=array503.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.99 comment=array604.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.61 comment=array504.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.131 comment=array510.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.132 comment=array511.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.96 comment=array601.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.104 comment=array609.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.138 comment=array517.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.60 comment=array501.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.139 comment=array518.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.118 comment=array623.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.113 comment=array820.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.103 comment=array608.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.154.7.100 comment=array807.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.129 comment=array508.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.134 comment=array513.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.62 comment=array505.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.137 comment=array516.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.101 comment=array606.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.96 comment=array502.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.130 comment=array509.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.112 comment=array617.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.100 comment=array605.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.115 comment=array620.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.136 comment=array515.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=purchase.md.mp.microsoft.com.akadns.net. comment=\\r
+ purchase.mp.microsoft.com list=windowsupdateslist\r
+add address=e110219.a.akamaiedge.net. comment=\\r
+ purchase.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=72.153.5.140 comment=array519.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.141 list=windowsupdateslist\r
+add address=72.153.5.63 comment=array506.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.128 comment=array507.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.102 comment=array607.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=storesdk.xbetservices.akadns.net. comment=\\r
+ storesdk.dsx.mp.microsoft.com list=windowsupdateslist\r
+add address=e16646.g.akamaiedge.net. comment=\\r
+ storesdk.dsx.mp.microsoft.com.edgekey.net list=windowsupdateslist\r
+add address=software-download.microsoft.com.delivery.microsoft.com. comment=\\r
+ software-download.microsoft.com list=windowsupdateslist\r
+add address=download.prss.microsoft.com.akamaized.net. comment=\\r
+ software-download.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.145.35.109 comment=array614.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=72.153.5.133 comment=array512.prod.do.dsp.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=213.180.192.0/19 comment=YandexDisk list=NoVdsina\r
+add address=87.250.250.50 comment=YandexDisk list=NoVdsina\r
+add address=consumer-prod-bcfd-v7-afd.trafficmanager.net. comment=\\r
+ displaycatalog.mp.microsoft.com list=windowsupdateslist\r
+add address=purchase-europeeap.md.mp.microsoft.com.akadns.net. comment=\\r
+ purchase.md.mp.microsoft.com.akadns.net list=windowsupdateslist\r
+add address=ne-az-conspurchase-mp.trafficmanager.net. comment=\\r
+ purchase-europeeap.md.mp.microsoft.com.akadns.net list=windowsupdateslist\r
+add address=storeedgefd.dsx.mp.microsoft.com.edgekey.net. comment=\\r
+ cdn.storeedgefd.dsx.mp.microsoft.com list=windowsupdateslist\r
+add address=star.f.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedge.f.tlu.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=a1996.dscd.akamai.net. comment=\\r
+ wildcard.f.dl.delivery.mp.microsoft.com.edgesuite.net list=\\r
+ windowsupdateslist\r
+add address=cp801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ cp801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=glb.tas02.sls-prod.dcat.dsp.mp.microsoft.com. comment=\\r
+ tas02.sls.update.microsoft.com list=windowsupdateslist\r
+add address=cp601.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ cp601.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=star.sb.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedgeextensions.sb.tlu.dl.delivery.mp.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=star.sf.dl.delivery.mp.microsoft.com.delivery.microsoft.com. \\r
+ comment=msedge.sf.dl.delivery.mp.microsoft.com list=windowsupdateslist\r
+add address=cdp-f-ssl-nlu-net.trafficmanager.net. comment=\\r
+ star.sf.dl.delivery.mp.microsoft.com.delivery.microsoft.com list=\\r
+ windowsupdateslist\r
+add address=tm-pifd-prod-gbl-weight.trafficmanager.net. comment=\\r
+ paymentinstruments.mp.microsoft.com list=windowsupdateslist\r
+add address=10.30.30.33 comment=NUC disabled=yes list=NoWG\r
+add address=10.30.30.10 comment=MikroNUC disabled=yes list=NoWG\r
+add address=89.110.101.17 comment=!!!VDSINA!!!! disabled=yes list=NoWG\r
+add address=wg.vados.ru comment=VDSina-vpn list=Trusted-VPN\r
+add address=80.85.244.9 list=TRUSTED\r
+add address=disc801.prod.do.dsp.mp.microsoft.com.edgekey.net. comment=\\r
+ disc801.prod.do.dsp.mp.microsoft.com list=windowsupdateslist\r
+add address=185.71.70.78 disabled=yes list=TRUSTED\r
+add address=176.53.203.171 disabled=yes list=TRUSTED\r
+add address=176.53.203.170 disabled=yes list=TRUSTED\r
+add address=176.53.202.194 disabled=yes list=TRUSTED\r
+add address=vdsina.vados.ru comment="!!!VDSina Server!!!" list=NoVdsina\r
+add address=dns.quad9.net comment=Quad9-dns disabled=yes list=Trusted-DNS\r
+add address=dns.google comment=Google-dns list=Trusted-DNS\r
+add address=security.cloudflare-dns.com comment=CloudFlare-dns list=\\r
+ Trusted-DNS\r
+add address=time.google.com comment=Google-time list=Trusted-NTP\r
+add address=0.ru.pool.ntp.org comment=ru.pool.ntp.org disabled=yes list=\\r
+ Trusted-NTP\r
+add address=1.ru.pool.ntp.org disabled=yes list=Trusted-NTP\r
+add address=2.ru.pool.ntp.org comment=2.ru.pool.ntp.org disabled=yes list=\\r
+ Trusted-NTP\r
+add address=3.ru.pool.ntp.org comment=3.ru.pool.ntp.org disabled=yes list=\\r
+ Trusted-NTP\r
+add address=cp.vdsina.com comment=VDSina-vpn list=Trusted-VPN\r
+add address=vdsina.ru comment=VDSina-vpn list=Trusted-VPN\r
+add address=ns.vados.ru comment=VDSina-vpn list=Trusted-VPN\r
+add address=vdsina.com comment=VDSina-vpn list=Trusted-VPN\r
+add address=cp.vdsina.ru comment=VDSina-vpn list=Trusted-VPN\r
+add address=ns1.vdsina.ru comment=VDSina-vpn list=Trusted-VPN\r
+add address=ghcr.io comment=GitHub list=Trusted-VPN\r
+add address=github.com comment=GitHub list=Trusted-VPN\r
+add address=149.154.164.13 comment=telegra.ph list=FuckRKN\r
+add address=194.85.61.76 comment=grani.ru list=FuckRKN\r
+add address=109.70.26.37 comment=grani.ru list=FuckRKN\r
+add address=104.16.4.81 comment=xhamster.com list=FuckRKN\r
+add address=104.16.3.81 comment=xhamster.com list=FuckRKN\r
+add address=188.114.96.1 comment=lostfilm.tv list=FuckRKN\r
+add address=188.114.97.1 comment=lostfilm.tv list=FuckRKN\r
+add address=172.67.182.196 comment=rutracker.org list=FuckRKN\r
+add address=104.21.32.39 comment=rutracker.org list=FuckRKN\r
+add address=104.247.81.99 comment=lurkmore.to list=FuckRKN\r
+add address=8.47.69.6 comment=dou.ua list=FuckRKN\r
+add address=8.6.112.6 comment=dou.ua list=FuckRKN\r
+add address=66.254.114.79 comment=youporn.com list=FuckRKN\r
+add address=185.110.92.40 comment=pornolab.net list=FuckRKN\r
+add address=185.110.92.41 comment=pornolab.net list=FuckRKN\r
+add address=104.21.71.238 comment=crimerussia.com list=FuckRKN\r
+add address=172.67.172.95 comment=crimerussia.com list=FuckRKN\r
+add address=149.154.167.99 comment=telegram.org list=FuckRKN\r
+add address=149.154.166.110 comment=api.telegram.org list=FuckRKN\r
+add address=myip.ru comment="!!! Check IP (MYIP.RU) !!!" disabled=yes list=\\r
+ NoVdsina\r
+add address=ipinfo.io comment="!!! Check IP (IPINFO.IO) !!!" list=NoVdsina\r
+/ip firewall filter\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=12h chain=input comment="block honeypot DNS UDP" \\r
+ connection-state=new dst-port=53 in-interface="ether1 - Unet" protocol=\\r
+ udp src-address-list=!VDS\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=4w2d chain=input comment="block honeypot DNS TCP" \\r
+ connection-state=new dst-port=53 in-interface="ether1 - Unet" protocol=\\r
+ tcp src-address-list=!VDS\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=4w2d chain=input comment="block honeypot NTP" \\r
+ connection-state=new dst-port=123 in-interface="ether1 - Unet" protocol=\\r
+ udp\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=4w2d chain=input comment="block honeypot asterisk" \\r
+ connection-state=new dst-port=5060 in-interface="ether1 - Unet" protocol=\\r
+ udp\r
+add action=add-src-to-address-list address-list="Honeypot Hacker" \\r
+ address-list-timeout=4w2d chain=input comment=\\r
+ "block honeypot ssh rdp winbox" connection-state=new dst-port=22,8291 \\r
+ in-interface-list=WAN protocol=tcp src-address-list=!TRUSTED\r
+add action=accept chain=input comment=\\r
+ "defconf: accept established,related,untracked" connection-state=\\r
+ established,related,untracked\r
+add action=drop chain=input comment="defconf: drop invalid" connection-state=\\r
+ invalid\r
+add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp\r
+add action=accept chain=input comment=\\r
+ "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \\r
+ dst-address=127.0.0.1 in-interface=lo src-address=127.0.0.1\r
+add action=drop chain=input comment="defconf: drop all not coming from LAN" \\r
+ in-interface-list=!LAN\r
+add action=accept chain=forward comment="defconf: accept in ipsec policy" \\r
+ disabled=yes ipsec-policy=in,ipsec\r
+add action=accept chain=forward comment="defconf: accept out ipsec policy" \\r
+ disabled=yes ipsec-policy=out,ipsec\r
+add action=accept chain=forward comment=\\r
+ "defconf: accept established,related, untracked" connection-state=\\r
+ established,related,untracked\r
+add action=drop chain=forward comment="defconf: drop invalid" \\r
+ connection-state=invalid\r
+add action=drop chain=forward comment=\\r
+ "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \\r
+ in-interface-list=WAN\r
+/ip firewall mangle\r
+add action=accept chain=prerouting dst-address-list=RFC1918 \\r
+ in-interface-list=!WAN\r
+add action=mark-connection chain=prerouting comment="NO VPN" disabled=yes \\r
+ dst-address-list=NoVdsina in-interface-list=!WAN new-connection-mark=\\r
+ To-ISP\r
+add action=mark-routing chain=prerouting comment=All2vpn connection-mark=\\r
+ !To-ISP disabled=yes dst-address=!89.110.101.17 dst-address-list=\\r
+ !NoVdsina new-routing-mark=To-VPN src-address=10.30.30.0/24 \\r
+ src-address-list=!NoWG\r
+add action=change-mss chain=forward comment="MSS on WG" connection-mark=\\r
+ !To-ISP disabled=yes in-interface-list=!WAN new-mss=1380 protocol=tcp \\r
+ tcp-flags=syn tcp-mss=1381-65535\r
+add action=mark-routing chain=prerouting connection-mark=to-vpn-conn \\r
+ disabled=yes new-routing-mark=To-VPN routing-mark=To-VPN src-address=\\r
+ 10.30.30.0/24\r
+add action=mark-connection chain=prerouting comment=\\r
+ "Mark VPN connections to exclude from FastTrack" disabled=yes \\r
+ in-interface=*B log-prefix=Mark-VPN-FT new-connection-mark=\\r
+ VPN_No_FastTrack\r
+add action=accept chain=prerouting comment="SSH To ME" disabled=yes \\r
+ dst-address=10.30.30.81 dst-port=2222 in-interface-list=!WAN protocol=tcp \\r
+ src-address=10.30.30.0/24\r
+add action=mark-routing chain=prerouting comment="VPN Network" disabled=yes \\r
+ dst-address=10.8.0.0/24 log-prefix=VPN-Net new-routing-mark=To-VPN \\r
+ src-address=10.30.30.0/24\r
+/ip firewall nat\r
+add action=masquerade chain=srcnat comment="Default NAT" dst-address=\\r
+ !10.30.30.0/24 ipsec-policy=out,none out-interface="ether1 - Unet" \\r
+ routing-mark=!To-VPN src-address=10.30.30.0/24\r
+add action=masquerade chain=srcnat comment="NAT for VPN" disabled=yes \\r
+ out-interface=lo routing-mark=To-VPN\r
+add action=dst-nat chain=dstnat comment="dst-nat for acme" dst-port=80 \\r
+ in-interface="ether1 - Unet" protocol=tcp to-addresses=10.30.30.33 \\r
+ to-ports=80\r
+add action=dst-nat chain=dstnat comment="dst-nat for amster HTTPS" dst-port=\\r
+ 443 in-interface="ether1 - Unet" protocol=tcp to-addresses=10.30.30.33 \\r
+ to-ports=443\r
+add action=dst-nat chain=dstnat comment="dst-nat for amster ssh" disabled=yes \\r
+ dst-port=22 protocol=tcp src-address-list=VDS to-addresses=10.30.30.33 \\r
+ to-ports=22\r
+add action=dst-nat chain=dstnat comment="dst-nat for amster DNS (TCP)" \\r
+ dst-port=53 in-interface="ether1 - Unet" protocol=tcp src-address-list=\\r
+ VDS to-addresses=10.30.30.33 to-ports=53\r
+add action=dst-nat chain=dstnat comment="dst-nat for amster DNS (UDP)" \\r
+ dst-port=53 in-interface="ether1 - Unet" protocol=udp src-address-list=\\r
+ VDS to-addresses=10.30.30.33 to-ports=53\r
+add action=masquerade chain=srcnat src-address=172.20.200.68/30\r
+/ip firewall service-port\r
+set ftp disabled=yes\r
+set tftp disabled=yes\r
+set irc disabled=no\r
+set sip disabled=yes\r
+set pptp disabled=yes\r
+set rtsp disabled=no\r
+/ip hotspot user profile\r
+set [ find default=yes ] address-pool=dhcp\r
+/ip route\r
+add check-gateway=ping disabled=yes distance=1 dst-address=10.10.10.0/24 \\r
+ gateway=10.30.30.33 routing-table=main scope=30 target-scope=10\r
+add comment=awg2all-dns disabled=yes distance=1 dst-address=10.9.0.1/32 \\r
+ gateway=""\r
+add comment=awg2all-dns disabled=yes distance=1 dst-address=8.8.4.4/32 \\r
+ gateway=""\r
+add comment=awg2vds-dns distance=1 dst-address=10.10.10.1/32 gateway=""\r
+/ip service\r
+set ftp disabled=yes\r
+set telnet disabled=yes\r
+set www disabled=yes port=188\r
+set reverse-proxy disabled=yes\r
+set ssh port=2222\r
+set www-ssl port=4433\r
+set api disabled=yes\r
+set api-ssl disabled=yes\r
+/ip service webserver\r
+set acme-plain=no crl-plain=no graphs-plain=no graphs-secure=no index-plain=\\r
+ no index-secure=no rest-plain=no rest-secure=no scep-plain=no \\r
+ webfig-plain=no webfig-secure=no\r
+/ip ssh\r
+set forwarding-enabled=both publickey-authentication-options=verify-required \\r
+ strong-crypto=yes\r
+/ip upnp\r
+set enabled=yes\r
+/ip upnp interfaces\r
+add interface="ether1 - Unet" type=external\r
+add interface=Bridge-Lan type=internal\r
+/ipv6 firewall filter\r
+add action=accept chain=input comment=\\r
+ "defconf: accept established,related,untracked" connection-state=\\r
+ established,related,untracked disabled=yes\r
+add action=drop chain=input comment="defconf: drop invalid" connection-state=\\r
+ invalid disabled=yes\r
+add action=accept chain=input comment="defconf: accept ICMPv6" disabled=yes \\r
+ protocol=icmpv6\r
+add action=accept chain=input comment="defconf: accept UDP traceroute" \\r
+ disabled=yes dst-port=33434-33534 protocol=udp\r
+add action=accept chain=input comment=\\r
+ "defconf: accept DHCPv6-Client prefix delegation." disabled=yes dst-port=\\r
+ 546 protocol=udp src-address=fe80::/10\r
+add action=accept chain=input comment="defconf: accept IKE" disabled=yes \\r
+ dst-port=500,4500 protocol=udp\r
+add action=accept chain=input comment="defconf: accept ipsec AH" disabled=yes \\r
+ protocol=ipsec-ah\r
+add action=accept chain=input comment="defconf: accept ipsec ESP" disabled=\\r
+ yes protocol=ipsec-esp\r
+add action=accept chain=input comment=\\r
+ "defconf: accept all that matches ipsec policy" disabled=yes \\r
+ ipsec-policy=in,ipsec\r
+add action=drop chain=input comment=\\r
+ "defconf: drop everything else not coming from LAN" disabled=yes \\r
+ in-interface-list=!LAN\r
+add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \\r
+ connection-state=established,related\r
+add action=accept chain=forward comment=\\r
+ "defconf: accept established,related,untracked" connection-state=\\r
+ established,related,untracked\r
+add action=drop chain=forward comment="defconf: drop invalid" \\r
+ connection-state=invalid\r
+add action=drop chain=forward comment=\\r
+ "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6\r
+add action=drop chain=forward comment=\\r
+ "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6\r
+add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \\r
+ hop-limit=equal:1 protocol=icmpv6\r
+add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\\r
+ icmpv6\r
+add action=accept chain=forward comment="defconf: accept HIP" protocol=139\r
+add action=accept chain=forward comment="defconf: accept IKE" dst-port=\\r
+ 500,4500 protocol=udp\r
+add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\\r
+ ipsec-ah\r
+add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\\r
+ ipsec-esp\r
+add action=accept chain=forward comment=\\r
+ "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec\r
+add action=drop chain=forward comment=\\r
+ "defconf: drop everything else not coming from LAN" in-interface-list=\\r
+ !LAN\r
+/system clock\r
+set time-zone-autodetect=no time-zone-name=Europe/Moscow\r
+/system identity\r
+set name=MikroMaster\r
+/system ntp client\r
+set enabled=yes\r
+/system ntp server\r
+set enabled=yes manycast=yes multicast=yes use-local-clock=yes\r
+/system ntp client servers\r
+add address=time.google.com\r
+/system scheduler\r
+add comment="Every Day Set Global Environment Variables" name=AM-SetGlobalEnv \\r
+ on-event="/system/script { run AM-GlobalConfig; run AM-GlobalFunc; }" \\r
+ policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-time=startup\r
+add comment="Every Day Check For Update Scripts" interval=1d name=\\r
+ AM-ScriptInstallUpdate on-event=\\r
+ ":global ScriptInstallUpdate; \$ScriptInstallUpdate;" policy=\\r
+ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+ start-time=startup\r
+/tool e-mail\r
+set certificate-verification=no from=MikroVados<vadossio@icloud.com> port=587 \\r
+ server=smtp.mail.me.com tls=starttls user=vadossio@icloud.com\r
+/tool netwatch\r
+add comment="doh-fallback, doh-url=https://security.cloudflare-dns.com/dns-que\\r
+ ry, doh-cert=DigiCert Global Root CA, notify, name=CloudFlare-doh IPv4 1" \\r
+ disabled=yes host=1.1.1.1 type=simple\r
+add comment="doh, doh-url=https://security.cloudflare-dns.com/dns-query, doh-c\\r
+ ert=DigiCert Global Root CA, notify, name=CloudFlare-doh IPv4 2" \\r
+ disabled=yes host=1.0.0.1 type=simple\r
+add comment="doh-fallback, dns-fallback, doh-url=https://dns.google/dns-query,\\r
+ \_doh-cert=DigiCert Global Root G2, notify, name=Google-doh IPv4 1" \\r
+ disabled=yes host=8.8.8.8 type=simple\r
+add comment="doh-fallback, dns-fallback, doh-url=https://dns.google/dns-query,\\r
+ \_doh-cert=DigiCert Global Root G2, notify, name=Google-doh IPv4 2" \\r
+ disabled=yes host=8.8.4.4 type=simple\r
+add comment="doh-fallback, dns-fallback, doh-url=https://dns.quad9.net/dns-que\\r
+ ry, doh-cert=DigiCert Global Root G3, notify, name=Cuad9-doh IPv4 1" \\r
+ disabled=yes host=9.9.9.9 type=simple\r
+add comment="doh-fallback, dns-fallback, doh-url=https://dns.quad9.net/dns-que\\r
+ ry, doh-cert=DigiCert Global Root G3, notify, name=Cuad9-doh IPv4 2" \\r
+ disabled=yes host=149.112.112.112 type=simple\r
+add comment="dns, notify, name=ns1.unet.ws" disabled=yes host=91.192.189.2 \\r
+ type=simple\r
+/user aaa\r
+set accounting=no\r
--- /dev/null
+19a20,24
+> /interface veth\r
+> add address=172.20.200.70/30 container-mac-address=00:00:00:00:00:00 dhcp=no \\r
+> gateway=172.20.200.69 gateway6="" name=veth-awg2vds\r
+> /interface wireguard\r
+> add disabled=yes listen-port=26084 mtu=1420 name=wg-awg2vds\r
+296a302,554
+> add comment=GENERATOR dont-require-permissions=no name=awg2vds owner=vados \\r
+> policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \\r
+> source="# ============================================================\\r
+> \n# AWG Proxy -- MikroTik RouterOS (protocol: v2)\\r
+> \n# 2026-07-21 10:33:39\\r
+> \n# ============================================================\\r
+> \n\\r
+> \n# 0. Check prerequisites\\r
+> \n:if ([:len [/system/package/find where name=\"container\" disabled=no]] \\r
+> = 0) do={\\r
+> \n :put \"Container package is not installed or disabled. Install it and \\r
+> reboot.\"\\r
+> \n :error \"Usage: /system/device-mode/update container=yes\"\\r
+> \n}\\r
+> \n\\r
+> \n# Check storage device\\r
+> \n{\\r
+> \n :local targetDisk \"usb1\"\\r
+> \n :local diskFree 0\\r
+> \n :do { :set diskFree [/disk/get [find where mount-point=\$targetDisk] f\\r
+> ree] } on-error={}\\r
+> \n :if (\$diskFree = 0) do={\\r
+> \n :local baseDisk \$targetDisk\\r
+> \n :local dashPos [:find \$targetDisk \"-part\"]\\r
+> \n :if ([:typeof \$dashPos] != \"nil\") do={ :set baseDisk [:pick \$tar\\r
+> getDisk 0 \$dashPos] }\\r
+> \n :if ([:len [/disk/find where slot=\$baseDisk]] > 0) do={\\r
+> \n :put (\"Device \$baseDisk found but \$targetDisk is not available.\\r
+> \")\\r
+> \n :put \"Format \$baseDisk as ext4\? ALL DATA WILL BE ERASED!\"\\r
+> \n :put \"Press 'y' to confirm, any other key to cancel:\"\\r
+> \n :local key [/terminal/inkey timeout=30]\\r
+> \n :if (\$key = 121 || \$key = 89) do={\\r
+> \n :put \"Formatting \$baseDisk as ext4...\"\\r
+> \n /disk/format-drive \$baseDisk file-system=ext4 label=\$baseDisk\\r
+> \n :delay 3s\\r
+> \n :do { :set diskFree [/disk/get [find where mount-point=\$targetD\\r
+> isk] free] } on-error={}\\r
+> \n :if (\$diskFree = 0) do={\\r
+> \n :put (\"ERROR: \$targetDisk not found after formatting.\")\\r
+> \n :put \"Check mount point: /disk/print\"\\r
+> \n :error (\"Mount point \$targetDisk not found after formatting\\r
+> \")\\r
+> \n }\\r
+> \n :put (\"Formatted OK. Free: \" . (\$diskFree / 1048576) . \" MB\\r
+> \")\\r
+> \n } else={\\r
+> \n :error \"Formatting cancelled\"\\r
+> \n }\\r
+> \n } else={\\r
+> \n :put (\"ERROR: Storage device \$targetDisk not found.\")\\r
+> \n :put \"Check available disks: /disk/print\"\\r
+> \n :error (\"Storage not found: \" . \$targetDisk)\\r
+> \n }\\r
+> \n } else={\\r
+> \n :put (\"Storage OK: \$targetDisk (\" . (\$diskFree / 1048576) . \" M\\r
+> B free)\")\\r
+> \n }\\r
+> \n}\\r
+> \n\\r
+> \n# 1. Uninstall script\\r
+> \n/system/script/add name=awg2vds-uninstall comment=awg2vds source={\\r
+> \n :put \"Uninstallimg AmneziaWG...\"\\r
+> \n :log info \"Uninstallimg AmneziaWG...\"\\r
+> \n :local prevDNS \"\"\\r
+> \n :do { :set prevDNS [/container/envs/get [find where list=\"awg2vds-env\\r
+> \" key=\"AWG_PREV_DNS\"] value] } on-error={}\\r
+> \n :local prevTmpdir \"\"\\r
+> \n :do { :set prevTmpdir [/container/envs/get [find where list=\"awg2vds-\\r
+> env\" key=\"AWG_PREV_TMPDIR\"] value] } on-error={}\\r
+> \n /ip/route/remove [find where comment=awg2vds-tunnel]\\r
+> \n /ip/route/remove [find where comment=awg2vds-dns]\\r
+> \n /container/stop [find where interface=veth-awg2vds]\\r
+> \n :delay 7s\\r
+> \n /container/remove [find where interface=veth-awg2vds]\\r
+> \n /container/envs/remove [find where list=\"awg2vds-env\"]\\r
+> \n :if (\$prevDNS != \"\") do={\\r
+> \n :do { /ip/dns/set servers=\"\$prevDNS\" } on-error={}\\r
+> \n :put (\"DNS restored to: \$prevDNS\")\\r
+> \n }\\r
+> \n /container/config set tmpdir=\$prevTmpdir\\r
+> \n :put (\"Container tmpdir restored to: \$prevTmpdir\")\\r
+> \n /ip/firewall/nat/remove [find where out-interface=\"wg-awg2vds\"]\\r
+> \n /ip/firewall/nat/remove [find where src-address=\"172.20.200.68/30\"]\\r
+> \n /ip/address/remove [find where address=\"172.20.200.69/30\"]\\r
+> \n /interface/veth/remove [find where name=\"veth-awg2vds\"]\\r
+> \n /interface/wireguard/peers/remove [find where interface=\"wg-awg2vds\"\\r
+> ]\\r
+> \n /ip/address/remove [find where interface=\"wg-awg2vds\"]\\r
+> \n /interface/wireguard/remove [find where name=\"wg-awg2vds\"]\\r
+> \n :do { /file/remove [find where name~\"awg2vds.+tar\"] } on-error={}\\r
+> \n :do { /file/remove [find where name=\"usb1/awg2vds\"] } on-error={}\\r
+> \n :do { /file/remove [find where name=\"usb1/ru_ranges_timeout.rsc\"] } \\r
+> on-error={}\\r
+> \n :do { /file/remove [find where name~\"usb1/pull\"] } on-error={}\\r
+> \n :put \"Uninstall AmneziaWG Proxy complete!\"\\r
+> \n :log info \"Uninstall AmneziaWG Proxy complete!\"\\r
+> \n /system/script/remove [find where name=awg2vds-uninstall]\\r
+> \n}\\r
+> \n\\r
+> \n# 2. Network infrastructure\\r
+> \n/interface/veth/add name=veth-awg2vds address=172.20.200.70/30 gateway=1\\r
+> 72.20.200.69\\r
+> \n/ip/address/add address=172.20.200.69/30 interface=veth-awg2vds\\r
+> \n/ip/firewall/nat/add chain=srcnat action=masquerade src-address=172.20.2\\r
+> 00.68/30\\r
+> \n\\r
+> \n# 3. WireGuard interface (MikroTik derives the public key automatically)\\r
+> \n/interface/wireguard/add name=wg-awg2vds private-key=\"4LNSJJNEDeT2LFXkF\\r
+> x0XyrNp2Mp7YXlS8SawhqNfKGQ=\" listen-port=26084 disabled=yes\\r
+> \n/interface/wireguard/peers/add interface=wg-awg2vds public-key=\"qHFd72X\\r
+> DJJ5UrUZCZ0vRFQmzxP7eUYcOuaGL9ZbHtyg=\" preshared-key=\"ckhzjCcr15ve+IeDRY\\r
+> veYITR7a/CMZCcOZ2Z0cABKD8=\" endpoint-address=172.20.200.70 endpoint-port=\\r
+> 51820 allowed-address=10.10.10.1/24,10.30.30.0/24,0.0.0.0/0 persistent-kee\\r
+> palive=10\\r
+> \n/ip/address/add address=10.10.10.2/24 interface=wg-awg2vds\\r
+> \n\\r
+> \n# 4. Container environment variables\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_LISTEN value=\":51820\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_REMOTE value=\"109.107.177.\\r
+> 79:443\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_JC value=\"6\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_JMIN value=\"171\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_JMAX value=\"481\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_S1 value=\"50\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_S2 value=\"139\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_H1 value=\"1189447486-11894\\r
+> 48396\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_H2 value=\"538303610-538304\\r
+> 276\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_H3 value=\"101001960-101002\\r
+> 598\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_H4 value=\"1783887443-17838\\r
+> 87851\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_SERVER_PUB value=\"qHFd72XD\\r
+> JJ5UrUZCZ0vRFQmzxP7eUYcOuaGL9ZbHtyg=\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_CLIENT_PUB value=[/interfac\\r
+> e/wireguard/get [find name=wg-awg2vds] public-key]\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_S3 value=\"17\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_S4 value=\"6\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_I1 value=\"<b 0x00010018211\\r
+> 2a442><r 12><b 0x80220009706a70726f6a65637400000080280004><r 4>\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_I2 value=\"<r 32><t>\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_I3 value=\"<rd 16><r 24>\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_I4 value=\"<t><rc 20>\"\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_I5 value=\"<r 18>\"\\r
+> \n\\r
+> \n# 5. DNS\\r
+> \n{ :local rawDNS [/ip/dns/get servers]; :local prevDNS \"\"; :foreach s i\\r
+> n=[:toarray \$rawDNS] do={ :if ([:len \$prevDNS] > 0) do={ :set prevDNS \"\\r
+> \$prevDNS,\$s\" } else={ :set prevDNS \$s } }; /container/envs/add list=aw\\r
+> g2vds-env key=AWG_PREV_DNS value=\"\$prevDNS\" }\\r
+> \n# NOTE: replaces existing DNS configuration\\r
+> \n/ip/dns/set servers=10.10.10.1\\r
+> \n/ip/route/add dst-address=10.10.10.1/32 gateway=wg-awg2vds distance=1 co\\r
+> mment=awg2vds-dns\\r
+> \n\\r
+> \n# 6. Download, create and start container\\r
+> \n:local prevTmpdir [/container/config/get tmpdir]\\r
+> \n/container/envs/add list=awg2vds-env key=AWG_PREV_TMPDIR value=\$prevTmp\\r
+> dir\\r
+> \n/container/config set tmpdir=usb1/pull memory-high=200M\\r
+> \n{\\r
+> \n :local arch [/system/resource/get architecture-name]\\r
+> \n :local ver [/system/resource/get version]\\r
+> \n :local dotPos [:find \$ver \".\"]\\r
+> \n :local rest [:pick \$ver (\$dotPos + 1) [:len \$ver]]\\r
+> \n :local endPos [:find \$rest \".\"]\\r
+> \n :if ([:typeof \$endPos] = \"nil\") do={ :set endPos [:find \$rest \" \\r
+> \"] }\\r
+> \n :local minor [:tonum [:pick \$rest 0 \$endPos]]\\r
+> \n :local suffix \"\"\\r
+> \n :if (\$minor <= 20) do={ :set suffix \"-7.20-Docker\" }\\r
+> \n :local file \"\"\\r
+> \n :if (\$arch = \"arm64\") do={ :set file (\"awg-proxy-arm64\" . \$suffi\\r
+> x . \".tar.gz\") }\\r
+> \n :if (\$arch = \"arm\") do={ :set file (\"awg-proxy-arm\" . \$suffix . \\r
+> \".tar.gz\") }\\r
+> \n :if (\$arch ~ \"x86\") do={ :set file (\"awg-proxy-amd64\" . \$suffix \\r
+> . \".tar.gz\") }\\r
+> \n :if (\$file = \"\") do={ :error \"Unsupported architecture: \$arch\" }\\r
+> \n #:local url \"https://github.com/timbrs/amneziawg-mikrotik-c/releases/\\r
+> latest/download/\$file\"\\r
+> \n :local url \"https://ros.vados.ru/amneziawg/img/\$file\"\\r
+> \n :local filePath (\"usb1/pull/\" . \$file)\\r
+> \n :do { /file/make-directory usb1/pull } on-error={}\\r
+> \n :if ([:len [/file/find where name=\$filePath]] = 0) do={\\r
+> \n :local freeStorage 0\\r
+> \n :do { :set freeStorage [/disk/get [find where mount-point=\"usb1\"] \\r
+> free] } on-error={}\\r
+> \n :if (\$freeStorage < 262144) do={\\r
+> \n :put (\"WARNING: Low disk space (\" . (\$freeStorage / 1024) . \"K\\r
+> B free). Need at least 256KB.\")\\r
+> \n :put \"See: https://github.com/timbrs/amneziawg-mikrotik-c#insuffi\\r
+> cient-disk-space\"\\r
+> \n :error \"Insufficient disk space\"\\r
+> \n }\\r
+> \n :put (\"Fetching: \$url -> \" . \$filePath)\\r
+> \n /tool/fetch url=\$url dst-path=\$filePath http-max-redirect-count=10\\r
+> \n } else={\\r
+> \n :put (\"File already exists: \" . \$filePath)\\r
+> \n }\\r
+> \n /container/add file=\$filePath interface=veth-awg2vds envlist=awg2vds-\\r
+> env hostname=awg2vds root-dir=usb1/awg2vds logging=no start-on-boot=yes co\\r
+> mment=awg2vds\\r
+> \n :if (\$minor > 20) do={ [:parse \"/container/set [find where interface\\r
+> =veth-awg2vds] shm-size=4M\"] }\\r
+> \n /file/remove \$filePath\\r
+> \n :local freeMem [/system/resource/get free-memory]\\r
+> \n :if (\$freeMem < 16777216) do={\\r
+> \n :put (\"WARNING: Low memory (\" . (\$freeMem / 1048576) . \"MB free)\\r
+> . 16MB+ recommended.\")\\r
+> \n }\\r
+> \n /container/start [find where interface=veth-awg2vds]\\r
+> \n :do { /file/remove [find where name=\"console-dump.txt\"] } on-error={\\r
+> }\\r
+> \n :put \"Waiting for container to start...\"\\r
+> \n :delay 5s\\r
+> \n /interface/wireguard/enable wg-awg2vds\\r
+> \n :put \"WireGuard interface enabled\"\\r
+> \n :put \"Installation complete!\"\\r
+> \n :put \"Ping test: 10.10.10.1 via AmneziaWG tunnel. repeat 10 times\"\\r
+> \n /ping 10.10.10.1 count=10 interval=1\\r
+> \n :put \"\"\\r
+> \n :put \"======= NEXT STEPS =======\"\\r
+> \n :put \"\"\\r
+> \n :put \"Route specific traffic through the AmneziaWG tunnel:\"\\r
+> \n :put \"\"\\r
+> \n :put \" Route a single host:\"\\r
+> \n :put \" /ip/route/add dst-address=8.8.8.8/32 gateway=wg-awg2vds com\\r
+> ment=awg2vds-tunnel\"\\r
+> \n :put \"\"\\r
+> \n :put \" Route a subnet:\"\\r
+> \n :put \" /ip/route/add dst-address=100.0.0.0/8 gateway=wg-awg2vds co\\r
+> mment=awg2vds-tunnel\"\\r
+> \n :put \"\"\\r
+> \n :put \" Remove a route:\"\\r
+> \n :put \" /ip/route/remove [find where comment=awg2vds-tunnel dst-add\\r
+> ress=8.8.8.8/32]\"\\r
+> \n :put \"\"\\r
+> \n :put \" Show all tunnel routes:\"\\r
+> \n :put \" /ip/route/print where comment=awg2vds-tunnel\"\\r
+> \n :put \"\"\\r
+> \n :put \" Uninstall:\"\\r
+> \n :put \" /system/script/run awg2vds-uninstall\"\\r
+> \n :put \"=========================\"\\r
+> \n}\\r
+> \n\\r
+> \n# 7. Verification\\r
+> \n# /container/print\\r
+> \n# /interface/wireguard/print\\r
+> \n# /interface/wireguard/peers/print\\r
+> \n"\r
+393a652,677
+> /container envs\r
+> add key=AWG_CLIENT_PUB list=awg2vds-env value=\\r
+> "wKjZCDbLW8snQ4SwLB5zGO+PjvCErnDUSXtogJaZf3Q="\r
+> add key=AWG_H1 list=awg2vds-env value=1189447486-1189448396\r
+> add key=AWG_H2 list=awg2vds-env value=538303610-538304276\r
+> add key=AWG_H3 list=awg2vds-env value=101001960-101002598\r
+> add key=AWG_H4 list=awg2vds-env value=1783887443-1783887851\r
+> add key=AWG_I1 list=awg2vds-env value="<b 0x000100182112a442><r 12><b 0x802200\\r
+> 09706a70726f6a65637400000080280004><r 4>"\r
+> add key=AWG_I2 list=awg2vds-env value="<r 32><t>"\r
+> add key=AWG_I3 list=awg2vds-env value="<rd 16><r 24>"\r
+> add key=AWG_I4 list=awg2vds-env value="<t><rc 20>"\r
+> add key=AWG_I5 list=awg2vds-env value="<r 18>"\r
+> add key=AWG_JC list=awg2vds-env value=6\r
+> add key=AWG_JMAX list=awg2vds-env value=481\r
+> add key=AWG_JMIN list=awg2vds-env value=171\r
+> add key=AWG_LISTEN list=awg2vds-env value=:51820\r
+> add key=AWG_PREV_DNS list=awg2vds-env value=89.110.101.17,10.30.30.33,8.8.4.4\r
+> add key=AWG_PREV_TMPDIR list=awg2vds-env value=""\r
+> add key=AWG_REMOTE list=awg2vds-env value=109.107.177.79:443\r
+> add key=AWG_S1 list=awg2vds-env value=50\r
+> add key=AWG_S2 list=awg2vds-env value=139\r
+> add key=AWG_S3 list=awg2vds-env value=17\r
+> add key=AWG_S4 list=awg2vds-env value=6\r
+> add key=AWG_SERVER_PUB list=awg2vds-env value=\\r
+> "qHFd72XDJJ5UrUZCZ0vRFQmzxP7eUYcOuaGL9ZbHtyg="\r
+419a704,708
+> /interface wireguard peers\r
+> add allowed-address=10.10.10.1/24,10.30.30.0/24,0.0.0.0/0 endpoint-address=\\r
+> 172.20.200.70 endpoint-port=51820 interface=wg-awg2vds name=peer4 \\r
+> persistent-keepalive=10s public-key=\\r
+> "qHFd72XDJJ5UrUZCZ0vRFQmzxP7eUYcOuaGL9ZbHtyg="\r
+427a717,719
+> add address=10.10.10.2/24 interface=*D network=10.10.10.0\r
+> add address=172.20.200.69/30 interface=veth-awg2vds network=172.20.200.68\r
+> add address=10.10.10.2/24 interface=wg-awg2vds network=10.10.10.0\r
+479c771
+< set allow-remote-requests=yes servers=10.30.30.33,89.110.101.17\r
+---
+> set allow-remote-requests=yes servers=10.30.30.33\r
+1089c1381,1382
+< add comment=awg2vds-dns distance=1 dst-address=10.10.10.1/32 gateway=""\r
+---
+> add comment=awg2vds-dns distance=1 dst-address=10.10.10.1/32 gateway=\\r
+> wg-awg2vds\r
git.vados.ru / Mikrotiks / backups.git / commitdiff
