#                   version: 7.24.4 (stable)
#           minimum-version: 6.46.3
#              total-memory: 256.0MiB
#                       cpu: MIPS 1004Kc V2.15
#                 cpu-count: 4
#           total-hdd-space: 16.0MiB
#         architecture-name: mmips
#                board-name: hEX
#                  platform: MikroTik
#   installed-version: 7.24.4
# 
# software id = 3GIP-WQBU
#
# model = RB750Gr3
# serial number = CC210F513C70
/interface bridge
add disabled=yes name=br-lan-cisco port-cost-mode=short
/interface pppoe-client
add add-default-route=yes allow=chap,mschap1,mschap2 disabled=no interface=ether1 max-mru=1492 max-mtu=1492 name=pppoe-51 password=Ser@server20 use-peer-dns=yes user=sermatica1
add add-default-route=yes allow=chap,mschap1,mschap2 default-route-distance=2 disabled=no interface=ether1 max-mru=1492 max-mtu=1492 name=pppoe-52 password=Ser@server20 user=sermatica2
/interface vlan
add interface=ether4 name=vlan102-vms-sermatica vlan-id=102
add interface=ether4 name=vlan104-vms-white-label vlan-id=104
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip smb users
set [ find default=yes ] disabled=yes
/ppp profile
add dns-server=177.73.253.254 local-address=192.168.100.1 name=vpn
/routing bgp template
set default as=65530 disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
add disabled=no name=default-v3 version=3
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
add disabled=yes instance=default-v3 name=backbone-v3
/snmp community
set [ find default=yes ] name=ipermonitor
/system keymat-provider
add disabled=yes name=default type=qkd
/system logging action
add name=iper remote=10.10.10.69 src-address=177.73.253.51 target=remote
/system script
add dont-require-permissions=no name=script_backup_ftp owner=iper policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":log info \"Iniciado Backup FTP\"\r\nexport file=backup-ftp\r\n/tool fetch address=ftp.iper.net.br port=8021 src-path=backup-ftp.rsc user=bkp.atm mode=ftp password=atm.bkp dst-path=([/system identity get name].\".rsc\") upload=yes\r\n:log info \"Terminado Backup FTP\"\r\n"
add dont-require-permissions=no name=script_backup_email owner=iper policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":log info \"Inciando Backup Email\"\r\nexport file=backup-email\r\n/tool e-mail send to=\"bkp.rb@iper.net.br\" subject=\"\$[/system identity get name]\" body=\"\$[/system clock get date]\" file=\"backup-email.rsc\"\r\n:log info \"Terminado Backup Email\"\r\n"
add dont-require-permissions=no name=maintjob333 owner=0 policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/system package update download; /system package update install"
/interface bridge port
add bridge=br-lan-cisco disabled=yes ingress-filtering=no interface=ether5 internal-path-cost=10 path-cost=10
add bridge=br-lan-cisco disabled=yes ingress-filtering=no interface=vlan104-vms-white-label internal-path-cost=10 path-cost=10
add bridge=br-lan-cisco disabled=yes ingress-filtering=no interface=ether2 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ipv6 settings
set max-neighbor-entries=8192
/interface l2tp-server server
set default-profile=default enabled=yes ipsec-secret="7.&(_r-Ew=!!lr[" use-ipsec=yes
/interface ovpn-server server
add auth=sha1,md5 certificate=SERVER-sermatica cipher=blowfish128,aes128-cbc,aes192-cbc,aes256-cbc disabled=no mac-address=FE:97:ED:54:D1:0D name=ovpn-server1
/interface pppoe-server server
add interface=ether3 max-mru=1480 max-mtu=1480 service-name=cisco-brf
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead
set authentication=pap,chap,mschap1,mschap2 enabled=yes
/ip address
add address=192.168.100.1/24 interface=vlan102-vms-sermatica network=192.168.100.0
add address=192.168.254.1/24 interface=vlan104-vms-white-label network=192.168.254.0
add address=177.73.253.49/29 interface=ether1 network=177.73.253.48
add address=172.16.0.26/30 interface=ether1 network=172.16.0.24
add address=177.73.253.50 interface=ether1 network=177.73.253.50
/ip firewall address-list
add address=192.168.0.0/16 list=esxi-accept
add address=172.16.0.0/12 list=esxi-accept
add address=10.0.0.0/8 list=esxi-accept
add address=177.73.253.0/24 list=esxi-accept
/ip firewall nat
add action=src-nat chain=srcnat disabled=yes dst-address=189.45.192.151 src-address=192.168.100.26 to-addresses=177.73.253.63
add action=src-nat chain=srcnat out-interface=ether1 src-address=192.168.254.0/24 to-addresses=177.73.253.50
add action=masquerade chain=srcnat dst-address=192.168.254.0/24 src-address=192.168.254.0/24 to-addresses=177.73.253.50
add action=dst-nat chain=dstnat dst-address=177.73.253.50 dst-port=80,443 protocol=tcp to-addresses=192.168.254.3
add action=accept chain=srcnat dst-address=192.168.254.0/24
add action=accept chain=srcnat dst-address=192.168.50.0/24 src-address=192.168.100.0/24
add action=accept chain=srcnat src-address=177.73.253.53
add action=accept chain=srcnat dst-address=177.73.253.53
add action=src-nat chain=srcnat disabled=yes src-address=192.168.53.2 to-addresses=177.73.253.53
add action=masquerade chain=srcnat out-interface=vlan102-vms-sermatica src-address=192.168.100.0/24
add action=masquerade chain=srcnat out-interface=!vlan102-vms-sermatica
add action=dst-nat chain=dstnat dst-address=177.73.253.51 dst-port=443 protocol=tcp to-addresses=192.168.100.12
add action=dst-nat chain=dstnat dst-address=177.73.253.51 dst-port=80 protocol=tcp to-addresses=192.168.100.12
add action=dst-nat chain=dstnat dst-address=177.73.253.52 dst-port=80 protocol=tcp to-addresses=192.168.100.12
add action=dst-nat chain=dstnat dst-address=177.73.253.51 dst-port=8080 protocol=tcp to-addresses=192.168.100.16
add action=dst-nat chain=dstnat dst-address=177.73.253.51 dst-port=53 protocol=udp to-addresses=192.168.100.10
add action=dst-nat chain=dstnat dst-address=177.73.253.52 dst-port=53 protocol=udp to-addresses=192.168.100.26
add action=dst-nat chain=dstnat dst-address=177.73.253.51 dst-port=21,60000-61000 protocol=tcp to-addresses=192.168.100.26
add action=accept chain=dstnat disabled=yes dst-address=177.73.253.53 dst-port=8291 protocol=tcp
add action=dst-nat chain=dstnat disabled=yes dst-address=177.73.253.53 to-addresses=192.168.53.2
add action=masquerade chain=srcnat out-interface=pppoe-51
add action=masquerade chain=srcnat out-interface=pppoe-52
/ip firewall raw
add action=drop chain=prerouting disabled=yes dst-address=192.168.100.0/24 src-address=192.168.254.0/24
add action=drop chain=prerouting comment="block esxi out" dst-address-list=!esxi-accept src-address=192.168.100.2
add action=drop chain=prerouting comment="block esxi out" dst-address-list=!esxi-accept src-address=192.168.100.3
add action=drop chain=prerouting comment="block esxi out" disabled=yes dst-address-list=!esxi-accept src-address=192.168.100.5
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=no dst-address=192.168.50.0/24 gateway=192.168.100.201
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www available-from=192.168.0.0/16,177.73.253.0/24 disabled=yes
set ssh port=2200
set winbox available-from=192.168.0.0/16,177.73.253.0/24,45.163.13.106/32,177.75.162.43/32
set api disabled=yes
set api-ssl disabled=yes
/ipv6 nd
# automatic dns option advertising is not started, re-apply dns config
set [ find default=yes ] advertise-dns=yes
/ppp secret
add local-address=192.168.100.1 name=atm password=atm@2020 profile=vpn remote-address=192.168.100.201 service=l2tp
add disabled=yes local-address=192.168.100.1 name=jean password=jea@2020 profile=vpn remote-address=192.168.100.202 service=l2tp
add local-address=192.168.100.1 name=daniel password="Qis\?o+uYE3ib" profile=vpn remote-address=192.168.100.205 service=pptp
add local-address=192.168.100.1 name=danielfilho password=12022022 profile=vpn remote-address=192.168.100.204 service=ovpn
add disabled=yes local-address=192.168.100.1 name=fabio password=m&5pItHuWl profile=vpn remote-address=192.168.100.206 service=pptp
add disabled=yes local-address=192.168.100.1 name=samuel password=sam@2020 profile=vpn remote-address=192.168.100.200 service=pptp
add local-address=192.168.100.1 name=alex password=HLw#iZ2- profile=vpn remote-address=192.168.100.207
add local-address=192.168.100.1 name=andre.paiva password=8g%29K profile=vpn remote-address=192.168.100.211 service=l2tp
add local-address=192.168.100.1 name=andre.paiva2 password="8g%29K\$%2gfeD" profile=vpn remote-address=192.168.100.212 service=l2tp
add local-address=192.168.100.1 name=danilo.schervinski password="\"1^z7,l1Y!1(:_z" profile=vpn remote-address=192.168.100.213 service=ovpn
add local-address=192.168.254.1 name=alex2 password=%JndOHrs53 remote-address=192.168.254.110
add local-address=192.168.254.1 name=demo-danielfilho password=%JndOHrs remote-address=192.168.254.111 service=ovpn
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/snmp
set contact=noc@iper.net.br enabled=yes location=br-sc-vii-vinhedo
/system clock
set time-zone-name=America/Sao_Paulo
/system identity
set name=atm-router-sermatica
/system logging
set 0 action=echo
set 1 action=echo
set 2 action=echo
add action=iper topics=info,!firewall
/system ntp client
set enabled=yes
/system ntp client servers
add address=200.160.0.8
add address=200.189.40.8
/system scheduler
add !days interval=1d name=script_backup_email on-event=script_backup_email policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=1970-01-01 start-time=03:30:00
add !days interval=1d name=script_backup_ftp on-event=script_backup_ftp policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=1970-01-01 start-time=03:00:00
add !days name=maintjob333 on-event=maintjob333 policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2026-09-16 start-time=20:09:50
/tool e-mail
set certificate-verification=no from=envia.bkp@iper.net.br password=Iper@2022 port=587 server=45.163.12.11 tls=starttls user=envia.bkp@iper.net.br