# sep/28/2019 09:53:22 by RouterOS 6.45.6 # # model = RBD25G-5HPacQD2HPnD /caps-man configuration add channel.band=2ghz-b/g/n channel.control-channel-width=20mhz \ channel.extension-channel=XX comment=defconf \ datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes \ distance=indoors installation=indoor name=cfg-2ghz ssid=MikroTik62627D-2 add channel.band=5ghz-a/n/ac channel.control-channel-width=20mhz \ channel.extension-channel=XXXX comment=defconf \ datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes \ distance=indoors installation=indoor name=cfg-5ghz-ac ssid=\ MikroTik62627D-5 add channel.band=5ghz-a/n channel.control-channel-width=20mhz \ channel.extension-channel=XX comment=defconf \ datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes \ distance=indoors installation=indoor name=cfg-5ghz-an ssid=\ MikroTik62627D-5 /interface bridge add admin-mac=74:4D:28:F9:17:ED auto-mac=no comment=defconf name=bridge /interface wireless # managed by CAPsMAN # channel: 2447/20-eC/gn(30dBm), SSID: MikroTik62627D-2, local forwarding set [ find default-name=wlan1 ] disabled=no ssid=MikroTik # managed by CAPsMAN # channel: 5260/20-Ceee/ac(23dBm), SSID: MikroTik62627D-5, local forwarding set [ find default-name=wlan2 ] disabled=no ssid=MikroTik /interface list add comment=defconf name=WAN add comment=defconf name=LAN /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik add authentication-types=wpa2-psk comment=defconf disable-pmkid=yes mode=\ dynamic-keys name=wpsSync supplicant-identity=MikroTik \ wpa2-pre-shared-key=8895-5a3f /interface wireless set [ find default-name=wlan3 ] band=5ghz-a/n/ac channel-width=20/40mhz-XX \ disabled=no mode=ap-bridge security-profile=wpsSync ssid=SYNC-F917F0 /ip pool add name=default-dhcp ranges=192.168.88.10-192.168.88.254 /ip dhcp-server add address-pool=default-dhcp disabled=no interface=bridge name=defconf /caps-man manager set enabled=yes /caps-man manager interface set [ find default=yes ] forbid=yes add comment=defconf disabled=no interface=bridge /caps-man provisioning add action=create-dynamic-enabled comment=defconf hw-supported-modes=gn \ master-configuration=cfg-2ghz name-format=prefix-identity name-prefix=\ 2ghz add action=create-dynamic-enabled comment=defconf hw-supported-modes=ac \ master-configuration=cfg-5ghz-ac name-format=prefix-identity name-prefix=\ 5ghz-ac add action=create-dynamic-enabled comment=defconf hw-supported-modes=an \ master-configuration=cfg-5ghz-an name-format=prefix-identity name-prefix=\ 5ghz-an /interface bridge port add bridge=bridge comment=defconf interface=ether2 add bridge=bridge comment=defconf interface=wlan1 add bridge=bridge comment=defconf interface=wlan2 add bridge=bridge comment=defconf interface=wlan3 /ip neighbor discovery-settings set discover-interface-list=LAN /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=ether1 list=WAN /interface wireless cap # set caps-man-addresses=127.0.0.1 enabled=yes interfaces=wlan1,wlan2 /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192.168.88.0 /ip dhcp-client add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\ ether1 /ip dhcp-server network add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1 /ip dns set allow-remote-requests=yes /ip dns static add address=192.168.88.1 comment=defconf name=router.lan /ip firewall filter add action=accept chain=input comment=\ "defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=\ invalid add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp add action=accept chain=input comment=\ "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept in ipsec policy" \ ipsec-policy=in,ipsec add action=accept chain=forward comment="defconf: accept out ipsec policy" \ ipsec-policy=out,ipsec add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ connection-state=established,related add action=accept chain=forward comment=\ "defconf: accept established,related, untracked" connection-state=\ established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" \ connection-state=invalid add action=drop chain=forward comment=\ "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \ connection-state=new in-interface-list=WAN /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" \ ipsec-policy=out,none out-interface-list=WAN /system clock set time-zone-name=Europe/Warsaw /tool mac-server set allowed-interface-list=LAN /tool mac-server mac-winbox set allowed-interface-list=LAN