# 2026-08-06 09:36:00 by RouterOS 7.23.2
# software id = 2ATI-ZRRH
#
# model = C52iG-5HaxD2HaxD
# serial number = HM70BFZBYVQ
/interface bridge
add admin-mac=D0:EA:11:4D:40:E1 auto-mac=no comment=defconf name=bridge \
    vlan-filtering=yes
/interface wireguard
add comment="TP10 Multi-Site VPN Hub (FM/DW spokes). Kein IP aufs IF (Routing \
    via AllowedIPs/Routes)." listen-port=51821 mtu=1412 name=wg-hub
/interface vlan
add comment="MAIN 10.40.10.0/24" interface=bridge name=vlan10 vlan-id=10
add comment="INFRA 10.40.20.0/24" interface=bridge name=vlan20 vlan-id=20
add comment="IOT 10.40.30.0/24" interface=bridge name=vlan30 vlan-id=30
add comment="MEDIA 10.40.40.0/24" interface=bridge name=vlan40 vlan-id=40
add comment="UNTRUSTED 10.40.50.0/24" interface=bridge name=vlan50 vlan-id=50
add comment="GUEST 10.40.90.0/24" interface=bridge name=vlan90 vlan-id=90
add comment="MGMT 10.40.99.0/24" interface=bridge name=vlan99 vlan-id=99
add comment="WAN Arris (Liwest)" interface=bridge name=vlan100 vlan-id=100
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=2ghz-ax disabled=no frequency=2462 name=ch-2g width=20mhz
add band=5ghz-ax disabled=no frequency=5745 name=ch-5g skip-dfs-channels=\
    10min-cac width=20/40/80mhz
/interface wifi datapath
add bridge=bridge name=dp-main vlan-id=10
add bridge=bridge name=dp-iot vlan-id=30
add bridge=bridge name=dp-media vlan-id=40
add bridge=bridge name=dp-untrusted vlan-id=50
add bridge=bridge name=dp-guest vlan-id=90
add bridge=bridge name=dp-infra vlan-id=20
/interface wifi security
add authentication-types=wpa3-psk disabled=no ft=yes ft-over-ds=yes name=\
    sec-main
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=no name=sec-iot
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=no ft-over-ds=no \
    name=sec-media
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=no name=\
    sec-untrusted
add authentication-types=wpa2-psk,wpa3-psk ft=yes ft-over-ds=yes name=\
    sec-guest
add authentication-types=wpa2-psk,wpa3-psk ft=no name=sec-infra
/interface wifi configuration
add country=Austria disabled=no mode=ap name=cfg-main-2g security=sec-main \
    ssid=dirtyvader-main tx-power=20
add country=Austria datapath=dp-iot mode=ap multicast-enhance=enabled name=\
    cfg-iot security=sec-iot ssid=dirtyvader-iot
add country=Austria datapath=dp-media mode=ap multicast-enhance=enabled name=\
    cfg-media security=sec-media ssid=dirtyvader-media
add country=Austria datapath=dp-untrusted mode=ap name=cfg-untrusted \
    security=sec-untrusted ssid=dirtyvader-untrusted
add country=Austria datapath=dp-guest mode=ap name=cfg-guest security=\
    sec-guest ssid=dirtyvader-guest
add country=Austria datapath=dp-infra mode=ap name=cfg-infra security=\
    sec-infra ssid=dirtyvader-infra
/interface wifi
set [ find default-name=wifi2 ] channel.frequency=2412 configuration=\
    cfg-main-2g configuration.manager=local disabled=no
add configuration=cfg-guest disabled=no mac-address=D2:EA:11:4D:40:EB \
    master-interface=wifi2 name=w2-guest
add configuration=cfg-iot disabled=no mac-address=D2:EA:11:4D:40:E8 \
    master-interface=wifi2 name=w2-iot
add configuration=cfg-media disabled=no mac-address=D2:EA:11:4D:40:E9 \
    master-interface=wifi2 name=w2-media
add configuration=cfg-untrusted disabled=no mac-address=D2:EA:11:4D:40:EA \
    master-interface=wifi2 name=w2-untrusted
/interface wifi steering
add name=st-main neighbor-group=bf-main rrm=yes wnm=yes
/interface wifi configuration
add channel=ch-5g country=Austria datapath=dp-main mode=ap name=cfg-main-5g \
    security=sec-main ssid=dirtyvader-main steering=st-main
/interface wifi
set [ find default-name=wifi1 ] channel.frequency=5180 configuration=\
    cfg-main-5g configuration.manager=local disabled=no
add configuration=cfg-guest disabled=no mac-address=D2:EA:11:4D:40:E7 \
    master-interface=wifi1 name=w5-guest
add configuration=cfg-media disabled=no mac-address=D2:EA:11:4D:40:E5 \
    master-interface=wifi1 name=w5-media
add configuration=cfg-untrusted disabled=no mac-address=D2:EA:11:4D:40:E6 \
    master-interface=wifi1 name=w5-untrusted
/ip dhcp-server option
add code=6 name="dns 1.1.1.1" value=0x01010101
add code=138 name=omada-inform value=0x0A2814AF
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=pool-v10 ranges=10.40.10.100-10.40.10.200
add name=pool-v20 ranges=10.40.20.100-10.40.20.200
add name=pool-v30 ranges=10.40.30.100-10.40.30.250
add name=pool-v40 ranges=10.40.40.100-10.40.40.200
add name=pool-v50 ranges=10.40.50.100-10.40.50.200
add name=pool-v90 ranges=10.40.90.100-10.40.90.200
add name=pool-v99 ranges=10.40.99.100-10.40.99.200
add comment="BF flat .41 (legacy, retiring)" name=pool-v1 ranges=\
    10.40.41.180-10.40.41.199
/ip dhcp-server
add address-pool=pool-v1 disabled=yes interface=bridge lease-time=2h name=\
    defconf
add address-pool=pool-v10 comment=MAIN interface=vlan10 lease-time=1d name=\
    dhcp-v10
add address-pool=pool-v20 comment=INFRA interface=vlan20 lease-time=1d name=\
    dhcp-v20
add address-pool=pool-v30 comment=IOT interface=vlan30 lease-time=1d name=\
    dhcp-v30
add address-pool=pool-v40 comment=MEDIA interface=vlan40 lease-time=1d name=\
    dhcp-v40
add address-pool=pool-v50 comment=UNTRUSTED interface=vlan50 lease-time=1d \
    name=dhcp-v50
add address-pool=pool-v90 comment=GUEST interface=vlan90 lease-time=12h name=\
    dhcp-v90
add address-pool=pool-v99 comment=MGMT interface=vlan99 lease-time=1d name=\
    dhcp-v99
/system logging action
add disk-file-name=wan-test disk-lines-per-file=2000 name=wantest target=disk
/system script
add dont-require-permissions=no name=wantest-probe owner=admin policy=\
    read,write,policy,test source="  :local ts ([/system clock get date] . \" \
    \" . [/system clock get time])\
    \n  :local e1stat \"\?\"\
    \n  :do { :set e1stat [/ip dhcp-client get [find interface=ether1] status]\
    \_} on-error={}\
    \n  :local e1addr \"-\"\
    \n  :do { :set e1addr [/ip dhcp-client get [find interface=ether1] address\
    ] } on-error={}\
    \n  :local e1mac [/interface ethernet get [find name=ether1] mac-address]\
    \n  :log info (\"WANTEST [\" . \$ts . \"] ether1 status=\" . \$e1stat . \"\
    \_addr=\" . \$e1addr . \" mac=\" . \$e1mac)\
    \n  :local gw \"-\"\
    \n  :do { :set gw [/ip route get [find dst-address=\"0.0.0.0/0\" active=ye\
    s] gateway] } on-error={}\
    \n  :log info (\"WANTEST route default-gw=\" . \$gw)\
    \n  # WAN-Routing+NAT: Router -> public 1.1.1.1 (UDP/53). UNABH\C3\84NGIG \
    von ap1-DNS-Config.\
    \n  # (ICMP/HTTPS sind hier geblockt -> :resolve gegen feste IP ist das ro\
    buste Signal.)\
    \n  :do { :local w [:resolve \"google.com\" server=1.1.1.1] ; :log info (\
    \"WANTEST wan-reach via-1.1.1.1 ok google.com=\" . \$w) } on-error={ :log \
    info \"WANTEST wan-reach via-1.1.1.1 FAIL (Routing/NAT\?)\" }\
    \n  # DoH end-to-end: ap1-Resolver = was die Clients als DNS bekommen\
    \n  :do { :local d [:resolve \"google.com\"] ; :log info (\"WANTEST dns-do\
    h ok google.com=\" . \$d) } on-error={ :log info \"WANTEST dns-doh FAIL (D\
    oH/Bootstrap\?)\" }"
add dont-require-permissions=no name=wantest-run owner=admin policy=\
    read,write,policy,test source="  :global WTN\
    \n  :if (([:typeof \$WTN] = \"nothing\") or (\$WTN = \"\")) do={ :set WTN \
    24 }\
    \n  :log info (\"WANTEST run start (\" . \$WTN . \"x @15s, ~\" . (\$WTN * \
    15 / 60) . \" min)\")\
    \n  :for i from=1 to=\$WTN do={\
    \n    /system script run wantest-probe\
    \n    :delay 15s\
    \n  }\
    \n  :log info \"WANTEST run done\""
add dont-require-permissions=no name=wanmac-clone owner=admin policy=\
    read,write,policy,test source="  :global FBMAC\
    \n  :if (([:typeof \$FBMAC] = \"nothing\") or (\$FBMAC = \"\")) do={ :set \
    FBMAC \"0C:72:74:36:90:99\" }\
    \n  :global E1ORIG\
    \n  :set E1ORIG [/interface ethernet get [find name=ether1] mac-address]\
    \n  :log info (\"WANTEST macclone: orig=\" . \$E1ORIG . \" -> fb=\" . \$FB\
    MAC . \" (Auto-Revert in ~90s)\")\
    \n  /interface ethernet set [find name=ether1] mac-address=\$FBMAC\
    \n  :do { /ip dhcp-client release [find interface=ether1] } on-error={}\
    \n  :delay 2s\
    \n  :do { /ip dhcp-client renew [find interface=ether1] } on-error={}\
    \n  :delay 25s\
    \n  :for i from=1 to=4 do={ /system script run wantest-probe ; :delay 15s \
    }\
    \n  # --- garantierter Auto-Revert im selben Lauf (kein Scheduler n\C3\B6t\
    ig) ---\
    \n  /interface ethernet reset-mac-address [find name=ether1]\
    \n  :do { /ip dhcp-client release [find interface=ether1] } on-error={}\
    \n  :delay 2s\
    \n  :do { /ip dhcp-client renew [find interface=ether1] } on-error={}\
    \n  :delay 15s\
    \n  /system script run wantest-probe\
    \n  :log info (\"WANTEST macclone done -> revert auf factory-MAC (orig war\
    \_\" . \$E1ORIG . \")\")"
add dont-require-permissions=no name=wanmac-revert owner=admin policy=\
    read,write,policy,test source="  /interface ethernet reset-mac-address [fi\
    nd name=ether1]\
    \n  :do { /ip dhcp-client release [find interface=ether1] } on-error={}\
    \n  :delay 2s\
    \n  :do { /ip dhcp-client renew [find interface=ether1] } on-error={}\
    \n  :delay 10s\
    \n  /system script run wantest-probe\
    \n  :log info \"WANTEST macclone manual-revert -> factory-MAC\""
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi2
add bridge=bridge interface=ether1
/interface bridge vlan
add bridge=bridge untagged=bridge,ether2 vlan-ids=1
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=10
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=20
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=30
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=40
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=50
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=90
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=99
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=100
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add comment="WAN Arris via vlan100" interface=vlan100 list=WAN
/interface wifi access-list
add action=accept comment="pin P750W to ap1 (1/2): accept on ap1 iot" \
    disabled=yes interface=w2-iot mac-address=4C:EB:BD:E3:25:F2
add action=reject comment=\
    "pin P750W to ap1 (2/2): reject on any other AP incl dynamic ap2 VAPs" \
    disabled=yes mac-address=4C:EB:BD:E3:25:F2
/interface wifi cap
set caps-man-addresses=10.40.41.1 discovery-interfaces=bridge
/interface wifi capsman
set enabled=yes interfaces=bridge
/interface wifi provisioning
add action=create-dynamic-enabled master-configuration=cfg-main-2g \
    slave-configurations=cfg-iot,cfg-media,cfg-untrusted,cfg-guest,cfg-infra \
    supported-bands=2ghz-ax
add action=create-dynamic-enabled master-configuration=cfg-main-5g \
    slave-configurations=cfg-media,cfg-untrusted,cfg-guest,cfg-infra \
    supported-bands=5ghz-ax
/interface wireguard peers
add allowed-address=10.101.0.0/24 comment=fm endpoint-address=\
    abxhutfgsid9snmy.myfritz.net endpoint-port=52476 interface=wg-hub name=fm \
    public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE="
add allowed-address=10.95.10.0/24 comment=dw interface=wg-hub name=dw \
    public-key="FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw="
/ip address
add address=10.40.41.1/24 comment=defconf interface=bridge network=10.40.41.0
add address=10.40.10.1/24 comment="MAIN GW" interface=vlan10 network=\
    10.40.10.0
add address=10.40.20.1/24 comment="INFRA GW" interface=vlan20 network=\
    10.40.20.0
add address=10.40.30.1/24 comment="IOT GW" interface=vlan30 network=\
    10.40.30.0
add address=10.40.40.1/24 comment="MEDIA GW" interface=vlan40 network=\
    10.40.40.0
add address=10.40.50.1/24 comment="UNTRUSTED GW" interface=vlan50 network=\
    10.40.50.0
add address=10.40.90.1/24 comment="GUEST GW" interface=vlan90 network=\
    10.40.90.0
add address=10.40.99.1/24 comment="MGMT GW" interface=vlan99 network=\
    10.40.99.0
add address=10.40.41.254/24 comment="Secondary = alte FB-GW-IP; haelt statisch\
    e .41-Hosts online nach Arris-Swap (ap1 NATs + WG-Hub)" interface=bridge \
    network=10.40.41.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1 name=client1 use-peer-dns=\
    no
add comment="WAN Arris DHCP (Liwest) via vlan100" interface=vlan100 name=\
    client2 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=10.40.10.82 client-id=1:56:71:6c:22:e6:a9 dhcp-option=\
    "dns 1.1.1.1" mac-address=56:71:6C:22:E6:A9 server=dhcp-v10
add address=10.40.10.196 client-id=1:f2:62:4c:e1:af:9 mac-address=\
    F2:62:4C:E1:AF:09 server=dhcp-v10
add address=10.40.40.199 client-id=1:48:a6:b8:b:63:10 mac-address=\
    48:A6:B8:0B:63:10 server=dhcp-v40
add address=10.40.40.191 client-id=1:34:7e:5c:32:37:96 mac-address=\
    34:7E:5C:32:37:96 server=dhcp-v40
add address=10.40.40.192 client-id=1:34:7e:5c:32:33:b8 mac-address=\
    34:7E:5C:32:33:B8 server=dhcp-v40
add address=10.40.40.193 client-id=1:78:28:ca:80:2a:f6 mac-address=\
    78:28:CA:80:2A:F6 server=dhcp-v40
add address=10.40.40.195 client-id=1:78:28:ca:82:16:c2 mac-address=\
    78:28:CA:82:16:C2 server=dhcp-v40
add address=10.40.40.201 client-id=1:94:9f:3e:49:59:ee mac-address=\
    94:9F:3E:49:59:EE server=dhcp-v40
add address=10.40.40.196 client-id=1:48:a6:b8:16:38:ae mac-address=\
    48:A6:B8:16:38:AE server=dhcp-v40
add address=10.40.40.197 client-id=1:48:a6:b8:14:fe:f2 mac-address=\
    48:A6:B8:14:FE:F2 server=dhcp-v40
add address=10.40.40.200 client-id=1:48:a6:b8:69:69:7b mac-address=\
    48:A6:B8:69:69:7B server=dhcp-v40
add address=10.40.40.194 client-id=1:48:a6:b8:14:fe:d0 mac-address=\
    48:A6:B8:14:FE:D0 server=dhcp-v40
add address=10.40.40.198 comment=SonosTerrasse mac-address=78:28:CA:D2:0D:AC \
    server=dhcp-v40
add address=10.40.30.202 comment=shelly-s22_kueche_steckdose3-2 mac-address=\
    A0:85:E3:C8:65:34 server=dhcp-v30
add address=10.40.30.203 comment=shelly-s23_dieleug-wohnzimmer_licht \
    mac-address=AC:15:18:7B:62:20 server=dhcp-v30
add address=10.40.30.205 comment=shelly-s25_bad_lichtschalter mac-address=\
    98:A3:16:79:38:50 server=dhcp-v30
add address=10.40.30.206 comment=shelly-s20_kueche_steckdosen2 mac-address=\
    98:A3:16:7C:5F:EC server=dhcp-v30
add address=10.40.30.207 comment=shelly-s21_kueche_steckdosen4 mac-address=\
    20:6E:F1:01:F9:F8 server=dhcp-v30
add address=10.40.30.208 comment=shelly-s1_weihnachten_kueche mac-address=\
    E4:B0:63:D7:C7:A4 server=dhcp-v30
add address=10.40.30.209 comment=shelly-s2_weihnachten_terrasse mac-address=\
    28:37:2F:36:F4:7C server=dhcp-v30
add address=10.40.30.210 comment=shelly-s3_weihnachten_kinderzimmer \
    mac-address=E4:B0:63:E4:EF:7C server=dhcp-v30
add address=10.40.30.211 comment=shelly-s4_kueche_mikrowelle mac-address=\
    E4:B0:63:E4:0F:30 server=dhcp-v30
add address=10.40.30.212 comment=shelly-s5_kueche_backofen mac-address=\
    D8:85:AC:0C:5C:C8 server=dhcp-v30
add address=10.40.30.213 comment=shelly-s6_kueche_kuehlschrank mac-address=\
    D0:CF:13:D8:18:FC server=dhcp-v30
add address=10.40.30.214 comment=shelly-s7_kueche_tiefkuehlschrank \
    mac-address=D0:CF:13:D9:94:E8 server=dhcp-v30
add address=10.40.30.215 comment=shelly-s8_kueche_geschirrspueler \
    mac-address=E4:B0:63:FA:FD:E0 server=dhcp-v30
add address=10.40.30.216 comment=shelly-s9_wohnzimmer_sideboard mac-address=\
    E8:F6:0A:61:88:08 server=dhcp-v30
add address=10.40.30.217 comment=shelly-s10_bad_sonos mac-address=\
    E4:B0:63:FC:57:E4 server=dhcp-v30
add address=10.40.30.218 comment=shelly-s11_kinderzimmer_sonos mac-address=\
    E4:B0:63:FA:6C:00 server=dhcp-v30
add address=10.40.30.219 comment=shelly-s12_dieleug_steckdosen mac-address=\
    48:F6:EE:C8:E6:AC server=dhcp-v30
add address=10.40.30.220 comment=shelly-s13_arbeitszimmer_technik \
    mac-address=48:F6:EE:DD:6A:F4 server=dhcp-v30
add address=10.40.30.221 comment=shelly-s14_schlafzimmer_bett mac-address=\
    E4:B0:63:FC:59:48 server=dhcp-v30
add address=10.40.30.222 comment=shelly-s15_technik_pve mac-address=\
    E4:B0:63:FA:D5:34 server=dhcp-v30
add address=10.40.30.223 comment=shelly-s16_wohnzimmer_steckdosen \
    mac-address=10:20:BA:FA:F5:40 server=dhcp-v30
add address=10.40.30.224 comment=shelly-s17_bad_steckdosen mac-address=\
    10:20:BA:FB:6D:64 server=dhcp-v30
add address=10.40.30.225 comment=shelly-s18_kueche_steckdosen1 mac-address=\
    48:F6:EE:CC:16:E4 server=dhcp-v30
add address=10.40.30.226 comment=shelly-s19_kueche_steckdosen3 mac-address=\
    10:20:BA:FB:70:FC server=dhcp-v30
add address=10.40.30.227 comment=switchbot-floorlamp mac-address=\
    B8:F8:62:09:F2:04 server=dhcp-v30
add address=10.40.30.228 comment=Twinkly_Weihnachtsgirlande mac-address=\
    98:F4:AB:2C:A7:88 server=dhcp-v30
add address=10.40.30.230 comment=Withings_waage mac-address=00:24:E4:40:2A:72 \
    server=dhcp-v30
add address=10.40.30.231 comment=Withings_blutdruck mac-address=\
    A4:7E:FA:18:2C:64 server=dhcp-v30
add address=10.40.30.232 comment=pve-homematic-raspi-ccu mac-address=\
    BC:24:11:8E:0A:57 server=dhcp-v30
add address=10.40.30.233 comment=shelly-s26_bad_luefter mac-address=\
    98:A3:16:7A:A3:54 server=dhcp-v30
add address=10.40.30.236 comment=lichterkette mac-address=A4:F0:0F:5F:D0:EC \
    server=dhcp-v30
add address=10.40.30.237 comment=lichterkette-mini mac-address=\
    24:DC:C3:9B:89:64 server=dhcp-v30
add address=10.40.30.241 comment=NukiSmartlock mac-address=28:DB:A7:09:7B:54 \
    server=dhcp-v30
add address=10.40.30.244 comment=NukiBridge mac-address=24:62:AB:B1:63:F4 \
    server=dhcp-v30
add address=10.40.30.8 comment=DTUBI-414392337823 mac-address=\
    54:F2:9F:12:51:F0 server=dhcp-v30
add address=10.40.20.10 comment=nas-bf mac-address=90:09:D0:58:20:F9 server=\
    dhcp-v20
add address=10.40.40.11 comment=tv mac-address=70:AF:24:B8:C9:86 server=\
    dhcp-v40
add address=10.40.30.5 comment=P750W mac-address=4C:EB:BD:E3:25:F2 server=\
    dhcp-v30
add address=10.40.30.180 client-id=1:e4:bc:96:1f:b2:81 comment=Airfryer \
    dhcp-option="dns 1.1.1.1" mac-address=E4:BC:96:1F:B2:81 server=dhcp-v30
add address=10.40.30.204 comment=shelly-s24_bad_spiegelschrank mac-address=\
    14:33:5C:D8:2D:7C server=dhcp-v30
add address=10.40.30.150 client-id=1:fc:ee:11:3:32:26 comment=Ender3V3KE-3226 \
    mac-address=FC:EE:11:03:32:26 server=dhcp-v30
/ip dhcp-server network
add address=10.40.10.0/24 comment=MAIN dns-server=10.40.10.1 gateway=\
    10.40.10.1
add address=10.40.20.0/24 comment=INFRA dns-server=10.40.20.1 gateway=\
    10.40.20.1
add address=10.40.30.0/24 comment=IOT dns-server=10.40.30.1 gateway=\
    10.40.30.1
add address=10.40.40.0/24 comment=MEDIA dns-server=10.40.40.1 gateway=\
    10.40.40.1
add address=10.40.41.0/24 comment=defconf dns-server=10.40.41.1 gateway=\
    10.40.41.1 netmask=24
add address=10.40.50.0/24 comment=UNTRUSTED dns-server=10.40.50.1 gateway=\
    10.40.50.1
add address=10.40.90.0/24 comment=GUEST dns-server=10.40.90.1 gateway=\
    10.40.90.1
add address=10.40.99.0/24 comment=MGMT dhcp-option=omada-inform dns-server=\
    10.40.99.1 gateway=10.40.99.1
/ip dns
set allow-remote-requests=yes mdns-repeat-ifaces=\
    vlan10,vlan20,vlan40,vlan30,vlan90,bridge servers=1.1.1.1 use-doh-server=\
    https://px35ynlol3.cloudflare-gateway.com/dns-query verify-doh-cert=yes
/ip dns static
add address=10.40.41.1 comment=defconf name=router.lan type=A
add address=10.40.41.2 comment=\
    "TP4-transition; update to 10.40.99.2 after MGMT migration" name=\
    ap2.bf.lan type=A
add address=10.40.41.11 comment="ALLNET core switch" name=sw1.bf.lan type=A
add address=10.40.41.12 comment="Omada access switch" name=sw2.bf.lan type=A
add address=10.40.20.167 comment=\
    "Mac mini (INFRA VLAN20, migriert 2026-06-16)" name=macmini.bf.lan type=A
add address=10.40.20.100 comment="Proxmox hypervisor" name=pve.bf.lan type=A
add address=10.40.20.173 comment="pve-mcp SSE server" name=pve-mcp.bf.lan \
    type=A
add address=10.40.20.10 comment=\
    "DS923+ NAS (VLAN20, TP14.1, DNS-Sweep TP14.3 2026-07-16)" name=\
    nas.bf.lan type=A
add address=10.40.20.126 comment=\
    "Docker-LXC / Portainer (VLAN20, TP14.2, DNS-Sweep TP14.3 2026-07-16)" \
    name=docker.bf.lan type=A
add address=10.40.99.1 comment=\
    "TP19.1: ap1 MGMT = vlan99 GW (live since TP4), no separate move needed" \
    name=ap1.bf.lan type=A
add address=10.40.20.20 comment=\
    "TP20: Platform-Postgres LXC 105 on pve, PG16, nautobot DB" name=\
    platform-pg.bf.lan type=A
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    in-interface-list=WAN
add action=accept chain=input comment=TP10-seal-est connection-state=\
    established,related,untracked
add action=drop chain=input comment=TP10-seal-inv connection-state=invalid
add action=accept chain=input comment="TP10: WG hub listen (51821)" dst-port=\
    51821 protocol=udp
add action=accept chain=forward comment="TP10: allow from WG spokes (FM/DW)" \
    in-interface=wg-hub
add action=accept chain=forward comment="TP10: allow to WG spokes (FM/DW)" \
    out-interface=wg-hub
add action=accept chain=input comment=TP10-seal-dhcp dst-port=68 \
    in-interface-list=WAN protocol=udp
add action=accept chain=input comment=TP10-seal-icmp protocol=icmp
add action=accept chain=input comment=TP10-seal-lan in-interface-list=LAN
add action=drop chain=input comment=TP10-seal-wandrop in-interface-list=WAN
add action=accept chain=forward comment=\
    "TP5: MAIN->MEDIA forward (AirPlay/Sonos)" in-interface=vlan10 \
    out-interface=vlan40
add action=accept chain=forward comment=\
    "TP5: MEDIA->MAIN forward (AirPlay/Sonos)" in-interface=vlan40 \
    out-interface=vlan10
add action=accept chain=input comment=\
    "TP5: mDNS 5353 input vlan10 (repeater)" dst-port=5353 in-interface=\
    vlan10 protocol=udp
add action=accept chain=input comment=\
    "TP5: mDNS 5353 input vlan40 (repeater)" dst-port=5353 in-interface=\
    vlan40 protocol=udp
add action=accept chain=forward comment=\
    "TP5: INFRA->MEDIA forward (HA<->Sonos)" in-interface=vlan20 \
    out-interface=vlan40
add action=accept chain=forward comment=\
    "TP5: MEDIA->INFRA forward (HA<->Sonos)" in-interface=vlan40 \
    out-interface=vlan20
add action=accept chain=input comment=\
    "TP5: mDNS 5353 input vlan20 (repeater/HA)" dst-port=5353 in-interface=\
    vlan20 protocol=udp
add action=accept chain=input comment=\
    "TP5: mDNS 5353 input vlan30 (repeater)" dst-port=5353 in-interface=\
    vlan30 protocol=udp
add action=accept chain=input comment=\
    "TP5: mDNS 5353 input vlan90 (repeater)" dst-port=5353 in-interface=\
    vlan90 protocol=udp
add action=accept chain=forward comment=\
    "TP5: GUEST->MEDIA forward (Sonos/Cast)" in-interface=vlan90 \
    out-interface=vlan40
add action=accept chain=forward comment=\
    "TP5: MEDIA->GUEST forward (Sonos/Cast)" in-interface=vlan40 \
    out-interface=vlan90
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=accept chain=srcnat comment=\
    "TP4: no-NAT inter-VLAN (LAN-internal, before masquerade)" dst-address=\
    10.40.0.0/16
add action=masquerade chain=srcnat comment="TP4: masquerade VLANs toward FB" \
    disabled=yes out-interface=bridge
add action=masquerade chain=srcnat comment=\
    "TP4: masquerade VLANs via ether1 (Liwest WAN)" disabled=yes \
    out-interface=ether1
/ip route
add comment="TP10: FM spoke -> wg-hub" dst-address=10.101.0.0/24 gateway=\
    wg-hub
add comment="TP10: DW spoke (kuenftig) -> wg-hub" dst-address=10.95.10.0/24 \
    gateway=wg-hub
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=ap1
/system logging
add action=wantest topics=script