# aug/10/2021 14:38:40 by RouterOS 6.47.6
# software id = UEEE-LREP
#
# model = RB750Gr3
# serial number = D5030D65BC82
/interface bridge
add name=LAN_MPLS
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp_pool0 ranges=172.17.156.101-172.17.156.199
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=LAN_MPLS name=dhcp1
/snmp community
add addresses=190.61.4.34/32,190.61.4.170/32,190.61.4.35/32 name=ifxcliente write-access=yes
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/interface bridge port
add bridge=LAN_MPLS interface=ether2
add bridge=LAN_MPLS interface=ether3
add bridge=LAN_MPLS interface=ether4
add bridge=LAN_MPLS interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=172.17.120.26/30 interface=ether1 network=172.17.120.24
add address=172.17.156.1/24 interface=LAN_MPLS network=172.17.156.0
/ip dhcp-server network
add address=172.17.156.0/24 dns-server=8.8.8.8 gateway=172.17.156.1
/ip firewall filter
add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 protocol=tcp src-address-list=ftp_blacklist
add action=drop chain=input comment="drop Telnet brute forcers" dst-port=23 protocol=tcp src-address-list=telnet_blacklist
add action=accept chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcp
add action=add-dst-to-address-list address-list=telnet_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=input comment="drop telnet brute forcers" dst-port=23 protocol=tcp src-address-list=telnet_blacklist
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp
add action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=23 protocol=tcp
add action=drop chain=forward comment="drop ssh brute downstream" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
/ip route
add distance=1 gateway=172.17.120.25
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh address=190.60.0.0/16,190.61.0.0/16,172.16.0.0/16,172.17.0.0/16,10.0.120.0/24,200.62.0.0/16,200.91.0.0/16,192.168.21.0/24,200.78.196.69/32
set winbox address=190.60.0.0/16,200.62.0.0/16,200.91.0.0/16,192.168.21.0/24,200.78.196.69/32
/snmp
set enabled=yes trap-community=ifxcliente
/system identity
set name=SID_1471732_TRANSPORTE_EMPAQUE_SOLOMA_HUEHUETENANGO
/system note
set note="**************************************************************\
    \n*                                                            *\
    \n*    ATENCION:  Este equipo es propiedad de IFX Networks     *\
    \n*     El uso no autorizado esta estrictamente prohibido.     *\
    \n*   Todos los usuarios son legalmente responsables de sus    *\
    \n* acciones sobre el sistema y toda actividad sera registrada *\
    \n*                                                            *\
    \n**************************************************************"