Jedná se o model CCR1036-8G-2S+
Klidně mohou být dva bridge mezi sebou viditelné. Jediné co potřebuji je to, aby tedy ten jeden bridge-data1 šel přes WAN2 a bridge-app1 přes WAN1(směrem ven)
# dec/08/2015 11:29:34 by RouterOS 6.33.3
# software id = YYIL-WV08
#
/interface bridge
add name=bridge-app1
add name=bridge-data1
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
set [ find default-name=ether2 ] disabled=yes name=WAN2
set [ find default-name=sfp-sfpplus1 ] disabled=yes
set [ find default-name=sfp-sfpplus2 ] disabled=yes
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.100-192.168.1.150
add name=dhcp-pool-data1 ranges=192.168.2.100-192.168.2.150
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge-app1 lease-time=8h name=\
dhcp1
add address-pool=dhcp-pool-data1 disabled=no interface=bridge-data1 \
lease-time=8h name=dhcp-data1
/snmp community
add addresses=0.0.0.0/0 authentication-password=XXXXXX \
authentication-protocol=SHA1 encryption-password=XXXXX name=\
Xaro
/interface bridge port
add bridge=bridge-app1 interface=ether3
add bridge=bridge-app1 interface=ether4
add bridge=bridge-app1 interface=ether5
add bridge=bridge-data1 interface=ether6
add bridge=bridge-data1 interface=ether7
add bridge=bridge-data1 interface=ether8
/ip address
add address=192.168.1.1/24 comment=XAPP1 interface=bridge-app1 network=\
192.168.1.0
add address=1.2.3.161/28 interface=WAN1 network=1.2.3.160
add address=192.168.2.1/24 comment=XDATA1 interface=bridge-data1 network=\
192.168.2.0
add address=1.2.3.162/28 interface=WAN1 network=1.2.3.160
add address=1.2.3.163/28 interface=WAN1 network=1.2.3.160
add address=1.2.3.168/28 interface=WAN2 network=1.2.3.160
/ip dhcp-client
add dhcp-options=hostname,clientid interface=sfp-sfpplus2
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1 netmask=24
add address=192.168.2.0/24 gateway=192.168.2.1
/ip dns
set allow-remote-requests=yes servers=2.3.4.5,2.3.4.6
/ip firewall filter
add chain=input comment="Povol p\F8\EDstup Winboxem na Mikrotik" dst-port=\
8291 protocol=tcp src-address=XXX.XXX.XX.110-XXX.XXX.XX.115
add chain=input comment="Povol Management Mikrotiku" dst-port=61001 protocol=\
tcp src-address=XXX.XXX.XX.110-XXX.XXX.XX.115
add chain=input comment="SNMP na Mikrotik" dst-port=161 protocol=udp \
src-address=XXX.XXX.XX.110-XXX.XXX.XX.115
add chain=input comment="accept established connection packets" \
connection-state=established
add chain=forward connection-state=established
add chain=input comment="accept related connection packets" connection-state=\
related
add chain=forward connection-state=related
add chain=input comment="Allow limited pings" limit=50/5s,2 protocol=icmp
add action=drop chain=input comment="Drop excess pings" protocol=icmp
add action=drop chain=input comment="drop invalid packets" connection-state=\
invalid
add action=drop chain=forward connection-state=invalid
add action=drop chain=input in-interface=WAN1
add action=drop chain=input in-interface=WAN2
add action=tarpit chain=input connection-limit=3,32 in-interface=WAN1 \
protocol=tcp src-address-list=blocked-addr
add action=jump chain=forward comment="SYN Flood protect" connection-state=\
new disabled=yes jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add chain=SYN-Protect connection-state=new limit=400,5 protocol=tcp \
tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp \
tcp-flags=syn
add action=add-src-to-address-list address-list=blocked-addr \
address-list-timeout=1m chain=input connection-limit=50,32 in-interface=\
WAN1 protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN1 src-address=\
192.168.1.0/24
add action=masquerade chain=srcnat out-interface=WAN2 src-address=\
192.168.2.0/24
add action=dst-nat chain=dstnat dst-address=1.2.3.161 dst-port=80 \
protocol=tcp to-addresses=192.168.1.3 to-ports=80
add action=dst-nat chain=dstnat dst-address=1.2.3.161 dst-port=443 \
protocol=tcp to-addresses=192.168.1.3 to-ports=443
add action=dst-nat chain=dstnat dst-address=1.2.3.168 dst-port=443 \
protocol=tcp to-addresses=192.168.2.3 to-ports=443
add action=dst-nat chain=dstnat comment="ILO APP1 server" dst-address=\
1.2.3.162 dst-port=443 protocol=tcp src-address=\
XXX.XXX.XX.110-XXX.XXX.XX.115 to-addresses=192.168.1.2 to-ports=443
add action=dst-nat chain=dstnat dst-address=1.2.3.162 dst-port=17990 \
protocol=tcp src-address=XXX.XXX.XX.110-XXX.XXX.XX.115 to-addresses=\
192.168.1.2 to-ports=17990
/ip route
add distance=1 gateway=1.2.3.174
/ip service
set www port=61001
set www-ssl disabled=no port=61443
/lcd
set enabled=no
/lcd pin
set pin-number=5716
/snmp
set contact=XaroFW enabled=yes location="Praha" \
trap-community=Xaro
/system clock
set time-zone-name=Europe/Prague
/system identity
set name=XaroFW
/system routerboard settings
set cpu-frequency=1200MHz memory-frequency=1066DDR protected-routerboot=\
disabled
