# EJEMPLO DEMOSTRATIVO
# Generado por MikroTik Configurator
# Escenario: Dual-WAN con failover
# Identificador: dual-wan-failover
# Objetivo principal: RouterOS 7
# No probado directamente en RouterOS, CHR ni hardware
# Revisa interfaces, direccionamiento, credenciales, claves y dependencias antes de importarlo
# Más información: https://mikrotik-configurator.com/ejemplos
# ============================================================
# Script generado por MikroTik Configurator
# MikroTik Configurator: 2.9.0
# RouterOS objetivo: 7.x
# Perfil de dispositivo: generic
# Perfil visible: Perfil genérico
# Fecha: 15/7/2026, 5:39:40
# Dispositivo: MikroTik-Demo-DualWAN
# Firewall: Nivel normal
# Revisa el script, realiza un backup y prueba los cambios de forma controlada.
# ============================================================

# ============================================================
# System
# ============================================================
/system identity set name="MikroTik-Demo-DualWAN"
/system clock set time-zone-name=Europe/Madrid
/ip cloud set update-time=no
/system ntp client set enabled=yes servers=0.pool.ntp.org,1.pool.ntp.org
# ============================================================
# WAN
# ============================================================
/ip address add address=192.0.2.2/24 interface=ether1 comment="WAN"

# ============================================================
# LAN
# ============================================================
# Bridge
/interface bridge add name=bridge protocol-mode=none comment="Bridge LAN"
/ip address add address=192.168.88.1/24 interface=bridge comment="LAN"
/interface bridge port add bridge=bridge interface=ether2
/interface bridge port add bridge=bridge interface=ether3
/interface bridge port add bridge=bridge interface=ether4

# DHCP Server
/ip pool add name=dhcp_pool0 ranges=192.168.88.100-192.168.88.200
/ip dhcp-server add name=dhcp-lan interface=bridge address-pool=dhcp_pool0 lease-time=1d disabled=no
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1,1.1.1.1

# ============================================================
# DNS
# ============================================================
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-max-ttl=1w cache-size=2048KiB

# ============================================================
# NAT
# ============================================================
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT General de salida a Internet"

# ============================================================
# Multi-WAN Failover - Recursive Routing
# ============================================================

# ISP2 - IP Estatica
/ip address add address=198.51.100.2/24 interface=ether5 comment="ISP2 Backup - documentación"
/ip firewall nat add chain=srcnat out-interface=ether5 action=masquerade comment="NAT ISP2 - ISP2 Backup - documentación"

# Tablas de enrutamiento por ISP
/routing table add name=via-isp1 fib comment="ISP1 Principal - documentación"
/routing table add name=via-isp2 fib comment="ISP2 Backup - documentación"

# Rutas de chequeo - anclan el recursive routing
/ip route add dst-address=1.1.1.1/32 gateway=192.0.2.1 distance=1 scope=10 comment="ISP1 Principal - documentación - Check route"
/ip route add dst-address=8.8.8.8/32 gateway=198.51.100.1 distance=1 scope=10 comment="ISP2 Backup - documentación - Check route"

# Rutas por defecto - recursive sobre las IPs de chequeo
/ip route add dst-address=0.0.0.0/0 gateway=1.1.1.1 distance=1 scope=30 target-scope=11 check-gateway=ping comment="ISP1 Principal - documentación - Default Principal"
/ip route add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=2 scope=30 target-scope=11 check-gateway=ping comment="ISP2 Backup - documentación - Default Backup"

# Rutas en tablas especificas para policy routing
/ip route add dst-address=0.0.0.0/0 gateway=192.0.2.1 routing-table=via-isp1 distance=1 comment="ISP1 Principal - documentación"
/ip route add dst-address=0.0.0.0/0 gateway=198.51.100.1 routing-table=via-isp2 distance=1 comment="ISP2 Backup - documentación"

# Routing rules - policy routing
/routing rule add routing-mark=via-isp1 action=lookup table=via-isp1 comment="ISP1 Principal - documentación"
/routing rule add routing-mark=via-isp2 action=lookup table=via-isp2 comment="ISP2 Backup - documentación"

# Mangle - Policy routing
/ip firewall mangle add chain=prerouting action=accept dst-address-list=Bogons src-address-list=Bogons comment="Mangle - Skip bogons"
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark=isp1-conn passthrough=yes connection-mark=no-mark connection-state=new in-interface=ether1 comment="Mangle - Marcar conexiones nuevas ISP1"
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark=isp2-conn passthrough=yes connection-mark=no-mark connection-state=new in-interface=ether5 comment="Mangle - Marcar conexiones nuevas ISP2"
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark=via-isp1 passthrough=no connection-mark=isp1-conn in-interface=bridge comment="Mangle - Routing mark prerouting ISP1"
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark=via-isp2 passthrough=no connection-mark=isp2-conn in-interface=bridge comment="Mangle - Routing mark prerouting ISP2"
/ip firewall mangle add chain=output action=mark-routing new-routing-mark=via-isp1 passthrough=no connection-mark=isp1-conn comment="Mangle - Routing mark output ISP1"
/ip firewall mangle add chain=output action=mark-routing new-routing-mark=via-isp2 passthrough=no connection-mark=isp2-conn comment="Mangle - Routing mark output ISP2"

# ============================================================
# Firewall Configuration
# ============================================================
# ============================================================
# Interface Lists
# ============================================================
/interface list add name=WAN
/interface list add name=LAN
/interface list member add interface=ether1 list=WAN
/interface list member add interface=bridge list=LAN

# ============================================================
# Address Lists
# ============================================================
/ip firewall address-list add list=LAN address=192.168.88.0/24
/ip firewall address-list add list=Bogons address=10.0.0.0/8
/ip firewall address-list add list=Bogons address=172.16.0.0/12
/ip firewall address-list add list=Bogons address=192.168.0.0/16
/ip firewall address-list add list=Bogons address=100.64.0.0/10
/ip firewall address-list add list=Bogons address=169.254.0.0/16
/ip firewall address-list add list=Bogons address=0.0.0.0/8
/ip firewall address-list add list=Bogons address=255.255.255.255/32
/ip firewall address-list add list=Blacklist address=0.0.0.0/32 comment="Placeholder - agregar IPs manualmente"

# ============================================================
# Firewall Filter - Nivel: NORMAL
# ============================================================

# -- INPUT --
/ip firewall filter add chain=input action=accept connection-state=established,related comment="INPUT - Accept establecidas y relacionadas"
/ip firewall filter add chain=input action=drop connection-state=invalid comment="INPUT - Drop invalidos"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,syn comment="INPUT - Drop TCP FIN+SYN"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,rst comment="INPUT - Drop TCP FIN+RST"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,!ack comment="INPUT - Drop TCP FIN sin ACK"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=syn,rst comment="INPUT - Drop TCP SYN+RST"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=!fin,!syn,!rst,!ack comment="INPUT - Drop TCP null scan"
/ip firewall filter add chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1 address-list=Port-Scanners address-list-timeout=1w comment="INPUT - Detectar port scanning"
/ip firewall filter add chain=input action=drop src-address-list=Port-Scanners comment="INPUT - Drop port scanners"
/ip firewall filter add chain=input action=accept protocol=icmp icmp-options=8:0 limit=5,10:packet comment="INPUT - Accept ICMP echo con rate limit"
/ip firewall filter add chain=input action=drop protocol=icmp icmp-options=8:0 comment="INPUT - Drop ICMP flood"
/ip firewall filter add chain=input action=accept protocol=icmp comment="INPUT - Accept resto ICMP"
/ip firewall filter add chain=input action=accept protocol=tcp dst-port=8291 src-address-list=LAN comment="INPUT - Accept Winbox desde LAN"
/ip firewall filter add chain=input action=accept src-address-list=LAN comment="INPUT - Accept red local"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=13231 disabled=yes comment="INPUT - Accept WireGuard"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=500  disabled=yes comment="INPUT - Accept IPsec IKE"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=4500 disabled=yes comment="INPUT - Accept IPsec NAT-T"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=1701 disabled=yes comment="INPUT - Accept L2TP"
/ip firewall filter add chain=input action=accept protocol=ipsec-esp         disabled=yes comment="INPUT - Accept IPsec ESP"
/ip firewall filter add chain=input action=accept protocol=ipsec-ah          disabled=yes comment="INPUT - Accept IPsec AH"
/ip firewall filter add chain=input action=accept protocol=tcp dst-port=443  disabled=yes comment="INPUT - Accept SSTP"
/ip firewall filter add chain=input action=drop comment="INPUT - Drop implicito final"

# -- FORWARD --
/ip firewall filter add chain=forward action=accept connection-state=established,related comment="FORWARD - Accept establecidas y relacionadas"
/ip firewall filter add chain=forward action=accept connection-nat-state=dstnat connection-state=new comment="FORWARD - Accept DSTNAT"
/ip firewall filter add chain=forward action=drop connection-state=invalid comment="FORWARD - Drop invalidos"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN src-address-list=Bogons comment="FORWARD - Drop Bogons desde WAN"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN src-address-list=Port-Scanners comment="FORWARD - Drop forward port scanners"
/ip firewall filter add chain=forward action=drop protocol=tcp tcp-flags=fin,syn comment="FORWARD - Drop TCP flags invalidos"
/ip firewall filter add chain=forward action=drop protocol=tcp tcp-flags=fin,!ack comment="FORWARD - Drop TCP FIN sin ACK"
/ip firewall filter add chain=forward action=accept src-address-list=LAN comment="FORWARD - Accept LAN"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN comment="FORWARD - Drop implicito WAN -> LAN"
# ============================================================
# FIN DEL SCRIPT
# ============================================================