# EJEMPLO DEMOSTRATIVO
# Generado por MikroTik Configurator
# Escenario: Red de invitados aislada
# Identificador: guest-network
# Objetivo principal: RouterOS 7
# No probado directamente en RouterOS, CHR ni hardware
# Revisa interfaces, direccionamiento, credenciales, claves y dependencias antes de importarlo
# Más información: https://mikrotik-configurator.com/ejemplos
# ============================================================
# Script generado por MikroTik Configurator
# MikroTik Configurator: 2.9.0
# RouterOS objetivo: 7.x
# Perfil de dispositivo: generic
# Perfil visible: Perfil genérico
# Fecha: 15/7/2026, 5:39:40
# Dispositivo: MikroTik-Demo-Guest
# Firewall: Nivel normal
# Revisa el script, realiza un backup y prueba los cambios de forma controlada.
# ============================================================

# ============================================================
# System
# ============================================================
/system identity set name="MikroTik-Demo-Guest"
/system clock set time-zone-name=Europe/Madrid
/ip cloud set update-time=no
/system ntp client set enabled=yes servers=0.pool.ntp.org,1.pool.ntp.org
# ============================================================
# WAN
# ============================================================
/ip dhcp-client add interface=ether1 default-route-distance=1 add-default-route=yes use-peer-dns=no disabled=no comment="WAN DHCP"

# ============================================================
# LAN
# ============================================================
# Bridge
/interface bridge add name=bridge protocol-mode=none comment="Bridge LAN"
/ip address add address=192.168.88.1/24 interface=bridge comment="LAN"
/interface bridge port add bridge=bridge interface=ether2
/interface bridge port add bridge=bridge interface=ether3
/interface bridge port add bridge=bridge interface=ether4
/interface bridge port add bridge=bridge interface=ether5

# DHCP Server
/ip pool add name=dhcp_pool0 ranges=192.168.88.100-192.168.88.200
/ip dhcp-server add name=dhcp-lan interface=bridge address-pool=dhcp_pool0 lease-time=1d disabled=no
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1,1.1.1.1

# ============================================================
# VLANs
# ============================================================

# VLAN 40 — Invitados
/interface vlan add name=invitados-40 vlan-id=40 interface=bridge comment="VLAN 40 Invitados - ejemplo demostrativo"
/ip address add address=192.168.40.1/24 interface=invitados-40 comment="VLAN 40 - Invitados"
/ip pool add name=pool-vlan40 ranges=192.168.40.100-192.168.40.220
/ip dhcp-server add name=dhcp-vlan40 interface=invitados-40 address-pool=pool-vlan40 lease-time=1d disabled=no
/ip dhcp-server network add address=192.168.40.0/24 gateway=192.168.40.1 dns-server=1.1.1.1,8.8.8.8
/ip firewall address-list add list=VLAN-40-Guest address=192.168.40.0/24 comment="VLAN 40 - Invitados guests"
/ip firewall filter add chain=forward src-address-list=VLAN-40-Guest dst-address-list=!Bogons action=accept comment="FORWARD - VLAN 40 guest -> internet"
/ip firewall filter add chain=forward src-address-list=VLAN-40-Guest action=drop comment="FORWARD - VLAN 40 guest drop privado"

# ============================================================
# DNS
# ============================================================
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-max-ttl=1w cache-size=2048KiB

# ============================================================
# NAT
# ============================================================
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT General de salida a Internet"

# ============================================================
# Firewall Configuration
# ============================================================
# ============================================================
# Interface Lists
# ============================================================
/interface list add name=WAN
/interface list add name=LAN
/interface list member add interface=ether1 list=WAN
/interface list member add interface=bridge list=LAN

# ============================================================
# Address Lists
# ============================================================
/ip firewall address-list add list=LAN address=192.168.88.0/24
/ip firewall address-list add list=Bogons address=10.0.0.0/8
/ip firewall address-list add list=Bogons address=172.16.0.0/12
/ip firewall address-list add list=Bogons address=192.168.0.0/16
/ip firewall address-list add list=Bogons address=100.64.0.0/10
/ip firewall address-list add list=Bogons address=169.254.0.0/16
/ip firewall address-list add list=Bogons address=0.0.0.0/8
/ip firewall address-list add list=Bogons address=255.255.255.255/32
/ip firewall address-list add list=Blacklist address=0.0.0.0/32 comment="Placeholder - agregar IPs manualmente"

# ============================================================
# Firewall Filter - Nivel: NORMAL
# ============================================================

# -- INPUT --
/ip firewall filter add chain=input action=accept connection-state=established,related comment="INPUT - Accept establecidas y relacionadas"
/ip firewall filter add chain=input action=drop connection-state=invalid comment="INPUT - Drop invalidos"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,syn comment="INPUT - Drop TCP FIN+SYN"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,rst comment="INPUT - Drop TCP FIN+RST"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,!ack comment="INPUT - Drop TCP FIN sin ACK"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=syn,rst comment="INPUT - Drop TCP SYN+RST"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=!fin,!syn,!rst,!ack comment="INPUT - Drop TCP null scan"
/ip firewall filter add chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1 address-list=Port-Scanners address-list-timeout=1w comment="INPUT - Detectar port scanning"
/ip firewall filter add chain=input action=drop src-address-list=Port-Scanners comment="INPUT - Drop port scanners"
/ip firewall filter add chain=input action=accept protocol=icmp icmp-options=8:0 limit=5,10:packet comment="INPUT - Accept ICMP echo con rate limit"
/ip firewall filter add chain=input action=drop protocol=icmp icmp-options=8:0 comment="INPUT - Drop ICMP flood"
/ip firewall filter add chain=input action=accept protocol=icmp comment="INPUT - Accept resto ICMP"
/ip firewall filter add chain=input action=accept protocol=tcp dst-port=8291 src-address-list=LAN comment="INPUT - Accept Winbox desde LAN"
/ip firewall filter add chain=input action=accept src-address-list=LAN comment="INPUT - Accept red local"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=13231 disabled=yes comment="INPUT - Accept WireGuard"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=500  disabled=yes comment="INPUT - Accept IPsec IKE"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=4500 disabled=yes comment="INPUT - Accept IPsec NAT-T"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=1701 disabled=yes comment="INPUT - Accept L2TP"
/ip firewall filter add chain=input action=accept protocol=ipsec-esp         disabled=yes comment="INPUT - Accept IPsec ESP"
/ip firewall filter add chain=input action=accept protocol=ipsec-ah          disabled=yes comment="INPUT - Accept IPsec AH"
/ip firewall filter add chain=input action=accept protocol=tcp dst-port=443  disabled=yes comment="INPUT - Accept SSTP"
/ip firewall filter add chain=input action=drop comment="INPUT - Drop implicito final"

# -- FORWARD --
/ip firewall filter add chain=forward action=accept connection-state=established,related comment="FORWARD - Accept establecidas y relacionadas"
/ip firewall filter add chain=forward action=accept connection-nat-state=dstnat connection-state=new comment="FORWARD - Accept DSTNAT"
/ip firewall filter add chain=forward action=drop connection-state=invalid comment="FORWARD - Drop invalidos"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN src-address-list=Bogons comment="FORWARD - Drop Bogons desde WAN"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN src-address-list=Port-Scanners comment="FORWARD - Drop forward port scanners"
/ip firewall filter add chain=forward action=drop protocol=tcp tcp-flags=fin,syn comment="FORWARD - Drop TCP flags invalidos"
/ip firewall filter add chain=forward action=drop protocol=tcp tcp-flags=fin,!ack comment="FORWARD - Drop TCP FIN sin ACK"
/ip firewall filter add chain=forward action=accept src-address-list=LAN comment="FORWARD - Accept LAN"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN comment="FORWARD - Drop implicito WAN -> LAN"
# ============================================================
# FIN DEL SCRIPT
# ============================================================