# EJEMPLO DEMOSTRATIVO
# Generado por MikroTik Configurator
# Escenario: Acceso remoto mediante WireGuard
# Identificador: wireguard-remote-access
# Objetivo principal: RouterOS 7
# No probado directamente en RouterOS, CHR ni hardware
# Revisa interfaces, direccionamiento, credenciales, claves y dependencias antes de importarlo
# Más información: https://mikrotik-configurator.com/ejemplos
# ============================================================
# Script generado por MikroTik Configurator
# MikroTik Configurator: 2.9.0
# RouterOS objetivo: 7.x
# Perfil de dispositivo: generic
# Perfil visible: Perfil genérico
# Fecha: 15/7/2026, 5:39:40
# Dispositivo: MikroTik-Demo-WireGuard
# Firewall: Nivel normal
# Revisa el script, realiza un backup y prueba los cambios de forma controlada.
# ============================================================

# ============================================================
# System
# ============================================================
/system identity set name="MikroTik-Demo-WireGuard"
/system clock set time-zone-name=Europe/Madrid
/ip cloud set update-time=no
/system ntp client set enabled=yes servers=0.pool.ntp.org,1.pool.ntp.org
# ============================================================
# WAN
# ============================================================
/ip dhcp-client add interface=ether1 default-route-distance=1 add-default-route=yes use-peer-dns=no disabled=no comment="WAN DHCP"

# ============================================================
# LAN
# ============================================================
# Bridge
/interface bridge add name=bridge protocol-mode=none comment="Bridge LAN"
/ip address add address=192.168.88.1/24 interface=bridge comment="LAN"
/interface bridge port add bridge=bridge interface=ether2
/interface bridge port add bridge=bridge interface=ether3
/interface bridge port add bridge=bridge interface=ether4
/interface bridge port add bridge=bridge interface=ether5

# DHCP Server
/ip pool add name=dhcp_pool0 ranges=192.168.88.100-192.168.88.200
/ip dhcp-server add name=dhcp-lan interface=bridge address-pool=dhcp_pool0 lease-time=1d disabled=no
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1,1.1.1.1

# ============================================================
# DNS
# ============================================================
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-max-ttl=1w cache-size=2048KiB

# ============================================================
# NAT
# ============================================================
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT General de salida a Internet"

# ============================================================
# Firewall Configuration
# ============================================================
# ============================================================
# Interface Lists
# ============================================================
/interface list add name=WAN
/interface list add name=LAN
/interface list member add interface=ether1 list=WAN
/interface list member add interface=bridge list=LAN

# ============================================================
# Address Lists
# ============================================================
/ip firewall address-list add list=LAN address=192.168.88.0/24
/ip firewall address-list add list=Bogons address=10.0.0.0/8
/ip firewall address-list add list=Bogons address=172.16.0.0/12
/ip firewall address-list add list=Bogons address=192.168.0.0/16
/ip firewall address-list add list=Bogons address=100.64.0.0/10
/ip firewall address-list add list=Bogons address=169.254.0.0/16
/ip firewall address-list add list=Bogons address=0.0.0.0/8
/ip firewall address-list add list=Bogons address=255.255.255.255/32
/ip firewall address-list add list=Blacklist address=0.0.0.0/32 comment="Placeholder - agregar IPs manualmente"

# ============================================================
# Firewall Filter - Nivel: NORMAL
# ============================================================

# -- INPUT --
/ip firewall filter add chain=input action=accept connection-state=established,related comment="INPUT - Accept establecidas y relacionadas"
/ip firewall filter add chain=input action=drop connection-state=invalid comment="INPUT - Drop invalidos"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,syn comment="INPUT - Drop TCP FIN+SYN"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,rst comment="INPUT - Drop TCP FIN+RST"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=fin,!ack comment="INPUT - Drop TCP FIN sin ACK"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=syn,rst comment="INPUT - Drop TCP SYN+RST"
/ip firewall filter add chain=input action=drop protocol=tcp tcp-flags=!fin,!syn,!rst,!ack comment="INPUT - Drop TCP null scan"
/ip firewall filter add chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1 address-list=Port-Scanners address-list-timeout=1w comment="INPUT - Detectar port scanning"
/ip firewall filter add chain=input action=drop src-address-list=Port-Scanners comment="INPUT - Drop port scanners"
/ip firewall filter add chain=input action=accept protocol=icmp icmp-options=8:0 limit=5,10:packet comment="INPUT - Accept ICMP echo con rate limit"
/ip firewall filter add chain=input action=drop protocol=icmp icmp-options=8:0 comment="INPUT - Drop ICMP flood"
/ip firewall filter add chain=input action=accept protocol=icmp comment="INPUT - Accept resto ICMP"
/ip firewall filter add chain=input action=accept protocol=tcp dst-port=8291 src-address-list=LAN comment="INPUT - Accept Winbox desde LAN"
/ip firewall filter add chain=input action=accept src-address-list=LAN comment="INPUT - Accept red local"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=13231 comment="INPUT - Accept WireGuard"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=500  disabled=yes comment="INPUT - Accept IPsec IKE"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=4500 disabled=yes comment="INPUT - Accept IPsec NAT-T"
/ip firewall filter add chain=input action=accept protocol=udp dst-port=1701 disabled=yes comment="INPUT - Accept L2TP"
/ip firewall filter add chain=input action=accept protocol=ipsec-esp         disabled=yes comment="INPUT - Accept IPsec ESP"
/ip firewall filter add chain=input action=accept protocol=ipsec-ah          disabled=yes comment="INPUT - Accept IPsec AH"
/ip firewall filter add chain=input action=accept protocol=tcp dst-port=443  disabled=yes comment="INPUT - Accept SSTP"
/ip firewall filter add chain=input action=drop comment="INPUT - Drop implicito final"

# -- FORWARD --
/ip firewall filter add chain=forward action=accept connection-state=established,related comment="FORWARD - Accept establecidas y relacionadas"
/ip firewall filter add chain=forward action=accept connection-nat-state=dstnat connection-state=new comment="FORWARD - Accept DSTNAT"
/ip firewall filter add chain=forward action=drop connection-state=invalid comment="FORWARD - Drop invalidos"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN src-address-list=Bogons comment="FORWARD - Drop Bogons desde WAN"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN src-address-list=Port-Scanners comment="FORWARD - Drop forward port scanners"
/ip firewall filter add chain=forward action=drop protocol=tcp tcp-flags=fin,syn comment="FORWARD - Drop TCP flags invalidos"
/ip firewall filter add chain=forward action=drop protocol=tcp tcp-flags=fin,!ack comment="FORWARD - Drop TCP FIN sin ACK"
/ip firewall filter add chain=forward action=accept src-address-list=LAN comment="FORWARD - Accept LAN"
/ip firewall filter add chain=forward action=drop in-interface-list=WAN comment="FORWARD - Drop implicito WAN -> LAN"

# ============================================================
# VPN
# ============================================================

# WireGuard
/interface wireguard add name=wg0 listen-port=13231 comment="WireGuard Server"
/ip address add address=10.10.1.1/24 interface=wg0 comment="WireGuard LAN"

# WireGuard Peers
/interface wireguard peers add interface=wg0 public-key="CHANGE_ME_WIREGUARD_CLIENT_PUBLIC_KEY" allowed-address=10.10.1.2/32 persistent-keepalive=25s comment="Cliente remoto demostrativo"


# WireGuard — reglas firewall para trafico VPN
/ip firewall address-list add list=WireGuard-Clients address=10.10.1.0/24 comment="Red WireGuard"
/ip firewall filter add chain=forward src-address-list=WireGuard-Clients action=accept comment="FORWARD - WireGuard clientes -> LAN"
/ip firewall filter add chain=forward dst-address-list=WireGuard-Clients connection-state=established,related action=accept comment="FORWARD - LAN -> WireGuard establecidas"
# ============================================================
# FIN DEL SCRIPT
# ============================================================