Ниже приведена конфигурация роутера. Конфигурация свитча была пустой, теперь я настроил его как второй роутер, потому что должен быть какой-то интернет. Таким образом, настройки свитча были без DHCP-клиента и сервера, пула IP-адресов и правила маскарадинга в брандмауэре.
# jan/18/2021 12:21:09 by RouterOS 6.48
# software id = LDD6-9T84
#
# model = RB1100Dx4
# serial number = D0BF0B953F24
/interface bridge
add name=bridge
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
set 12 default-vlan-id=0
set 13 default-vlan-id=0
set 14 default-vlan-id=0
set 15 default-vlan-id=0
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=192.168.1.11-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=bridge name=dhcp1
/system logging action
set 1 disk-file-count=5 disk-file-name=logg disk-lines-per-file=10000 disk-stop-on-full=yes
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
add bridge=bridge interface=ether10
add bridge=bridge interface=ether11
add bridge=bridge interface=ether12
add bridge=bridge interface=ether13
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=192.168.1.0
/ip dhcp-client
add !dhcp-options disabled=no interface=ether1
/ip dhcp-server config
set store-leases-disk=12h
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1 netmask=24
/ip dns
set servers=192.168.1.1
/ip firewall address-list
add address=192.168.1.2-192.168.1.254 list=allowed_to_router
add address=78.83.52.228 list=allowed_to_router
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet
/ip firewall filter
add action=accept chain=input comment="default configuration" connection-state=established,related
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input protocol=icmp
add action=drop chain=input disabled=yes
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related
add action=accept chain=forward comment="Established, related" connection-state=established,related
add action=drop chain=forward comment="Drop Invalid" connection-state=invalid disabled=yes log=yes log-prefix=invalid
add action=drop chain=forward comment="Drop tries to reach not public addresses from LAN" disabled=yes dst-address-list=not_in_internet in-interface=bridge log=yes log-prefix=!public_from_LAN out-interface=!bridge
add action=drop chain=forward comment="Drop incoming packets that are not NATted" connection-nat-state=!dstnat connection-state=new disabled=yes in-interface=ether1 log=yes log-prefix=!NAT
add action=drop chain=forward comment="Drop incoming from internet which is not public IP" disabled=yes in-interface=ether1 log=yes log-prefix=!public src-address-list=not_in_internet
add action=drop chain=forward comment="Drop packets from LAN that do not have LAN IP" disabled=yes in-interface=bridge log=yes log-prefix=LAN_!LAN src-address=!192.168.1.0/24
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=xxx protocol=tcp to-addresses=xxx to-ports=xxx
add action=dst-nat chain=dstnat dst-port=xxx protocol=udp to-addresses=xxx to-ports=xxx
add action=dst-nat chain=dstnat dst-port=xxx protocol=tcp to-addresses=xxx to-ports=xxx
add action=dst-nat chain=dstnat dst-port=xxx protocol=tcp to-addresses=xxx to-ports=xxx
add action=dst-nat chain=dstnat dst-port=xxx protocol=tcp to-addresses=xxx to-ports=xxx
add action=dst-nat chain=dstnat dst-port=xxx protocol=tcp to-addresses=xxx to-ports=xxx
add action=dst-nat chain=dstnat dst-port=xxx protocol=tcp to-addresses=xxx to-ports=xxx
add action=dst-nat chain=dstnat dst-port=xxx protocol=tcp to-addresses=xxx to-ports=xxx
add action=masquerade chain=srcnat out-interface=ether1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.1.0/24,xxxxxx
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Sofia
/system logging
add action=disk topics=info
add action=disk topics=warning
add action=disk topics=firewall
add action=disk topics=pptp
