/interface bridge
add admin-mac=18:FD:74:8E:55:66 auto-mac=no comment=defconf name=vlan-bridge vlan-filtering=yes
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface vlan
add interface=vlan-bridge name=vlan1 vlan-id=1
add interface=vlan-bridge name=vlan3 vlan-id=3
add interface=vlan-bridge name=vlan70 vlan-id=70
add interface=vlan-bridge name=vlan90 vlan-id=90
add interface=vlan-bridge name=vlan111 vlan-id=111
add interface=vlan-bridge name=vlan200 vlan-id=200
add interface=vlan-bridge name=vlan_fritzbox vlan-id=4
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=wlan-intern supplicant-identity=""  
add authentication-types=wpa2-psk mode=dynamic-keys name=wlan-gast supplicant-identity=""  
add authentication-types=wpa2-psk mode=dynamic-keys name=wlan-iot supplicant-identity=""  
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=germany disabled=no distance=indoors frequency=2427 installation=indoor mode=ap-bridge name=wlan-intern \
    security-profile=wlan-intern ssid=dahoam vlan-id=70 vlan-mode=use-tag wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX country=germany disabled=no distance=indoors frequency=5500 installation=indoor mode=ap-bridge \
    name=wlan-intern-5ghz security-profile=wlan-intern ssid=dahoam_5GHz vlan-id=70 vlan-mode=use-tag wireless-protocol=802.11 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=1A:FD:74:8E:72:6B master-interface=wlan-intern multicast-buffering=disabled name=wlan-iot security-profile=wlan-iot ssid=\
    IoT vlan-id=111 vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=1A:FD:74:8E:72:6D master-interface=wlan-intern-5ghz multicast-buffering=disabled name=wlan-iot-5ghz security-profile=\
    wlan-iot ssid=IoT_5GHz vlan-id=111 vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=1A:FD:74:8E:72:6A master-interface=wlan-intern multicast-buffering=disabled name=wlan-gast security-profile=wlan-gast \
    ssid=HeimwehLAN vlan-id=90 vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=1A:FD:74:8E:72:6C master-interface=wlan-intern-5ghz multicast-buffering=disabled name=wlan-gast-5ghz security-profile=\
    wlan-gast ssid=HeimwehLAN_5GHz vlan-id=90 vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=intern ranges=192.168.7.200-192.168.7.230
add name=wohnung-eg ranges=192.168.3.200-192.168.3.230
add name=wlan-intern ranges=192.168.70.200-192.168.70.230
add name=wlan-gast ranges=192.168.90.200-192.168.90.230
add name=iot ranges=192.168.111.200-192.168.111.230
add name=freifunk ranges=192.168.200.200-192.168.200.230
add name=Pool_Mama_Papa ranges=192.168.4.200-192.168.4.230
/ip dhcp-server
add address-pool=intern interface=vlan1 lease-time=2h name=intern
add address-pool=wohnung-eg interface=vlan3 lease-time=2h name=wohnung-eg
add address-pool=wlan-intern interface=vlan70 lease-time=2h name=wlan-intern
add address-pool=wlan-gast interface=vlan90 lease-time=2h name=wlan-gast
add address-pool=iot interface=vlan111 lease-time=2h name=iot
add address-pool=freifunk interface=vlan200 lease-time=30m name=Freifunk
add address-pool=Pool_Mama_Papa interface=vlan_fritzbox name=DHCP_Mama_Papa
/queue simple
add max-limit=5M/5M name=queue1 target=vlan111
/interface bridge port
add bridge=vlan-bridge comment=defconf interface=ether3
add bridge=vlan-bridge comment=defconf interface=ether4
add bridge=vlan-bridge comment=defconf interface=ether5
add bridge=vlan-bridge comment=defconf frame-types=admit-only-vlan-tagged interface=wlan-intern pvid=70
add bridge=vlan-bridge comment=defconf interface=wlan-intern-5ghz
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=wlan-iot pvid=111
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=wlan-gast pvid=90
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=wlan-gast-5ghz pvid=90
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=wlan-iot-5ghz pvid=111
add bridge=vlan-bridge interface=ether2 pvid=4
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=vlan-bridge tagged=vlan-bridge vlan-ids=1
add bridge=vlan-bridge tagged=vlan-bridge,ether5,vlan3 vlan-ids=3
add bridge=vlan-bridge tagged=vlan-bridge,ether5,wlan-intern,wlan-intern-5ghz,vlan70 vlan-ids=70
add bridge=vlan-bridge tagged=vlan-bridge,ether5,wlan-gast,wlan-gast-5ghz,vlan90 vlan-ids=90
add bridge=vlan-bridge tagged=vlan-bridge,ether5,wlan-iot,wlan-iot-5ghz,vlan111 vlan-ids=111
add bridge=vlan-bridge tagged=vlan-bridge,ether5 vlan-ids=200
add bridge=vlan-bridge tagged=vlan-bridge vlan-ids=4
/interface list member
add comment=defconf interface=ether1 list=WAN
add interface=vlan1 list=LAN
add interface=vlan3 list=LAN
add interface=vlan70 list=LAN
add interface=vlan90 list=LAN
add interface=vlan111 list=LAN
add interface=vlan200 list=LAN
add interface=vlan_fritzbox list=LAN
/ip address
add address=192.168.7.1/24 comment=defconf interface=vlan1 network=192.168.7.0
add address=192.168.3.1/24 comment=defconf interface=vlan3 network=192.168.3.0
add address=192.168.70.1/24 comment=defconf interface=vlan70 network=192.168.70.0
add address=192.168.90.1/24 comment=defconf interface=vlan90 network=192.168.90.0
add address=192.168.111.1/24 comment=defconf interface=vlan111 network=192.168.111.0
add address=192.168.77.1/24 interface=wireguard1 network=192.168.77.0
add address=192.168.200.1/24 interface=vlan200 network=192.168.200.0
add address=192.168.4.1/24 interface=vlan_fritzbox network=192.168.4.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.3.0/24 gateway=192.168.3.1
add address=192.168.4.0/24 dns-server=192.168.4.1 gateway=192.168.4.1
add address=192.168.7.0/24 dns-server=192.168.7.11 gateway=192.168.7.1
add address=192.168.70.0/24 dns-server=192.168.7.11 gateway=192.168.70.1
add address=192.168.90.0/24 gateway=192.168.90.1
add address=192.168.111.0/24 gateway=192.168.111.1
add address=192.168.200.0/24 gateway=192.168.200.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked  
add action=drop chain=forward comment="Kamera keine Internetverbindung" out-interface=ether1 src-address=192.168.7.71  
add action=drop chain=forward comment="Wohnung nur ins Internet" in-interface=vlan3 out-interface=!ether1  
add action=drop chain=forward comment="Mama Papa nur ins Internet" disabled=yes in-interface=vlan_fritzbox out-interface=!ether1  
add action=drop chain=forward comment="TV Schlafzimmer nur Internet. Kein LAN" out-interface=!ether1 src-address=192.168.7.39  
add action=drop chain=forward comment="TV Wohnzimmer nur Internet. Kein LAN" out-interface=!ether1 src-address=192.168.7.38  
add action=accept chain=input comment="wireguard ip input" src-address=192.168.77.0/24  
add action=accept chain=input comment="wireguard udp input" dst-port=13231 protocol=udp  
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp  
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid  
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1  
add action=drop chain=input in-interface=vlan90 protocol=icmp
add action=accept chain=forward dst-address=192.168.111.10 in-interface=vlan1
add action=accept chain=forward dst-address=192.168.111.10 in-interface=vlan70
add action=accept chain=forward dst-address=192.168.111.10 in-interface=vlan90
add action=accept chain=forward dst-address=192.168.111.11 in-interface=vlan1
add action=accept chain=forward dst-address=192.168.111.12 in-interface=vlan1
add action=accept chain=forward dst-address=192.168.111.40 in-interface=vlan1
add action=accept chain=forward dst-address=192.168.70.2 in-interface=vlan1
add action=accept chain=forward dst-address=192.168.111.11 in-interface=vlan70
add action=drop chain=forward in-interface=vlan200 out-interface=!ether1
add action=drop chain=forward comment="WLAN Gast nur ins Internet" disabled=yes in-interface=vlan90 out-interface=!ether1  
add action=reject chain=forward comment="WLAN iot keine Zugriff auf WLAN Intern" in-interface=vlan70 out-interface=vlan111 reject-with=icmp-network-unreachable  
add action=reject chain=forward comment="WLAN iot keine Zugriff auf Intern" in-interface=vlan1 out-interface=vlan111 reject-with=icmp-network-unreachable  
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN  
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec  
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec  
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes  
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked  
add action=accept chain=forward comment="Reverse Proxy" connection-nat-state=dstnat in-interface=ether1  
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid  
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN  
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN  
add action=dst-nat chain=dstnat dst-port=80,443 in-interface=ether1 protocol=tcp to-addresses=192.168.7.11
/ip traffic-flow
set interfaces=ether2
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6  
add address=::1/128 comment="defconf: lo" list=bad_ipv6  
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6  
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6  
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6  
add address=100::/64 comment="defconf: discard only " list=bad_ipv6  
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6  
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6  
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6  
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked  
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid  
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6  
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp  
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10  
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp  
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah  
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp  
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec  
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN  
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked  
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid  
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6  
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6  
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6  
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6  
add action=accept chain=forward comment="defconf: accept HIP" protocol=139  
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp  
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah  
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp  
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec  
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN  
/system clock
set time-zone-name=Europe/Berlin
/tool bandwidth-server
set authenticate=no enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

/export

/ip dhcp-server network set [find address=192.168.4.0/24] dns-server=192.168.4.1,192.168.4.1
/interface list member add interface=vlan4 list=LAN

[void] [System.Reflection.Assembly]::LoadFrom("c:\temp\BarcodeImaging.dll");      
$barcodes = @{}
[BarcodeImaging]::FullScanPage([ref] $barcodes, $src, 150)

using namespace System.Drawing;
Add-Type -AssemblyName System.Drawing;

[void] [Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")  

$testBild = "C:\temp\code_ls4.png-1.png"  
$src=[System.Drawing.Image]::FromFile($testBild)

$rect = New-Object System.Drawing.Rectangle(740,1500,400,250) # top, left, width, height of slice
$slice = $src.Clone($rect, $src.PixelFormat);
#$slice.Save("c:\temp\test_slice.png", "png"); 

$src = $slice;

[void] [System.Reflection.Assembly]::LoadFrom("c:\temp\BarcodeImaging.dll");      
$barcodes = @{}
[BarcodeImaging]::FullScanPage([ref] $barcodes, $src, 150)

$barcodes

nslookup -type=srv _sip._udp.proxy14.sip.plusnet.de192.168.90.1

nslookup -type=srv _sip._udp.proxy14.sip.plusnet.de 192.168.4.1
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  192.168.4.1

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Zeitüberschreitung bei Anforderung an UnKnown.

#
DEFAULT         Cleartext-Password := "%{User-Name}"  
                         Tunnel-Type = VLAN,
                         Tunnel-Medium-Type = IEEE-802,
                         Tunnel-Private-Group-Id = 99