#ADICIONA LISTA DE INTERFACES SEGURAS
/interface list add name=interfaces-seguras


#AJUSTA LOGS PARA SALVAR EM DISCO E ENVIAR PARA SERVIDOR REMOTO
/system logging action
set 1 disk-file-count=3
set 3 remote=10.20.20.1

/system logging
add action=disk topics=critical
add action=disk topics=error
add action=disk topics=info,!pppoe
add action=disk topics=warning
add action=remote topics=warning
add action=remote topics=info,!pppoe
add action=remote topics=error
add action=remote topics=critical


#AJUSTA NEIGHBORS E ACESSO VIA MAC
/ip neighbor discovery-settings
set discover-interface-list=interfaces-seguras
/tool mac-server
set allowed-interface-list=interfaces-seguras
/tool mac-server mac-winbox
set allowed-interface-list=interfaces-seguras

#CONFIGURA DNS NO ROTEADOR
/ip dns
set servers=8.8.8.8,1.1.1.1

#AJUSTA IP SERVICES
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=61234
set api disabled=yes
set api-ssl disabled=yes


#AJUSTA DATA E HORA
/system clock
set time-zone-autodetect=no time-zone-name=America/Sao_Paulo

/system ntp client set enabled=yes

/system ntp client servers
add address=a.ntp.br
add address=b.ntp.br

#ADICIONA USUARIO NO ROTEADOR
#/user/add name=seu_usuario group=full password=sua_senha	


#FIREWALL INPUT COM DROP GERAL
/ip firewall filter

add action=accept chain=input comment="ACEITA CONEXOES ESTABELECIDAS OU RELACIONADAS" connection-state=\
    established,related
	
add action=accept chain=input comment="ACEITA REDE SUPORTE" src-address-list=rede-suporte

add action=add-src-to-address-list address-list=pre-rede-suporte1 address-list-timeout=5s chain=input \
    comment="PEGA IP PARA PRE-REDE-SUPORTE1" dst-port=30010 protocol=tcp
	
add action=add-src-to-address-list address-list=pre-rede-suporte2 address-list-timeout=5s chain=input \
    comment="PEGA IP PARA PRE-REDE-SUPORTE2" dst-port=20020 protocol=tcp src-address-list=\
    pre-rede-suporte1
	
add action=add-src-to-address-list address-list=rede-suporte address-list-timeout=5h chain=input comment=\
    "PEGA IP PARA REDE-SUPORTE" dst-port=10030 protocol=tcp src-address-list=pre-rede-suporte2
	
add action=accept chain=input comment="ACEITA 100 PACOTES DE ICMP POR SEGUNDO" limit=100,5:packet \
    protocol=icmp

add action=drop chain=input comment="DROP GERAL" disa=yes


/ip firewall address-list
add address=10.3.3.0/24 comment="REDE PC SUPORTE" list=rede-suporte
add address=10.80.250.0/24 comment="REDE SERVIDORES" list=rede-suporte