# It is examples base configuration for Mikrotik.
Please always check these options for base config new device:
1. Add user new user with admin priv:
`/user add name="admin2" password="PASSWORD" group=full`
2. Set NTP server:
`/system ntp client set enabled=yes primary-ntp=80.240.216.155 secondary-ntp=85.21.78.23`
`/system ntp client set enabled=yes`
`/system ntp client servers`
`add address=0.pool.ntp.org`
`add address=1.pool.ntp.org`
`/system ntp server set enabled=no`
3. Set Time Zone:
`/system clock set time-zone-name=Europe/Moscow`
4. Disabled unuse service:
`{ :local ver [/system resource get version]; :global vermajor [:pick $ver 0 [:find $ver "."]] }`
`:if ($vermajor = 7) do={ /ipv6 settings set disable-ipv6=yes }`
`:if ($vermajor = 6) do={ /system package disable ipv6 }'`
`/ip neighbor discovery-settings set discover-interface-list=interfaces-MAC-MGMT`
`/tool mac-server set allowed-interface-list=none`
`/tool mac-server mac-winbox set allowed-interface-list=interfaces-MAC-MGMT`
`/tool mac-server ping set enabled=no`
`/ip smb set enabled=no`
`/ip service set www disabled=yes`
`/ip service set api disabled=yes`
`/ip service set api-ssl disabled=yes`
`/ip service set ftp disabled=yes`
`/ip service set telnet disabled=yes`
`/ip service set winbox disabled=no`
`/ip service set ssh disabled=no`
`/tool bandwidth-server set enabled=no`
`/tool romon set enabled=no`
`/ip ssh set strong-crypto=yes host-key-size=4096 forwarding-enabled=both always-allow-password-login=yes`
`/ip settings set tcp-syncookies=yes`
`/ip proxy set enabled=no`
`/ip socks set enabled=no`
`/ip upnp set enabled=no`
`/ip cloud set ddns-enabled=no update-time=no`
5. For security add blackhole routes and deny BOGON networks
`/ip route add comment="Blackhole [ BOGON IP addresses ] FID=SERVICE-ROUTE" distance=249 dst-address=10.0.0.0/8 blackhole`
`/ip route add comment="Blackhole [ BOGON IP addresses ] FID=SERVICE-ROUTE" distance=249 dst-address=169.254.0.0/16 blackhole`
`/ip route add comment="Blackhole [ BOGON IP addresses ] FID=SERVICE-ROUTE" distance=249 dst-address=172.16.0.0/12 blackhole`
`/ip route add comment="Blackhole [ BOGON IP addresses ] FID=SERVICE-ROUTE" distance=249 dst-address=192.168.0.0/16 blackhole`
`/ip firewall address-list add address=0.0.0.0/8 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=127.0.0.0/16 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=10.0.0.0/8 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=172.16.0.0/12 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=192.168.0.0/16 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=169.254.0.0/16 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=192.0.2.0/24 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=198.51.100.0/24 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=203.0.113.0/24 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=198.18.0.0/15 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=192.88.99.0/24 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=100.64.0.0/10 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=240.0.0.0/4 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=224.0.0.0/4 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall address-list add address=255.255.255.255 list=all-bogon comment="List addr BOGON networks"`
`/ip firewall filter add action=drop chain=input comment="deny INPUT Invalid connections FID=SERVICE-RULES" connection-state=invalid`
`/ip firewall filter add action=drop chain=forward comment="deny FORWARD Invalid connections FID=SERVICE-RULES" connection-state=invalid`
`/ip firewall filter add action=drop chain=input comment="deny INPUT outside ->> ME [ BOGON IP addresses ] FID=SERVICE-RULES" connection-state="" in-interface=ether1-outside src-address-list=all-bogon`
`/ip firewall filter add action=drop chain=output comment="deny OUTPUT from ME -->> outside [ BOGON IP addresses ] FID=SERVICE-RULES" connection-state="" dst-address-list=all-bogon out-interface=ether1-outside`
`/ip firewall filter add action=drop chain=forward comment="deny FORWARD from outside -->> inside [ BOGON IP addresses ] FID=SERVICE-RULES" connection-state="" in-interface=ether1-outside src-address-list=all-bogon`
`/ip firewall filter add action=drop chain=forward comment="deny FORWARD from inside -->> outside [ BOGON IP addresses ] FID=SERVICE-RULES" connection-state="" dst-address-list=all-bogon out-interface=ether1-outside`
`/ip firewall filter add action=drop chain=forward comment="deny FORWARD from inside -->> outside FID=SERVICE-RULES FID=SERVICE-RULES" connection-nat-state=!dstnat connection-state=new in-interface=ether1-outside`
`/ip firewall filter add action=accept chain=input comment="allow INPUT from lo -->> ME " in-interface=lo`
`/ip firewall filter add action=reject chain=input comment="deny INPUT any -->> ME TCP reject-with tcp-reset" connection-state=new protocol=tcp reject-with=tcp-reset`
`/ip firewall filter add action=reject chain=input comment="deny INPUT any -->> ME UDP reject-with icmp-port-unreachable" connection-state=new protocol=udp reject-with=icmp-port-unreachable`
`/ip firewall filter add action=drop chain=input comment="deny INPUT all" connection-state=""`
`/ip firewall filter add action=reject chain=forward comment="deny FORWARD any -->> any TCP reject-with tcp-reset" connection-state=new protocol=tcp reject-with=tcp-reset`
`/ip firewall filter add action=reject chain=forward comment="deny FORWARD any -->> any UDP reject-with tcp-reset" connection-state=new protocol=udp reject-with=icmp-port-unreachable`
`/ip firewall filter add action=drop chain=forward comment="deny FORWARD all" connection-state=""`
6. For config bridge:
`/interface bridge add name=bridge-1`
`/interface bridge port add bridge=bridge-1 hw=yes interface=ether2`
`/interface bridge port add bridge=bridge-1 hw=yes interface=ether3`
`/interface bridge port add bridge=bridge-1 hw=yes interface=ether4`
`/interface bridge port add bridge=bridge-1 hw=yes interface=ether5`
У портов есть 3 варианта настроек:
`admit all — Аналог гибридного порта, пропускать весь трафик (все теги vlan, в т.ч. native Vlan)`
`admit only VLAN tagged — Аналог Trunk, пропускать только тэгированный трафик (все теги Vlan указанные в VLAN’s)`
`admit only untagged and priority tagged — Аналог Access, пропускать указанный PVID Vlan`
7. For backup
`export terse file=gw02-21.04.20`
`console clear-history`
For CHR:
4 vCPU / 4 RAM / 512MB IDE HDD
vmkfstools -i chr-6.46.6.vmdk MikroTik-CHR.vmdk -d thin
vmkfstools -X 512M MikroTik-CHR.vmdk