Wireless Networking • No IPS over WLAN

# 2024-01-03 13:20:11 by RouterOS 7.13# software id = 00TF-I6FU## model = L009UiGS# serial number = HFB09AKEH3S/container mountsadd dst=/etc/pihole name=etc_pihole src=/usb1/pihole/etcadd dst=/etc/dnsmasq.d name=dnsmasq_pihole src=/usb1/pihole/etc-dnsmasq.d/diskset usb1 type=hardware/interface bridgeadd name=BRIDGE-LAN port-cost-mode=short vlan-filtering=yesadd name=containers port-cost-mode=short/interface ethernetset [ find default-name=ether1 ] comment=WANset [ find default-name=ether2 ] comment=PCset [ find default-name=ether3 ] comment=WLANset [ find default-name=ether4 ] comment=Modem/interface wireguardadd listen-port=13231 mtu=1420 name=WG-SITE-C/interface vethadd address=172.17.0.2/24 gateway=172.17.0.1 gateway6="" name=pihole/interface vlanadd interface=BRIDGE-LAN name=vlan-Gast-25 vlan-id=25add interface=BRIDGE-LAN name=vlan1 vlan-id=1add interface=ether1 name=vlan7-pppoe vlan-id=7/interface listadd name=WANadd name=LAN/ipv6 pooladd name=ULA-Pool-vlan25 prefix=fd00:8888::/64 prefix-length=64add name=ULA-Pool-vlan1 prefix=fd00:6969::/64 prefix-length=64/portset 0 name=serial0/interface pppoe-clientadd add-default-route=yes disabled=no interface=ether1 name=ether1-pppoe \    profile=default-encryption user=0021993121005510104718610001@t-online.de/queue typeadd kind=fq-codel name=FQ-Codel/queue simpleadd max-limit=100M/100M name=queue1 packet-marks=no-mark queue=\    FQ-Codel/FQ-Codel target=ether1-pppoe total-queue=FQ-Codel/containeradd envlist=pihole_envs interface=pihole mounts=etc_pihole,dnsmasq_pihole \    root-dir=usb1/pihole/pihole start-on-boot=yes/container configset registry-url=https://registry-1.docker.io/ tmpdir=usb1/pull/container envsadd key=TZ name=pihole_envs value=Europe/Berlinadd key=WEBPASSWORD name=pihole_envs value=P@ssw0rdadd key=DNSMASQ_USER name=pihole_envs value=root/interface bridge portadd bridge=BRIDGE-LAN comment=PC frame-types=\    admit-only-untagged-and-priority-tagged interface=ether2 \    internal-path-cost=10 path-cost=10add bridge=BRIDGE-LAN comment=WLAN interface=ether3 internal-path-cost=10 \    path-cost=10add bridge=BRIDGE-LAN comment=Modem interface=ether4 internal-path-cost=10 \    path-cost=10add bridge=containers interface=pihole internal-path-cost=10 path-cost=10/interface bridge vlanadd bridge=BRIDGE-LAN tagged=BRIDGE-LAN,ether3 vlan-ids=1add bridge=BRIDGE-LAN tagged=BRIDGE-LAN,ether3 vlan-ids=25/interface detect-internetset detect-interface-list=all/interface list memberadd interface=ether1 list=WANadd interface=BRIDGE-LAN list=LANadd interface=vlan1 list=LANadd interface=vlan-Gast-25 list=LANadd interface=ether1-pppoe list=WANadd interface=WG-SITE-C list=LANadd interface=containers list=LAN/interface wireguard peersadd allowed-address=0.0.0.0/0 endpoint-address=162.55.221.136 endpoint-port=\    13231 interface=WG-SITE-C persistent-keepalive=30s public-key=\    "DhIKnOLaU7LfMMulhNo52TKsxXyOpICirxNUeSfbNwo="/ip addressadd address=192.168.20.1/24 comment=Normal interface=vlan1 network=\    192.168.20.0add address=192.168.25.1/24 comment=Gast interface=vlan-Gast-25 network=\    192.168.25.0add address=10.0.0.2/30 interface=WG-SITE-C network=10.0.0.0add address=172.17.0.1/24 comment=Container interface=containers network=\    172.17.0.0/ip arpadd address=192.168.20.2 interface=vlan1 published=yes/ip dhcp-server leaseadd block-access=yes mac-address=78:9A:18:A7:0F:7D/ip dhcp-server networkadd address=192.168.20.0/24 caps-manager=192.168.20.1 dns-server=172.17.0.2 \    gateway=192.168.20.1 netmask=24 ntp-server=192.168.20.1 wins-server=\    192.168.20.1add address=192.168.25.0/24 caps-manager=192.168.25.1 dns-server=192.168.25.1 \    gateway=192.168.25.1 netmask=24 ntp-server=192.168.25.1 wins-server=\    192.168.25.1/ip firewall filteradd action=accept chain=input comment="Alles aus VPN erlauben" in-interface=\    WG-SITE-Cadd action=accept chain=input comment="WG Port erlauben" dst-port=13231 \    protocol=udpadd action=accept chain=input comment="BGP Verbindung erlauben" dst-port=179 \    protocol=tcpadd action=accept chain=input comment="ICMP erlauben" protocol=icmpadd action=accept chain=input comment="LAN Traffic erlauben" \    in-interface-list=LAN log-prefix=acceptINPUTadd action=accept chain=input comment=Default connection-state=\    established,relatedadd action=accept chain=input dst-port=67,68 log=yes log-prefix=dhcp \    protocol=udpadd action=drop chain=input comment="Alles andere Input drop" log=yes \    log-prefix=inputDROPadd action=accept chain=forward comment=\    "Temp da WhatsApp sonst nicht funktioniert" in-interface=vlan-Gast-25add action=accept chain=forward comment="Gast HTTP, HTTPS erlauben" dst-port=\    80,443 in-interface=vlan-Gast-25 protocol=tcpadd action=accept chain=forward comment="Gast DNS erlauben" dst-port=53,443 \    in-interface=vlan-Gast-25 protocol=udpadd action=drop chain=forward comment="Gast sonst drop" in-interface=\    vlan-Gast-25 log=yes log-prefix="drop gast"add action=accept chain=forward comment="Von LAN zu Gast erlauben" \    in-interface=vlan1 out-interface=vlan-Gast-25add action=accept chain=forward connection-state=established,related \    in-interface=vlan-Gast-25 out-interface=vlan1add action=reject chain=forward comment="Von Gast zu LAN block" in-interface=\    vlan-Gast-25 out-interface=vlan1 reject-with=icmp-admin-prohibitedadd action=fasttrack-connection chain=forward comment=FastTrack \    connection-state=established,related hw-offload=yesadd action=accept chain=forward comment="Default Forward" connection-state=\    established,relatedadd action=drop chain=forward comment="Alles andere forward drop" \    connection-state=invalid log-prefix=invalidadd action=accept chain=output comment="Output erlauben"/ip firewall natadd action=masquerade chain=srcnat out-interface-list=WANadd action=masquerade chain=srcnat src-address=172.17.0.0/24/ip pooladd name=dhcpLAN next-pool=dhcpLAN ranges=192.168.20.10-192.168.20.200add name=dhcp-GAST next-pool=dhcp-GAST ranges=192.168.25.10-192.168.25.200/ip serviceset telnet disabled=yesset ftp disabled=yesset www address=192.168.0.0/16set ssh disabled=yesset api disabled=yesset winbox address=192.168.0.0/16set api-ssl disabled=yes/ipv6 dhcp-clientadd interface=ether1-pppoe request=address/routing bgp connectionadd as=65000 connect=yes disabled=no listen=yes local.address=10.0.0.2 .role=\    ibgp-rr-client name=TO-SITE-C output.network=BGP-OUT remote.address=\    10.0.0.1/32 .as=65000 router-id=10.0.0.2/routing ruleadd action=lookup disabled=no dst-address=192.168.10.0/24 interface=ether1 \    src-address=192.168.22.0/24 table=main/system clockset time-zone-name=Europe/Berlin/system noteset show-at-login=no/system ntp clientset enabled=yes/system ntp serverset broadcast=yes enabled=yes multicast=yes/system ntp client serversadd address=0.pool.ntp.org/system routerboard settingsset enter-setup-on=delete-key/tool bandwidth-serverset enabled=no

# 2024-01-03 13:27:37 by RouterOS 7.13# software id = 5C17-FKE5## model = cAPGi-5HaxD2HaxD# serial number = HEV0995C7WP/interface bridgeadd name=BRIDGE-LAN port-cost-mode=short vlan-filtering=yes/interface vlanadd interface=BRIDGE-LAN name=vlan1-lan vlan-id=1add interface=BRIDGE-LAN name=vlan25-gast vlan-id=25/interface wifi datapathadd bridge=BRIDGE-LAN disabled=no name=LAN vlan-id=1add bridge=BRIDGE-LAN disabled=no name=GAST vlan-id=25/interface wifi securityadd authentication-types=wpa2-psk,wpa3-psk disabled=no name=Gastadd authentication-types=wpa2-psk,wpa3-psk disabled=no name=LAN/interface wifi configurationadd country=Germany datapath=LAN disabled=no mode=ap name=LAN \    security=LAN ssid="404 Network unavailable"add country=Germany datapath=GAST disabled=no mode=ap name=Gast \    security=Gast ssid="402 Payment Required"/interface wifiset [ find default-name=wifi1 ] configuration=LAN \    configuration.manager=local .mode=ap disabled=noset [ find default-name=wifi2 ] configuration=LAN \    configuration.manager=local .mode=ap disabled=noadd configuration=Gast configuration.mode=ap disabled=no \    mac-address=7A:9A:18:28:B1:1E master-interface=wifi1 name=wifi3add configuration=Gast configuration.mode=ap disabled=no \    mac-address=7A:9A:18:28:B1:1F master-interface=wifi2 name=wifi4/interface bridge portadd bridge=BRIDGE-LAN interface=ether1 internal-path-cost=10 \    path-cost=10add bridge=BRIDGE-LAN frame-types=\    admit-only-untagged-and-priority-tagged interface=ether2 \    internal-path-cost=10 path-cost=10 pvid=25add bridge=BRIDGE-LAN frame-types=\    admit-only-untagged-and-priority-tagged interface=wifi1 \    internal-path-cost=10 path-cost=10add bridge=BRIDGE-LAN frame-types=\    admit-only-untagged-and-priority-tagged interface=wifi2 \    internal-path-cost=10 path-cost=10/ip neighbor discovery-settingsset discover-interface-list=!dynamic/interface bridge vlanadd bridge=BRIDGE-LAN tagged=BRIDGE-LAN,ether1 untagged=wifi1,wifi2 \    vlan-ids=1add bridge=BRIDGE-LAN tagged=BRIDGE-LAN,ether1 vlan-ids=25/interface wifi capset certificate=request discovery-interfaces=vlan1-lan/ip addressadd address=192.168.20.3/24 interface=vlan1-lan network=\    192.168.20.0add address=192.168.25.3/24 interface=vlan25-gast network=\    192.168.25.0/ip dnsset servers=8.8.8.8/ip routeadd disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\    192.168.20.1 pref-src="" routing-table=main scope=30 \    suppress-hw-offload=no target-scope=10/system clockset time-zone-name=Europe/Berlin/system identityset name=CAP/system noteset show-at-login=no