VPN+L2TP

/interface ethernet
set [ find default-name=ether1 ] advertise=10M-full,100M-full,1000M-full comment=WAN name=et1Wan
set [ find default-name=ether2 ] comment=LAN name=et2Lan
set [ find default-name=ether3 ] master-port=et2Lan name=et3Lan
/ip neighbor discovery
set et1Wan comment=WAN discover=no
set et2Lan comment=LAN
/ip firewall layer7-protocol
add name=social regexp="^.*(get|GET).+(vk.com|vkontakte.ru|odnoklassniki.ru|odnoklassniki.com|fa cebook.com|twitter.com).*\$"
/ip ipsec policy group
add name=group1
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des
/ip firewall connection tracking
set tcp-close-wait-timeout=2s tcp-time-wait-timeout=2s
/interface l2tp-server server
set authentication=mschap2 default-profile=default ipsec-secret=222
/ip address
add address=192.168.0.44/24 interface=et2Lan network=192.168.0.0
add address=84.42.x.x/30 interface=et1Wan network=84.42.x.x
/ip dns
set allow-remote-requests=yes servers=84.42.0.34,84.42.14.3,8.8.8.8
/ip dns static
add address=127.0.0.1 name=vk.com ttl=0s
add address=127.0.0.1 name=ok.ru ttl=0s
add address=127.0.0.1 name=odnoklassniki.ru ttl=0s
/ip firewall address-list
add address=0.0.0.0/8 list=BOGON
add address=10.0.0.0/8 list=BOGON
add address=100.64.0.0/10 list=BOGON
add address=127.0.0.0/8 list=BOGON
add address=169.254.0.0/16 list=BOGON
add address=172.16.0.0/12 list=BOGON
add address=192.0.0.0/24 list=BOGON
add address=192.0.2.0/24 list=BOGON
add address=198.18.0.0/15 list=BOGON
add address=198.51.100.0/24 list=BOGON
add address=203.0.113.0/24 list=BOGON
add address=224.0.0.0/4 list=BOGON
add address=240.0.0.0/4 list=BOGON
add address=77.37.x.x list=RDT_acces
add address=85.235.x.x list=RDT_acces
add address=192.168.0.0/24 list=RDT_acces
add address=192.168.10.0/24 list=RDT_acces
/ip firewall filter
add chain=input comment=IPSec protocol=ipsec-esp src-address=85.235.x.x
add chain=input comment=IPSec protocol=ipsec-ah src-address=85.235.x.x
add action=drop chain=forward comment="Drop Spammers" dst-port=25,2525 protocol=tcp src-address-list=Spammer
add action=drop chain=forward comment="Drop Spammers" dst-port=25,2525 protocol=tcp src-address-list=Spammer
add action=add-src-to-address-list address-list=Spammer address-list-timeout=1d chain=forward connection-limit=30,32 dst-port=25,2525 limit=20,5acket protocol=tcp src-address-list=!Spammer
add action=reject chain=forward comment=social disabled=yes layer7-protocol=social protocol=tcp reject-with=tcp-reset src-address=192.168.0.0/24
add action=drop chain=forward comment=RDT_acces dst-port=3389 protocol=tcp src-address-list=!RDT_acces
add action=drop chain=forward comment="TB9 port acces" dst-port=25700 protocol=tcp src-address-list=!RDT_acces
add action=drop chain=input comment=" boggon input drop" in-interface=et2Lan src-address=!192.168.0.0/24
add action=reject chain=input comment=" ip spoofing protect" connection-state=new protocol=tcp reject-with=tcp-reset tcp-flags=syn,ack
add action=drop chain=forward comment=" drop forward" connection-state=invalid
add action=drop chain=forward comment="drop web19-40 80 port" dst-port=80 in-interface=et2Lan protocol=tcp src-address=192.168.0.19-192.168.0.40
add action=drop chain=forward comment="drop web19-40 443 port" dst-port=443 in-interface=et2Lan protocol=tcp src-address=192.168.0.19-192.168.0.40
add chain=input comment=" accept established & related" connection-state=established,related
add action=drop chain=input comment=" drop input" in-interface=et1Wan
add chain=forward comment=" established forward & related" connection-state=established,related
add chain=input protocol=ipsec-esp
/ip firewall nat
add chain=srcnat comment=IPSec dst-address=192.168.10.0/24 src-address=192.168.0.0/24
add action=masquerade chain=srcnat comment=Massq out-interface=et1Wan
add action=dst-nat chain=dstnat comment=RDT_acces dst-port=3389 in-interface=et1Wan protocol=tcp to-addresses=192.168.0.1 to-ports=3389
add action=redirect chain=dstnat comment=DNS dst-port=53 in-interface=et2Lan protocol=udp
add action=dst-nat chain=dstnat comment="TB9 port" dst-port=25700 in-interface=et1Wan protocol=tcp to-addresses=192.168.0.1
/ip ipsec peer
add address=85.235.x.x/32 enc-algorithm=aes-128 hash-algorithm=md5 nat-traversal=no secret=123456
/ip ipsec policy
add dst-address=192.168.10.0/24 ipsec-protocols=ah-esp sa-dst-address=85.235.x.x sa-src-address=84.42.x.x src-address=192.168.0.0/24 tunnel=yes
/ip route
add distance=1 gateway=84.42.x.x
add distance=1 dst-address=192.168.10.0/24 gateway=et1Wan
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.0.0/24
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.0.0/24,85.235.x.x/32
set api-ssl disabled=yes
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system routerboard settings
set protected-routerboot=disabled