Доступ на внешний интерфейс из локальной сети

# jul/10/2017 15:11:49 by RouterOS 6.39.2
# software id = RKQS-LBHM
#
/interface bridge
add name=bridge1-lan
/interface ethernet
set [ find default-name=ether1 ] name=ether1-ext
/interface wireless security-profiles
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
management-protection=allowed mode=dynamic-keys name="wi-fi home" \
supplicant-identity="" wpa-pre-shared-key=Pass wpa2-pre-shared-key=\
Pass
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=russia disabled=no \
mode=ap-bridge security-profile="wi-fi home" ssid=Home tx-power=20 \
tx-power-mode=all-rates-fixed wireless-protocol=802.11
/ip dhcp-client option
add code=55 name=parameter_request_list value=0x01F90321062A
/ip pool
add name=dhcp ranges=192.168.1.11-192.168.1.50
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge1-lan lease-time=3d name=\
dhcp1
/ppp profile
add change-tcp-mss=yes name=beeline-L2TP remote-address=192.168.255.254 \
use-compression=no use-encryption=no use-mpls=no
/interface l2tp-client
add add-default-route=yes connect-to=tp.internet.beeline.ru \
default-route-distance=1 disabled=no name=l2tp-beeline password=\
Pass profile=beeline-L2TP user=UserLogin
/interface bridge port
add bridge=bridge1-lan interface=ether2
add bridge=bridge1-lan interface=ether3
add bridge=bridge1-lan interface=ether4
add bridge=bridge1-lan interface=ether5
add bridge=bridge1-lan interface=wlan1
/ip address
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add default-route-distance=10 dhcp-options=\
hostname,clientid,parameter_request_list disabled=no interface=ether1-ext
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
/ip firewall address-list
add address=home.ustim.ru list=external-name
/ip firewall filter
add action=accept chain=forward connection-state=established
add action=accept chain=input connection-state=established
add action=accept chain=forward connection-state=related
add action=accept chain=input connection-state=related
add action=drop chain=forward comment="invalid connections" connection-state=\
invalid
add action=drop chain=input connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat out-interface=l2tp-beeline src-address=\
192.168.1.0/24
add action=masquerade chain=srcnat out-interface=ether1-ext src-address=\
192.168.1.0/24
add action=dst-nat chain=dstnat comment="SERVER PROXMOX (ssh, web)" dst-port=\
2203,8006 protocol=tcp to-addresses=192.168.1.3
add action=dst-nat chain=dstnat comment="FS01 (ssh, ftp)" dst-port=\
2204,8384,21 protocol=tcp to-addresses=192.168.1.4
add action=dst-nat chain=dstnat comment="WS (ssh, web)" dst-port=2205,80 \
in-interface=l2tp-beeline protocol=tcp to-addresses=192.168.1.5
add action=dst-nat chain=dstnat comment="VM01 (rdp)" dst-port=3390 protocol=\
tcp to-addresses=192.168.1.6 to-ports=3390
add action=dst-nat chain=dstnat comment=TS3Server dst-port=30033,10011 \
protocol=tcp to-addresses=192.168.1.7
add action=dst-nat chain=dstnat comment=TS3Server dst-port=9987 protocol=udp \
to-addresses=192.168.1.7
/ip firewall service-port
set ftp disabled=yes
/ip route
add distance=1 dst-address=77.106.201.221/32 gateway=10.52.8.1
add distance=1 dst-address=77.106.201.222/32 gateway=10.52.8.1
add distance=1 dst-address=77.106.202.0/24 gateway=10.52.8.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=8080
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Moscow
/system routerboard settings
set init-delay=0s