---

# Создаем стандартный мост (имя СТРОГО bridge)
/interface bridge add name=bridge

# Добавляем порты 2-5 в мост
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5

# Настраиваем провайдера OBIT на ether1
/ip address add address=95.161.175.22/30 interface=ether1
/ip route add dst-address=0.0.0.0/0 gateway=95.161.175.21

# DNS
/ip dns set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1

# Базовый Firewall (ОБЯЗАТЕЛЬНО!)
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface=bridge
add action=drop chain=input in-interface=ether1 comment="Drop WAN Input"
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward in-interface=bridge out-interface=ether1
add action=drop chain=forward in-interface=ether1 connection-nat-state=!dstnat comment="Drop WAN Forward"

# NAT
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

# Локальная подсеть
/ip address add address=192.168.88.1/24 interface=bridge
/ip pool add name=pool-local ranges=192.168.88.10-192.168.88.200
/ip dhcp-server add address-pool=pool-local interface=bridge name=dhcp-local disabled=no
/ip dhcp-server network add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1



# Wi-Fi Каналы (2.4 стандартно, 5 ГГц жестко без DFS для старта без задержек)
/interface wifi channel
add name=channel-2g band=2ghz-ax width=20mhz
add name=channel-5g-nodfs band=5ghz-ax width=20/40/80mhz frequencies=5180,5200,5220,5240 skip-dfs-channels=all

# Безопасность (WPA2+WPA3, Fast Transition для Маков, Management Protection)
/interface wifi security
add name=sec-office authentication-types=wpa2-psk,wpa3-psk passphrase="СЮДА_ПАРОЛЬ" ft=yes ft-over-ds=yes management-protection=allowed

# Datapath (привязка строго к bridge, чтобы wAP ax поняли куда кидать трафик)
/interface wifi datapath
add name=dp-local bridge=bridge

# Профили конфигурации
/interface wifi configuration
add name=cfg-2g ssid="RoiMedia_WiFi" channel=channel-2g security=sec-office datapath=dp-local country=Russia
add name=cfg-5g ssid="RoiMedia_WiFi" channel=channel-5g-nodfs security=sec-office datapath=dp-local country=Russia

# Правила Provisioning
/interface wifi provisioning
add action=create-dynamic-enabled master-configuration=cfg-5g supported-bands=5ghz-ax
add action=create-dynamic-enabled master-configuration=cfg-2g supported-bands=2ghz-ax

# Включаем CAPsMAN
/interface wifi capsman
set enabled=yes interfaces=bridge package-path="" require-peer-certificate=no

# Подключаем Wi-Fi самого hAP ax2 под управление своего же CAPsMAN
/interface wifi set [ find ] configuration.manager=capsman datapath.bridge=bridge