How to apply it
- Reset the router without the default configuration: System → Reset Configuration → No Default Configuration. This wipes current settings, so take a backup first.
- Connect with WinBox by MAC address (Neighbors tab) and open New Terminal.
- Paste the whole script. Or upload the .rsc to Files and run /import file-name=prefixkit-mikrotik.rsc.
- Set the admin password (/password), or create your own user and disable admin.
What the script does
- Firewall follows MikroTik's own baseline: established/related pass, invalid is dropped, the router itself is reachable only from the LAN, and only dst-nat port forwards reach the network from the internet.
- Failover: with static addresses it uses recursive routes via 1.1.1.1 and 8.8.8.8, so it switches when the internet is gone, not only the link. With DHCP and PPPoE it relies on route distance.
- SIP ALG rewrites SIP packets and breaks VoIP: one-way audio, failed registrations. Check the result with the SIP check.
- CAKE keeps latency low while the line is saturated. The limit is 90% of the plan, and fasttrack is turned off, which lowers peak throughput on small models. See the effect in the speed test (loaded latency).
Need a VPN to the router? Keys and client configs with QR codes come from the WireGuard generator. To see whether a port is open from outside, use the port check.