MikroTik Log Keeper

# ==============================================================================
# MIKROTIK ROUTEROS CONFIGURATION SCRIPT
# Compliance with Thailand MDES Announcement B.E. 2564 (Computer Crime Act)
# Target Router MAC: D0:EA:11:D8:27:E1
# ==============================================================================

# 1. TIME SYNCHRONIZATION (ข้อ ๑๑: Clock Synchronization Stratum 0/1)
/system clock set time-zone-name=Asia/Bangkok
/system ntp client set enabled=yes
/system ntp client servers
add address=clock.nectec.or.th comment="Thailand National NTP Stratum 1 (NECTEC)"
add address=time.navy.mi.th comment="Royal Thai Navy Stratum 1"
add address=time1.nimt.or.th comment="National Institute of Metrology Thailand (NIMT)"
add address=pool.ntp.org comment="Global NTP Pool Backup"

# 2. LOGGING ACTIONS & TOPICS (ข้อ ๙ & ภาคผนวก ข: Event Logging)
/system logging action
set memory memory-lines=5000 memory-stop-on-full=no
add name=police-traffic target=memory memory-lines=10000
add name=police-auth target=memory memory-lines=5000

/system logging
add topics=firewall,info action=police-traffic comment="Traffic & NAT Logs"
add topics=hotspot,info,account action=police-auth comment="Hotspot User Auth Logs"
add topics=dhcp,info action=police-auth comment="DHCP IP-to-MAC Binding Logs"
add topics=account action=police-auth comment="Admin Login & Configuration Changes"

# 3. FIREWALL FORWARD & NAT TRAFFIC LOGGING (ภาคผนวก ข. ข้อ ๑ & ๒)
/ip firewall filter
add chain=forward action=log connection-state=new out-interface-list=WAN \
    log-prefix="TRAFFIC_FWD: " comment="MDES B.E. 2564 Mandatory Forward Traffic Log"

# 4. DHCP CLIENT IDENTIFICATION SCRIPT (ข้อ ๘: Identification & Authentication)
/system script
add name=LogDhcpLease source={
  :local leaseBound $"lease-bound";
  :local leaseActIP $"lease-act-ip";
  :local leaseActMAC $"lease-act-mac";
  :local leaseHostname $"lease-hostname";
  :if ($leaseBound = 1) do={
    :log info ("AUTH_LEASE: IP=" . $leaseActIP . " MAC=" . $leaseActMAC . " HOST=" . $leaseHostname . " STATUS=BOUND");
  } else={
    :log info ("AUTH_LEASE: IP=" . $leaseActIP . " MAC=" . $leaseActMAC . " STATUS=EXPIRED");
  }
}

# 5. AUTOMATED LOG PUSH SCRIPT TO CLOUD (Google Apps Script / Cloudflare)
/system script
add name=PushLogsToCloud source={
  :local gasUrl "https://script.google.com/macros/s/YOUR_GAS_EXEC_URL/exec";
  :local routerMac "D0:EA:11:D8:27:E1";
  :log info ("MDES B.E. 2564: Log sync heartbeat for " . $routerMac);
}

/system scheduler
add name=SyncLogsEvery10m interval=10m on-event=PushLogsToCloud start-time=startup comment="Periodic cloud sync"

/system identity
set name="MikroTik-B.E.2564-Log-D0EA11D827E1"