RouterOS edge: stateful firewall, masquerade and DHCP server.
/system identity set name=edge-01
!
/interface bridge add name=bridge1 protocol-mode=rstp
/ip address add address=10.60.0.1/24 interface=bridge1
!
/ip pool add name=lan-pool ranges=10.60.0.50-10.60.0.250
/ip dhcp-server add name=lan-dhcp interface=bridge1 address-pool=lan-pool disabled=no
/ip dhcp-server network add address=10.60.0.0/24 gateway=10.60.0.1/24 dns-server=1.1.1.1
!
# Order matters: established/related first is what makes this stateful and
# cheap. The drop is last and catches everything not explicitly allowed.
/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=input connection-state=invalid action=drop
/ip firewall filter add chain=input in-interface=bridge1 action=accept
/ip firewall filter add chain=input action=drop comment="drop all other input"
!
/ip firewall filter add chain=forward connection-state=established,related action=accept
/ip firewall filter add chain=forward connection-state=invalid action=drop
/ip firewall filter add chain=forward in-interface=bridge1 out-interface=ether1 action=accept
/ip firewall filter add chain=forward action=drop comment="drop all other forward"
!
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
!
/ip neighbor discovery-settings set discover-interface-list=none
/ip service disable telnet,ftp,www,api