Анонимный выход в сеть для чайников.

/system package update check-for-updates
/system package update download
/system package update install

/user set admin password="НовыйСильныйПароль"
/user add name=adm-sec group=full password="ЕщёОдинНадёжный"
/user remove admin

/system identity set name="Secure-USB"
/system clock set time-zone-name=Europe/Moscow
/system ntp client set enabled=yes \
    server-dns-names=time.google.com,ru.pool.ntp.org
/system logging add topics=critical action=memory

/ip service disable telnet,ftp,www,www-ssl,api,api-ssl
/ip service disable mac-server,mac-winbox
/ip service set winbox address=192.168.88.10/32

/ip neighbor discovery-settings set discover-interface-list=none
/tool bandwidth-server set enabled=no
/ip cloud set ddns-enabled=no update-time=no

/interface bridge filter add chain=forward action=accept \
    src-mac-address=AA:BB:CC:DD:EE:FF
/interface bridge filter add chain=forward action=drop \
    src-mac-address=!AA:BB:CC:DD:EE:FF

/ip address add address=192.168.88.1/24 interface=bridge-local

/interface ppp-client print detail
/interface ppp-client set ppp-out1 \
    add-default-route=yes use-peer-dns=yes dial-on-demand=no \
    keepalive-timeout=60 info-channel=auto data-channel=auto

/ip firewall nat add chain=srcnat out-interface=ppp-out1 \
    action=masquerade comment="USB NAT"

/ip firewall filter remove [find]

/ip firewall filter
add chain=input action=accept connection-state=established,related \
    comment="Рабочие сессии"
add chain=input action=accept in-interface=bridge-local \
    src-address=192.168.88.10/32 comment="Мой ПК"
add chain=input action=drop in-interface=ppp-out1 \
    comment="Запрет входа с модема"
add chain=input action=drop comment="Остальное отсекаем"

add chain=forward action=accept src-address=192.168.88.10/32 \
    out-interface=ppp-out1 connection-state=new,established,related \
    comment="Трафик ПК наружу"
add chain=forward action=drop out-interface=ppp-out1 \
    comment="Всё прочее наружу блокируем"

/ip firewall filter add chain=input in-interface=ppp-out1 \
    protocol=icmp action=drop comment="Block ping"

/ipv6 settings set disable-ipv6=yes

/ip dns set allow-remote-requests=no \
    use-doh-server="https://dns.google/dns-query" \
    doh-ca-file=dynamic

/system scheduler add interval=1w name=auto-backup \
    on-event="/system backup save name=SecureUSB"

/export file=SecureUSB-config

:local pppIfName "ppp-out1"
:local apnName "internet"
:local dialNumber "*99#"
:local infoChannel "auto"
:local dataChannel "auto"
:local pppUser ""
:local pppPassword ""

/log info ("[3G/LTE SETUP] Настраиваю интерфейс " . $pppIfName)

:if ([/interface ppp-client find where name=$pppIfName] = "") do={
    /log error ("PPP-интерфейс " . $pppIfName . " не найден — проверьте USB-модем")
    :error "PPP interface not found"
}

/interface ppp-client set $pppIfName info-channel=$infoChannel data-channel=$dataChannel
/interface ppp-client set $pppIfName \
    apn=$apnName phone=$dialNumber user=$pppUser password=$pppPassword \
    allow=pap,chap dial-on-demand=no add-default-route=yes \
    default-route-distance=0 use-peer-dns=yes keepalive-timeout=60

/interface enable $pppIfName
/ip dns set allow-remote-requests=yes use-doh-server="" servers=""

/log info "[3G/LTE SETUP] DNS готов"

:if ([/ip firewall nat find where chain=srcnat and out-interface=$pppIfName \
      and action=masquerade] = "") do={
    /ip firewall nat add chain=srcnat out-interface=$pppIfName \
        action=masquerade comment="3G/LTE auto NAT"
    /log info "[3G/LTE SETUP] Добавлен NAT masquerade"
} else={
    /log info "[3G/LTE SETUP] NAT уже существует"
}

:delay 3s
/tool ping address=8.8.8.8 interval=1s count=5 interface=$pppIfName
/log info "[3G/LTE SETUP] Проверка завершена"

sudo apt install -y iptables-persistent

sudo iptables -F
sudo iptables -N PASSVPN
sudo iptables -N BLOCKANY
sudo iptables -A OUTPUT -o tun+ -j ACCEPT
sudo iptables -A OUTPUT -o lo+ -j ACCEPT
sudo iptables -A OUTPUT -j PASSVPN
sudo iptables -A OUTPUT -j BLOCKANY
sudo iptables -A PASSVPN -d 127.0.0.1 -j ACCEPT
sudo iptables -A PASSVPN -d ВАШ_VPN_IP -j ACCEPT
sudo iptables -A BLOCKANY -j DROP

sudo iptables-save | sudo tee /etc/iptables/rules.v4
sudo systemctl enable netfilter-persistent.service