# Hybrid PREP saja — aman di Failover Fase 1 (tanpa PCC/Netwatch)
# Import: /import file=hybrid-prep.rsc
# Hapus: /ip firewall mangle remove [find comment~"hybrid"]

# Laptop admin tidak kena policy routing saat Fase 2 nanti
/ip firewall mangle add chain=prerouting action=accept src-address=192.168.0.33 comment="hybrid mgmt bypass laptop" place-before=0

# Office ke server tidak ter-mark (persiapan bypass PCC)
/ip firewall mangle add chain=prerouting action=accept dst-address=10.100.1.0/24 in-interface=office comment="hybrid office-to-server-bypass" place-before=0