diff --git a/routeros/autorun.scr b/routeros/autorun.scr
index 01fbbbb..d6fa6ff 100644
--- a/routeros/autorun.scr
+++ b/routeros/autorun.scr
@@ -1,11 +1,49 @@
+# RouterOS minimal autorun / bootstrap script
+# Basic connectivity + service hardening + time sync.
+# Adjust the CHANGE_ME placeholders before importing:
+#   /import file-name=autorun.scr
+
+# ---------------------------------------------------------------------------
+# Basic connectivity (per-deployment — adjust address / gateway)
+# ---------------------------------------------------------------------------
 /ip address
-add address= interface=ether1 network=10.0.0.1
+add address= interface=ether1 network=10.0.0.1 comment="address issued by ISP"
 /ip route
-add dst-address=0.0.0.0/0 gateway=10.0.0.1
+add dst-address=0.0.0.0/0 gateway=10.0.0.1 comment="CHANGE_ME: default gateway"
 /ip dhcp-client
 add interface=ether1 disabled=yes
+
+# ---------------------------------------------------------------------------
+# Interface lists
+# ---------------------------------------------------------------------------
+/interface list
+add name=WAN comment="Uplinks / Internet-facing interfaces"
+add name=LAN comment="Local trusted networks"
+add name=StS comment="Site-to-Site tunnels"
+add name=VPN comment="Remote-access VPN clients"
+
+/interface list member
+# Assign your real interfaces here, examples below:
+add list=WAN interface=ether1
+# add list=LAN interface=bridge
+# add list=StS interface=<gre-tunnel1>
+# add list=VPN interface=<wireguard1>
+
+# ---------------------------------------------------------------------------
+# Firewall NAT
+# ---------------------------------------------------------------------------
+/ip firewall nat
+add action=masquerade chain=srcnat comment="LAN -> Internet" out-interface-list=WAN
+
+# ---------------------------------------------------------------------------
+# Admin user
+# ---------------------------------------------------------------------------
 /user
-set 0  password="CHANGE_ME"
+set 0 password="CHANGE_ME"
+
+# ---------------------------------------------------------------------------
+# Service / management hardening
+# ---------------------------------------------------------------------------
 /ip service
 set telnet disabled=yes
 set ftp disabled=yes
@@ -22,6 +60,10 @@ set allowed-interface-list=none
 set enabled=no
 /ipv6 settings
 set disable-ipv6=yes
+
+# ---------------------------------------------------------------------------
+# Time / NTP
+# ---------------------------------------------------------------------------
 /system clock
 set time-zone-name=Asia/Yekaterinburg
 /system ntp client