ether5 has an ip of 192.168.50.1 and I did not want to manual give my laptop everytime an ip address. So DHCP was the solution and it works on ether5
(2) Missing the defining of ether2 on bridge ports …
/interface bridge port
add bridge=bridge-1 > ingress-filtering=yes > frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=30
add bridge=bridge-1 i> ngress-filtering=yes > frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=40
add bridge=bridge-1 ingress-filtering=yes > frame-types=admit-only-vlan-tagged > > interface=ether2(3) Similarly missing info on interface bridge vlans…
/interface bridge vlan
add bridge=bridge-1 tagged> =bridge> ,ether2 > untagged=ether3 > vlan-ids=30
add bridge=bridge-1 tagged=> bridge> ,ether2 > untagged=ether4 > vlan-ids=40You can get away with untagged entries as the router dynamically adds them for traffic based on pvid, however I always manually put them on the config,
so that they are available on exports and one can map between bridge ports and bridge vlans to see what was intended or understood and what makes sense…
I added the missing configurations
(4) Ether5 does NOT require dhcp-server network
I assume this would not cause any issue if I leave DHCP server and pool enabled on ether5
(5) mac-server by itself is not secure set to NONE.
/tool mac-server
set allowed-interface-list=> LAN
Configured.
(6) The bridge just does bridging so need to modify.
From:
/interface list member
add comment=defconf interface=bridge-1 list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether5emergency list=LAN
TO:
/interface list member
add interface=vlan-30 list=LAN
add interface=vlan-40 list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether5emergency list=LAN
Configured.
Still I am not able to get an IP address with my laptop connected to ether3 and ether4.
I have tried to disable all firewall rules and still the same result. Also configuring a static ip on my laptop to 192.168.30.5 and connecting to ether3 does not work.
No responce to a ping 192.168.30.1
/interface bridge
add name=bridge-1 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether5 ] name=ether5emergency
/interface vlan
add interface=bridge-1 name=vlan-30 vlan-id=30
add interface=bridge-1 name=vlan-40 vlan-id=40
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp-pool-50 ranges=192.168.50.100-192.168.50.150
add name=dhcp-pool-30 ranges=192.168.30.2-192.168.30.254
add name=dhcp-pool-40 ranges=192.168.40.2-192.168.40.254
/ip dhcp-server
add address-pool=dhcp-pool-50 interface=ether5emergency name=dhcp-port-5
add address-pool=dhcp-pool-30 interface=vlan-30 name=dhcp-vlan-30
add address-pool=dhcp-pool-40 interface=vlan-40 name=dhcp-vlan-40
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge-1 frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=30
add bridge=bridge-1 frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=40
add bridge=bridge-1 frame-types=admit-only-vlan-tagged interface=ether2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge-1 tagged=ether2 vlan-ids=30
add bridge=bridge-1 tagged=ether2 vlan-ids=40
/interface list member
add comment=defconf interface=bridge-1 list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether5emergency list=LAN
add interface=vlan-30 list=LAN
add interface=vlan-40 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.50.1/24 interface=ether5emergency network=192.168.50.0
add address=192.168.30.1/24 interface=vlan-30 network=192.168.30.0
add address=192.168.40.1/24 interface=vlan-40 network=192.168.40.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.30.0/24 gateway=192.168.30.1
add address=192.168.40.0/24 gateway=192.168.40.1
add address=192.168.50.0/24 gateway=192.168.50.1
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related \
hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=5201 in-interface-list=WAN protocol=tcp to-addresses=192.168.88.254 \
to-ports=5201
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=RouterOS
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN