Community discussions

MikroTik App
  4. RouterOS
  5. Beginner Basics

MACVLAN on top of current VLAN  [SOLVED]

Post Reply
 
tunguskalabs
just joined
Topic Author
Posts: 18
Joined: Tue May 23, 2023 3:36 pm

MACVLAN on top of current VLAN

Wed Mar 20, 2024 3:08 pm

Hi all,

After successfully configuring my network with VLANs, I had to change the topology, and now I have a situation where one ethernet port has to serve two machines that are in different VLANs. I tried enabling the MACVLAN, untagging the ethernet port and allowing all traffic and setting DHCP on the macvlan1, but no machine was detected in the port, even before the DHCP server had a chance to connect to it. What is the correct way to change the "standard" VLAN configuration for one port being trunk with MACVLAN on it?
Code: Select all
/interface bridge
add admin-mac=DC:2C:6E:13:F3:B3 auto-mac=no comment=defconf name=bridge protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-onlyac channel-width=20/40/80mhz-XXXX country=brazil disabled=no distance=indoors frequency-mode=superchannel \
    mode=ap-bridge secondary-frequency=auto ssid=loveandrockets wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=2ghz-g/n channel-width=20/40mhz-XX country=brazil disabled=no distance=indoors frequency=2447 frequency-mode=\
    superchannel installation=indoor mode=ap-bridge ssid=rocketsandlove wireless-protocol=802.11
/interface vlan
add interface=bridge name=base_vlan vlan-id=99
add interface=bridge name=guest_vlan vlan-id=30
add interface=bridge name=home_vlan vlan-id=10
add interface=bridge name=work_vlan vlan-id=20
/interface macvlan
add disabled=yes interface=ether9 mac-address=A2:86:E2:AC:4B:F3 name=macvlan1
/interface pppoe-client
add ac-name=i-br-sp-scl-cli-hl4-01 add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 user=cliente@cliente
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
add name=BASE
/interface wifi channel
add band=5ghz-ax disabled=no frequency=2300-7300 name=channel1 width=20/40/80+80mhz
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk connect-priority=0 disabled=no name=home_wifi_sec wps=disable
/interface wifi configuration
add channel.band=5ghz-ax .frequency=2300-7300 .width=20/40/80+80mhz country=Brazil disabled=no manager=local mode=station-bridge name=cfg1 security=\
    home_wifi_sec security.connect-priority=0 ssid=loveandrockets
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=workshop supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=guest supplicant-identity=MikroTik
/interface wireless
add disabled=no mac-address=DE:2C:6E:13:F3:BD master-interface=wlan1 name=wlan3 security-profile=workshop ssid=workshop
add disabled=no mac-address=2E:C8:1B:BF:E8:D6 master-interface=wlan2 name=wlan4 security-profile=guest ssid=paloma
/ip pool
add name=home_pool ranges=192.168.10.2-192.168.10.254
add name=work_pool ranges=192.168.20.2-192.168.20.254
add name=guest_pool ranges=192.168.30.2-192.168.30.254
add name=base_pool ranges=192.168.0.10-192.168.0.254
/ip dhcp-server
add address-pool=home_pool interface=home_vlan name=home_dhcp
add address-pool=work_pool interface=work_vlan name=work_dhcp
add address-pool=guest_pool interface=guest_vlan name=guest_dhcp
add address-pool=base_pool interface=base_vlan name=base_dhcp
/port
set 0 name=serial0
set 1 name=serial1
/system logging action
add name=logserver remote=192.168.10.2 target=remote
/interface bridge port
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether6 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether7 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether8 pvid=20
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether9 pvid=30
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether10 pvid=99
add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus1
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=wlan1 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=wlan2 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=wlan4 pvid=30
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=wlan3 pvid=20
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=10
add bridge=bridge tagged=bridge vlan-ids=20
add bridge=bridge tagged=bridge vlan-ids=30
add bridge=bridge tagged=bridge vlan-ids=99
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=home_vlan list=VLAN
add interface=work_vlan list=VLAN
add interface=guest_vlan list=VLAN
add interface=base_vlan list=BASE
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.0.1/24 interface=base_vlan network=192.168.0.0
add address=192.168.10.1/24 interface=home_vlan network=192.168.10.0
add address=192.168.20.1/24 interface=work_vlan network=192.168.20.0
add address=192.168.30.1/24 interface=guest_vlan network=192.168.30.0
/ip cloud
set update-time=no
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=1.1.1.1,9.9.9.9 gateway=192.168.0.1
add address=192.168.10.0/24 dns-server=192.168.10.2,192.168.0.1,1.1.1.1 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=1.1.1.1,9.9.9.9 gateway=192.168.20.1
add address=192.168.30.0/24 dns-server=1.1.1.1,9.9.9.9 gateway=192.168.30.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,9.9.9.9
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=8.8.8.8 comment="google DNS" list=GOOGLE_DNS
add address=8.8.4.4 comment="google DNS" list=GOOGLE_DNS
add address=0.0.0.0/8 comment="defconf: RFC6890" list=no_forward_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890" list=no_forward_ipv4
add address=224.0.0.0/4 comment="defconf: multicast" list=no_forward_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=no_forward_ipv4
add address=127.0.0.0/8 comment="defconf: RFC6890" list=bad_ipv4
add address=192.0.0.0/24 comment="defconf: RFC6890" list=bad_ipv4
add address=192.0.2.0/24 comment="defconf: RFC6890 documentation" list=bad_ipv4
add address=198.51.100.0/24 comment="defconf: RFC6890 documentation" list=bad_ipv4
add address=203.0.113.0/24 comment="defconf: RFC6890 documentation" list=bad_ipv4
add address=240.0.0.0/4 comment="defconf: RFC6890 reserved" list=bad_ipv4
add address=0.0.0.0/8 comment="defconf: RFC6890" list=not_global_ipv4
add address=10.0.0.0/8 comment="defconf: RFC6890" list=not_global_ipv4
add address=100.64.0.0/10 comment="defconf: RFC6890" list=not_global_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890" list=not_global_ipv4
add address=172.16.0.0/12 comment="defconf: RFC6890" list=not_global_ipv4
add address=192.0.0.0/29 comment="defconf: RFC6890" list=not_global_ipv4
add address=192.168.0.0/16 comment="defconf: RFC6890" list=not_global_ipv4
add address=198.18.0.0/15 comment="defconf: RFC6890 benchmark" list=not_global_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=not_global_ipv4
add address=224.0.0.0/4 comment="defconf: multicast" list=bad_src_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=bad_src_ipv4
add address=0.0.0.0/8 comment="defconf: RFC6890" list=bad_dst_ipv4
add address=224.0.0.0/4 comment="defconf: RFC6890" list=bad_dst_ipv4
add address=192.168.0.0/24 list=allowed_to_router
add address=192.168.0.0/16 comment="internal networks, including VLANs" list=allowed_lan
add address=192.168.10.11 comment=roku list=redirect_dns
add address=192.168.10.7 comment=chiba list=redirect_dns
add address=192.168.10.7 list=allowed_to_router
add address=192.168.10.12 list=allowed_to_router
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="Allow list to router" src-address-list=allowed_to_router
add action=accept chain=input comment="DNS - UDP" dst-port=53 in-interface-list=VLAN protocol=udp
add action=accept chain=input comment="DNS - TCP" dst-port=53 in-interface-list=VLAN protocol=tcp
add action=drop chain=input comment=Drop
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="VLAN Internet Access only" connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment="Drop google DNS" disabled=yes dst-address-list=GOOGLE_DNS log=yes log-prefix=googledns
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log-prefix=fw_invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=\
    WAN
add action=drop chain=forward comment="defconf: drop bad forward IPs" src-address-list=no_forward_ipv4
add action=drop chain=forward comment="defconf: drop bad forward IPs" dst-address-list=no_forward_ipv4 log=yes
add action=drop chain=forward comment=Drop
/ip firewall nat
add action=masquerade chain=srcnat comment="fix the ntp client by changing its source port 123 with something higher (mikrotik forum 794718)" protocol=\
    udp src-port=123 to-ports=12400-12440
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.10.2 dst-port=53 log=yes log-prefix=roku_dns_src protocol=udp src-address-list=\
    redirect_dns
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.10.2 dst-port=53 log=yes log-prefix=roku_dns_src protocol=tcp src-address-list=\
    redirect_dns
add action=dst-nat chain=dstnat dst-port=53 log-prefix=roku_dns_dst protocol=udp src-address-list=redirect_dns to-addresses=192.168.10.2 to-ports=53
add action=dst-nat chain=dstnat dst-port=53 log-prefix=roku_dns_dst protocol=tcp src-address-list=redirect_dns to-addresses=192.168.10.2 to-ports=53
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=2233
set www-ssl address=192.168.0.0/16 certificate=tunguska.cc.cer_0 disabled=no
set api disabled=yes
set winbox address=192.168.0.0/16
set api-ssl address=192.168.0.0/16 certificate=tunguska.cc.cer_0 disabled=yes
/ip ssh
set host-key-size=4096 host-key-type=ed25519
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
add address=fe80::/16 list=allowed
add address=ff02::/16 comment=multicast list=allowed
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=input comment="allow established and related" connection-state=established,related
add action=accept chain=input comment="allow allowed addresses" src-address-list=allowed
add action=drop chain=input comment="Drop all"
add action=accept chain=forward comment=established,related connection-state=established,related
add action=drop chain=forward comment=invalid connection-state=invalid log=yes log-prefix=ipv6,invalid
add action=drop chain=forward comment="drop all" log-prefix=IPV6
/system clock
set time-zone-name=America/Sao_Paulo
/system leds
add interface=wlan2 leds=wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-led,wlan2_signal4-led,wlan2_signal5-led type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive
/system logging
set 0 topics=info,!firewall
add prefix=login topics=system,info
add action=logserver prefix=MikroTik topics=!debug,!packet,!snmp,!dns
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=2001:12ff::8
add address=200.189.40.8
/tool mac-server
set allowed-interface-list=BASE
/tool mac-server mac-winbox
set allowed-interface-list=BASE
/tool netwatch
add comment=NAS disabled=no down-script=":log message=\"NAS down\"" host=192.168.10.2 interval=1m packet-count=10 packet-interval=1s test-script="" \
    timeout=10s type=icmp up-script=":log message=\"NAS up\""
Top
 
CGGXANNX
Frequent Visitor
Frequent Visitor
Posts: 64
Joined: Thu Dec 21, 2023 6:45 pm

Re: MACVLAN on top of current VLAN

Wed Mar 20, 2024 7:21 pm

What are the two machines? are they PC running Windows, Linux, or Mac? all three OSes support the use of tagged VLAN so you maybe able to just leave the port as Trunk port, with the two VLANs tagged.

For Linux you use the 8021q module. For Windows, many NIC either allow you to choose the VLANID in the driver properties

realtekvlan.png

or provide helper configuration tools for that. If the network adapter doesn't provide such setting capability, you can rely on the Virtual network adapter + virtual switch feature of Hyper-V to use VLAN (I am using such configuration). Here is some guide: https://woshub.com/configure-multiple-vlan-on-windows/

For Mac there is this guide https://support.apple.com/en-us/guide/m ... h15134/mac
You do not have the required permissions to view the files attached to this post.
Top
 
tunguskalabs
just joined
Topic Author
Posts: 18
Joined: Tue May 23, 2023 3:36 pm

Re: MACVLAN on top of current VLAN

Wed Mar 20, 2024 8:18 pm

Thanks for your answer! Both machines are macs. I changed the configuration as you suggested, but then DHCP seems to not work. Any suggestions on how to make DHCP work in this scenario? Thanks
Top
 
CGGXANNX
Frequent Visitor
Frequent Visitor
Posts: 64
Joined: Thu Dec 21, 2023 6:45 pm

Re: MACVLAN on top of current VLAN

Wed Mar 20, 2024 10:43 pm

Unfortunately. I have no devices running macOS and have no experiences with its configuration. If it's like the other OSes, network configuration like DHCP client settings should be performed on the newly created virtual interface, as if it was a separate network adapter.

In the configuration that you provided in the original post, I see no ports configured as trunk port yet. Did you add the port to the "tagged" list of the two /interface/bridge/vlan entries? Additionally, frame-types=admit-only-vlan-tagged must also be set for that port.

How do you connect the two machines to the single port of the router? Do you use ethernet cables and have a switch in between? If it's a dumb switch, the switch must forward the packets unchanged, keeping the 802.1Q 4-byte header (not all models can do that), otherwise it won't work. If it's a smart switch, then you can just configure VLAN on that switch and make two ports access ports for the two VLAN, no configurations on the computer needed.

If you are using wireless access points, some business focused models like the UniFi, Aruba, TP-Link Omada support mapping separate SSIDs to separate VLANs, you just have to connect them to the trunk port and make the configuration on their controllers, they'll be equivalent to a smart switch, each of your two computers will connect to the SSID associated with the right VLAN. On the other hand, some consumer grade APs might strip the VLAN header from all the packets, or drop tagged packets, so you won't be able to make use of the VLAN support from macOS.
Top
 
User avatar
Buckeye
Forum Veteran
Forum Veteran
Posts: 896
Joined: Tue Sep 11, 2018 2:03 am
Location: Ohio, USA

Re: MACVLAN on top of current VLAN

Thu Mar 21, 2024 11:45 am

After successfully configuring my network with VLANs, I had to change the topology, and now I have a situation where one ethernet port has to serve two machines that are in different VLANs. I tried enabling the MACVLAN, untagging the ethernet port and allowing all traffic and setting DHCP on the macvlan1, but no machine was detected in the port, even before the DHCP server had a chance to connect to it. What is the correct way to change the "standard" VLAN configuration for one port being trunk with MACVLAN on it?
Are you confusing MAC-based vlans with MACVLAN? MACVLAN is to allow you to emulate two (or more) ethernet adapters, each with their own MAC address, but using the same physical port. Vyos/vyatta/edgeos calls this feature psuedo-ethernet, which I think is less confusing than MACVLAN, but MACVLAN is the linux name for the feature. Wilmer Almazan / The Network Trip has a youtube video MACVLAN Mikrotik - Multiple MACs, One Interface that discusses the use cases for MACVLAN, and it is worth watching.

So if you really want two distinct broadcast domains, you should be using a vlans to send at two virtual LANs to the far end. You will need something that is vlan-aware at the far end to untag if both machines are not vlan-aware. A MikroTik RB260 (CSS106-5G-1S) would work, as would a hap ax lite. Or even cheaper a 5 or 8 port "smart switch" that is vlan aware (e.g. TL-SG105E, or netgear GS305, etc.) It seems to me you are going to need to use a switch at the far end anyway, so spend a bit more and get a switch that is vlan-aware. I would probably get an 8 port instead of a 5 port, since you can then support up to 7 devices at the far end, instead of just 4. And using "standard" IEEE802.1Q tagged vlans is a much better emulation of separate LANs, and they are supported by cheaper devices than switches that support MAC-based vlans.
Top
 
tunguskalabs
just joined
Topic Author
Posts: 18
Joined: Tue May 23, 2023 3:36 pm

Re: MACVLAN on top of current VLAN

Thu Mar 21, 2024 7:57 pm

This is the diagram for what I'm trying to do:
vlan_mac.png
VLAN10 and VLAN20 are working fine for the other devices, without any configuration on the devices themselves. I have a cable that connects ethernet port 9 from the RB4011 to a tplink LS1005G, and from this dumb switch, I connect the two macbooks in question. One macbook needs to be on the VLAN10, my home network, while the other must be in the VLAN20, the work network.

I tried setting ether9 to vlag-tagged-only, but without ingress filtering on, and the DHCP servers on the home_vlan and work_vlan did not work. I then tried to set a virtual network interface on the macbook for VLAN10 with pvid 10, and same problem. So I'm not sure if MACVLAN is what I need, I thought that I could create two macvlans on ether9, one for each VLAN, and connect one of each notebooks to these MACVLANs, but this seems to not be the way forward. So, first, is it possible to do this without having to replace the tplink dumb switch with a vlan-aware switch? And if that's possible, what are the paths forward to configure the network as such? Thanks again!
You do not have the required permissions to view the files attached to this post.
Top
 
User avatar
Buckeye
Forum Veteran
Forum Veteran
Posts: 896
Joined: Tue Sep 11, 2018 2:03 am
Location: Ohio, USA

Re: MACVLAN on top of current VLAN

Fri Mar 22, 2024 6:49 am

So, first, is it possible to do this without having to replace the tplink dumb switch with a vlan-aware switch? And if that's possible, what are the paths forward to configure the network as such? Thanks again!
What happened to vlans 30 and 99 in your diagram? They exist in your config, but not the diagram.

Is ether9 the port connected to the dumb switch?

For under $30 you can get an 8 port vlan-aware switch, and that's the only way you will really have isolation. Any time you connect a device to a trunk link, it has the capability to access all vlans defined on the link. And when you connect a vlan-transparent switch to a trunk port, then you are just adding more trunk ports; all ports on the dumb switch will have the same access as any other port. The TL-SG108E is currently 10% off on Amazon (the "E" version is a vlan-aware "smart" switch, it supports vlans but isn't a "full feature" managed switch), and I have 3 and they are fine for home use and the vlans work fine on them. I haven't ever used the D-Link DGS-1100-05V2 (a 5 port "smart" switch, currenty $20 on Amazon). In general I don't trust D-Link for routers, I don't know anything first hand about their smart switches, but it is inexpensive. For the extra $7 the TL-SG108E costs, that's what I would buy, but either one would probably work fine. You can probably find more help for the TPlink than the D-link. You can always use your existing 5 port dumb switch to add more ports to a specific vlan.

To address your question, I am not aware of any way to get the equipment shown in the diagram to work with two non-vlan-aware devices connected to the dumb switch, but be part of separate vlans. You could have the bridge port ether9 have pvid 10 and tagged vlan 20. Then you would need to configure the vlan 20 device to use tagged frames for its connection to the RB4011. Although I don't have a TPlink LS1005G, I do have a TPlink TL-SG1008D (8 port dumb switch) that is vlan-transparent (meaning that it will pass ethertype as is, so vlan tagged frames will pass though as is). I haven't found any dumb switches that have been made in the last 20 years that are not vlan-transparent, but I have heard others warn that they do exist. My guess is that the LS1005G is vlan-transparent, but it is easy to determine. First get it working so you can connect one or the other to the ether9 port, and if you have it correctly configured, then when you plug in the device without any vlan config, it will be connected to vlan 10 and get its ip address from the vlan 10 dhcp scope. If you connect the device configured to work with vlan 20 tagged, and connect it to ether9, it should get its ip address from the vlan 20 scope. Once you have that working for both devices connected one at a time, put the switch in, and if the switch is vlan-transparent, it will continue to work the same as when it is not in between.

Make a backup and export of your config (for safe keeping) then remove the macvlan stuff, and change the /interface bridge port from
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether9 pvid=30
to
add bridge=bridge comment=defconf interface=ether9 pvid=10

And change the /interface bridge vlan from
add bridge=bridge tagged=bridge vlan-ids=20
to
add bridge=bridge tagged=bridge,ether9 vlan-ids=20

Then connect the VLAN 10 laptop (top right in diagram) to the wire from ether9, and verify that the device is connected to the "home" vlan. Then connect the other device that is configured to use only tagged vlan 20 (and to ignore untagged frames, how you do that on the macOS hosts, I don't know).

But if these are really laptops, you will probably be using them in other places, and if you want to be able to use the wired ethernet, you will probably want the devices configured to use "standard ethernet frames" instead of "IEEE 802.1Q tagged" frames. That is another reason to invest in a vlan-aware switch, because then the link between ether9 and the vlan-aware switch could be configured to use tagged frames on the trunk link, and be configured to have other switch ports configured as access ports to vlans 10 and 20. If you also connect vlans 30 and 99 to ether9 as tagged, you could also dedicate ports on the switch as access ports for those vlans as well, if you wanted access to those vlans from the other room with the LS1005G.

Some references about vlans that you may find interesting.
IEEE 802.1Q
Virtual Local Area Networks (VLANs)
smart switch vlan rosetta stone video
Top
 
tunguskalabs
just joined
Topic Author
Posts: 18
Joined: Tue May 23, 2023 3:36 pm

Re: MACVLAN on top of current VLAN  [SOLVED]

Sat Mar 23, 2024 7:12 pm

Thank you so much for your very complete answer. I'll look into getting one TP-Link that you mentioned, only that they're R$ 250 now and I don't want to spend that kind of money. Believe or not, my Mikrotik wifi coverage is reasonable on my office where these two macbooks sit, so until I see a good sale or I need more bandwitdh for work, I'll keep the situation as is. Thanks again!
Top
Post Reply

Who is online

Users browsing this forum: marko1982m and 28 guests
  4. RouterOS
  5. Beginner Basics