Short example.... I included one native subnet for clarity vlan630, .
THe big mistake is thinking that the vlan tagging for two subnets is the same WRONG
the iot uplink is NOT 710 and is in fact associated with the PFSENSE Subnet associated 222.20.222.0, where the LANIP to the MT is also the MTs WANIP 222.20.222.6
we will call this vlan 222 on the MT.
the IOT vlan is indeed 710, and is associated with the dhcp setup as per your diagram. I asked you for clarity and you failed to provide.
So how is the bridge subnet hitting the port leading to the MT, I will for this exercise ASSUME its untagged as that is most complicated.
If its tagged then its easier as that a clear trunk port, but if its just an untagged subnet then we have to deal with a hybrid port at the MT.
OPTION1 --> No base vlan ( two vlans in hybrid, the untagged wan source and the tagged dhcp 710 vlan, both entering the MT)
# model = CRS328-4C-20S-4S+
/interface bridge
add comment=B1-CRS328-Master-Bridge name=B1-CRS328-Master-Bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=combo3 ] comment="IOT COntroller (VL710)" { assume this is the etherport to the iot device affliated with the pfsense subent .20 subnet }
set [ find default-name=combo4 ] comment=">> VRF1-V8-VL222-IOT Uplink" { assume this is the HYBRID port from the pfsense }
set [ find default-name=sfp18 ] auto-negotiation=no comment="GW and DS Printer (VL630)"
/interface vlan
add comment=">> VRF1-V8-VL222-IOT Uplink-VLAN" interface=B1-CRS328-Master-Bridge name=V8-VL222-IOT-UPLINK_WAN vlan-id=222
add comment="local vlan for printer etc" interface=B1-CRS328-Master-Bridge name=V2-S4-VL630-LAN vlan-id=630
Note1: The pfsense transparent vlan is NOT identified in vlans.
Note2: the Uplink VLAN interface is the BRIDGE not the port.
/interface list
add name=WAN
add name=LAN
add name=TRUSTED
/interface bridge port
add bridge=B1-CRS328-Master-Bridge interface=combo4 pvid=222 comment="hybrid Trunk with WAN and transparent pfsense vlan"
add bridge=B1-CRS328-Master-Bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=spf18 pvid=630 comment="local vlan for printer etc"
add bridge=B1-CRS328-Master-Bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=combo3 pvid=710 comment="pfsense device"
/interface bridge vlan
add bridge=B1-CRS328-Master-Bridge tagged=B1-CRS328-Master-Bridge untagged=combo4 vlan-ids=222
add bridge=B1-CRS328-Master-Bridge tagged=B1-CRS328-Master-Bridge untagged=spf18 vlan-ids=630
add bridge=B1-CRS328-Master-Bridge tagged=combo4 untagged=combo3 vlan-ids=710
/interface list member
add interface=V8-VL222-IOT-UPLINK_WAN list=WAN
add interface=V2-S4-VL630-LAN list=LAN
add interface=V8-VL222-IOT-UPLINK_WAN list=TRUSTED
/ip address
add address=222.10.50.1/24 interface=V2-S4-VL630-LAN network=222.10.50.0 comment="Switch subnet"
add address=222.20.20.6/24 interface=V8-VL222-IOT-UPLINK_WAN network=222.10.50.0 comment="Switch WAN IP and switch address"
/ip route
add dst-address=0.0.0.0/0 gateway=222.20.20.1 routing-table=main
/ip dns
set server=222.20.20.1
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
OPTION2 --> Base-Trusted vlan from pfsense added ( 2 tagged vlans in trunk, one untagged (wan) )
model = CRS328-4C-20S-4S+
/interface bridge
add comment=B1-CRS328-Master-Bridge name=B1-CRS328-Master-Bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=combo3 ] comment="IOT COntroller (VL710)" { assume this is the port to the device on the pfsense .20 subnet }
set [ find default-name=combo4 ] comment=">> VRF1-V8-VL222-IOT Uplink" { assume this is the hybrid port to the pfsense }
set [ find default-name=sfp18 ] auto-negotiation=no comment="GW and DS Printer (VL630)"
set [ find default-name=sfp20 ] auto-negotiation=no comment="Management port on switch"
/interface vlan
add comment=">> VRF1-V8-VL222-IOT Uplink-VLAN" interface=B1-CRS328-Master-Bridge name=V8-VL222-IOT-UPLINK_WAN vlan-id=222
add comment="local vlan for printer etc" interface=B1-CRS328-Master-Bridge name=V2-S4-VL630-LAN vlan-id=630
add interface=B1-CRS328-Master-Bridge name=Trusted-VLAN vlan-id=987 { just using this vlan as an example of a management vlan } [/i]
Note1: The pfsense transparent vlan is NOT identified in vlans.
Note2: the Uplink VLAN interface is the BRIDGE not the port.
/interface list
add name=WAN
add name=LAN
add name=TRUSTED
/interface bridge port
add bridge=B1-CRS328-Master-Bridge interface=combo4 pvid=222 comment="hybrid Trunk with WAN , transparent pfsense vlan, base vlan"
add bridge=B1-CRS328-Master-Bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=spf18 pvid=630 comment="local vlan for printer etc"
add bridge=B1-CRS328-Master-Bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=combo3 pvid=710 comment="pfsense device"
add bridge=B1-CRS328-Master-Bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=sfp20 pvid=987 comment="mgmt port"
//interface bridge vlan
add bridge=B1-CRS328-Master-Bridge tagged=B1-CRS328-Master-Bridge untagged=combo4 vlan-ids=222
add bridge=B1-CRS328-Master-Bridge tagged=B1-CRS328-Master-Bridge untagged=spf18 vlan-ids=630
add bridge=B1-CRS328-Master-Bridge tagged=combo4 untagged=combo3 vlan-ids=710
add bridge=B1-CRS328-Master-Bridge tagged=B1-CRS328-Master-Bridge,combo4 untagged=sfp20 vlan-ids=987
/interface list member
add interface=V8-VL222-IOT-UPLINK_WAN list=WAN
add interface=V2-S4-VL630-LAN list=LAN
add interface=Trusted-VLAN list=LAN
add interface=Trusted-VLAN list=TRUSTED
/ip address
add address=222.10.50.1/24 interface=V2-S4-VL630-LAN network=222.10.50.0 comment="Switch subnet"
add address=222.20.20.6/24 interface=V8-VL222-IOT-UPLINK_WAN network=222.10.50.0 comment="Switch WAN IP"
add address=222.20.98.7/24 interface=Trusted-VLAN network=222.20.98.0 comment=Switch Address
Note: not shown for simplicity is the dhcp pool, dhcp server dhcp-server network for VLAN 630.
/ip route
add dst-address=0.0.0.0/0 gateway=222.20.20.1 routing-table=main
/ip dns
set server=222.20.20.1
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
