Add ethernet interface to existing VLAN on another interface

RouterOS General
1

I have done my best to outline the pertinent information below. I would like to setup ether3 to be a part of vlan20-IoT as the device that I want to connect to it (smart TV) doesn’t support VLAN tagging. The thought was to tag ether3 with vlan20-IoT so that the device (smart TV) can get a DHCP address from the vlan20-IoT network.

I have explored creating a bridge and adding vlan20-IoT to a bridge. But, ether2-LAN is already a part of the bridge-LAN and I received an error that “DHCP server cannot run on slave interface” when I attempt to add vlan20-IoT to bridge-vlan20IoT.

I have a firewall rule in place to prevent the LAN traffic from being able to communicate with the IoT traffic and vise-versa. In one room I will just have to buy a switch capable of VLAN tagging. But, since the smart TV can be directly connected to one of the available ports on the MikroTik I though I might be able to save myself some money and put ether3 onto the vlan20-IoT VLAN and that would be that. Just not sure the right way to get there with my current setup.

Please forgive me as my knowledge of how MikroTik’s work is fair at best. Most of my VLAN knowledge is on Cisco but again my knowledge is fair at best there as well.

Interface List:
bridge-LAN
bridge-van20IoT
ether1-WAN
ether2-LAN
–vlan20-IoT (attached to ether2-LAN interface)
–vlan30-Guest (attached to ether2-LAN interface)
ether3 (currently empty/unused port)

DHCP:
[Name, Interface, Address Pool]
dhcp-LAN, bridge-LAN, dhcp-pool-LAN
dhcp-IoT, vlan20-IoT, dhcp-pool-IoT
dhcp-Guest, vlan30-Guest, dhcp-pool-Guest

VLAN:
vlan20-IoT
vlan30-Guest

Address List:
[Address, Interface]
10.10.1.0/24, ether2-LAN
10.10.2.0/24, vlan20-IoT
10.10.3.0/24, vlan30-Guest

Bridge Ports:
[Interface, Bridge]
ether2-LAN, bridge-LAN

2

I answered my own question. I ended up creating a secondary bridge (bridge-IoT2) for ports 3, 4, & 5. I created a new DHCP pool, assigned the newly created pool to the bridge-IoT2 and its working how I wanted. Not exactly how I pictured but it gets the job done. Next step is to setup a secondary MikroTik and attempt to do VLAN trunking so I can finish my work to isolate IoT devices from my internal traffic while still allowing them access to the Internet.

nterface List:
bridge-LAN
bridge-IoT2 (vlan40
ether1-WAN
ether2-LAN
–vlan20-IoT (attached to ether2-LAN interface)
–vlan30-Guest (attached to ether2-LAN interface)
ether3 (currently empty/unused port)
–assigned to bridge (vlan 40)

DHCP:
[Name, Interface, Address Pool]
dhcp-LAN, bridge-LAN, dhcp-pool-LAN
dhcp-IoT, vlan20-IoT, dhcp-pool-IoT
dhcp-Guest, vlan30-Guest, dhcp-pool-Guest
dhcp-IoT3, vlan40-IoT2, dhcp-pool-IoT2

VLAN:
vlan20-IoT
vlan30-Guest
vlan40-IoT2

Address List:
[Address, Interface]
10.10.1.0/24, ether2-LAN
10.10.2.0/24, vlan20-IoT
10.10.3.0/24, vlan30-Guest
10.10.4.0/24, vlan40-IoT2

Bridge Ports:
[Interface, Bridge]
ether2-LAN, bridge-LAN
ether3, bridge-IoT2 (directly connected to devices in patch panel)
ether4, bridge-IoT2 (directly connected to devices in patch panel)
ether5, bridge-IoT2 (directly connected to devices in patch panel)

3

Coming soon to a forum near you.