Add vlan tag to ZT traffic going to certain subnet

[bradkuhl]

I have 3 locations linked with zerotier. All three have different subnets. This is working. I can access all three subnets from any location and from any ZT connected device (laptop) from a remote location.

All the routers are mikrotik.

I have a need in the third location to separate into vlans.

Zerotier network: 10.10.10.0/24

router 1 - 10.10.10.1/24
subnet - 192.168.11.0/24

router 2 - 10.10.10.2/24
subnet - 192.168.88.0/24

router3 - 10.10.10.3/24
subnet - 10.252.0.0/24 (needs to be vlan 50)

I am trying to find the proper way to tag traffic coming in through zerotier interface on third router destined for subnet 10.252.0.0/24 as vlan50.
(not any traffic destined for the zerotier subnet 10.10.10.0/24)

My zerotier interface is not part of my bridge, as it causes routing issues if I try that. I have a firewall rule that allows all ZT traffic at the top of the list.

Please help me find what link I’m missing to make this work.

[Larsa]

The simplest approach is probably to go with regular routing:

1. In the Zerotier’s management console → Network Management → Managed Routes, add ‘destination’ 10.252.0.0/24 ‘via’ 10.10.10.3
2. On Router 3, add: ‘/ip route add dst-address=10.252.0.0/24 gateway=vlan50’

If you want multiple vlans/subnets on R3, just repeat the same steps above. For example like this for vlan 55 with subnet 10.55.0.0/24:

3. In the Zerotier’s management console → Network Management → Managed Routes, add ‘destination’ 10.55.0.0/24 ‘via’ 10.10.10.3
4. On Router 3, add: ‘/ip route add dst-address=10.55.0.0/24 gateway=vlan55’

[bradkuhl]

The simplest approach is probably to go with regular routing:

1. In the Zerotier’s management console → Network Management → Managed Routes, add ‘destination’ 10.252.0.0/24 ‘via’ 10.10.10.3
2. On Router 3, add: ‘/ip route add dst-address=10.252.0.0/24 gateway=vlan50’

If you want multiple vlans/subnets on R3, just repeat the same steps above. For example like this for vlan 55 with subnet 10.55.0.0/24:

3. In the Zerotier’s management console → Network Management → Managed Routes, add ‘destination’ 10.55.0.0/24 ‘via’ 10.10.10.3
4. On Router 3, add: ‘/ip route add dst-address=10.55.0.0/24 gateway=vlan55’

Would this handle tagging the packets with vlan50?

[Larsa]

Yes, since tagging happens at the interface level, through the VLAN or bridge setup. The router first checks the routing table to figure out which interface to send the packet to, and that interface (like vlan50) adds the VLAN tag to the outbound traffic.