I got this issue that I’m trying to figured out. I have main network that sits on 10.0.0.0/24 also I have 2 additional networks WiFi Home 10.0.10.0/24 and WiFi Guest 10.0.20.0/24 everybody can get on internet but I would also like to network 10.0.10.0/24 to be able to access network 10.0.0.0/24. In my case for example to get to the shared folders or use mobile app to control AC that sits on 10.0.0.0/24.
Here is my topology for better understanding. So basically PC connected through Wi-Fi Home cant access PC connected via network 10.0.0.0/24 (Connection in Red). Also including relevant config that is currently on my router
Nice diagram by the way!
What I don’t see is the tie-in between the VLAN networks and the LAN network 10.0.0.0 ?
Where, how do you tell the VLAN to piggyback/ride symbiotically live off the HOST LAN?
I’m assuming the VLAN networks are specifically used for WIFI and the rest of the network is normal LAN traffic.
In general, I thought that at the router level without a specific drop rule VLAN members would be able to connect to other VLAN members through layer 3 routing?
In other words, even if you had specific ROUTING to go out the internet, a FW rule would be needed to block inter VLAN to LAN or to other VLAN traffic at the layer 3 routing level (VLANS only block at layer2).
configuration for IP Interface and IP Address is not complete. The native LAN must have an address and interface as well. and showing your NAT rules would help.
My best guess, is the problem is likely to be a source NAT issue, try this
Correct VLAN are just for WiFi everything else sits on LAN 10.0.0.0/24 trying to help friend of mine with this setup and basically doing this remotely. Unfortunately I don’t know nothing about Mikrotik so I’m a little bit lost here
Correct from what i understand that L3 switch is just setup as L2 switch and since it’s PoE I think he use that to feed some security cameras with that. if you guys tell me what output to show i will do that once I get home tonight.
So here is the current config . There is few other Wi-Fi vlans for 5GHz radio but If I know what I'm missing for vlan10 I'm, sure I can fix the on the other one....
Hmm with my limited experience nothing jumped out at me.
I see that all interface are on the same bridge and same LAN.
I am just not sure the right way to tell the router that the VLANs are piggybacking on 10.0.0.0???
I believe you need to enable vlan filtering on the bridge. By default, Mikrotik allows communications between any routed interfaces. You would have to use firewall rules to drop any traffic between LAN segments you did not want. https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_VLAN_Filtering
The image gives first impression that there’s a lot of stuff, but on second look, there isn’t anything special. Just one router with VLANs, different subnet for each, and serves as gateway for all of them. Firewall config is default, so the only thing it blocks is access from WAN, there’s no filtering between VLAN subnets, so everything should be able to communicate with everything else.
Only thing I see, that might need adjusting, is bridge/VLAN config. For example, IP address on bridged port (LAN-ETH2) is wrong, it should be on bridge (but it’s not breaking bug). I’m not completely sure what VLANs on bridged port do with current bridge implementation.
You right technically there is only 2 interfaces eth2 with one switch that runs 10.0.0.0/24 and eth6 with Cisco switch Dot1q Trunk and 4 Vlans. The only thing that works is internet for Lan (eth2 10.0.0.0/24) and all 4 vlans (4x wifi connections) what is not working is communication between 10.0.0.0 and 10.0.10.0. Other words if I log in with laptop to wifi and lets say I will get address 10.0.10.120 from DHCP pool which I can confirm in the output on Cisco AP and trying ping that address from computer that is wired to LAN 10.0.0.0/24 nothing happened and getting the usual “time out” so there is only 2 things that could prevent this either the local system has no route to the desired destination, or a remote router reports that it has no route to the destination. Not sure about Firewall since if that was the case I should receive different msg.
Just a quick thought, since you are using a Cisco AP, it doesn’t have any client-isolation or vlan filtering on it that is blocking vlan subnets from communicating does it?
Is ether6 trunk (all tagged) or hybrid (some untagged together with tagged) port?
If it’s trunk then it woukd perhaps work better if that port wasn’t member of bridge.
If it’s hybrid, I’d make it trunk by creating another VLAN, used for passing otherwise untagged traffic over trunk connections.
N.b.: VLAN id 1 is sometimes considered untagged, sometimes tagged. To avoid confusion about that, it’s better to avoid using that VLAN id and explicitly configure access ports for chosen VLAN id (different than 1).
I don’t thing so since I didn’t set up anything like that just a simple setup as far for Cisco AP
Hmmm i will have to ask my friend to check this out for me. The home Wif-Fi clients are authenticating through RADIUS server that sits under Windows Server there might be possibility since it’s default behavior that there are some rules preventing different sub-net from ping request. His problem is that some of his appliances like printers, air condition controllers are plug in to the home network which is 10.0.0.0 and he wants to be able to access those devices through that 10.0.10.0 network and now I remember one thing at one point when i was testing some stuff there was a time when i saw two clients (2 IP addresses) connected to the AP I was able to ping one but not the other and i really didn’t pay much attention to that but he mention that I should use the other one which was his computer the first one that worked was his cellphone. I will try that test again let him sign up with 2 devices aka phone and pc and then try to ping individual IP if I get through the phone then I know the problem is not on router but rather at the end device which could be the Server/PC.
Yes I was avoiding to use VLAN1 since it’s not the secure way to do things on business network. I know if I left everything to default VLAN1 I could just easily have only 2 SSID running both frequencies but since I’m not using the default VLAN1 then each radio needs to have its own SSID and vlan. Other words VLAN1 would allow me to have single SSID Home on both 2.4 and 5Ghz at the same time if that makes sense at least on cisco devices not sure about other manufacturers.
