Assistance in configuring vlan truck between RB4011 router and RB260 switch

colporteur · August 23, 2026, 12:32am

I have spent considerable time trying to configure the RB4011 router and RB260 switch to support a trunk between port 6 connected via CAT6 cable to copper media converter in SFP port.

My test is getting DHCP to be available at ports 3 & 4. I've confirmed DHCP is not working on any vlans with the expection of vlan42 it doesn't have dhcp.

The router is in a dev environment. It has internet access from 192.168.2.0/24 subnet. The switch was working just as a standalone switch on the same subnet with no vlans. It is currently running swos ver 2.18

I've made this type of configuration in August 2025 when I first started building the network. I shared some of my finding in a post in this forum. For the life of me, I can't figure out what I am doing or not doing that is preventing this from working.

I've attached parts of the router export and three screen shots for the switch. After two days off-and-on working on this with not success, I could use some help. Maybe a fresh pair of eyes will see my mistake.

# 2026-08-22 18:35:31 by RouterOS 7.20.4
# software id = 
#
# model = RB4011iGS+5HacQ2HnD
# serial number = 
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge \
    port-cost-mode=short

add comment=residence_VLAN name=bridge_VLAN vlan-filtering=yes
add comment=development_subnet name=bridge_dev

add comment="guest wifi build" name=guest-bridge
/interface wireless
set [ find default-name=wlan2 ] band=5ghz-a/n/ac comment="guest wifi build" \
    country=canada default-forwarding=no disabled=no distance=indoors \
    frequency=5720 installation=indoor mode=ap-bridge name=wlan1 ssid=\
    RRS_Guest_5G_bck wireless-protocol=802.11
set [ find default-name=wlan1 ] band=2ghz-b/g/n comment="guest wifi build" \
    country=canada default-forwarding=no disabled=no distance=indoors \
    frequency=2462 mode=ap-bridge name=wlan2 ssid=RRS_Guest_2G_bck \
    wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether10 ] comment="offbridge build" name=OFFBridge
set [ find default-name=ether1 ] comment=ISP
set [ find default-name=ether9 ] comment=res_VLAN_trunk
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no comment=\
    SP_VLAN_trunk disabled=yes speed=1G-baseT-full
/interface wireless manual-tx-power-table
set wlan1 comment="guest wifi build"
set wlan2 comment="guest wifi build"
/interface wireless nstreme
set wlan1 comment="guest wifi build"
set wlan2 comment="guest wifi build"

/interface vlan
add comment=VLAN42 interface=bridge_VLAN name=vlan42 vlan-id=42
add comment=VLAN70 interface=bridge_VLAN name=vlan70 vlan-id=70
add comment=VLAN80 interface=bridge_VLAN name=vlan80 vlan-id=80
add comment=VLAN90 interface=bridge_VLAN name=vlan90 vlan-id=90
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=5ghz-ax frequency=5180 name=5GHZ::CH36 width=20mhz
add band=5ghz-ax frequency=5200 name=5GHZ::CH40 width=20mhz
add band=5ghz-ax frequency=5220 name=5GHZ::CH44 width=20mhz
add band=5ghz-ax frequency=5240 name=5GHZ::CH48 width=20mhz
add band=5ghz-ax frequency=5745 name=5GHZ::CH149 width=20mhz
add band=5ghz-ax frequency=5765 name=5GHZ::CH153 width=20mhz
add band=5ghz-ax frequency=5785 name=5GHZ::CH157 width=20mhz
add band=5ghz-ax frequency=5805 name=5GHZ::CH161 width=20mhz
add band=5ghz-ax frequency=5825 name=5GHZ::CH165 width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5200,5220,5240 name=5GHZ::UNII-1 \
    width=20mhz
add band=5ghz-ax disabled=no frequency=5745,5765,5785,5805,5825 name=\
    5GHZ::UNII-3 width=20mhz
add band=5ghz-ax disabled=no frequency=\
    5180,5200,5220,5240,5745,5765,5785,5805,5825 name=5GHZ::NON-DFS width=\
    20mhz
add band=2ghz-ax frequency=2412 name=2GHZ::CH1 width=20mhz
add band=2ghz-ax frequency=2437 name=2GHZ::CH6 width=20mhz
add band=2ghz-ax frequency=2462 name=2GHZ::CH11 width=20mhz
add band=2ghz-ax disabled=no frequency=2412,2437,2462 name=2GHZ::AUTO width=\
    20mhz
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk comment=\
    "guest wifi build" mode=dynamic-keys supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add comment="guest wifi build" name=guest-pool ranges=\
    192.168.99.200-192.168.99.254
add comment=seedplant_subnet name="pool 70" ranges=\
    192.168.70.200-192.168.70.254
add comment=office_subnet name="pool 80" ranges=192.168.80.200-192.168.80.254
add comment=residence_subnet name="pool 90" ranges=\
    192.168.90.200-192.168.90.254
add comment="l2tp config" name=l2tp-pool ranges=192.168.50.200-192.168.50.254
add comment=development_subnet name="pool 2" ranges=\
    192.168.2.200-192.168.2.254
add name=dhcp_pool8 ranges=192.168.121.200-192.168.121.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=guest-pool comment="guest wifi build" interface=guest-bridge \
    name=guest-server
add address-pool="pool 2" comment=development_subnet interface=bridge_dev \
    name="server 2"
add address-pool="pool 90" comment=VLAN90 interface=vlan90 name=dhcp_vlan90
add address-pool="pool 70" comment=VLAN70 interface=vlan70 name=dhcp_vlan70
add address-pool="pool 80" comment=VLAN80 interface=vlan80 name=dhcp_vlan80

/port
set 0 name=serial0
set 1 name=serial1
/ppp profile

/snmp community

/system logging action
set 1 disk-file-count=3 disk-lines-per-file=4096
/certificate settings
set builtin-trust-anchors=not-trusted
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \
    path-cost=10

add bridge=guest-bridge comment="guest wifi build" interface=wlan1 \
    internal-path-cost=10 path-cost=10
add bridge=guest-bridge comment="guest wifi build" interface=wlan2 \
    internal-path-cost=10 path-cost=10
add bridge=bridge_dev comment=development_subnet interface=ether3
add bridge=bridge_VLAN comment=res_VLAN interface=ether9
add bridge=bridge_VLAN comment=off_VLAN interface=ether8
add bridge=bridge_VLAN comment=sp_VLAN interface=sfp-sfpplus1

add bridge=bridge_VLAN comment=sunroom interface=ether6
/ip neighbor discovery-settings
set discover-interface-list=none
/interface bridge vlan
add bridge=bridge_VLAN comment=VLAN90 tagged=ether9,bridge_VLAN,ether6 \
    vlan-ids=90
add bridge=bridge_VLAN comment=VLAN42 tagged=\
    ether9,sfp-sfpplus1,ether8,bridge_VLAN,ether6 vlan-ids=42
add bridge=bridge_VLAN comment=VLAN80 tagged=ether8,bridge_VLAN,ether6 \
    vlan-ids=80
add bridge=bridge_VLAN comment=VLAN70 tagged=sfp-sfpplus1,bridge_VLAN,ether6 \
    vlan-ids=70
/interface l2tp-server server
set authentication=mschap2 default-profile=l2tp-profile enabled=yes \
    use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=development_subnet interface=bridge_dev list=LAN
add interface=ether1 list=WAN
add comment=VLAN interface=bridge_VLAN list=LAN


/interface wireguard peers

/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.69.1/30 comment="offbridge build" interface=bridge \
    network=192.168.69.0
add address=192.168.99.1/24 comment="guest wifi build" interface=guest-bridge \
    network=192.168.99.0
add address=192.168.2.1/24 comment=development_subnet interface=bridge_dev \
    network=192.168.2.0

add address=192.168.90.1/24 comment=VLAN90 interface=vlan90 network=\
    192.168.90.0
add address=192.168.42.1/24 comment=VLAN42 interface=vlan42 network=\
    192.168.42.0
add address=192.168.80.1/24 comment=VLAN80 interface=vlan80 network=\
    192.168.80.0
add address=192.168.70.1/24 comment=VLAN70 interface=vlan70 network=\
    192.168.70.0

/ip cloud
set ddns-enabled=yes ddns-update-interval=1h
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.2.201 client-id=1:a0:ad:9f:87:ad:7c mac-address=\
    A0:AD:9F:87:AD:7C server="server 2"
add address=192.168.2.200 client-id=1:d4:93:90:16:5a:e8 mac-address=\
    D4:93:90:16:5A:E8 server="server 2"
add address=192.168.2.254 client-id=1:10:5a:95:c4:5a:5d mac-address=\
    10:5A:95:C4:5A:5D server="server 2"
/ip dhcp-server network
add address=192.168.2.0/24 comment=development_subnet dns-server=\
    192.168.2.199 gateway=192.168.2.1
add address=192.168.70.0/24 comment=seedplant_subnet dns-server=192.168.70.1 \
    gateway=192.168.70.1
add address=192.168.80.0/24 comment=office_subnet dns-server=192.168.80.1 \
    gateway=192.168.80.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
add address=192.168.99.0/24 comment="guest wifi build" dns-server=\
    149.112.121.20,149.112.122.20 gateway=192.168.99.1
add address=192.168.121.0/24 dns-server=149.112.121.20,149.112.122.20 \
    gateway=192.168.121.1
/ip dns
set allow-remote-requests=yes servers=149.112.121.20,149.112.122.20
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list

/ip firewall filter


/ip ipsec policy
# bad proposal
add comment=agriflow dst-address=192.168.80.0/24 peer=*2 proposal=*1 \
    src-address=192.168.2.0/24 tunnel=yes
/ip route
add comment=vlan80 disabled=no distance=1 dst-address=192.168.80.0/24 \
    gateway=wg1 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
add comment=vlan70 disabled=no distance=1 dst-address=192.168.70.0/24 \
    gateway=wg1 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
add comment=vlan90 disabled=no distance=1 dst-address=192.168.90.0/24 \
    gateway=wg1 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
add comment=vlan42 disabled=no distance=1 dst-address=192.168.42.0/24 \
    gateway=wg1 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10

/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set www-ssl certificate=
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set always-allow-password-login=yes
/ipv6 firewall filter
add action=drop chain=input comment="ipv6 removed"
add action=drop chain=forward comment="ipv6 removed"
/ppp secret

/snmp
set enabled=yes
/system clock
set time-zone-autodetect=no time-zone-name=
/system identity
set name=edgerouterbck
/system leds
add interface=wlan2 leds="wlan1_signal1-led,wlan1_signal2-led,wlan1_signal3-le\
    d,wlan1_signal4-led,wlan1_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan1_tx-led type=interface-transmit
add interface=wlan2 leds=wlan1_rx-led type=interface-receive
/system logging
add action=disk topics=critical
add action=disk topics=error
add action=disk topics=info
add action=disk topics=warning
/system ntp client
set enabled=yes
/system ntp client servers
add address=ca.pool.ntp.org
/system routerboard settings
set enter-setup-on=delete-key
/system scheduler

/tool bandwidth-server
set authenticate=no enabled=no
/tool e-mail

/tool graphing interface
add disabled=yes interface=bridge
add interface=sfp-sfpplus1
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool mac-server ping
set enabled=no

Buckeye · August 23, 2026, 3:27am

Can you explain your need for 4 bridges? It is almost certain that there is a better way than 4 bridges.

You only have two /interface list items, WAN and LAN from your defconf.

Many of your interfaces are not included in any interface list. Your vlan interfaces are not.

Your CSS106/RB260 config should look more like the example here

Tip: Configure a vlan80 access port on the RB4011, ideally on port ether5 or ether7, because those don't appear in your config. Then get dhcp working there. Then you will know that part is working without the trunk link having a possibility to be "breaking" something. Once you have that working, access ports on the CSS106/RB260 should work identiacally to the access port on the RB4011.

colporteur · August 23, 2026, 3:12pm

Thanks B for the response.

I am totally flummoxed with the CSS106/RB260 config. I have never seen or used it before. I have a CSS106 installed today with trunks and it doesn't use the configuration example. I patterned this switch after that one, thinking I would be close.

As for the router configuration, what is there may be detritus from other configurations. Ideally I should blow it away and start over. I never seem to have the time for that.

tadawson · August 23, 2026, 4:52pm

I am doing similar with CSS610 and CSS318 to an RB5009 (ROS7), and I can say for a fact that "Strict", "Only untagged" and set the correct PVID works for access ports on SwOs . . . (On my trunks, I assign the VLANs, and have "strict" and "any", since mine are hybrid . . . )

On the ROS side, I have 4 VLANs and 1 untagged, all with different IP ranges and DHCP on a single bridge and it's fully funtional. (Due to my multiple subnets, I did need to use multipls DHCP servers though - 1 per VLAN, specifically assigned to the VLAN.

As I think others have noted, if you can put a host with VLAN capability on your router trunk port (6?) and verify that all VLANs are running correctly on the trunk, that will go a long way in determining where the issue is. (For that matter, you could do the same facing the CSS to ensure that all hosts/ports can be reached as expected.)

Buckeye · August 23, 2026, 6:52pm

Unfortunately, attaching only parts does not give the whole picture. What you uploaded has a blank /ip firewall filter. If you removed that, we can's see what was there, and it may be affecting things.

If I were you, I would first make back and exports of the RB4011.

Second, I would focus on getting one vlan to work, vlan80 is probably the best to start with.

Can you be more clear about what the second sentence of your statement means?

I will assume that "expection" was a typo for "exception". When you confirmed that DHCP was not working, what was your test procedure?

Let's first configure port ether7 of the RB4011 as an access port for vlan80.

Before we do that though, let's add vlan80 to the LAN interface list

/interface list member add comment="Treat vlan80 as LAN" interface=vlan80 list=LAN

Side note: vlan80 is an interface that is sharing the physical bridge port with "bridge_VLAN", but ROS treats vlan80 and bridge_VLAN as two distict interfaces. So your entry

/interface list member add comment=VLAN interface=bridge_VLAN list=LAN

does not automatically include all the subinterfaces that use bridge_VLAN as a parent bridge port.

Now add ether7 as a bridge port as an access port for vlan 80 (set the pvid to 80, this will tell the switch chip to assign vlan 80 to untagged ingress traffic, and also to create a dynamic vlan table entry so that egress traffic out of ether5 will be sent untagged as well).

/interface bridge port add bridge=bridge_VLAN comment=vlan80_access_port interface=ether7 pvid=80

That's all you should need to do (assuming that the firewall works with LAN)

Then plug a PC configured to obtain its ip configuration with dhcp (e.g. a dhcp client) into ether7.

Does the PC get a dchp address from "pool 80"? e.g. 192.168.80.254?

Buckeye · August 23, 2026, 8:24pm

I am not sure why MikroTik doesn't have a link directly to the VLAN and VLANS section of the manual, but if you use the link above, you can scroll up to see a description of what the different options (are documented to) do. This section of the manual should be cleaned up, as it has weird values in the example screenshots (especially for the VLANs (vlan table) example. Without context and seeing the corresponding VLAN (ingress settings) screenshots, (and the screenshot under VLAN doesn't go with the VLANs screenshot; the VLAN screenshot does go with the First example (trunk and access ports), but the VLANs is not explained at all, and probably causes a lot of confusion to people trying to understand for the first time. I think the screenshots should be removed, or an different example use case should be presented.

If you can explain why you need other settings, then you may need to use other settings, but for 99% of the use cases, (unless you are sure you understand what you are doing) the following options should be used.

Use strict vlan mode. This enforces vlans and prevents vlan hopping.
Use leave-as-is for both ingress and egress. This makes the CSS106 operate like a cisco switch. The vlan specified by pvid will be untagged (an by default it will be set to pvid=1) similar to cisco native vlan or access vlan.
vlan receive is a filter for ingress traffic. If you configure an access port an want any tagged traffic to be ignored, set this to "only untagged", then only the vlan specified by default vlan id (what SwOS calls the pvid) will be allowed on the port, and only untagged traffic will be allowed in (but classified into the vlan specified by the default vlan id). Once classified into a vlan, it can exit through another port tagged or untagged, depending on the egress ports setting. E.g. in the trunk and access port example, untagged traffic received on port ether3 (an access port for vlan 200) will be classified as belonging to vlan 200. When the frame is forwarded out of port ether2 (trunk with tagged only traffic), it will have an IEEE 802.1Q tag with vlan id 200 inserted (and the CRC will be regenerated). The opposite happens when the traffic comes back, the frame received by ether2 has a tag for vlan 200; the frame is classified as vlan 200 in the switch, so it can only exit through other ports that are members of vlan 200 (the only other port in vlan 200 is ether3, and it has default vlan id 200, so when the frame is transmitted out ether3, the vlan tag is not included;(the only way to get it to tag the frame when the default vlan id matches is to use "force vlan id" on the port, and that is a special case that you will probably never encounter, so never set force vlan id, unless you really understand why). For pure trunk ports (where all data has explicit vlan tags) you would use vlan receive = only tagged. For Hybrid ports (a trunk that carries one vlan's data untagged) you must use vlan receive = any. any will "work" for all modes, access, trunk or hybrid; it just won't filter anything.

Buckeye · August 23, 2026, 10:03pm

Another option:
Make backup and full export (so you know what you had and can easily return to it if you don't like what the generator creates).
Use the tool from this thread (that I just saw) and generate your config.
Clear the config, then paste in the generated config.

I just tried it out. Couldn't add another reply, so appending it here.

Just testing out the config generator.

These were inputs

And the generated config:

Generated RB4011 Office with Vlan config

# MikroTik RouterOS v7 configuration
# Device:  RB4011iGS+RM (RB4011iGS+RM)
# Role:    Office router with VLANs
# Created: 2026-08-24 01:46 UTC with the eXtreme Hosting MikroTik Configurator
#          https://extremehosting.nl/configurator/en/mikrotik/
# Syntax:  https://manual.mikrotik.com/docs/introduction
#
# Apply on a device WITHOUT configuration (/system reset-configuration no-defaults=yes skip-backup=yes),
# with Safe Mode active (Ctrl+X in the terminal). Review every line before pasting.

/interface bridge
add name=bridge protocol-mode=rstp comment="genconf"

/interface vlan
add name=vlan42 vlan-id=42 interface=bridge comment="management"
add name=vlan70_seedplant vlan-id=70 interface=bridge
add name=vlan80_office vlan-id=80 interface=bridge
add name=vlan90_residence vlan-id=90 interface=bridge

/interface list
add name=WAN comment="genconf"
add name=LAN comment="genconf"

/interface list member
add list=WAN interface=ether1 comment="genconf"
add list=LAN interface=bridge comment="genconf"
add list=LAN interface=vlan42 comment="genconf"
add list=LAN interface=vlan70_seedplant comment="genconf"
add list=LAN interface=vlan80_office comment="genconf"
add list=LAN interface=vlan90_residence comment="genconf"

/interface bridge port
add bridge=bridge interface=ether2 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether3 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether4 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether5 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether6 comment="genconf" frame-types=admit-only-vlan-tagged ingress-filtering=yes
add bridge=bridge interface=ether7 comment="genconf" pvid=80 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether8 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether9 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether10 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=sfp-sfpplus1 comment="genconf" frame-types=admit-only-vlan-tagged ingress-filtering=yes

/interface bridge vlan
add bridge=bridge vlan-ids=42 tagged=bridge untagged=ether2,ether3,ether4,ether5,ether6,ether8,ether9,ether10,sfp-sfpplus1 comment="vlan42"
add bridge=bridge vlan-ids=70 tagged=bridge comment="vlan70_seedplant"
add bridge=bridge vlan-ids=80 tagged=bridge untagged=ether7 comment="vlan80_office"
add bridge=bridge vlan-ids=90 tagged=bridge comment="vlan90_residence"

/interface bridge
set bridge vlan-filtering=yes

/ip pool
add name=pool-vlan70_seedplant ranges=192.168.70.10-192.168.70.254
add name=pool-vlan80_office ranges=192.168.80.10-192.168.80.254
add name=pool-vlan90_residence ranges=192.168.90.10-192.168.90.254

/ip dhcp-server
add name=dhcp-vlan70_seedplant interface=vlan70_seedplant address-pool=pool-vlan70_seedplant lease-time=1d
add name=dhcp-vlan80_office interface=vlan80_office address-pool=pool-vlan80_office lease-time=1d
add name=dhcp-vlan90_residence interface=vlan90_residence address-pool=pool-vlan90_residence lease-time=1d

/ip dhcp-server network
add address=192.168.70.0/24 gateway=192.168.70.1 dns-server=192.168.70.1 comment="vlan70_seedplant"
add address=192.168.80.0/24 gateway=192.168.80.1 dns-server=192.168.80.1 comment="vlan80_office"
add address=192.168.90.0/24 gateway=192.168.90.1 dns-server=192.168.90.1 comment="vlan90_residence"

/ip dhcp-client
add interface=ether1 add-default-route=yes default-route-distance=1 use-peer-dns=yes use-peer-ntp=no comment="WAN1"

/ip address
add address=192.168.42.1/24 interface=vlan42 comment="vlan42"
add address=192.168.70.1/24 interface=vlan70_seedplant comment="vlan70_seedplant"
add address=192.168.80.1/24 interface=vlan80_office comment="vlan80_office"
add address=192.168.90.1/24 interface=vlan90_residence comment="vlan90_residence"

/ipv6 settings
set disable-ipv6=no accept-router-advertisements=no

/ipv6 dhcp-client
add interface=ether1 request=prefix pool-name=ipv6-pool pool-prefix-length=64 prefix-hint=::/56 add-default-route=yes use-peer-dns=no comment="IPv6 prefix delegation"

/ipv6 address
add address=::1/64 from-pool=ipv6-pool interface=bridge advertise=yes comment="bridge"
add address=::1/64 from-pool=ipv6-pool interface=vlan42 advertise=yes comment="vlan42"
add address=::1/64 from-pool=ipv6-pool interface=vlan70_seedplant advertise=yes comment="vlan70_seedplant"
add address=::1/64 from-pool=ipv6-pool interface=vlan80_office advertise=yes comment="vlan80_office"
add address=::1/64 from-pool=ipv6-pool interface=vlan90_residence advertise=yes comment="vlan90_residence"

/ipv6 nd
set [ find default=yes ] interface=all advertise-dns=self managed-address-configuration=no other-configuration=no

/ip dns
set allow-remote-requests=yes cache-size=4096 servers=9.9.9.9,149.112.112.112

/ip firewall address-list
add list=bad_ipv4 address=127.0.0.0/8 comment="genconf: RFC6890"
add list=bad_ipv4 address=192.0.0.0/24 comment="genconf: RFC6890"
add list=bad_ipv4 address=192.0.2.0/24 comment="genconf: RFC6890 documentation"
add list=bad_ipv4 address=198.51.100.0/24 comment="genconf: RFC6890 documentation"
add list=bad_ipv4 address=203.0.113.0/24 comment="genconf: RFC6890 documentation"
add list=bad_ipv4 address=240.0.0.0/4 comment="genconf: RFC6890 reserved"
add list=not_global_ipv4 address=0.0.0.0/8 comment="genconf: RFC6890"
add list=not_global_ipv4 address=10.0.0.0/8 comment="genconf: RFC6890"
add list=not_global_ipv4 address=100.64.0.0/10 comment="genconf: RFC6890"
add list=not_global_ipv4 address=169.254.0.0/16 comment="genconf: RFC6890"
add list=not_global_ipv4 address=172.16.0.0/12 comment="genconf: RFC6890"
add list=not_global_ipv4 address=192.0.0.0/29 comment="genconf: RFC6890"
add list=not_global_ipv4 address=192.168.0.0/16 comment="genconf: RFC6890"
add list=not_global_ipv4 address=198.18.0.0/15 comment="genconf: RFC6890 benchmark"
add list=not_global_ipv4 address=255.255.255.255/32 comment="genconf: RFC6890"
add list=bad_src_ipv4 address=224.0.0.0/4 comment="genconf: multicast"
add list=bad_src_ipv4 address=255.255.255.255/32 comment="genconf: RFC6890"
add list=bad_dst_ipv4 address=0.0.0.0/8 comment="genconf: RFC6890"
add list=bad_dst_ipv4 address=224.0.0.0/4 comment="genconf: RFC6890"

/ip firewall raw
add action=accept chain=prerouting comment="genconf: accept DHCP discover" dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=udp src-address=0.0.0.0 src-port=68
add action=drop chain=prerouting comment="genconf: drop bogon IP's" src-address-list=bad_ipv4
add action=drop chain=prerouting comment="genconf: drop bogon IP's" dst-address-list=bad_ipv4
add action=drop chain=prerouting comment="genconf: drop bogon IP's" src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="genconf: drop bogon IP's" dst-address-list=bad_dst_ipv4
add action=drop chain=prerouting comment="genconf: drop non global from WAN" src-address-list=not_global_ipv4 in-interface-list=WAN
add action=drop chain=prerouting comment="genconf: drop bad UDP" port=0 protocol=udp

/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="genconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="genconf: drop invalid"
add action=drop chain=input comment="Bruteforce: drop blacklisted" protocol=tcp dst-port=22,8291 src-address-list=bruteforce_blacklist
add action=add-src-to-address-list address-list=bruteforce_blacklist address-list-timeout=1d chain=input comment="Blacklist" connection-state=new dst-port=22,8291 protocol=tcp src-address-list=connection3
add action=add-src-to-address-list address-list=connection3 address-list-timeout=1h chain=input comment="Third attempt" connection-state=new dst-port=22,8291 protocol=tcp src-address-list=connection2
add action=add-src-to-address-list address-list=connection2 address-list-timeout=15m chain=input comment="Second attempt" connection-state=new dst-port=22,8291 protocol=tcp src-address-list=connection1
add action=add-src-to-address-list address-list=connection1 address-list-timeout=5m chain=input comment="First attempt" connection-state=new dst-port=22,8291 protocol=tcp
add chain=input action=accept protocol=icmp comment="genconf: accept ICMP"
add chain=input action=accept dst-address=127.0.0.1 comment="genconf: accept to local loopback (for CAPsMAN)"
add chain=input action=drop protocol=udp dst-port=53 in-interface-list=WAN comment="drop DNS from WAN (no open resolver)"
add chain=input action=drop protocol=tcp dst-port=53 in-interface-list=WAN comment="drop DNS from WAN (no open resolver)"
add chain=input action=drop in-interface-list=!LAN comment="genconf: drop all not coming from LAN"
add chain=forward action=accept ipsec-policy=in,ipsec comment="genconf: accept in ipsec policy"
add chain=forward action=accept ipsec-policy=out,ipsec comment="genconf: accept out ipsec policy"
add chain=forward action=fasttrack-connection connection-state=established,related hw-offload=yes comment="genconf: fasttrack"
add chain=forward action=accept connection-state=established,related,untracked comment="genconf: accept established,related, untracked"
add chain=forward action=drop connection-state=invalid comment="genconf: drop invalid"
add chain=forward action=drop in-interface=vlan42 out-interface-list=WAN comment="vlan42: no internet"
add chain=forward action=drop in-interface=vlan70_seedplant out-interface-list=!WAN connection-state=new comment="isolate vlan70_seedplant: internet only"
add chain=forward action=drop in-interface=vlan80_office out-interface-list=!WAN connection-state=new comment="isolate vlan80_office: internet only"
add chain=forward action=drop in-interface=vlan90_residence out-interface-list=!WAN connection-state=new comment="isolate vlan90_residence: internet only"
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="genconf: drop all from WAN not DSTNATed"

/ip firewall nat
add chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none comment="genconf: masquerade"

/ipv6 firewall address-list
add list=bad_ipv6 address=::/128 comment="genconf: unspecified address"
add list=bad_ipv6 address=::1/128 comment="genconf: lo"
add list=bad_ipv6 address=fec0::/10 comment="genconf: site-local"
add list=bad_ipv6 address=::ffff:0.0.0.0/96 comment="genconf: ipv4-mapped"
add list=bad_ipv6 address=::/96 comment="genconf: ipv4 compat"
add list=bad_ipv6 address=100::/64 comment="genconf: discard only"
add list=bad_ipv6 address=2001:db8::/32 comment="genconf: documentation"
add list=bad_ipv6 address=2001:10::/28 comment="genconf: ORCHID"
add list=bad_ipv6 address=3ffe::/16 comment="genconf: 6bone"

/ipv6 firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="genconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="genconf: drop invalid"
add chain=input action=accept protocol=icmpv6 comment="genconf: accept ICMPv6"
add chain=input action=accept protocol=udp port=33434-33534 comment="genconf: accept UDP traceroute"
add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/10 comment="genconf: accept DHCPv6-Client prefix delegation."
add chain=input action=accept protocol=udp dst-port=500,4500 comment="genconf: accept IKE"
add chain=input action=accept protocol=ipsec-ah comment="genconf: accept ipsec AH"
add chain=input action=accept protocol=ipsec-esp comment="genconf: accept ipsec ESP"
add chain=input action=accept ipsec-policy=in,ipsec comment="genconf: accept all that matches ipsec policy"
add chain=input action=drop in-interface-list=!LAN comment="genconf: drop everything else not coming from LAN"
add chain=forward action=accept connection-state=established,related,untracked comment="genconf: accept established,related,untracked"
add chain=forward action=drop connection-state=invalid comment="genconf: drop invalid"
add chain=forward action=drop src-address-list=bad_ipv6 comment="genconf: drop packets with bad src ipv6"
add chain=forward action=drop dst-address-list=bad_ipv6 comment="genconf: drop packets with bad dst ipv6"
add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="genconf: rfc4890 drop hop-limit=1"
add chain=forward action=accept protocol=icmpv6 comment="genconf: accept ICMPv6"
add chain=forward action=accept protocol=139 comment="genconf: accept HIP"
add chain=forward action=accept protocol=udp dst-port=500,4500 comment="genconf: accept IKE"
add chain=forward action=accept protocol=ipsec-ah comment="genconf: accept ipsec AH"
add chain=forward action=accept protocol=ipsec-esp comment="genconf: accept ipsec ESP"
add chain=forward action=accept ipsec-policy=in,ipsec comment="genconf: accept all that matches ipsec policy"
add chain=forward action=drop in-interface=vlan70_seedplant out-interface-list=!WAN comment="isolate vlan70_seedplant (IPv6)"
add chain=forward action=drop in-interface=vlan80_office out-interface-list=!WAN comment="isolate vlan80_office (IPv6)"
add chain=forward action=drop in-interface=vlan90_residence out-interface-list=!WAN comment="isolate vlan90_residence (IPv6)"
add chain=forward action=drop in-interface-list=!LAN comment="genconf: drop everything else not coming from LAN"

/system clock
set time-zone-name=Europe/Amsterdam time-zone-autodetect=no

/system ntp client
set enabled=yes mode=unicast servers=nl.pool.ntp.org,time.cloudflare.com

/system package update
set channel=stable

/system routerboard settings
set auto-upgrade=yes

/ip service
set winbox disabled=no address=192.168.42.0/24
set ssh disabled=no address=192.168.42.0/24
set www disabled=yes
set www-ssl disabled=yes
set api disabled=yes
set api-ssl disabled=yes
set ftp disabled=yes
set telnet disabled=yes

/ip ssh
set strong-crypto=yes

/tool mac-server
set allowed-interface-list=none

/tool mac-server mac-winbox
set allowed-interface-list=LAN

/tool mac-server ping
set enabled=no

/ip neighbor discovery-settings
set discover-interface-list=LAN

/tool bandwidth-server
set enabled=no

/system identity
set name=RB4011iGS-RM

/user
set admin

rextended · August 24, 2026, 11:17am

vlan truck

mkx · August 24, 2026, 3:48pm

trunk ... truck ... small difference for people who are neither lumberjacks nor drivers

rextended · August 24, 2026, 3:56pm

V.L.A.N. (Vehicle Logistics Asset Network) Trucks

colporteur · August 24, 2026, 11:44pm

Thanks for pointing it out. I found my trunk truck error in the body of the message before posting but didn't pick up the subject line.

colporteur · August 25, 2026, 12:27am

I made some really bad assumption of my first post. I thought my issue was small and someone would point out the mistake and I could move on. No such luck. I've invested more time and still don't have an answer.

I have refreshed the drawing to replace the RB4011 with a RB750Gr3. The RB4011 has a number of fingers in it. Explaining away all the configurations would be time consuming and take away from my focus of getting VLANs supported on an RB260GS. So to that end I unpacked a hex router from a box and started fresh.

I followed Buckeyes suggestion of working my way up by getting VLAN access ports to work and then work on the the trunk (spelt that right this time).

The router has no firewall filter rules, doesn't need them since it will never see production.. I'm using it as a source to generate the VLANs for the testing of the RB260.

Another eight hour day of trying different configurations and still no success. Success being getting DHCP IP's at the ports on the switch. Attached is the router configuration and the switch screen shot.

# 2026-08-24 19:13:45 by RouterOS 7.24
# software id =
#
# model = RB750Gr3
# serial number = 
/interface bridge
add name=bridge_LAN port-cost-mode=short
add comment="VLAN42 VLAN70 VLAN80" name=bridge_VLAN protocol-mode=stp vlan-filtering=yes
/interface vlan
add comment=VLAN42 interface=bridge_VLAN name=vlan42 vlan-id=42
add comment=VLAN70 interface=bridge_VLAN name=vlan70 vlan-id=70
add comment=VLAN80 interface=bridge_VLAN name=vlan80 vlan-id=80
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/ip pool
add name=dhcp_pool0 ranges=192.168.88.200-192.168.88.254
add name=dhcp_pool_vlan70 ranges=192.168.70.100-192.168.70.254
add name=dhcp_pool_vlan80 ranges=192.168.80.100-192.168.80.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=bridge_LAN name=dhcp1
add address-pool=dhcp_pool_vlan70 comment="VLAN70 DHCP server" interface=vlan70 name=dhcp_vlan70
add address-pool=dhcp_pool_vlan80 comment="VLAN80 DHCP server" interface=vlan80 name=dhcp_vlan80
/interface bridge port
add bridge=bridge_VLAN frame-types=admit-only-untagged-and-priority-tagged interface=ether2 internal-path-cost=10 path-cost=10 \
    pvid=70
add bridge=bridge_VLAN frame-types=admit-only-untagged-and-priority-tagged interface=ether3 internal-path-cost=10 path-cost=10 \
    pvid=80
add bridge=bridge_VLAN interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge_LAN ingress-filtering=no interface=ether5 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ipv6 settings
set max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge_VLAN comment="VLAN42 tagged trunk" tagged=bridge_VLAN,ether4 vlan-ids=42
add bridge=bridge_VLAN comment="VLAN70 access ether2 and tagged trunk" tagged=bridge_VLAN,ether4 untagged=ether2 vlan-ids=70
add bridge=bridge_VLAN comment="VLAN80 access ether3 and tagged trunk" tagged=bridge_VLAN,ether4 untagged=ether3 vlan-ids=80
/interface ovpn-server server
add auth=sha1,md5 mac-address="" name=ovpn-server1
/ip address
add address=192.168.88.1/24 interface=bridge_LAN network=192.168.88.0
add address=192.168.42.1/24 comment="VLAN42 gateway" interface=vlan42 network=192.168.42.0
add address=192.168.70.1/24 comment="VLAN70 gateway" interface=vlan70 network=192.168.70.0
add address=192.168.80.1/24 comment="VLAN80 gateway" interface=vlan80 network=192.168.80.0
/ip dhcp-client
add interface=ether1 name=ether1
/ip dhcp-server network
add address=192.168.70.0/24 comment="VLAN70 DHCP network" dns-server=149.112.121.20,149.112.122.20 gateway=192.168.70.1
add address=192.168.80.0/24 comment="VLAN80 DHCP network" dns-server=149.112.121.20,149.112.122.20 gateway=192.168.80.1
add address=192.168.88.0/24 dns-server=149.112.121.20,149.112.122.20 gateway=192.168.88.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
set reverse-proxy disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=""
/system identity
set name=RouterOS

I tried Buckeyes SWOS VLAN configuration suggestion from the manual.

It didn't work.

I do get VLAN IP's at the router access points. I plugged a windows 11 pro laptop into the access ports. VLAN70 provides a 192.168.70/24 IP and VLAN80 provides a 192.168.80.0/24 IP. The DHCP time to actually get an IP to appear on the laptop is almost a minute of waiting. Not sure of that. DHCP should be fairly fast but not in this case.

I turned my focus to the trunk and had no success with that. I don't get any IP's and even manually assigning IP to hosts connected to ports doesn't work.

I did the basics, confirmed lights on ports become active. The switch did work without VLANS before I started.

tadawson · August 25, 2026, 1:30am

What can you connect to if you put a system on port ether4 of the router?

I also don't see ether4 ever being assigned to bridge_VLAN, upon which the VLANs are defined (or I am blind . . . )

Buckeye · August 25, 2026, 4:18am

It's there (at least as of now)

colporteur:

/interface bridge port
add bridge=bridge_VLAN frame-types=admit-only-untagged-and-priority-tagged interface=ether2 internal-path-cost=10 path-cost=10 \
    pvid=70
add bridge=bridge_VLAN frame-types=admit-only-untagged-and-priority-tagged interface=ether3 internal-path-cost=10 path-cost=10 \
    pvid=80
add bridge=bridge_VLAN interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge_LAN ingress-filtering=no interface=ether5 internal-path-cost=10 path-cost=10
...
/interface bridge vlan
add bridge=bridge_VLAN comment="VLAN42 tagged trunk" tagged=bridge_VLAN,ether4 vlan-ids=42
add bridge=bridge_VLAN comment="VLAN70 access ether2 and tagged trunk" tagged=bridge_VLAN,ether4 untagged=ether2 vlan-ids=70
add bridge=bridge_VLAN comment="VLAN80 access ether3 and tagged trunk" tagged=bridge_VLAN,ether4 untagged=ether3 vlan-ids=80

Buckeye · August 25, 2026, 4:23am

Can you post output of the following commands on the RB750Gr3?

/interface/bridge/print
/interface/bridge/port/print
/interface/bridge/vlan/print

Also on the CSS106/RB260 if you click on the HOST tab, do you see any hosts in vlan70 or vlan80? If you plug a pc into for example port 1 of the RB260GS, do you see the pc's mac address show up in the host (mac address table) of the RB260GS under port 1 with vlan 70? If you then move the cable from the PC to port 4 of the RB260GS, does the mac address move to port 4 and vlan 80?

While on the RB260GS, click on the upgrade tab. What version of SwOS is loaded?

I keep editing this post because the forum software will only allow two consecutive posts in the same thread (to prevent spamming).

Another thing to try. On the RB260GS, set port 3 (currently unused) the same as the SFP port. Then connect a standard patch cable between Port 4 of the RB750Gr3 and port 3 of the RB260GS. This is just to eliminate the possibility of the SFP module and media converter from changing the behavior.

What type of SPF is in the RB260GS (post output of the SFP tab on the RB260GS). If it is a fiber SFP, what type of media converter are you using on the RB750Gr3 ether4 port? Is it vlan transparent?

tadawson · August 25, 2026, 4:26am

Sadly, I think my brain had mapped it to ether6 when I wrote that. Oops . . .

In any case, you should ensure that you can access all VLANs on the trunk before evel looking at the switch.

Also, I'd try just using "admit all" or "admit only VLAN tagged" . . . not sure if the "priority" might be stepping on things.

(I see folks using excess options here break things frequently . . . I suggest setting as little as needed, and using the defaults until the basics work . . . )

All I use on my trunk from ROS 7.x is:

interface bridge port
add bridge=bridge comment=defconf interface=sfp-sfpplus1

interface bridge vlan
add bridge=bridge comment="Lab 101 (VLAN 12)" tagged=ether8,bridge,sfp-sfpplus1 vlan-ids=12
add bridge=bridge comment="Wireless 10 (VLAN13)" tagged=ether8,bridge,sfp-sfpplus1 vlan-ids=13
add bridge=bridge comment="Internet 150 (VLAN 14)" tagged=ether8,bridge,sfp-sfpplus1 vlan-ids=14
add bridge=bridge comment="Test Equipment 30 (VLAN 15)" tagged=ether8,bridge,sfp-sfpplus1 vlan-ids=15

interface vlan
add comment="Internet 120 (VLAN 14)" interface=bridge name="Internet 120" vlan-id=14
add comment="Lab 101 Subnet (VLAN 12)" interface=bridge name=Lab_101 vlan-id=12
add comment="Test Equipment 30 (VLAN 15)" interface=bridge name=Test_30 vlan-id=15
add comment="Wireless 10 (VLAN 13)" interface=bridge name=Wireless_10 vlan-id=13

All VLANs are in interface list LAN, and a dhcp server is added per VLAN.

(PVID 1 is my default on all ports, so not in the export)

This feeds multips CSS switches with sililar fan-out to what younare attempting without fail.

Buckeye · August 25, 2026, 4:32am

You can edit your posts. And the title can be edited too, just hover over the title, and a "pencil" icon will appear at the right of the title.

Buckeye · August 25, 2026, 4:43am

I agree with use defaults unless you understand the reason for changing. I.e. don't just do it because someone recommeded it (without an explanation as to why it it should be changed, or what the side effects of the change will be).

There are several things in the RB750Gr3 config that look like leftovers.

Back up and copy the backup (and exported .rsc) off to another device. Then reset as start from a clean slate (defconf is ok, and for most people, I recommend that over an empty config). Once you have your export and backup (backup will get your device back to the state it is in at time of backup, assuming you have the same router and the same version of ROS loaded). The first time you do this, it is a bit scary, especially if you have spent a lot of time creating the config. Because it does warn you that the reset is going to discard your current config, and reset to the factory default.

[demo@MikroTik] > /system/reset-configuration keep-users=yes skip-backup=yes
Dangerous! Reset anyway? [y/N]:

colporteur · August 25, 2026, 5:57pm

Noooooooooooooooo! YES...your suggestion led to the solution. A 10G media converters was in the box with 1G. What are the chances I pull the wrong one?

My test to see the switch was working without vlans didn't include the media converter. I just plugged it into the network and confirmed it worked.

After another long session of trying to find a working configuration and failing, I took a break and examined posted comments. I started to step through your list and found the mix up. Once replaced and auto negotiate turned on, VLANs appeared on the switch.

I am using my switch setup and not the one in the manual. I'm going to go back and make changes to use that.

Much thanks for your assistance. A rookie mistake that took a fresh pair of eyes to resolve. How do I mark this post as complete so no one else spends time on it.

colporteur · August 25, 2026, 6:08pm

More details I discovered as I went to order additional media converters. The S+RJ10 are only for SFP+ plus ports. The RB260 is an SFP port. Not compatible!