Basic VLAN Access Port

RouterOS Beginner Basics
1

I have an RB750GRr3 that I’m trying to set up as a beginner router for my home lab (just getting started here).

I’ve been looking at this thing on and off for about a month, running little experiments to learn how to configure it.

Presently, I’m trying to set up a VLAN access port on eth5, and leaving everything else with factory presets.

I’ve been able to set up a DHCP server for the VLAN. I can connect to the router on eth5, and I get an address, but that’s where the fun stops.

I’ve given the VLAN interface an IP address, and I was assuming that I’d be able to ping it, but I can’t get that to work. The error message I get from ping is “Destination Host Unreachable”.

My most recent attempt was to remove all firewall settings, with just a minimal configuration. This didn’t work either.

Could someone please give me some advice? I’m at a loss for what configuration changes are needed.

Thanks for your time!
removed-firewall.rsc (2.04 KB)

2

Hello,if you want to create access port you need to untag desired port, not set it to tagged as you did here. ROS will automatically untag you desired port with PVID you set.

Also your pool starts with 192.168.0.30 and ends with 192.168.30.100. That is not possible with CIDR of 24. Probably just a typo.

One small piece of advice, if you go VLANs go VLANs all the way.

What IP address do you get ? Error you are getting means there is no route to desired destination.

3

You currently have:

/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5 pvid=100

/interface bridge vlan
add bridge=bridge tagged=bridge,ether4,ether5 vlan-ids=100

As @gigabyte091 stated, if you want an access port for vlan 100 on ether5, you need to change the /interface bridge vlan section to

/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=100

or as @anav would suggest (to make your intentions clear)

/interface bridge vlan
add bridge=bridge tagged=bridge untagged=ether5 vlan-ids=100

I removed ether4 because you stated that everything else as default config.

An as @gigabyte091 you need to change

/ip pool
…
add name=MGMT_POOL ranges=192.168.0.30-192.168.30.100

to

add name=MGMT_POOL ranges=192.168.30.30-192.168.30.100

4

Thank you for the replies! This was very helpful. As everyone says, the dhcp pool range was indeed a type-o. Though I swear that I really did get an IP address.

The tagged / untagged suggestion was spot on! After making this small change, I was able to connect, and ping the MGMT_VLAN:

/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=100

The configuration I initially tried was based of of the router on a stick example in this thread.

I’m clearly having some trouble understanding some of the fundamental concepts here. I started by trying to connect the router to my switch with trunking. After running into problems, I tried isolating the configuration just to the router.

Now that I have a working example for VLAN access ports, I’ll go back to trying to connect the router and switch via trunking.

5

Baby steps is my advice, so get VLANs to work on your router without any trunking.

When you see that it’s working and most importantly, you know why it’s working then go to the next step.

6

Again, I agree with what @gigabyte091 said, especially the importance of understanding why things work.

Confidence comes with understanding, so start there.

Do you have any previous experience with tagged vlans? If not, I like Ed Harmoush’s vlan explanations. If you need a review of Networking Fundamentals, Ed’s free course on youtube that is well worth going through, even if you do have some networking experience. If you have trouble understanding what is in Virtual Local Area Networks (VLANs), then I recommend going through the Networking Fundamentals: How data moves through the Internet youtube series first, because understanding vlans assumes you understand how LANs work.

Once you understand the above background info, then you will have a better chance in understanding the MikroTik specific stuff, which you can find on youtube as well.

But there is no substitute for actually trying things on real router in a lab situation, where you can make mistakes without taking down your working network. You will learn more when things don’t work the first time, and you have to try to figure out why they are not working. This is where having some theoretical background can give you guidance on what is the more likely cause of the symptoms you are seeing.