I think I’ve managed to set up VLAN 10 on trunk port ether8, to which I have connected a wireless access point that tags a specific network with VLAN ID 10. I’m able to connect to it and get an IP in the 10.0.10.x range. If I connect to another wireless network that has VLAN ID 11, I don’t get an IP (which is expected since VLAN 11 is not configured on the router).
The (apparently working) config is:
/interface bridge
add name=switches vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no speed=1Gbps
/interface vlan
add interface=ether8 name=vlan10 vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=local ranges=10.0.0.10-10.0.0.254
add name=vlan10 ranges=10.0.10.2-10.0.10.254
/ip dhcp-server
add address-pool=local interface=local name=local
add address-pool=vlan10 interface=vlan10 name=vlan10
/interface bridge port
add bridge=local comment=defconf ingress-filtering=no interface=ether2
add bridge=local comment=defconf ingress-filtering=no interface=ether3
add bridge=local comment=defconf ingress-filtering=no interface=ether4
add bridge=local comment=defconf ingress-filtering=no interface=ether5
add bridge=local comment=defconf ingress-filtering=no interface=ether6
add bridge=switches disabled=yes frame-types=admit-only-untagged-and-priority-tagged interface=ether7 pvid=10
add bridge=switches ingress-filtering=no interface=ether8
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface bridge vlan
add bridge=switches tagged=ether8 untagged=ether7 vlan-ids=10
/interface list member
add comment=defconf interface=local list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=10.0.0.1/24 interface=local network=10.0.0.0
add address=10.0.10.1/24 interface=vlan10 network=10.0.10.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=10.0.0.0/24 comment=defconf dns-server=10.0.0.1 gateway=10.0.0.1 netmask=24
add address=10.0.10.0/24 comment=vlan10 dns-server=10.0.10.1 gateway=10.0.10.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=10.0.0.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
However, when I change the interface that vlan10 is on from ether8 to “switches” (my bridge is called that), I am no longer able to get an IP after connecting to the network.
The client’s MAC shows up under Bridge > Hosts with VID 10. It didn’t previously show up here before the vlan interface change, which makes sense since it only lists bridges.
Some things I’m confused about:
I don’t understand why the above change leads to different behavior. “switches” is a bridge with only ether8. Shouldn’t I be able to connect and get an IP like when the vlan interface was set to ether8?
If you have VLAN interface on bridge, that bridge must be listed as tagged interface, i.e. tagged=switches,ether8 instead of your tagged=ether8.
You need VLAN interface only when router itself needs to access that VLAN. If for some VLANs it works only as managed switch and doesn’t otherwise interact with other devices in them, it doesn’t need VLAN interfaces for them.
You can’t. So if you want to, you need VLAN interface for that VLAN.
VLAN 1000 has a pure access port (ether3) and a hybrid port (ether8). The entry in
/interface bridge port
already specifies
pvid=1000
. ether3 and ether8 both show up under “Current Untagged” in Bridge > VLANs, so I’m curious if there is any reason to specify them explicitly as untagged in the
Technically you don’t have to specify untagged ports under /interface bridge vlan. Only reason to do so is to make configuration export of that section more readable … but it makes changing also more error prone as you have to change things in two places.
I disagree, the ability to physically map (see and check off on a paper copy of the config or on the screen, between Bridge Ports and Bridge vlans, especially for troubleshooting issues, is better accomplished with manually entering the untagged entries IMHO.
Its up to you though, and I am one of the rare folks that espouses this as I am not professionally trained and thus can relate better to the new user.
If you are comfortable and understand how they work, as you clearly do, not required.
