Hi,
I am a bit new to mikrotik and especially to VLANs. I already read a few topic about mikrotik vlans but i am sill struggling..
I would like to install some IP cameras but due to their nature I would like to isolate them from the internet, and from devices on the network. Obviously except for the nvr.
My setup would look like this:
ether1: WAN
ether2: a default lan where all my trusted devices go, via a simple plain old switch pc, phone etc. [access to ether3, internet, access to the default lan]
ether3: dedicated port for an nvr [VLAN200: access to ether4, internet, access to the default lan]
ether4: cameras would go here also via a switch [VLAN100: access to ether3, no internet, optional but would be great: no access to the default lan]
ether5: connection to a another mikrotik functioning as a cap for wifi extension, also should be part of the default lan [access to ether3, internet, access to the default lan]
I have managed to setup the VLANs, but my problem is that I can not communicate between them, I can ping each vlans own gateway but can not ping any other device, gateway located on different vlan.
My question would be: how could I achieve inter VLAN communication, but with restrictions…
Also a another question do I need 3 vlans or it is achievable with only 2? (one for the nvr, one for the cameras)
Thanks!
Here is my config: (sorry it is not pretty i have been trying all sorts of things without luck..)
# 1970-01-02 03:48:57 by RouterOS 7.15.1
#
#
# model = RB951Ui-2HnD
/interface bridge
add ageing-time=10s name=bridge1 vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
/interface pppoe-client
add add-default-route=yes interface=ether1 name=pppoe-out1 use-peer-dns=yes
/interface vlan
add interface=bridge1 name=vlan1 vlan-id=10
add interface=bridge1 name=vlan100_Iso vlan-id=100
add interface=bridge1 name=vlan200_Control vlan-id=200
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool3 ranges=192.168.88.2-192.168.88.254
add name=pool_VLAN100 ranges=192.168.100.10-192.168.100.200
add name=pool_VLAN200 ranges=192.168.200.10-192.168.200.200
/ip dhcp-server
add address-pool=pool3 interface=vlan1 name=dhcp1
add address-pool=pool_VLAN100 interface=vlan100_Iso name=dhcp_VLAN100
add address-pool=pool_VLAN200 interface=vlan200_Control name=dhcp_VLAN200
/interface bridge port
add bridge=bridge1 interface=ether2 pvid=10
add bridge=bridge1 interface=ether3 pvid=200
add bridge=bridge1 interface=ether4 pvid=100
add bridge=bridge1 interface=ether5 pvid=10
/interface bridge settings
set use-ip-firewall=yes
/interface bridge vlan
add bridge=bridge1 tagged=bridge1 untagged=ether3 vlan-ids=200
add bridge=bridge1 tagged=bridge1 untagged=ether4 vlan-ids=100
add bridge=bridge1 tagged=bridge1 untagged=ether2,ether5 vlan-ids=10
/ip address
add address=192.168.88.1/24 comment="Normal LAN" interface=vlan1 network=\
192.168.88.0
add address=192.168.100.1/24 comment="Isolated VLAN100 " interface=vlan100_Iso \
network=192.168.100.0
add address=192.168.200.1/24 comment="VLAN200 " interface=vlan200_Control \
network=192.168.200.0
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.88.1
add address=192.168.100.0/24 dns-none=yes gateway=192.168.100.1
add address=192.168.200.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.200.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment="accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
# pppoe-out1 not ready
add action=accept chain=input comment="accept ICMP" in-interface=pppoe-out1 \
limit=5,10:packet protocol=icmp
# pppoe-out1 not ready
add action=drop chain=input comment="block everything else" in-interface=\
pppoe-out1
add action=fasttrack-connection chain=forward comment=\
"fast-track for established,related" connection-state=established,related \
hw-offload=yes
add action=accept chain=forward comment="accept established,related" \
connection-state=established,related
add action=drop chain=forward connection-state=invalid
# pppoe-out1 not ready
add action=drop chain=forward comment=\
"drop access to clients behind NAT from WAN" connection-nat-state=!dstnat \
connection-state=new in-interface=pppoe-out1
add action=accept chain=forward comment="Control -> Isolated" in-interface=\
vlan200_Control out-interface=vlan100_Iso
add action=accept chain=forward in-interface=vlan100_Iso out-interface=\
vlan200_Control
add action=drop chain=forward comment="Drop all except Isolated -> Control" \
disabled=yes in-interface=vlan100_Iso out-interface=!vlan200_Control
add action=drop chain=forward comment="Block Dial Out for Isolated" disabled=\
yes in-interface=vlan100_Iso out-interface=pppoe-out1
/ip firewall nat
# no interface
add action=masquerade chain=srcnat out-interface=pppoe-out1
/system note
set show-at-login=no
/system ntp server
set broadcast=yes enabled=yes manycast=yes multicast=yes