bridged vlan & leaking discovery question

[Buckeye]

Site A (Router 1)
eoip-tunnel to Router 2, bridged to bridge_lan

Site B (Router 2)
eoip-tunnel to Router 1, also bridged to bridge_lan, but with also the following additional config:

/interface bridge set bridge_lan vlan-filtering=yes
/interface bridge port add bridge=bridge_lan interface=eoip-router1 pvid=1234
/interface bridge vlan add bridge=bridge_lan tagged=bridge_lan,ether5_lan untagged=eoip-router1 vlan-ids=1234

The intention is that any device now plugged into ether5_lan of Router 2, will still only see untagged traffic from its own site (Site B) by default, but can now optionally be on Site A instead, using vlan1234. And that seems to work fine, as expected

However the problem comes in if I plug a Windows PC on ether5_lan @ Site B. For some reason, it can also “discover” all Mikrotik devices which are on Site A’s bridge_lan with winbox discovery (“Neighbors”) section.

So my question is, howcome is discovery of devices from Site A leaking through the VLAN @ Site B like this and how can I block/overcome this “cross-vlan” layer-2 traffic? I don’t want Site A devices to be visible on untagged LAN @ Site B which seems to be the case right now

Are you saying that a windows PC with “standard” settings is seeing the tagged vlans, or did you go into driver properties and set it to have an second interface for vlan 10?

The “normal way” to do this would be to decouple the vlans at site B. E.g. have an access lan for the Site A vlan (an untagged access port, say ether5) and then when you plugged into ether5, you would “be” on the remote LAN at site A. If you plugged into ether1 through ether4 you would be on the local LAN at site B.

Something like:

/interface bridge add bridge_lan vlan-filtering=yes pvid=1
/interface bridge port add bridge=bridge_lan frame-types=admit-only-untagged-and-priority-tagged interface=ether1_lan pvid=1
/interface bridge port add bridge=bridge_lan frame-types=admit-only-untagged-and-priority-tagged interface=ether2_lan pvid=1
/interface bridge port add bridge=bridge_lan frame-types=admit-only-untagged-and-priority-tagged interface=ether3_lan pvid=1
/interface bridge port add bridge=bridge_lan frame-types=admit-only-untagged-and-priority-tagged interface=ether4_lan pvid=1
/interface bridge port add bridge=bridge_lan frame-types=admit-only-untagged-and-priority-tagged interface=ether5_lan pvid=1234
/interface bridge port add bridge=bridge_lan frame-types=admit-only-untagged-and-priority-tagged interface=eoip-router1 pvid=1234
/interface bridge vlan add bridge=bridge_lan untagged=bridge_lan,ether1_lan,ether2_lan,ether3_lan,ether4_lan vlan-ids=1
/interface bridge vlan add bridge=bridge_lan tagged=bridge_lan untagged=eoip-router1,ether5_lan vlan-ids=1234

This is intentionally mismatching vlans (connecting different vlans over an untagged link with different pvid values at each end of the eoip-router1 interface link). I assume if vlans are in use at site A, the main lan is not using vlan 1234, it may be using the default vlan 1, but as long as it is untagged over the link, it will be “cast” into the correct local vlan by the specification of the pvid.

By using the above config, will receive untagged on the eoip-router1 interface and bridge ot vlan 1234, and then also connect vlan 1234 to a local access port on ether5_lan. Then a device plugged into ether1-ether4 will be only on the local lan, and when plugged into ether5 only on the remote lan.

Since you have eoip-router1 interface (probably with an address too), you will need to have a firewall in place if you don’t want things routed between the two networks.

I found the links in this post helpful when I was learning the RouterOS bridge way of dealing with vlans.