Can't access VLAN with IP address 192.168.88.1

XerXesCZ · June 3, 2024, 9:14am

Hello,

I’m having trouble with accessing VLAN with IP address 192.168.88.1. I have removed this default IP address from the bridge, and assigned it to VLAN300_LEGACY (because on the old router, the network for all the devices was 192.168.88.0/24).

I can access all other VLANs from my management VLAN without problems, however, this one with this specific IP address cannot be accessed no matter what I do. (However, devices on this VLAN can be pinged from the router.) If I setup an access port and connect to this VLAN directly, everything is working without problems.

Any help would be greatly appreciated. Config is below:

# 2024-06-03 11:06:48 by RouterOS 7.15
# software id = NGSX-LU5G
#
# model = RB5009UG+S+
# serial number = HG409T6H414
/interface bridge
add admin-mac=D4:01:C3:29:F9:9E auto-mac=no comment=defconf name=BR0_LAN \
    port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1_WAN1
set [ find default-name=ether2 ] name=ether2_WAN2
set [ find default-name=sfp-sfpplus1 ] name=sfp-sfpplus1_trunk
/interface wireguard
add listen-port=63321 mtu=1420 name=wireguard1_mgmt
/interface vlan
add interface=BR0_LAN name=VLAN10_SERVICES vlan-id=10
add interface=BR0_LAN name=VLAN100_CLIENTS vlan-id=100
add interface=BR0_LAN name=VLAN200_MGMT vlan-id=200
add interface=BR0_LAN name=VLAN300_LEGACY vlan-id=300
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
add name=MGMT
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=POOL_SERVICES ranges=192.168.10.2-192.168.10.254
add name=POOL_CLIENTS ranges=10.0.100.2-10.0.100.254
add name=POOL_MGMT ranges=10.0.200.10-10.0.200.254
add name=POOL_LEGACY ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=POOL_SERVICES interface=VLAN10_SERVICES name=DHCP_SERVICES
add address-pool=POOL_CLIENTS interface=VLAN100_CLIENTS name=DHCP_CLIENTS
add address-pool=POOL_MGMT interface=VLAN200_MGMT name=DHCP_MGMT
add address-pool=POOL_LEGACY interface=VLAN300_LEGACY name=DHCP_LEGACY
/interface bridge port
add bridge=BR0_LAN comment=defconf interface=ether3 internal-path-cost=10 \
    path-cost=10 pvid=100
add bridge=BR0_LAN comment=defconf interface=ether4 internal-path-cost=10 \
    path-cost=10 pvid=200
add bridge=BR0_LAN comment=defconf interface=ether5 internal-path-cost=10 \
    path-cost=10 pvid=10
add bridge=BR0_LAN comment=defconf interface=ether6 internal-path-cost=10 \
    path-cost=10 pvid=10
add bridge=BR0_LAN comment=defconf interface=ether7 internal-path-cost=10 \
    path-cost=10 pvid=300
add bridge=BR0_LAN comment=defconf interface=ether8 internal-path-cost=10 \
    path-cost=10 pvid=10
add bridge=BR0_LAN comment=defconf interface=sfp-sfpplus1_trunk \
    internal-path-cost=10 path-cost=10 pvid=200
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=BR0_LAN tagged=BR0_LAN,sfp-sfpplus1_trunk untagged=ether6,ether8 \
    vlan-ids=10
add bridge=BR0_LAN tagged=BR0_LAN,sfp-sfpplus1_trunk untagged=ether3 vlan-ids=\
    100
add bridge=BR0_LAN tagged=BR0_LAN,sfp-sfpplus1_trunk untagged=ether4 vlan-ids=\
    200
add bridge=BR0_LAN tagged=BR0_LAN vlan-ids=1
add bridge=BR0_LAN tagged=BR0_LAN,sfp-sfpplus1_trunk untagged=ether7 vlan-ids=\
    300
/interface list member
add comment=defconf interface=BR0_LAN list=LAN
add comment=defconf interface=ether1_WAN1 list=WAN
add interface=ether2_WAN2 list=WAN
add interface=VLAN10_SERVICES list=VLAN
add interface=VLAN100_CLIENTS list=VLAN
add interface=VLAN200_MGMT list=MGMT
add interface=VLAN200_MGMT list=VLAN
add interface=VLAN300_LEGACY list=VLAN
/interface wireguard peers
add allowed-address=10.0.250.2/32 interface=wireguard1_mgmt name=dan_novy_dell \
    persistent-keepalive=30s public-key=\
    "H72QS1VzFJ62v0oQ737klp7qMVFc3fgS6O246QCRZE0="
/ip address
add address=82.113.60.30/24 interface=ether2_WAN2 network=82.113.60.0
add address=10.0.100.1/24 interface=VLAN100_CLIENTS network=10.0.100.0
add address=10.0.200.1/24 interface=VLAN200_MGMT network=10.0.200.0
add address=192.168.10.1/24 interface=VLAN10_SERVICES network=192.168.10.0
add address=10.0.250.1/24 interface=wireguard1_mgmt network=10.0.250.0
add address=192.168.88.1/24 interface=VLAN300_LEGACY network=192.168.88.0
/ip dhcp-server lease
add address=10.0.100.2 client-id= mac-address=\
    E4:8D:8C:6C:2F:BD server=DHCP_CLIENTS
add address=10.0.100.106 client-id= mac-address=\
    C0:C9:E3:7F:B5:37 server=DHCP_CLIENTS
add address=10.0.100.105 client-id= mac-address=\
    1C:61:B4:27:BA:F3 server=DHCP_CLIENTS
/ip dhcp-server network
add address=10.0.100.0/24 gateway=10.0.100.1
add address=10.0.200.0/24 gateway=10.0.200.1
add address=192.168.10.0/24 gateway=192.168.10.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="allow management VLAN Full Access" \
    in-interface=VLAN200_MGMT
add action=accept chain=input comment="allow management VPN Full Access" \
    in-interface=wireguard1_mgmt
add action=accept chain=input comment="Wireguard VPN_MGMT Allow" dst-port=63321 \
    in-interface-list=WAN protocol=udp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment=\
    "make sure management VLAN can access all of the networks" \
    connection-state=new in-interface=VLAN200_MGMT out-interface-list=VLAN
add action=accept chain=forward comment=\
    "make sure wireguard management VPN can access all of the networks" \
    in-interface=wireguard1_mgmt
add action=accept chain=forward comment="allow NAT" connection-nat-state=dstnat
add action=accept chain=forward comment=\
    "make sure all VLANs can access the internet" connection-state=new \
    in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="Quantcom Masquerade" ipsec-policy=\
    out,none out-interface=ether2_WAN2
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=82.113.60.29 routing-table=main \
    suppress-hw-offload=no
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" \
    src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" \
    dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Prague
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Thanks in advance

anav · June 3, 2024, 12:45pm

(1) WTH(alibut) is this?? ( vlanID is not part of your vlan list AND where is the identified port ???)
add bridge=BR0_LAN tagged=BR0_LAN vlan-ids=1 ???

(2) Your /interface bridge vlan rules are wrong they do not match /interface bridge ports. In addition your sfp plus TRUNK port has a pvid assigned in /interface bridge ports.
In that case if true it would be a HYBRID ports. Assuming this was an error seeing its a trunk port on all /interface bridge vlan settings including for vlan-id=200.

Fixed:

/interface bridge port
add bridge=BR0_LAN ingress-filtering=yes frame-type=admit-priority-and-untagged interface=ether3 pvid=100
add bridge=BR0_LAN ingress-filtering=yes frame-type=admit-priority-and-untagged interface=ether4 pvid=200
add bridge=BR0_LAN ingress-filtering=yes frame-type=admit-priority-and-untagged interface=ether5 pvid=10
add bridge=BR0_LAN ingress-filtering=yes frame-type=admit-priority-and-untagged interface=ether6 pvid=10
add bridge=BR0_LAN ingress-filtering=yes frame-type=admit-priority-and-untagged interface=ether7 pvid=300
add bridge=BR0_LAN ingress-filtering=yes frame-type=admit-priority-and-untagged interface=ether8 pvid=10
add bridge=BR0_LAN ingress-filtering=yes frame-type=admit-only-vlan-tagged interface=sfp-sfpplus1trunk_

/interface bridge vlan
add bridge=BR0_LAN tagged=BR0_LAN,sfp-sfpplus1_trunk untagged=ether5,ether6,ether8 vlan-ids=10
add bridge=BR0_LAN tagged=BR0_LAN,sfp-sfpplus1_trunk untagged=ether3 vlan-ids=100
add bridge=BR0_LAN tagged=BR0_LAN,sfp-sfpplus1_trunk untagged=ether4 vlan-ids=200
add bridge=BR0_LAN tagged=BR0_LAN,sfp-sfpplus1_trunk untagged=ether7 vlan-ids=300

(3) The Bridge has no need to be identified on the interface settings, and in reality only one list entry is needed ( either VLAN or LAN ) but not both in your case.
Thus remove Bridge entry here and fixed:

/interface list member
add interface=ether2_WAN2 list=WAN
add interface=VLAN10_SERVICES list=LAN
add interface=VLAN100_CLIENTS list=LAN
add interface=VLAN200_MGMT list=LAN
add interface=VLAN300_LEGACY list=LAN
add interface=wireguard1_mgmt list=LAN
add interface=VLAN200_MGMT list=MGMT
add interface=wireguard1_mgmt list=MGMT

(4) Remove persistent keep alive setting on allowed IPs. Clearly this router is the Server Peer for handshake so it does not apply.

(5) Complete the dhcp server-network settings
/ip dhcp-server network
add address=10.0.100.0/24 dns-server=10.0.100.1 gateway=10.0.100.1
add address=10.0.200.0/24 dns-server=10.0.200.1 gateway=10.0.200.1
add address=192.168.10.0/24 dns-server=192.168.10.1 gateway=192.168.10.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1

(6) It would appear you have to WANS, but only one setup at the moment??? Please explain.

(7) FIREWALL RULES fixed… ( of real note missing fastrack rule ?? )

_/ip firewall filte_r
{ default rules to keep }
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1
{admin rules}
add action=accept chain=input comment=“Wireguard handshake” dst-port=63321 protocol=udp
add action=accept chain=input comment=“admin access” in-interface-list=MGMT
add action=accept chain=input comment=“users to services” dst-port=53 protocol=udp in-interface-list=LAN
add action=accept chain=input comment=“users to services” dst-port=53 protocol=tcp in-interface-list=LAN
add action=drop chain=input comment=“drop all else” { add this rule as the last rule entered, so you dont lock yourself out }
++++++++++++++++++++++++++++++++++++++++++++++++++++
{default rules to keep}
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
{admin rules}
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“admin access to all subnets” in-interface-list=MGMT out-interface-list=LAN
add action=accept chain=forward comment=“allow NAT” connection-nat-state=dstnat disabled=yes { enable if required }
add action=drop chain=forward comment=“drop all else”

(8) Addition:
/ip neighbor discovery-settings
set discover-interface-list=MGMT

(9) Addition:
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=MGMT