I’m in the process of setting up my home network, and as the main router I have a CRS109-8G-1S-2HnD running RouterOS 7.18.2, with two OpenWRT devices acting as WiFi 6 access points and another one acting as a managed switch.
I wanted to have isolation between my IoT devices, guest devices and my personal devices, so I am using VLANs, and specifically, my configuration is based on anrich's Home VLAN Tutorial, which I then tweaked to suit my needs and devices.
My issue is that I’ve noticed that mDNS does not work properly on my network, or at least not on my vlan10-owner VLAN, but it does seem to work on vlan20-iot, which I find odd. To test mDNS functionality, I have avahi setup on two Linux devices connected to VLAN 10, and then ran avahi-browse --all, which produced no results on both machines. But then, over on VLAN 20, I have a Raspberry Pi running Home Assistant and other devices like a Smart TV, some lightbulbs and other things, and the Home Assistant instance is able to find them, and running avahi-browse on the Pi I can see all these devices appear. I’m pretty sure the problem does not lie on the Linux machines as mDNS worked fine before working on the network.
I’d also like for mDNS to work from VLAN 10 to VLAN 20 (i.e. for devices connected to VLAN 10 to be able to see the devices connected to VLAN 20, but not vice-versa), so I followed UpRunTech's mDNS between VLANs with just bridge filters setup but it isn’t working either.
Here’s the parts of my config I find are relevant, mainly the VLAN bridge and firewall sections
# 2026-03-07 22:55:30 by RouterOS 7.21
# software id = <redacted>
#
# model = CRS109-8G-1S-2HnD
# serial number = <redacted>
/interface bridge
add comment="LAN bridge" name=bridge-lan vlan-filtering=yes
add name=bridge-mdns protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] comment="ISP PPPoE WAN" name=ether1-wan
set [ find default-name=ether2 ] comment="Access Point 1" name=ether2-ap1
set [ find default-name=ether3 ] comment="Access Point 2" name=ether3-ap2
set [ find default-name=ether4 ] comment="Managed switch/AP" name=ether4-switch
set [ find default-name=ether5 ] comment="Raspberry Pi" name=ether5-rpi
set [ find default-name=ether6 ] comment="Intel NUC" name=ether6-nuc
set [ find default-name=ether8 ] comment=\
"Dedicated unbridged management port" name=ether8-management
set [ find default-name=sfp1 ] disabled=yes
/interface wireguard
add comment="Wireguard VPN" listen-port=<redacted> mtu=1420 name=wg1
/interface vlan
add comment="Owner VLAN" interface=bridge-lan name=vlan10-owner vlan-id=10
add comment="IoT VLAN" interface=bridge-lan name=vlan20-iot vlan-id=20
add comment="Guest VLAN" interface=bridge-lan name=vlan30-guest vlan-id=30
add comment="Management VLAN" interface=bridge-lan name=vlan99-management \
vlan-id=99
/interface macvlan
add interface=vlan10-owner mac-address=AA:BB:CC:DD:EE:FF name=macvlan10-owner
add interface=vlan20-iot mac-address=AA:BB:CC:DD:EE:FF name=macvlan20-iot
/interface list
add comment="Management interface list" name=management
add comment="ALL VLANs excluding management VLAN" name=vlan
add comment="WAN interface list" name=wan
add comment="Owner access interface list" name=owner-ifs
/ip pool
add name=pool-owner ranges=10.10.0.100-10.10.0.199
add name=pool-iot ranges=10.20.0.100-10.20.0.199
add name=pool-guest ranges=10.30.0.100-10.30.0.199
add name=pool-management ranges=10.99.0.100-10.99.0.199
/ip dhcp-server
add address-pool=pool-owner interface=vlan10-owner lease-time=1d name=\
dhcp-owner
add address-pool=pool-iot interface=vlan20-iot lease-time=1d name=dhcp-iot
add address-pool=pool-guest interface=vlan30-guest lease-time=1h name=\
dhcp-guest
add address-pool=pool-management interface=vlan99-management lease-time=1d \
name=dhcp-management
/interface bridge filter
add action=accept chain=forward comment="Allow mDNS only" dst-address=\
224.0.0.251/32 dst-mac-address=01:00:5E:00:00:FB/FF:FF:FF:FF:FF:FF \
dst-port=5353 in-bridge=bridge-mdns ip-protocol=udp mac-protocol=ip \
out-bridge=bridge-mdns src-port=5353
add action=drop chain=forward comment="Drop all other L2 traffic" in-bridge=\
bridge-mdns out-bridge=bridge-mdns
/interface bridge nat
add action=src-nat chain=srcnat comment="SNAT to primary VLAN bridge" \
dst-mac-address=01:00:5E:00:00:FB/FF:FF:FF:FF:FF:FF to-src-mac-address=\
B8:69:F4:53:CD:A9
/interface bridge port
add bridge=bridge-lan comment="AP1 Trunk Port" frame-types=\
admit-only-vlan-tagged interface=ether2-ap1
add bridge=bridge-lan comment="AP2 Trunk Port" frame-types=\
admit-only-vlan-tagged interface=ether3-ap2
add bridge=bridge-lan comment="Admin Trunk Port" frame-types=\
admit-only-vlan-tagged interface=ether4-switch
add bridge=bridge-lan comment="Raspberry Pi Access Port (VLAN 20)" \
frame-types=admit-only-untagged-and-priority-tagged interface=ether5-rpi \
pvid=20
add bridge=bridge-lan comment="Intel NUC Access Port (VLAN 20)" frame-types=\
admit-only-untagged-and-priority-tagged interface=ether6-nuc pvid=20
/interface bridge vlan
add bridge=bridge-lan comment="Owner VLAN" tagged=\
bridge-lan,ether2-ap1,ether3-ap2,ether4-switch vlan-ids=10
add bridge=bridge-lan comment="IoT VLAN" tagged=\
bridge-lan,ether2-ap1,ether3-ap2,ether4-switch untagged=\
ether5-rpi,ether6-nuc vlan-ids=20
add bridge=bridge-lan comment="Guest VLAN" tagged=\
bridge-lan,ether2-ap1,ether3-ap2,ether4-switch vlan-ids=30
add bridge=bridge-lan comment="Management VLAN" tagged=\
bridge-lan,ether2-ap1,ether3-ap2,ether4-switch vlan-ids=99
/interface list member
add comment="Dedicated management port" interface=ether8-management list=\
management
add comment="Management VLAN" interface=vlan99-management list=management
add comment="Owner VLAN" interface=vlan10-owner list=vlan
add comment="IoT VLAN" interface=vlan20-iot list=vlan
add comment="Guest VLAN" interface=vlan30-guest list=vlan
add comment="PPPoE WAN interface" interface=pppoe-wan list=wan
add comment="Wireguard VPN" interface=wg1 list=owner-ifs
add comment="Owner VLAN" interface=vlan10-owner list=owner-ifs
/interface wireguard peers
add allowed-address=10.50.0.2/32 client-address=10.50.0.2/24 \
client-allowed-address=10.50.0.1/32 client-dns=10.50.0.1 client-endpoint=\
10.10.0.1 client-keepalive=30s comment="laptop" \
interface=wg1 name=peer1-laptop public-key=\
"<redacted>"
/ip address
add address=10.10.0.1/24 comment="Owner VLAN addresses" interface=\
vlan10-owner network=10.10.0.0
add address=10.20.0.1/24 comment="IoT VLAN addresses" interface=vlan20-iot \
network=10.20.0.0
add address=10.30.0.1/24 comment="Guest VLAN addresses" interface=\
vlan30-guest network=10.30.0.0
add address=10.99.0.1/24 comment="Management VLAN addresses" interface=\
vlan99-management network=10.99.0.0
add address=10.50.0.1/24 comment="Wireguard VPN addresses" interface=wg1 \
network=10.50.0.0
/ip arp
add address=10.10.0.2 comment=desktop interface=vlan10-owner mac-address=\
AA:BB:CC:DD:EE:FF
/ip dhcp-server network
add address=10.10.0.0/24 comment="Owner DHCP Network" dns-server=10.10.0.1 \
gateway=10.10.0.1
add address=10.20.0.0/24 comment="IoT DHCP Network" dns-server=10.20.0.1 \
gateway=10.20.0.1
add address=10.30.0.0/24 comment="Guest DHCP Network" dns-server=10.30.0.1 \
gateway=10.30.0.1
add address=10.99.0.0/24 comment="Management DHCP Network" dns-server=\
10.99.0.1 gateway=10.99.0.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip firewall filter
add action=accept chain=input comment="Allow established connections" \
connection-state=established,related,untracked
add action=drop chain=input comment="Drop invalid packets" connection-state=\
invalid
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input comment="Allow local loopback" dst-address=\
127.0.0.1
add action=accept chain=input comment="Allow LAN DNS queries (udp)" dst-port=\
53 in-interface-list=!wan protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries (tcp)" dst-port=\
53 in-interface-list=!wan protocol=tcp
add action=accept chain=input comment="Allow Wireguard" dst-port=<redacted> \
protocol=udp
add action=accept chain=input comment=\
"Allow full access to the management interfaces" in-interface-list=\
management
add action=accept chain=input comment=\
"Allow restricted webfig/ssh access to the router" dst-port=80,443,22 \
in-interface=vlan10-owner protocol=tcp src-address-list=owner-webfig
add chain=input comment="Allow mDNS on IoT" in-interface=vlan20-iot protocol=\
udp src-port=5353
add chain=input comment="Allow mDNS on Owner" in-interface=vlan10-owner \
protocol=udp src-port=5353
add action=drop chain=input comment="Drop all other inputs"
add action=fasttrack-connection chain=forward comment=\
"Fasttrack established connections" connection-state=established,related
add action=accept chain=forward comment="Allow established connections" \
connection-state=established,related,untracked
add action=drop chain=forward comment="Drop invalid packets" \
connection-state=invalid
add action=accept chain=forward comment="Allow Owner -> IoT traffic" \
connection-state=new in-interface-list=owner-ifs out-interface=vlan20-iot
add action=accept chain=forward comment="Allow Owner -> Management traffic" \
connection-state=new in-interface-list=owner-ifs out-interface=\
vlan99-management
add action=accept chain=forward comment=\
"Allow internet access for management VLAN" connection-state=new \
in-interface-list=management out-interface-list=wan
add action=accept chain=forward comment=\
"Allow internet access for all other VLANs" connection-state=new \
in-interface-list=vlan out-interface-list=wan
add action=accept chain=forward comment="Allow port forwarding" \
connection-nat-state=dstnat
add action=drop chain=forward comment="Drop all other forwarded traffic"
/ip firewall nat
add action=masquerade chain=srcnat comment="NAT for internet access" \
in-interface-list=vlan out-interface-list=wan
add action=dst-nat chain=dstnat comment="dstNAT for Wake-on-LAN" \
dst-port=8009 in-interface-list=vlan protocol=udp \
to-addresses=10.10.0.2 to-ports=9
/ipv6 address
add address=<prefix>:0:ba69:f4ff:fe53:cda9 eui-64=yes interface=\
vlan20-iot
add address=<prefix>:4000:ba69:f4ff:fe53:cda9 eui-64=yes interface=\
vlan10-owner
add address=<prefix>:8000:ba69:f4ff:fe53:cda9 eui-64=yes interface=\
vlan30-guest
/ipv6 firewall address-list
add address=::/128 comment="Unspecified address" list=bad_ipv6
add address=::1/128 comment=Loopback list=bad_ipv6
add address=fec0::/10 comment="Site local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="IPv4 mapped" list=bad_ipv6
add address=::/96 comment="IPv4 compat" list=bad_ipv6
add address=100::/64 comment="Discard only" list=bad_ipv6
add address=2001:db8::/32 comment=Documentation list=bad_ipv6
add address=2001:10::/28 comment=ORCHID list=bad_ipv6
add address=3ffe::/16 comment=6bone list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="Allow established connections" \
connection-state=established,related,untracked
add action=drop chain=input comment="Drop invalid packets" connection-state=\
invalid
add action=accept chain=input comment="Allow ICMPv6" protocol=icmpv6
add action=accept chain=input comment="Allow UDP traceroute" port=33434-33534 \
protocol=udp
add action=accept chain=input comment="Allow DHCPv6-Client prefix delegation" \
dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="Allow IKE" dst-port=500,4500 protocol=\
udp
add action=accept chain=input comment="Allow IPsec AH" protocol=ipsec-ah
add action=accept chain=input comment="Allow IPsec ESP" protocol=ipsec-esp
add action=accept chain=input comment=\
"Allow full access to the management interfaces" in-interface-list=\
management
add action=drop chain=input comment="Drop all other inputs"
add action=accept chain=forward comment="Allow established connections" \
connection-state=established,related,untracked
add action=drop chain=forward comment="Drop invalid packets" \
connection-state=invalid
add action=drop chain=forward comment="Drop packets with bad src IPv6" \
src-address-list=bad_ipv6
add action=drop chain=forward comment="Drop packets with bad dst IPv6" \
dst-address-list=bad_ipv6
add action=drop chain=forward comment="RFC4890 Drop hop-limit=1" hop-limit=\
equal:1 protocol=icmpv6
add action=accept chain=forward comment="Allow ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="Allow HIP" protocol=139
add action=drop chain=forward comment="Drop all other forwarded traffic"