I have x86 ros and RB962 both running 6.40.4, an internet connection cabled to eth1 of x86 and running capsman server, rb962 acts as cap. 2.4G wifi broadcasts two SSID, one is for local (vlan10), one is for guest (vlan20) , 5G wifi brocasts one SSID, for local only (VLAN10). I have a wireless printer connected to VLAN10 without a problem, but I found even I enabled the client2client Forwarding, those wired device still lost lots of packages when pinging it for a while until I enable local forward which i don’t want. I made a workaround yesterday, and I found something interesting, if I create another vlan55 (192.168.55.0/24), means all wired device will still use vlan10, local wireless devices use vlan55, the problem is resolved. I don’t know why, can someone explain on it ?
Followings are the confs for x86(capsman) and rb962 (cap)
x86(capsman)
# oct/09/2017 11:08:25 by RouterOS 6.40.4
/interface bridge
add fast-forward=no name=br_vlan10
add comment="for guest" fast-forward=no name=br_vlan20
add name=br_vlan55
/interface ethernet
set [ find default-name=ether1 ] name=ether1-wan
set [ find default-name=ether2 ] name=ether2-lan
/interface vlan
add interface=ether2-lan name=vlan10 vlan-id=10
add interface=ether2-lan name=vlan20 vlan-id=20
add interface=ether2-lan name=vlan55 vlan-id=55
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=br_vlan20 interface=vlan20
add bridge=br_vlan10 interface=vlan10
add bridge=br_vlan55 interface=vlan55
/interface l2tp-server server
set default-profile=profile-l2tp enabled=yes ipsec-secret=vpn1234567890 use-ipsec=yes
/ip firewall layer7-protocol
add name=tbcdn regexp="^(get|post).+\\alicdn\\.\\com*"
add name=tb regexp="^(get|post).+\\taobao\\.\\com*"
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
add enc-algorithms=3des name=proposal-l2tp
add auth-algorithms=sha256,sha1 name=proposal-ikev2 pfs-group=none
/ip pool
add name=dhcp ranges=192.168.6.50-192.168.6.240
add name=vlan20-pool ranges=192.168.20.50-192.168.20.240
add name=l2tp-pool ranges=192.168.12.2-192.168.12.100
add name=ikev2-pool ranges=192.168.13.2-192.168.13.100
add name=vlan10-pool ranges=192.168.10.50-192.168.10.240
add name=vlan55-pool ranges=192.168.55.50-192.168.55.240
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay disabled=no interface=\
ether2-lan lease-time=1d10m name=dhcp1
add address-pool=vlan20-pool authoritative=after-2sec-delay disabled=no \
interface=br_vlan20 name=dhcp-vlan20
add address-pool=vlan10-pool authoritative=after-2sec-delay disabled=no \
interface=br_vlan10 lease-time=2h10m name=dhcp-vlan10
add address-pool=vlan55-pool authoritative=after-2sec-delay disabled=no \
interface=br_vlan55 lease-time=2h10m name=dhcp-vlan55
/ip ipsec mode-config
add address-pool=ikev2-pool address-prefix-length=32 name=ikev2
/ip address
add address=192.168.5.2/24 interface=ether1-wan network=192.168.5.0
add address=192.168.6.1/24 interface=ether2-lan network=192.168.6.0
add address=192.168.20.1/24 interface=br_vlan20 network=192.168.20.0
add address=192.168.10.1/24 interface=br_vlan10 network=192.168.10.0
add address=192.168.55.1/24 interface=br_vlan55 network=192.168.55.0
/ip dhcp-client
add dhcp-options=hostname,clientid
/ip dhcp-server lease
add address=192.168.10.59 comment=retropie_wifi mac-address=B8:27:EB:3D:BB:D3
add address=192.168.10.253 client-id=1:64:d1:54:5e:23:98 mac-address=\
64:D1:54:5E:23:98 server=dhcp-vlan10
/ip dhcp-server network
add address=192.168.6.0/24 dns-server=192.168.6.1 gateway=192.168.6.1 netmask=\
24
add address=192.168.10.0/24 dns-server=192.168.10.1 gateway=192.168.10.1 \
netmask=24
add address=192.168.20.0/24 dns-server=114.114.114.114 gateway=192.168.20.1 \
netmask=24
add address=192.168.55.0/24 dns-server=192.168.55.1 gateway=192.168.55.1 \
netmask=24
/ip dns
set allow-remote-requests=yes servers=192.168.5.1
/ip firewall address-list
add address=192.168.0.0/16 list=whitelist
add address=10.0.0.0/8 list=whitelist
add address=116.247.117.0/24 list=whitelist
/ip firewall filter
add action=passthrough chain=forward comment=\
";;;special dummy rule to show fasttrack counters"
add action=fasttrack-connection chain=forward connection-state=\
established,related disabled=yes
add action=accept chain=forward connection-state=established,related disabled=\
yes
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="Port scanners to list " \
protocol=tcp psd=21,3s,3,1 src-address-list=!whitelist
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" \
protocol=tcp src-address-list=!whitelist tcp-flags=\
fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp \
src-address-list=!whitelist tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp \
src-address-list=!whitelist tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=tcp \
src-address-list=!whitelist tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp \
src-address-list=!whitelist tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp \
src-address-list=!whitelist tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" src-address-list=\
"port scanners"
add action=accept chain=input comment=ipsec_l2tp_a port=1701,500,4500 protocol=\
udp
add action=accept chain=input comment=ipsec_l2tp_b protocol=ipsec-esp
add action=accept chain=output protocol=tcp src-port=10050
add action=accept chain=input dst-port=8291 protocol=tcp
add action=accept chain=input dst-port=8728 protocol=tcp
add action=drop chain=forward out-interface=br_vlan20 src-address=\
192.168.6.2-192.168.6.255
add action=drop chain=forward disabled=yes out-interface=br_vlan20 src-address=\
192.168.10.2-192.168.10.255
add action=accept chain=input comment=\
"defconf: accept established,related; also for VLAN clients dns resolving" \
connection-state=established,related in-interface=ether1-wan protocol=udp \
src-port=53
add action=accept chain=input comment=\
"defconf: accept established,related; also for VLAN clients dns resolving" \
connection-state=established,related in-interface=ether1-wan protocol=tcp \
src-port=53
add action=accept chain=input comment="all ping from WAN" in-interface=\
ether1-wan protocol=icmp
add action=drop chain=input comment="defconf: drop all from WAN" disabled=yes \
in-interface=ether1-wan
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new disabled=yes in-interface=ether1-wan
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-wan
add action=redirect chain=dstnat comment="enable it when using http proxy" \
disabled=yes dst-port=80 layer7-protocol=!tbcdn log-prefix=http-proxy \
protocol=tcp to-ports=8080
add action=dst-nat chain=dstnat comment="allow op discover zabbix server" \
dst-address=192.168.6.1 dst-port=10050 protocol=tcp to-addresses=\
192.168.6.129 to-ports=10050
add action=dst-nat chain=dstnat comment="xunlei xiazaibao" disabled=yes \
dst-address=192.168.6.1 dst-port=4593-4594 protocol=tcp to-addresses=\
192.168.6.136
add action=dst-nat chain=dstnat comment="xunlei xiazaibao" disabled=yes \
dst-address=192.168.6.1 dst-port=4693-4694 protocol=udp to-addresses=\
192.168.6.136
/ip ipsec peer
add address=0.0.0.0/0 dh-group=modp1024 dpd-interval=2s enc-algorithm=3des \
exchange-mode=main-l2tp generate-policy=port-override secret=vpn1234567890
add address=0.0.0.0/0 auth-method=rsa-signature certificate=Server dh-group=\
modp2048 enc-algorithm=aes-256 exchange-mode=ike2 generate-policy=\
port-strict hash-algorithm=sha256 mode-config=ikev2 passive=yes
/ip ipsec policy
set 0 disabled=yes
add proposal=proposal-l2tp template=yes
add proposal=proposal-ikev2 template=yes
/ip proxy
set cache-on-disk=yes cache-path=disk-ext
/ip proxy access
add src-address=192.168.0.0/16
add src-address=10.0.0.0/8
add action=deny
/ip proxy cache
add action=deny path=*.exe
add action=deny path=*.iso
/ip route
add distance=1 gateway=192.168.5.1
/ip service
set www-ssl certificate=server-template disabled=no port=6443
rb962(cap)
# oct/09/2017 11:19:18 by RouterOS 6.40.4
/interface bridge
add fast-forward=no name=br-vlan10
add name=br-vlan20
/interface wireless
# managed by CAPsMAN
# channel: 2442/20-Ce/gn(30dBm), SSID: ecapsul, CAPsMAN forwarding
set [ find default-name=wlan1 ] ssid=MikroTik
# managed by CAPsMAN
# channel: 5745/20-Ceee/ac(30dBm), SSID: ecapsul5, CAPsMAN forwarding
set [ find default-name=wlan2 ] ssid=MikroTik
/interface vlan
add interface=ether1 name=vlan10 vlan-id=10
add interface=ether1 name=vlan20 vlan-id=20
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=br-vlan10 interface=ether2
add bridge=br-vlan10 interface=ether3
add bridge=br-vlan10 interface=ether4
add bridge=br-vlan10 interface=ether5
add bridge=br-vlan10 interface=sfp1
add bridge=br-vlan10 disabled=yes interface=wlan1
add bridge=br-vlan10 disabled=yes interface=wlan2
add bridge=br-vlan10 disabled=yes interface=ether1
add bridge=br-vlan10 interface=vlan10
/interface wireless cap
#
set discovery-interfaces=ether1 enabled=yes interfaces=wlan1,wlan2
/ip address
add address=192.168.10.253/24 interface=br-vlan10 network=192.168.10.0
add address=192.168.6.253/24 interface=ether1 network=192.168.6.0
/ip dns
set allow-remote-requests=yes servers=192.168.10.1,114.114.114.114
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
established,related
add action=accept chain=forward connection-state=established,related
/ip route
add distance=1 gateway=192.168.10.1
/snmp
set enabled=yes trap-version=2
/system clock
set time-zone-name=Asia/Shanghai
/system identity
set name=rb962
/system ntp client
set enabled=yes primary-ntp=192.168.10.1