I’m trying to use the Router HAP AX3 as an AP to forward VLAN’s with already working DHCP to separate WIFI’s. Traffic inbetween the networks will be made on the opnsense firewall.
Trunk port from managed switch with 3 VLANs is connected to ether1 (the 2.5Gbit Port).
VLANs are working, testet with a Notebook over Cable, Problem needs to be on the Mikrotik.
ether2 has an ip, to not lock me out, can remove that in the end.
After hours of trying I’m now ready for a forum post.
Problem:
cannot get an IP when connecting to wifi1(LAN) and wifi2(IoT)
but wifi3 (Guest) ist working perfectly fine.
Also I don’t know if those dhcp relays are even necessary.
Here is my config (RouterOS 7.15.3):
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no name=main-bridge vlan-filtering=\
yes
/interface vlan
add interface=main-bridge name=vlan10-LAN vlan-id=10
add interface=main-bridge name=vlan20-IoT vlan-id=20
add interface=main-bridge name=vlan30-Guest vlan-id=30
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=5ghz-ax disabled=no frequency=2300-7000 name="5GHz AX" width=\
20/40/80mhz
add band=2ghz-ax disabled=no frequency=2300-7000 name="2.4GHz AX" width=\
20/40mhz
/interface wifi datapath
add bridge=main-bridge disabled=no name=Guest vlan-id=30
add bridge=main-bridge disabled=no name=LAN vlan-id=10
add bridge=main-bridge disabled=no name=IoT vlan-id=20
/interface wifi security
add authentication-types=wpa3-psk disabled=no name=LAN
add authentication-types=wpa3-psk disabled=no name=Guest
add authentication-types=wpa3-psk disabled=no name=IoT
/interface wifi configuration
add country=Wonderland datapath=LAN disabled=no name=LAN qos-classifier=\
priority security=LAN
add country=Wonderland datapath=Guest disabled=no name=Guest security=Guest
add country=Wonderland datapath=IoT disabled=no name=IoT security=IoT
/interface wifi
set [ find default-name=wifi1 ] channel="5GHz AX" channel.band=5ghz-ax \
.skip-dfs-channels=10min-cac .width=20/40/80mhz configuration=LAN \
configuration.mode=ap .ssid=LAN datapath=LAN disabled=no security=LAN \
security.authentication-types=wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel="2.4GHz AX" channel.band=2ghz-ax \
.skip-dfs-channels=10min-cac .width=20/40mhz configuration=IoT \
configuration.mode=ap .ssid=IoT datapath=IoT disabled=no security=IoT \
security.authentication-types=wpa3-psk .ft=yes .ft-over-ds=yes
add configuration=Guest configuration.mode=ap .ssid=Guest datapath=Guest \
disabled=no mac-address=7A:9A:18:3A:7A:5D master-interface=wifi1 name=\
wifi3 security=Guest security.authentication-types=wpa3-psk .ft=yes \
.ft-over-ds=yes
/disk settings
set auto-media-interface=*9 auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=main-bridge interface=ether2
add bridge=main-bridge interface=ether3
add bridge=main-bridge interface=ether4
add bridge=main-bridge interface=ether5
add bridge=main-bridge comment=rgr interface=ether1 internal-path-cost=10 \
path-cost=10
add bridge=main-bridge interface=wifi1 pvid=10
add bridge=main-bridge interface=wifi2 pvid=20
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=main-bridge tagged=ether1,main-bridge untagged=wifi1 vlan-ids=10
add bridge=main-bridge tagged=ether1,main-bridge untagged=wifi2 vlan-ids=20
add bridge=main-bridge tagged=ether1,main-bridge untagged=wifi3 vlan-ids=30
/interface list member
add comment=defconf interface=ether1 list=LAN
/ip address
add address=192.168.10.2/24 comment=LAN-IP interface=vlan10-LAN network=\
192.168.10.0
add address=192.168.10.20/24 comment=antilockout interface=ether2 network=\
192.168.10.0
/ip dhcp-relay
add dhcp-server=192.168.10.1 disabled=no interface=vlan10-LAN local-address=\
192.168.10.2 name=relay-lan
add dhcp-server=192.168.20.1 disabled=no interface=vlan20-IoT local-address=\
192.168.20.2 name=relay-iot
add dhcp-server=172.16.30.1 disabled=no interface=vlan30-Guest local-address=\
172.16.30.2 name=relay-guest
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.10.2 name=hermes.lan
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" disabled=yes \
in-interface-list=!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" disabled=yes \
in-interface-list=!LAN
/system identity
set name=Hermes
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.10.1
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system script
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
p\" && disabled=no)] do={\r\
\n /interface/wifi wps-push-button \$iface;}\r\
\n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Thanks already for any help.
