CRS305 inter-vlan routing

RouterOS Beginner Basics
1

Need some help understanding how to configure the CRS305 as end switch for a couple servers that have multiple vlans on them. My goal is to have the vlan traffic that origin and destination are both ports on the switch not leave the switch to be routed by the upstream router.

<unifi udm router> == <USW Pro MAX Switch> ==  (tagged trunk) 10 gig fiber == <CRS305-1G-4S+>

The trunk ports are tagged VLAN10,20,30 with native vlan 1

The ports on the CRS305 are as such:
<SFP+1>== (tagged trunk) dac == VM server 1
<SFP+2>== (tagged trunk) dac == VM server 2
<SFP+3>== (tagged trunk) dac == NAS storage
<SFP+4>== (tagged trunk) fiber == to upstream router

Currently the all the inter-VM traffic and VM-NAS traffic all goes to UDM and then back again even though source and destination are on the same switch.

So I believe the equivalent trunk setup in Mikrotik is a hybrid trunk port. The online examples have me confused routeros-to-vlan because I am not using it as a WAN router but want it as a managed layer3 switch with intervlan routing.

When I have tried vlan-filtering I keep getting it wrong and either loose my native vlan1 or vlan10-30.

attaching my config below.

/interface bridge
add admin-mac=08:55:31:8F:61:13 auto-mac=no comment=defconf name=bridge port-cost-mode=short
/interface list
add name=WAN
add name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip smb users
set [ find default=yes ] disabled=yes
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus2 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus3 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus4 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes
/interface list member
add interface=ether1 list=WAN
add interface=sfp-sfpplus1 list=LAN
add interface=sfp-sfpplus2 list=LAN
add interface=sfp-sfpplus3 list=LAN
add interface=sfp-sfpplus4 list=LAN
/interface ovpn-server server
add auth=sha1,md5 mac-address=FE:BE:5E:90:18:8F name=ovpn-server1
/ip dhcp-client
add interface=bridge
/ip dns
set servers=8.8.8.8
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set telnet disabled=yes
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/system clock
set time-zone-name=America/Los_Angeles
/system swos
set allow-from-ports=\
    p1,p2,p3,p4,p5,p6,p7,p8,p9,p10,p11,p12,p13,p14,p15,p16,p17,p18,p19,p20,p21,p22,p23,p24,p25,p26,p27,p28,p29,p30,p31 \
    static-ip-address=192.168.88.7
2

Don’t forget the L3 offload, or you will not be happy with the routing performance you’ll get.

3

Well, that is actually quite tough to do. You need to decide where you are going to route, and it isn’t that straightforward to do it in two different places. Your routing between VLANs will either happen on the CRS305 (where it can be L3 accelerated as rightly remarked) and your Unifi router will only route everything to internet, or it works as you apparently already have it (with a trunk port passing all inter-VLAN traffic back and forth to the router).

When you really want to have some hybrid system where e.g. devices on the USW switch use the Unifi router and devices on the CRS use that as a router, you will need to define further VLANs for that on the CRS to put the devices (with different IP subnets on them) so the CRS can be the router for those, and the Unifi will be the router for your existing VLANs.

4

I personally do not understand requirements that are networking equipment centric, NOT user centric or end devices centric. In other words, the focus is on the wrong syllable.
What user traffic needs to be served by the router and switch and perhaps other networking equipment.
Aka.

a. network diagram
b. set of requirements (users, groups of users, devices, groups of device, admin )……..
Then naturally a networking and config will fall gracefully from the tree of experts here.