Hello,
I'm stuck with a problem that emerged with the 7.13 series of routeros, I'm currently using the CRS as L2 switch with VLANs (hybrid ports) and would like to use it also to route some packet from a "local" vlan992 to the vlan9 but the problem is that it seem the rules of the firewall table simply were not matched. I tried enabling or disabling the "Use IP Firewall" in the bridge setting option without any success.
The symptoms are that forging a packet that should be natted, the rule packet count doesn't arise.
(e.g. from 192.168.123.27 in interface com2-node3 pinging 192.168.10.83)
Some of you can give me some hints?
Another "anomaly" was that when I upgraded the software from 7.13 to 7.13.2, after the double reboot (one for the firmware upgrade, the other for the routerboard upgrade) ethernet interfaces were unable to manage the jumbo frames (MTU 9000). My solution was a power off-on cycle after that all became functional again. I think this it's a problem when if the thevice was only remote managed.
Here is my configuration:
2024-01-16 11:08:25 by RouterOS 7.13.2
software id = WCWD-WNAK
model = CRS312-4C+8XG
serial number = D84C0EF77D43
/interface bridge
add comment=defconf name=bridge port-cost-mode=short pvid=992 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether8 ] l2mtu=9092 mtu=9000 name=Downlink8
set [ find default-name=ether1 ] l2mtu=9092 mtu=9000 name=Uplink1
set [ find default-name=combo2 ] l2mtu=9092 mtu=9000 name=com2-node3
set [ find default-name=combo1 ] l2mtu=9092 mtu=9000
set [ find default-name=combo3 ] l2mtu=9092 mtu=9000
set [ find default-name=combo4 ] l2mtu=9092 mtu=9000
set [ find default-name=ether2 ] comment=Networkstorage l2mtu=9092 mtu=9000
set [ find default-name=ether3 ] l2mtu=9092 mtu=9000
set [ find default-name=ether4 ] l2mtu=9092 mtu=9000
set [ find default-name=ether5 ] l2mtu=9092 mtu=9000
set [ find default-name=ether6 ] l2mtu=9092 mtu=9000
set [ find default-name=ether7 ] l2mtu=9092 mtu=9000
set [ find default-name=ether9 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full
name=mgmt9
/interface vlan
add interface=bridge mtu=9000 name=vlan9 vlan-id=9
add interface=bridge mtu=9000 name=vlan1004 vlan-id=1004
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface list
add name=10Gvlan992
add name=10Gvlan9
add name=10Gvlan1
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.123.100-192.168.123.200
/ip dhcp-server
add address-pool=dhcp_pool0 interface=bridge lease-time=10m name=dhcp1
/port
set 0 name=serial0
/snmp community
set [ find default=yes ] name=ssisnet
/interface bridge port
add bridge=bridge interface=10Gvlan992 internal-path-cost=10 path-cost=10 pvid=992
add bridge=bridge interface=10Gvlan9 internal-path-cost=10 path-cost=10 pvid=9
add bridge=bridge interface=10Gvlan1 internal-path-cost=10 path-cost=10
/interface bridge settings
set use-ip-firewall-for-vlan=yes
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge comment=SSIS-CLIENT tagged=bridge,Uplink1,Downlink8,combo1,com2-node3,combo3,combo4 vlan-ids=9
add bridge=bridge comment=SSIS-DMZ tagged=bridge,Uplink1,Downlink8,ether7,combo1,com2-node3,combo3,combo4 vlan-ids=4
add bridge=bridge comment="VLAN ovirtmgmt" untagged=
combo1,Downlink8,bridge,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7 vlan-ids=992
add bridge=bridge comment="VLAN oWRT_DHCPSERVER" tagged=
ether2,bridge,ether3,ether4,ether5,ether6,ether7,Downlink8,combo1,com2-node3,combo3,combo4 vlan-ids=990
add bridge=bridge comment=SSIS-EXT tagged=
bridge,Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=3
add bridge=bridge comment=SSIS-SERVER tagged=bridge,Uplink1,Downlink8,combo1,com2-node3,combo3,combo4 vlan-ids=10
add bridge=bridge comment=CP-SSIS tagged=
bridge,combo1,com2-node3,combo3,combo4,Uplink1,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=101
add bridge=bridge comment=SSIS-DMZEXT tagged=Uplink1,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8,combo1,com2-node3,combo3,combo4
vlan-ids=20
add bridge=bridge comment=BC-SSIS tagged=
Uplink1,bridge,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8,combo1,com2-node3,combo3,combo4 vlan-ids=201
add bridge=bridge comment=SSIS-MGT tagged=ether2,ether3,ether4,ether5,ether6,ether7,Downlink8,combo1,com2-node3,combo3,combo4,bridge
untagged=Uplink1 vlan-ids=1
add bridge=bridge comment="iSCSI_GAV7000A28 169.254.30.26-27" tagged=
bridge,Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=1014
add bridge=bridge comment="iSCSI_GAV7000A28 169.254.31.26-27" disabled=yes tagged=
Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=1015
add bridge=bridge comment="iSCSI_GAV7000A28 169.254.32.26-27" disabled=yes tagged=
Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=1016
add bridge=bridge comment="iSCSI_GAV7000A28 169.254.33.26-27" disabled=yes tagged=
Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=1017
add bridge=bridge comment=CPSG-LAN tagged=
bridge,Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=132
add bridge=bridge tagged=bridge,Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=131
add bridge=bridge tagged=bridge,Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=420
add bridge=bridge tagged=bridge,Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=430
add bridge=bridge comment="WI-FI SSW" tagged=
bridge,Uplink1,combo1,com2-node3,combo3,combo4,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=980
add bridge=bridge comment=CP-10.6 tagged=
bridge,combo1,com2-node3,combo3,combo4,Uplink1,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=123
add bridge=bridge comment=TDATA-MNG tagged=
bridge,combo1,com2-node3,combo3,combo4,Uplink1,ether2,ether3,ether4,ether5,ether6,ether7,Downlink8 vlan-ids=76
/interface list member
add interface=combo1 list=10Gvlan992
add interface=com2-node3 list=10Gvlan992
add interface=combo3 list=10Gvlan992
add interface=combo4 list=10Gvlan992
add interface=ether2 list=10Gvlan992
add interface=ether3 list=10Gvlan992
add interface=ether4 list=10Gvlan992
add interface=ether5 list=10Gvlan992
add interface=ether6 list=10Gvlan992
add interface=Downlink8 list=10Gvlan992
add interface=ether7 list=10Gvlan992
add interface=Uplink1 list=10Gvlan1
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.123.1/24 interface=bridge network=192.168.123.0
add address=192.168.9.179/24 interface=vlan9 network=192.168.9.0
/ip dhcp-client
add add-default-route=no disabled=yes interface=mgmt9
add disabled=yes interface=vlan9
/ip dhcp-server lease
add address=192.168.123.12 client-id=1:a0:36:9f:2d:6f:8c mac-address=A0:36:9F:2D:6F:8C server=dhcp1
add address=192.168.123.13 client-id=1:0:1b:21:97:14:68 mac-address=00:1B:21:97:14:68 server=dhcp1
add address=192.168.123.14 client-id=1:0:a:cd:3c:bf:43 disabled=yes mac-address=00:0A:CD:3C:BF:43 server=dhcp1
add address=192.168.123.14 client-id=1:a0:36:9f:2d:6f:98 mac-address=A0:36:9F:2D:6F:98 server=dhcp1
/ip dhcp-server network
add address=192.168.123.0/24 dns-server=192.168.123.1 domain=ovirt gateway=192.168.123.1
/ip dns
set allow-remote-requests=yes servers=192.168.9.218,172.30.1.10
/ip dns static
add address=192.168.123.11 name=ovirt-node1.ovirt ttl=1h
add address=192.168.123.20 name=ovirt-engine.ovirt ttl=1m
add address=192.168.123.12 name=ovirt-node2.ovirt ttl=1h
add address=192.168.123.21 name=ovirt-backup.ovirt ttl=1h
add address=192.168.123.13 name=ovirt-node3.ovirt ttl=1h
/ip firewall address-list
add address=192.168.9.0/24 list=NOMASQ
/ip firewall filter
add action=accept chain=input disabled=yes
add action=accept chain=forward comment="Evita fastpath se devo nattare" dst-address-list=!NOMASQ log=yes log-prefix=nofp out-interface=
vlan9
add action=fasttrack-connection chain=forward connection-mark="" connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=new,untracked log=yes log-prefix=fw
/ip firewall nat
add action=accept chain=srcnat comment="permette accesso non nattato a networkstorage" dst-address=192.168.9.183 src-address=
192.168.123.0/24
add action=masquerade chain=srcnat dst-address=192.168.254.20/31 out-interface=vlan9 src-address=192.168.123.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=172.30.1.10 out-interface=vlan9 src-address=192.168.123.0/24
add action=accept chain=srcnat dst-address=192.168.123.0/24 src-address=192.168.9.183
add action=masquerade chain=srcnat disabled=yes out-interface=bridge src-address=192.168.9.0/24
add action=masquerade chain=srcnat dst-address=192.168.10.83
add action=masquerade chain=srcnat dst-address-list=!NOMASQ out-interface=vlan9
/ip route
add disabled=no dst-address=192.168.11.0/24 gateway=192.168.9.155 routing-table=main suppress-hw-offload=no
add check-gateway=ping disabled=no distance=30 dst-address=0.0.0.0/0 gateway=192.168.9.253 pref-src=0.0.0.0 routing-table=main scope=30
suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=40 dst-address=0.0.0.0/0 gateway=192.168.9.149 pref-src=0.0.0.0 routing-table=main scope=40
suppress-hw-offload=no target-scope=10
add disabled=no distance=3 dst-address=172.30.1.0/24 gateway=192.168.9.253 routing-table=main suppress-hw-offload=no
add disabled=no distance=100 dst-address=192.168.124.0/24 gateway=192.168.9.155 routing-table=main suppress-hw-offload=no
/snmp
set contact=Diego enabled=yes location="Ufficio Diego"
/system clock
set time-zone-name=Europe/San_Marino
/system identity
set name=oVirtSW
/system logging
add topics=netwatch
add topics=interface
add disabled=yes topics=dns
/system note
set show-at-login=no
/system routerboard settings
set boot-os=router-os