DHCP server blues...error interface is a slave

RouterOS Beginner Basics
1

I’m trying to use my RB2011 as a DHCP server. I create a new server and try to use the LAN interface, ether2-master but I get an error saying it is a slave. I tried using the bridge interface as this is the default server config but it doesn’t work. My config is below. Any ideas on what I’m going wrong? Thanks for your help.

[admin@MikroTik] > export

feb/25/2017 12:52:21 by RouterOS 6.38.1

software id = IAWX-FQW3

/interface bridge
add admin-mac=4C:5E:0C:1A:65:07 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=“TWC WAN”
set [ find default-name=ether2 ] arp=proxy-arp comment=LAN name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] master-port=ether2-master
set [ find default-name=ether6 ] name=ether6-master
set [ find default-name=ether7 ] master-port=ether6-master
set [ find default-name=ether8 ] master-port=ether6-master
set [ find default-name=ether9 ] master-port=ether6-master
set [ find default-name=ether10 ] master-port=ether6-master
/ip neighbor discovery
set ether1 discover=no
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=VPN-pool ranges=10.10.1.101-10.10.1.105
add name=My-DHCP-Pool ranges=10.10.1.10-10.10.1.199
/ip dhcp-server
add add-arp=yes address-pool=My-DHCP-Pool always-broadcast=yes disabled=no interface=bridge name=defconf
/ppp profile
add change-tcp-mss=yes dns-server=8.8.8.8,8.8.4.4 local-address=192.168.1.1 name=vpn-profile remote-address=192.168.1.2 use-encryption=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=ether6-master
add bridge=bridge comment=defconf interface=sfp1
/interface l2tp-server server
set default-profile=vpn-profile enabled=yes
/ip address
add address=10.10.2.2/24 comment=LAN interface=ether2-master network=10.10.2.0
add address=10.10.1.2 disabled=yes network=10.10.1.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server network
add address=10.10.1.0/24 comment=defconf gateway=10.10.1.50 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=10.10.2.2 name=router
/ip firewall filter
add action=accept chain=input comment=“defconf: accept ICMP” in-interface=bridge protocol=icmp
add action=accept chain=input comment=“accept ICMP on WAN” in-interface=ether1 protocol=icmp
add action=accept chain=input comment=“defconf: accept establieshed,related” connection-state=established,related
add action=accept chain=input comment=“VPN rules” dst-port=1701 protocol=udp
add action=accept chain=input comment=“VPN rules” dst-port=500 protocol=udp src-port=“”
add action=accept chain=input comment=“VPN rules” dst-port=4500 protocol=udp
add action=accept chain=input comment=“VPN rules” protocol=ipsec-ah
add action=accept chain=input comment=“VPN rules” protocol=ipsec-esp
add action=drop chain=input comment=“defconf: drop all from WAN” in-interface=ether1
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related” connection-state=established,related
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new
in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” out-interface=ether1
/ip ipsec peer
add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=port-override secret=50Purpl3
/ip route
add distance=1 dst-address=10.10.1.0/24 gateway=10.10.2.1
add distance=1 dst-address=10.10.10.0/24 gateway=10.10.2.1
add distance=1 dst-address=10.10.20.0/24 gateway=10.10.2.1
add distance=1 dst-address=10.10.30.0/24 gateway=10.10.2.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
/lcd pin
set pin-number=2440
/ppp secret
add name=vpn-user password=xxxxx
/system clock
set time-zone-name=America/New_York
/system clock manual
set time-zone=-05:00
/system logging
add disabled=yes topics=ipsec
/system ntp client
set enabled=yes primary-ntp=132.163.4.103 server-dns-names=time-c.timefreq.bldrdoc.gov
/tool bandwidth-server
set enabled=no
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge

2

ether2-master is now a slave to the bridge (which is called ‘bridge’ - you might be better off renaming it to save confusion). Likewise for ether6-master and sfp1.
You can no longer create a DHCP server on a slave, which is why it complains.
The IP address and the DHCP server should be on the master i.e. the bridge called ‘bridge’.

/ip address
add address=10.10.2.2/24 comment=LAN interface=bridge network=10.10.2.0

Your example already has the DHCP server on ‘bridge’.

3

Thank you. I’ll try that. The whole bridge thing is confusing to me as no other piece of networking equipment I’ve ever worked with used constructs like this. I need to read up on this to better understand.

4

I gave that a try but there is a little complexity here. The Mikrotik bridge interface is not on my LAN. There is a L3 switch at the core of my network. So the bridge interface connects to a port on the L3 switch. Here’s a diagram.
Capture.PNG
What I really need to do is serve multiple scopes (vlans) from the Mikrotik DHCP.