I’ve read almost every topic I’ve found here (and somewhere else too) that could by close to my set-up, but unfortunately - nothing gave me the answer. Also, all of my tries went to nowhere.
Here’s my setup:
1 x RBSXTR with LTE passthrough to VLAN “vlan1_sxt” and second VLAN “vlan100_mgmt” (for managing purposes)
1 x RBLHGR with LTE passthrough to VLAN “vlan2_lhg” and second VLAN “vlan100_mgmt” (for managing purposes)
1 x RB750 as main router with all 5 ports bridged together with 5 VLANs: vlan1_sxt, vlan2_lhg, vlan100_mgmt, vlan200_lan1, vlan201_lan2
1 x RB750 as a switch for IP cameras with ETH1-ETH4 bridged with “vlan201_lan2” (interface: ETH5) and “vlan100_mgmt” on ETH5. The clients connected to ports 1-4 are getting correct IP address from dhcp server on main router. Also - I can access this device and main router from client connected to ETH1-4
1 x cAP managed by CAPsMAN on main router with two separate SSIDs connected to VLAN’s 200 and 201. WiFi clients are getting correct addresses corresponding to their VLAN’s.
Every device can ping each other on the network (whole traffic between subnets is temporarily allowed for testing purposes).
But, no device (network device or client computers) can access WAN / Internet.
On my main router I have two mangle rules for each of subnets (LAN1 & LAN2) that’s marking routing for the packets.
In routing table I have two routes to 0.0.0.0/0 for each routing mark and for it’s designed gateway.
In NAT I have defined two masquerades, one for each VLAN (vlan1_sxt & vlan2_lhg).
When I try to ping anything outside my local network - I can see the packets are being sent correctly, and they’re coming back to my main router, but then - they disappear. It seems that my main router is unable to correctly route the server’s reply back to the device that initiated the connection.
Please help my out with this. I have no more ideas what can be wrong and without it - I can’t move to my summer house
It’s hard to tell without seeing actual configuration at least of the main router.
One thing does ring the bell: vlan1_sxt implies use of VLAN ID 1. Use of VLAN ID 1 is a bad choice. This VID is used as default value all around and if you’re not extra carefull, it can mess with config. So it’s better to use another VID instead. But as I wrote, this may not be a problem but impossible to tell without seeing the config.
You only have two vlans defined or I should state only two with DHCP serving capacity on the router.
200 and 201???
Where should we assume vlans 10, 20, 100 are coming from???
If this is a five port unit, why is the ISP (assuming ether1) included in the bridge??
So I see all bridge ports are carrying vlan201, what happened to vlan200??
I see you have at least given the mgnmt vlan an address, but missing the rest of the required info.
I see now that vlan10 and 20 are WAN side vlans??
Okay you really need to draw a network diagram. Its not clear if this device is hooked up to an ISP directly or via another router for example.
Your firewall rules are not SAFE or complete and cannot advise further.
Only two with DHCP (the are networks for my work and fun).
VLANs 10 and 20 are from LTE modems on the house roof. VLAN 10 is RBSXTR and VLAN 20 is RBLHGR. VLAN 100 is a management VLAN for modems and switches and yes - it ain’t got no DHCP server as it’s not needed.
The "ISP"s are connected to ETH1 and ETH2. They’re included in the bridge because I couldn’t find any other way to connect both of the "ISP"s to my management VLAN (100).
Honestly - I have no idea! It’s probably gone due to some tries-and-fails…
What other info? All VLAN’s have their respective IP’s (100, 200, 201) or DHCP clients (10, 20)
Yes.
It’s really simple. Two modems are connected to main RB750. Other devices are connected to this RB750 directly or via another RB750 (cameras, apple tv etc.).
the firewall is one of my least problems (I have private IP addresses on both ISP’s) and wouldn’t concern about them too much as long as my Internet connection isn’t working
I am not comfortable with, firewall rules are not needed because they are private IPs??
Do the LTE modem devices have firewalls?? Where is the protection point if not your router??
I have never heard of vlans from an LTE modem unless the ISP specfically carries the data on vlans and not on normal ethernet channels.
I am confused by you trying to access the LTE modem in any other way except entering the Gateway Address of the MODEM from your PC.
None of this make sense, probably due to my lack of experience.
Typically the bridge port setup is NOT for your WAN connections.
Typically the managment vlan is part of the Bridge port architecture, with it being the home vlan or a separate vlan, typically the one the admin usually works within or if separate then one the admin then gives himself access to in the firewall rules forward chain.
in-interface=vlan (where admin resides) out-interface=manangmentvlan source-address-list=adminaccess
where adminaccess could be a list of IP addresses the admin uses (desktop, laptop, smartphone etc.)
The same accessadmin would be used for the input chain
{standard default input rules}
accept in-interface=vlan source-address-list=adminaccess
accept dns servers for users/devices in-interface-list=LAN
…
drop all else
@anav, I feel your point, but let me repeat once again: my ISP gave me only SIM cards. The modems are two Mikrotiks (one SXT and one LHG) working in LTE passthrough mode with two VLAN’s configured: one VLAN is for traffic, and the second one is for management.
The bridge is only because the TWO of my Mikrotik modems couldn’t see the management VLAN when it was configured for one the ETH ports only (and I couldn’t figure out how to configure it for two ETH ports without a bridge).
No, this is really cool and different so interested LOL.
Can you add the config of each LTE
/export hide-senstive file=anynameyouwish
I am still thinking only one bridge is needed.
On the trunk port between the LTE and the router there are two vlans,
ONe goes to DHCP client on the router, the other goes to the bridge.’
Is what I am thinking…
In other words, the management vlan can be the management vlan for all devices, the LTES, the router and any thing behind the router.
YOu still need to create a DHCP and servers etc for the mnagement vlan, heck you could use 200 as your management vlan.
I will do the firewall rules. It’s just not the time for them as I’ve resetted the configuration few times yesterday and it would by pointless to configure them and the have to configure them over and over again
Do I understand correctly that one bridge should contain all of the physical ports (as it is now)? I can simplify the setup and indeed, use a vlan 200 as management. It’s only going to be for my summer house so total separation is not my concern. This setup is necessary for only one reason: me and my wife need a fast, stable LTE connection for our work (that’s why I’ve bought LHG LTE) and we can’t afford to have downtime due to data transfer limit. The other subnet is purely for entertainment, where reaching a data limit wouldn’t cause any downtime (and this limit is reached quickly when my son watches YouTube videos ). Also - my summer house is at very remote location, where SXT LTE reaches 5Mbps max, and it’s too low to work with it, but enough to watch YT videos
P.S. I’ll post the configuration of SXT later, during the day. LHG will be configured the same way when it will be back from RMA.
[EDIT]
I think I’ve got it working. It very not-quick and dirty way, but works as intended:
On my main router, I’ve created 5 vlans for management. One for each ETH port. then removed all physical ports from bridge and added all VLAN’s to it and assigned one management IP to that bridge. Next, I’ve created three vlans for one subnet, and another three for the second subnet. Each three vlans are added to their respective bridges. I’ve directed the LTE passthrough on modem to physical port and configured routing for the subnet to that port. Routing for the second subnet is configured to the second port (where LHG will be when it will be back from RMA).
I have no idea also, but my configuration wasn’t as perfect, as I previously thought… After two hours - my RB750 became really hot and fried… It was the oldest RB750 I’ve had (three electrolytic capacitors on board). So I’ve replaced it with a newer one and guess what? It also fried! Now, I’m thinking of buying used RB2011, so probably it will be more efficient…
I lost near 200 devices RB450 and RB411 for the “green” capacitor… model with black capacitor never have problems, all relpaced for RB711+, on the past years…
The only way to read back the cfg, if no backup are available, is replace the 2/3 green capacitors wit new or power the device with 9/10 volt…
