Well here is what I would do to get it working…
Go back to using both vlans and ether4 will be a trunk port to the Grandstream.
The important point is that the Grandstream needs an IP address itself on vlan10 subnet 192.168.0.0/24
Vlan10 being the home vlan. vlan20-guest for the wifi guests on AP.
But here is how we go about it.
First is to change ether5 to an emergency access port and we will do the changeback to vlans on that port (configuring either via laptop or desktop through that port).
So enter router as you are doing now…(presumably not from ether5)
- Remove eth5 from the Bridge
- rename it ether5-emerg
- Give it an IP address of 192.168.5.2 network 19.2.168.5.0
- add ether5 to the LAN interface list members
- Then exit router and then plug in laptop.desktop into ether 5 after setting your ipv4 to 192.168.5.5 gateway 192.168.5.1 netmask 255.255.255.0
- Confirm you can enter winbox and the router for configuration from ether5.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Now add back in vlans as indicated before…
/interface vlan
add interface=bridge name=vlan20-guests vlan-id=20
add interface=bridge name=vlan10 vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface list member
add comment=defconf interface=vlan20-guests list=LAN
add interface=vlan10 list=LAN
add interface=ether5-emerg list=LAN
add comment=defconf interface=ether1 list=WAN
/ip dhcp-server
add address-pool=dhcp interface=vlan10 name=main_dhcp
add address-pool=dhcp_pool_vlan20 interface=vlan20-guests name=dhcp_vlan20
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 pvid=10 ingress-filtering=yes frame-types=only-untagged-and-priority
add bridge=bridge comment=defconf interface=ether3 pvid=10 ingress-filtering=yes frame-types=only-untagged-and-priority
add bridge=bridge comment=defconf interface=ether4 ingress-filtering=yes frame-types=only-tagged
add bridge=bridge comment=defconf interface=wlan1 pvid=10 ingress-filtering=yes frame-types=only-untagged-and-priority disabled=yes
add bridge=bridge comment=defconf interface=wlan2 pvid=10 ingress-filtering=yes frame-types=only-untagged-and-priority disabled=yes
/interface bridge vlans
add bridge=bridge tagged=bridge,ether4 untagged=ether2,ether3,wlan1,wlan2 vlan-ids=10
add bridge=bridge tagged=bridge,ether4 vlan-ids=20
/ip address
add address=192.168.0.1/24 interface=vlan10 network=192.168.0.0
add address=192.168.20.1/24 interface=vlan20-guests network=192.168.20.0
/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN comment=“allow internet access”
add chain=forward action=accept comment=“allow port forwarding”
connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add chain=forward action=accept in-interface=vlan20 out-interface=vlan10 dst-port=1883
add chain=forward action=drop comment=“drop all else”
Ensure Bridge vlan filtering is set to yes.
When up and running you can add ethernet 5 back to the bridge or keep it as a separate entry point…
IF you add it back.
/interface bridge port
add bridge=bridge comment=defconf interface=ether5 pvid=10 ingress-filtering=yes frame-types=only-untagged-and-priority
/interface bridge vlans
add bridge=bridge tagged=bridge,ether4 untagged=ether2,ether3,ether5,wlan1,wlan2 vlan-ids=10