As per “VLAN Setup Diagram” i am doing configuration of Microtik as Router on Stick configuration with D Link Switch,
Here i have made 3 VLAN and for each VLAN assigned a separate Subnet and DHCP Pool.
Now i checked and found that may be due to Inter VLAN Routing, all the VLAN communicating to each other.
So, i have made a filter rules to stop it and want to make a rules further :
to communicate few IPs of a VLAN to a particular VLAN in upstream rules.
to communicate a Particular VLAN to a particular VLAN in upstream rules.
Please post complete configuration … in text form. You can get it by opening terminal window (you can open it from winbox) and execute command /export hide-sensitive (the leading slash is important). Before posting, obfuscate public IP address (if it’s set statically) … and post ti inside [__code] environment for better readability.
Before we get into details let me explain some basic stuff…
Bridge functions very sim8larly to a switch, forwarding packets between member ports. Right now your RB has all ether ports member of same bridge. Which is kind of a problem due to 3 reasons:
it seems like ether1 interface is used as WAN interface. WAN should not have direct connectivity with LAN, now some packets might escape router processing (NAT, firewall).
Cure: remove ether1 from the bridge. The rest of WAN config seems sensible (DHCP client on ether1)
you wrote you wanted to create “router on a stick”, which means only one of its interfaces should carry all of LAN traffic (possibly also WAN traffic). Right now all 5 ether interfaces are bridged, meaning any of those interfaces can be used to carry any part (or whole) of traffic.
if interface is member of a bridge, no other configuration should be done in that interface. Currently all of LAN setup (including VLAN stuff) is set up on ether2 which is slave interface of a bridge. In this case most of stuff seems to work, but many users of this forum reported weird behaviour which ceased after things got properly configured on bridge.
There are a few more problems with your current setup (including almost non-existing firewall), but think about problems of physical layout config for now. After we deal with it, we can move forward to inter-VLAN accessibility.
