Firewall not fully working with VLANs? Or could it be a (asymmetric) routing issue?

[AquaL1te]

The way I see it, router’s L2 config is a mess. On one hand your ether1 is considered independent interface (not part of bridge, …), but on other hand it’s part of VLAN 10. Same IP subnet 172.27.10.0/24 is supposed to be both on ether1 side (ISP modem etc.) and on bridge side (R Pi).

It is fibe to have hEX configured as switch (with all ports member of VLAN 10, with most ports member of other VLANs) and as router (routing between VLANs), but not the way it is now.

As your intentions are not entirely clear to me, I’ll refrain from start giving advice and I’ll wait for your description of wanted setup … expressed in plain words.

Good point, I indeed didn’t explain my intent.

So the 4 PoE ports should be members of VLAN 11, 12 and 13. Where VLAN 13 should have a route to the Internet, just like VLAN 10. On VLAN 13 I’ll run websites and other online services. VLAN 10 is just the default gateway to the Internet and the rest of my LAN. VLAN 11 and 12 should be closed from the Internet and the rest of the LAN.

So I want to be able to manage access to these networks. VLANs are setup, but I would prefer to also have a firewall from the Mikrotik in front of it.

If disabling the router functionality can be done and still have a L3 firewall, then that sounds great. I hope that doesn’t mean I have to use the software bridge. Because if I enable VLAN filtering there, hardware offload is disabled and the performance is quite low.