I just bought my first Mikrotik for home use and after reading multiple guides I’m still struggling with the vlan setup.
The design is pretty simple, all the ports and the main wifi on vlan10(10.0.10.0/24), then a guest ssid on vlan20(10.0.20.0/24), both with access to internet but isolated from one another.
With this configuration as soon as I enable the vlans with /interface bridge set BR1 vlan-filtering=yes
the router correctly reboots but i can’t connect again on winbox (via mac, as the IP remains 0.0.0.0) and can't understand why.
This is not the only issue as I also have issues with getting a dhcp address via wifi for example but I’d like to have the vlans configuration sorted first.
No need to put your main wifi on a vlan. Yes, every document you see does this, but basically you only put something on a vlan when you can articulate a need. At this stage, the only need we can articulate is to put the guest wifi on a vlan to keep guests separate from the main lan. So just do that. Leave your main wifi on the native lan. As you are new at this, only ever do one vlan at a time.
And then, hopefully, you will never again commit all your interfaces to a vlan. It is generally recommended to leave 1 ethernet port alone and not involved in vlans for precisely the situation you are in, so that you can get back into your config. You now have the more immediate problem of how to get back in. You might prefer to do a factory reset - or if you have a linux box, you can use Network Manager to set up a network connection on vlan10. Perhaps you can do the same from Windows too, but I don't know.
Thanks a lot for the replies, especially the tip about keeping an eth on vlan1, with that i was able to keep access and test further, with my surprise everything works as it should (for some reason it wasn’t the case before, and the only change was “/interface bridge port add bridge=BR1 interface=ether1”) so i can start adding things with a working base config.
I’m left with the question on how to keep winbox access with the eth1 untagged on vlan10 as well, I would expect to connect via the gw (10.0.10.1) but that’s not the case, do you have any hint?
Firstly, the author wrote a diagram and asked how it should work, and the answer was given. What he wants to do and whether he needs any more advice—we don't know, and we're not interested. I hope he's doing well.
Secondly, there shouldn't be any MGMT, VLAN isolation across horizons, or bridge filtering. This is all nonsense. Because the web interface is inconvenient, and the author will have to configure everything in WinBox, which a) securely encrypts the connection, and b) requires a password of 16 or more characters, which we a priori consider impossible to crack.
What's worth mentioning is:
a) for WiFi, we usually use dynamically adding bridge ports and a VLAN table, because the WiFi settings have a life of their own and are still full of errors. For example, /interface/wifi/reset wifi1 doesn't delete all the settings. Why Mikrotik?
b) a regular firewall is sufficient to isolate access and will be redundant for us; no rules for bridges, etc. are needed since they have their own specifics.
You lose access because all ports and WiFi are put into VLANs without a safe untagged management path, so when vlan-filtering is enabled Winbox traffic is dropped. Leave at least one Ethernet port untagged for management or keep the main LAN and main WiFi on the native bridge, and only place the guest WiFi on VLAN20. If you are already locked out, factory reset or connect using a VLAN-aware interface to regain access, then rebuild the VLANs step by step.
Thanks @gardlaerk for the extensive review, I’ve implemented some of the things you listed, but still haven’t found a solution there in order to keep eth1 untagged on vlan10 like the others and be able to access mgmt.
I just need an in-bound management access as i don’t want to deviate from the design above and not want to waste a port for mgmt only (although I recognize it’s another security layer), there should be a knob to turn to enable that..
We don't know what the current config is. And you are trying to combine multiple recommendations, and we don't know which recommendations you have used.
Please post in a </> (preformatted text) block, e.g. before pasting, press Ctrl-E or click the </> icon at the top. Then where is says "type or paste code here" paste in the output of your sanitized config (remove your serial number)
You should be able to connect to winbox when vlan-filtering is on. There must be something in your config that is preventing it.
I can't comment on the wifi config, because I don't have any MikroTik routers with wifi built in.
Here is the updated configuration: https://pastebin.com/b0S2tTHc
I’m able to access to winbox via eth1 (via MAC address) as I kept eth1 on BR1 on native vlan, I still have no way to access it from vlan10.
As a temporary solution, I found out I can use webfig (the tmp rule is for that) from vlan10 by pointing at the gw address, I would like to be able to do the same for winbox but I keep seeing 0.0.0.0 ip address there.
Note: before making any changes you get from the forum, backup your config using both back (under files) and export and save off the router. This gives you a way back in case the advice was not correct.
If vlan10 is your trusted vlan and where you want to be able to access the router via winbox, then you need to add vlan10 as a member of the LAN list.
This is controlled here:
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Here's what you currently have:
/interface list member
add comment=defconf interface=BR1 list=LAN
add interface=sfp1 list=WAN
you need to add vlan10 so your config would look like this:
/interface list member
add comment=defconf interface=BR1 list=LAN
add interface=vlan10 list=LAN
add interface=sfp1 list=WAN
Then connect to ether2 and verify you can connect the the router with winbox.
After you verify you have access from ether2, you can then change the pvid on ether1 to 10.
After that, then all your RJ45 ethernet ports will be on vlan10.
I think it should still allow access to winbox if you remove BR1 from the LAN list, since you won't have access to it anyway. But I am not sure if that's the case, so if you do remove it, then you should remove it when using safe mode. I would also remove the disabled entry for spf1 in the /interface bridge port stanza
