I’ve recently setup my router using the default settings and latest OS version, things are working well.
I’d now like to add a VLAN into the mix, the purpose of this VLAN is to create a separate network which will be utilised by Unifi Access Points
Current configuration
Eth1 = WAN
Eth2 = LAN (192.168.100.0/24) This goes into my main Unifi Switch where all devices are connected
Default Bridge
[admin@MikroTik] /interface bridge port> print
Flags: X - disabled, I - inactive, D - dynamic, H - hw-offload
# INTERFACE BRIDGE HW PVID PRIORITY PATH-COST INTERNAL-PATH-COST HORIZON
0 H ;;; defconf
ether2-LAN bridge yes 1 0x80 10 10 none
1 I H ;;; defconf
ether6-master bridge yes 1 0x80 10 10 none
2 I ;;; defconf
sfp1 bridge no 1 0x80 10 10 none
3 I H ether3 bridge yes 1 0x80 10 10 none
4 I H ether4 bridge yes 1 0x80 10 10 none
5 I H ether5 bridge yes 1 0x80 10 10 none
6 I H ether7 bridge yes 1 0x80 10 10 none
7 I H ether8 bridge yes 1 0x80 10 10 none
8 I H ether9 bridge yes 1 0x80 10 10 none
9 I H ether10 bridge yes 1 0x80 10 10 none
I’d like to create a new VLAN, eg VLAN 10 and it have a network address of 10.0.10.0/24. What steps are required to implement this?
Appreciate any assistance.
Create a vlan sub-interface on the bridge with your relevant vlan number.
In “/switch vlan” create a vlan entry and add ether2 and switch1-cpu. You can also add other ports if they might handle vlan traffic. If it’s something like an RB2011 you may need to add switch2-cpu to the list to use ports 6+
Add an ip to the vlan interface and setup a dhcp server on it
just add a vlan to your bridge and add an ip to this new interface. next you need to tag the vlan at your ubnt device, and use it for your requirements.
I’ve made the suggested changes, does everything look ok? Any obvious mistakes?
When I try connect to the UniFi wireless network, it has VLAN 10 set, it fails trying to obtain IP address.
I think as a starting point I want to first take Unifi and the main switch connected on Eth2 out of the equation. If I can connect a PC to Eth3, and get an IP on the VLAN 10, that would be a good start. Is there anything additional I might need to achieve this?
I’m not sure why the majority of the suggestions are pre-6.41 since that hasn’t been the case for almost a year now. You’ve got most of it right but here is what needs to happen.
Do not use the Switch setup. That’s wrong, it’s done via the Bridge now.
Under Bridge go to the VLAN tab, you’ll want to add a new VLAN. Add the VLAN ID where it asks and then add the bridge itself and the ether ports (3 in this case) that need to be tagged.
Enable VLAN Filtering on the Bridge.
Having the VLAN interface as a port on the bridge, correct.
Having the DHCP/IP Addresses assigned to the VLAN interface, correct.
You just need to set this up on the bridge instead of the switch interface.
I already have this setup using a different name, will this be ok?
[admin@MikroTik] /interface vlan> print
Flags: X - disabled, R - running, S - slave
# NAME MTU ARP VLAN-ID INTERFACE
0 R vlan10_Guest 1500 enabled 10 bridge
I’m very happy to be corrected, but for my own education, I hadn’t understood is as being as binary as using the switch menu before 6.41 and VLAN filtering after. My understanding was that if there was a VLAN switching requirement, you should still use the switch menu for devices with a switch chip, rather than VLAN filtering on the bridge, in order to maintain HW offload and wirespeed switching (with the exception of the crs3xx range that can maintain HW offload using VLAN filtering on the bridge).
If I’ve understood correctly, the answer given is right for the eth1 and eth2 question being asked by the OP as there is no switching going on. But wouldn’t there be benefit even after 6.41 to using the switch menu and chip to maintain HW offload if eth3, eth4 etc. were also used with VLAN’s?
@diddie17, you are 100% correct, if you want to switch VLAN’s, i.e. Ether3 and ether4 is in same vlan, then it is best to use switch vlan config except for crs3xx devices.
Between VLAN’s will happen with routing and this will go via cpu
Getting closer, when I connect to PC to Eth3 I now get an IP in the 10.0.10.0 subnet, however it can’t access the internet, or ping google dns 8.8.8.8.
Am I missing something? I’ve not put in any firewall rules to block traffic, the same rules remain as before I started trying to add this VLAN.
Traffic on the 192.168.100.0 subnet is fine, and has full connectivity.
