Help with config

[sticky911]

Your firewall rules are where the most work is needed, its clear you got mixed up or at least didnt think through the logic.
For example you have the office vlan accessing the training vlan and then you have the training vlan accessing the office vlan.

But you dont use vlan subnets you actually use interface lists which included other vlans
a. not targeted, by using internal for example you give training access to office AND Mgmt.… .
b. nonsensical, if you wish a to originate traffic to access b, and then you wish b to originate traffic to access a,
THEN THERE IS LITTLE POINT IN HAVING TWO SEPARATE VLANs.

what might make sense, is that you want to give the office access to training, and thats it.


Suggested changes:

1./interface bridge port
add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=99
add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether5

2. /interface detect-internet
   set wan-interface-list=NONE

3. FOUR VLANS and pools etc, but FIVE /ip dhcp-server network entries ???
   Remove the entry for the fictitious 192.168.1.3.0 entry.

4_. /interface list member
add interface=ether1 list=WAN
add interface=Office_VLAN list=LAN
add interface=Training_VLAN list=LAN
add interface=Mgmt_VLAN list=LAN
add interface=Guest_VLAN list=LAN
add interface=Office_VLAN list=Internet
add interface=Guest_VLAN list=Internet
add interface=Mgmt_VLAN list=Internet
add interface=Mgmt_VLAN list=Mgmt_

5. /tool mac-server
   set allowed-interface-list=none
   /tool mac-server mac-winbox
   set allowed-interface-list=Mgmt

6. /i_nterface bridge vlan
   add bridge=bridge1 tagged=bridge1,ether5 untagged=ether3 vlan-ids=10
   add bridge=bridge1 tagged=bridge1,ether5 vlan-ids=20,30
   add bridge=bridge1 tagged=bridge1,ether5 untagged=ether4 vlan-ids=99_

7. /ip firewall filter
   add action=accept chain=input connection-state=established,related,untracked
   add action=drop chain=input connection-state=invalid
   add action=accept chain=input protocol=icmp
   add action=accept chain=input comment=“Allow Mgmt_Vlan Full Access”
   in-interface-list=Mgmt
   add action=accept chain=input comment=“access to router DNS,NTP”
   in-interface-list=LAN dst-port=53,123 protocol=udp
   add action=acccept chain=input comment="access to router DNS tcp "
   in-interface-list=LAN dst-port=53 protocol=tcp
   add action=drop chain=input comment=“Drop all else” { PUT THIS RULE IN LAST }
   ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
   add action=fasttrack-connection chain=forward connection-state=established,related
   add action=accept chain=forward connection-state=established,related,untracked
   add action=drop chain=forward connection-state=invalid
   add action=accept chain=forward in-interface-list=Internet out-interface-list=WAN
   add action=accept chain=forward comment=“Office to Training”
   src-address=192.168.2.0/24 dst-address=192.168.1.0/24
   add action=accept chain=forward comment=“Training to Office Server(s)”
   src-address=192.168.1.0/24 dst-address=Officeserver-IP { if more than one server make a firewall address list to use }
   add action=accept chain=forward comment=“admin to all vlans” in-interface-list=Mgmt out-interface-list=LAN
   add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat disabled=yes { enable if required }
   add action=drop chain=forward comment=“Drop all else”

omg thank you… i guess i’m still too noob at this… was trying to follow one of the VLAN threads to setup previously… http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1