Help with vlans on RB5009

RouterOS Beginner Basics
1

Hello, Mikrotik newbie here. After watching The Network Berg’s tutorials on setting up VLANS, I decided to attempt setting up bridge VLAN filtering on my RB5009. All is mostly good, VLAN filtering is indeed working, DCHP is functional for those interfaces and my management VLAN is working as intended. The issue I’m currently having is, my management VLAN is the *only* VLAN that has internet connectivity. I would like to allow my Trusted, Untrusted and VOIP VLANs to access the internet as well.

I haven’t changed firewall settings or nat past their defconf. I did manually add DNS servers in DHCP network settings for the Trusted VLAN to test, but I’m unsure if that’s the issue, since I can’t ping IPs or domain names.

# RouterOS 7.20.2
#
# model = RB5009UPr+S+
#
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge pvid=\
    10 vlan-filtering=yes
/interface vlan
add interface=bridge name=Camera vlan-id=40
add interface=bridge name=Management vlan-id=10
add interface=bridge name=Trusted vlan-id=20
add interface=bridge name=Untrusted vlan-id=50
add interface=bridge name=VOIP vlan-id=30
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=MGMT
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=Management ranges=192.168.10.2-192.168.10.5
add name=Trusted ranges=192.168.20.2-192.168.20.52
add name=VOIP ranges=192.168.30.2-192.168.30.5
add name=Camera ranges=192.168.40.2-192.168.40.5
add name=Untrusted ranges=192.168.50.2-192.168.50.52
/ip dhcp-server
add address-pool=Management interface=Management name=Management
add address-lists="" address-pool=Trusted interface=Trusted name=Trusted
add address-pool=VOIP interface=VOIP name=VOIP
add address-pool=Camera interface=Camera name=Camera
add address-pool=Untrusted interface=Untrusted name=Untrusted
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridge comment=defconf interface=ether4 pvid=30
add bridge=bridge comment=defconf interface=ether5 pvid=40
add bridge=bridge comment=defconf interface=ether6 pvid=20
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether7 pvid=20
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged \
    interface=ether8 pvid=10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether3 pvid=10
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/interface bridge vlan
add bridge=bridge comment=Management tagged=ether8,ether3,bridge untagged=\
    ether2 vlan-ids=10
add bridge=bridge comment=Trusted tagged=ether8,bridge,ether3 untagged=\
    ether6,ether7 vlan-ids=20
add bridge=bridge comment=VOIP tagged=bridge,ether8 untagged=ether4 vlan-ids=\
    30
add bridge=bridge comment=Camera tagged=ether8,bridge untagged=ether5 \
    vlan-ids=40
add bridge=bridge comment=Untrusted tagged=bridge,ether3 vlan-ids=50
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=Management list=MGMT
add interface=Management list=LAN
/ip address
add address=192.168.10.1/24 comment=Management interface=Management network=\
    192.168.10.0
add address=192.168.20.1/24 comment=Trusted interface=Trusted network=\
    192.168.20.0
add address=192.168.40.1/24 comment=Camera interface=Camera network=\
    192.168.40.0
add address=192.168.30.1/24 comment=VOIP interface=VOIP network=192.168.30.0
add address=192.168.50.1/24 comment=Untrusted interface=Untrusted network=\
    192.168.50.0
/ip dhcp-client
add comment=defconf interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.10.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,1.1.1.2
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    in-interface-list=LAN ipsec-policy=out,none out-interface-list=WAN
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
set www-ssl disabled=no
/ipv6 firewall address-list
add address= comment="defconf: unspecified address" list=bad_ipv6
add address= comment="defconf: lo" list=bad_ipv6
add address= comment="defconf: site-local" list=bad_ipv6
add address= comment="defconf: ipv4-mapped" list=bad_ipv6
add address= comment="defconf: ipv4 compat" list=bad_ipv6
add address= comment="defconf: discard only " list=bad_ipv6
add address= comment="defconf: documentation" list=bad_ipv6
add address= comment="defconf: ORCHID" list=bad_ipv6
add address= comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port= protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port= protocol=\
    udp src-address=
add action=accept chain=input comment="defconf: accept IKE" dst-port= \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\ protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=America
/tool mac-server
set allowed-interface-list=MGMT
/tool mac-server mac-winbox
set allowed-interface-list=MGMT

I’m sure there’s something silly I’m overlooking, but would appreciate any feedback!

2

Hi and welcome.

Best to add your VLANs in interface list and then use those in your firewall forward rules as needed (and probably also some in input chain).

3

To expand on the above, you have 5 VLAN interfaces:

of these, ONLY Management is added in interface list as LAN:

and coincidentally :wink:, it is the only one that has access to the internet.

In the defconf firewall rules there is this one:

add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN

that prevents anything that is not LAN to access the router, but also the NAT:

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    in-interface-list=LAN ipsec-policy=out,none out-interface-list=WAN

is only for packet coming from LAN (and going to WAN), and you won't have internet without nat.

4

Most of the relevant comments have already been made.
What I recommend is that you access the router and the configuration, safely, from an Off Bridge port, that will stay up even if something untoward happens on vlan or bridge settings.

Since it appears you do not have any spare ports, suggesting you use ether2 which you currently use as a management port. If the Bridge or associated vlan burps on you, that access will be meaningless but the offbridge port will still function and allow access. Another option is to use your sfp-sfpplus1 port

Step1: Ensure you are accessing the router config from the TRUSTED vlan, temporarily, since we will be moving you off of ether2.
/interface list member
add interface=Trusted list=MGMT

Then plug computer into ether7 to access config.

Step3. Enter the config via ether7, and do the following (including taking ether2 off the /interface bridge port aka remove the first entry referring to ether2):

/interface ethernet
set [ find default-name=ether2 ] name=OffBridge2
/ip address
add address=192.168.77.1/30 interface=OffBridge2 network=192.168.77.0
/interface list member
add interface=OffBridge2  list=LAN
add interface=OffBridge2  list=MGMT
/interface bridge vlan
add bridge=bridge comment=Management tagged=ether8,ether3,bridge  vlan-ids=10

Then you only need to plug your laptop into ether2, change your ipv4 settings to 192.168.77.2 and with username and password you are in!.
Now you can remove the temporary interface=Trusted from the MGMT interface list membership.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
As for the config. The first thing to do is remove pvid 10 from the bridge, it needs to remain the default vlan-id=1, which works in the background as a glue. You can however add frame-type=admit-only-vlan-tagged. Removed unused pool. Added frame types to all /interface bridge port entries..
Confusion on ether8, its either access port (with pvid) or trunk port (admit only vlan tagged).
I used /interface bridge vlan settings to indicate truth ( removed the incorrect pvid entry )
Same problem with etherport3, conflict in that you state only vlans but also have a pvid.
MISSING three /ip dhcp-server network settings!
For better security overall to access router etc. we need to isolate all users ( especially untrusted) except admin, from access but still provide DNS service to all, we adjust input chain rules. Forward chain rules modified for clarity. if not using ipv6, disable services, remove firewall address lists and leave only two firewall rules. Mac server tool by itself is set to none (no security).

/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge pvid=1 \
    vlan-filtering=yes  frame-types=admit-only-vlan-tagged
/interface vlan
add interface=bridge name=Camera vlan-id=40
add interface=bridge name=Management vlan-id=10
add interface=bridge name=Trusted vlan-id=20
add interface=bridge name=Untrusted vlan-id=50
add interface=bridge name=VOIP vlan-id=30
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=MGMT
/ip pool
add name=Management ranges=192.168.10.2-192.168.10.5
add name=Trusted ranges=192.168.20.2-192.168.20.52
add name=VOIP ranges=192.168.30.2-192.168.30.5
add name=Camera ranges=192.168.40.2-192.168.40.5
add name=Untrusted ranges=192.168.50.2-192.168.50.52
/ip dhcp-server
add address-pool=Management interface=Management name=Management
add address-lists="" address-pool=Trusted interface=Trusted name=Trusted
add address-pool=VOIP interface=VOIP name=VOIP
add address-pool=Camera interface=Camera name=Camera
add address-pool=Untrusted interface=Untrusted name=Untrusted
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether3
add bridge=bridge frame-type=admit-only-priority-and-untagged interface=ether4 pvid=30
add bridge=bridge frame-type=admit-only-priority-and-untagged  interface=ether5 pvid=40
add bridge=bridge frame-type=admit-only-priority-and-untagged interface=ether6 pvid=20
add bridge=bridge frame-type=admit-only-priority-and-untagged interface=ether7 pvid=20
add bridge=bridge  frame-types=admit-only-vlan-tagged  interface=ether8 
add bridge=bridge comment=defconf interface=sfp-sfpplus1  disabled=yes ???
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge comment=Management tagged=ether8,ether3,bridge vlan-ids=10
add bridge=bridge comment=Trusted tagged=ether8,bridge,ether3 untagged=\
    ether6,ether7 vlan-ids=20
add bridge=bridge comment=VOIP tagged=bridge,ether8 untagged=ether4 vlan-ids=\
    30
add bridge=bridge comment=Camera tagged=ether8,bridge untagged=ether5 \
    vlan-ids=40
add bridge=bridge comment=Untrusted tagged=bridge,ether3 vlan-ids=50
/interface list member
add interface=ether1 list=WAN
add interface=Trusted list=LAN
add interface=VOIP list=LAN
add interface=Camera list=LAN
add interface=Untrusted list=LAN
add interface=Management list=LAN
add interface=OffBridge2 list=LAN
add interface=Management list=MGMT
add interface=OffBridge2 list=MGMT
/ip address
add address=192.168.10.1/24 comment=Management interface=Management network=\
    192.168.10.0
add address=192.168.20.1/24 comment=Trusted interface=Trusted network=\
    192.168.20.0
add address=192.168.40.1/24 comment=Camera interface=Camera network=\
    192.168.40.0
add address=192.168.30.1/24 comment=VOIP interface=VOIP network=192.168.30.0
add address=192.168.50.1/24 comment=Untrusted interface=Untrusted network=\
    192.168.50.0
add address=192.168.77.1/30 interface=OffBridge2 network=192.168.77.0
/ip dhcp-client
add comment=defconf interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.20.1
add address=192.168.30.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.30.1
add address=192.168.40.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.40.1
add address=192.168.50.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.50.1
(edit good eyes cgg!!)
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,1.1.1.2
/ip firewall filter
{ default rules to keep }
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
{ admin rules }
add action=accept chain=input comment="admin access" in-interface-list=MGMT
add action=accept chain=input comment="users to services"  in-interface-list=LAN \
   dst-port=53 protocol=udp 
add action=accept chain=input comment="users to services"  in-interface-list=LAN \
   dst-port=53 protocol=tcp
add action=drop chain=input comment="drop all else" { put rule here, but last of all rules entered }
+++++++++++++++++++++
{ default rules to keep }
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
{ admin rules }
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN \
   out-interface-list=WAN
add action=accept chain=forward comment="admin to vlans"  in-interface-list=MGMT \
   out-interface-list=LAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat \
   disabled=yes    {enable if required, otherwise remove }
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    in-interface-list=LAN ipsec-policy=out,none out-interface-list=WAN
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
set www-ssl disabled=no
/ipv6 firewall filter
add action=drop  chain=input
add action=drop  chain=forward 
/system clock
set time-zone-name=America
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=MGMT
5

Note: edited to correct my initial understanding (I didn't notice that there was a vlan 10 interface and assumed (incorrectly) that vlan 10 was associated with the untagged traffic from the bridge. But the ip address is assigned to the management vlan interface (bridge.10) and not the bridge.

It is more conventional to just not specify the pvid on the bridge and let it remain the default pvid 1. If you don't have any ip address assocated with the bridge, it will not be a way into the router. If you are going to specify a pvid, in my opinion, it would be better to use an unused vlan id than to overload it with the same vlan id as is used by a vlan interface on the bridge.

Before making any changes (especially ones suggested on forums or web resources that you don't understand) always make backup and export of what you currently have so you will have a way back if things don't go as expected.

As already suggested by @jaclaz and @holvoetn

Should be changed to

/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
add interface=Management list=MGMT
add interface=Management list=LAN
add interface=Trusted list=MGMT comment="Allow Trusted access to MGMT while configuring - Alternative to anav's offbridge"
add interface=Management list=LAN
add interface=Untrusted list=LAN
add interface=VOIP list=LAN

This is the simplest change to allow the access you specified. After adding the vlan interfaces you want to access the internet to the LAN list, they should be able to access the internet.

However, as @holvoetn mentioned, since you are creating vlans, you will probably want to limit access between the vlans, and this won't do that.

This should give Management (and Trusted) access to the RB5009 while you are making changes. Once you have things working, and you are sure you still have access from Management, you can remove Trusted from the ability to access the RB5009 itself, but while you are learning, having more than one door into the RB5009 can prevent the need to reset the router. Unfortunately the RB5009 does not have a dedicated Console port (I think they realized their oversight, because they added one to the L009), I don't know what they were thinking when they released "the perfect home lab router" without a serial console (all the previous home lab routers: RB2011, RB3011, RB4011 did have Cisco compatible RJ45 serial console ports) but that's water under the bridge.

The point is you don't want to make it easy to lock yourself out while you are configuring the router. Removing a port from the bridge is what anav suggests, but it isn't as flexible as having a dedicated vlan.

Personally I wouldn't make the change suggested by anav (removing a port from the bridge), but I am reasonably comfortable using vlans on ROS. The important key is to be careful not to make changes to your config that will affect the interface you are connected through (don't saw off the branch you are sitting on).

You are already past the stage that most people lock themselves out, but you currently only have access to RB5009 management from ether2 via untagged vlan 10 on the bridge interface. It appears you already have a vlan interface for vlan 10, so normally you would not specify a pvid for the bridge that was the same, it isn't "wrong", just confusing to use pvid 10 for the bridge, because that will make it appear that both the bridge and management (bridge.10) are both associated with vlan 10.

What is connected to ether3 and ether8? If they are vlan-aware switches, be aware they will not have access to vlan 10 with untagged traffic (even though you have specified pvid 10), because you have blocked ingress to untagged ethernet frames on ether3 and ether8. Although what you have will work as long as the switches are configured to send and receive vlan 10 via tagged ethernet frames, setting a pvid to the same vlan as is being used for tagged traffic is at least confusing. In my opinion it would be much better to leave the pvid unspecified (which will use the default vlan 1). At any rate, you must be sure that devices on the trunk link agree whether a specific vlan will use untagged or tagged traffic and all use either untagged or tragged for that vlan id. The pvid specifies what vlan will be associated with ingress frames that are not vlan tagged. Whether egress traffic for the vlan is tagged or not is controlled by /interface bridge vlan.

Last suggestion. If you don't understand why people are suggesting a specific change, don't make the change until you do understand. I.e. don't blindly make changes suggested by forum members without understanding. In general we are not MikroTik employees, just users of MikroTik equipment, and we may make incorrect suggestions.

6

I disagree with buckeyes, advice, an offbridge port works very well and has saved many, much time and grief ( especially new users ). He is dead wrong about a vlan being a safe haven. If the bridge burps then all vlans attached to the bridge become un-accessible.

However, what he does state, that is bang on, is to ask questions first, then make changes after, if not sure of anything. The other sage comment he made was ensuring you don't cut off the branch you are working from mid-stream.
That is why I said to temporarily include the Trusted vlan under the MGMT interface list, so that you coudl then switch your PC to ether7 and gain access to the config. Clearly if successful in doing so, you are now free to play with Ether2 and turn it into an OFFBridge port. Once that is setup and you connect your PC back on ether2, using the prescribed address 192.168.77.2 on ipv4 settings, then after some time you you can elect to remove Trusted from the MGMT interface list ( assuming all the other recommended changes have been made first ). So yes order is important.

7

I edited my previous post, because I hadn't read the config closely enought and assumed that the pvid on the bridge (10) was being used as the access to vlan 10. But that was an incorrect assumption. I didn't notice that the ip was associated with the management vlan interface, and that a vlan interface for vlan id 10 already existed.

Whether you want to dedicate a port to management is up to you. It you want to be able to access the management interface from switches connected to ether3 and ether8, my opinion is that using a dedicated vlan is more flexible. On the other hand, having a dedicated port that has access to the router can be a "get out of jail free" card, and because the RB5009 has no dedicated RJ45 serial console, it may be worth giving up a port, especially if you have other managed switches connected to ether3 and ether8 with extra ports. And having a dedicated offbridge port with management access doesn't preclude having a management vlan 10 in addition to the off bridge port.

8

I appreciate the in-depth reply!

Ether3 is a trunk port to a cAP ax, and ether8 is a trunk port to my CSS switch. Should've included that but forgot to mention it. I was initially confused about why those ports would be conflicting, but it makes sense now why trunks shouldn't have a PVID set (D'oh moment for me).

With all the VLAN work ahead, I may very well add an off-bridge port. Ether6 and ether7 aren't currently being used, so I may use one of those instead of eth2.

In reference to removing pvid 10 from the bridge and re-adding the default pvid of 1, what's the general rationale with keeping it the default pvid 1? Not doubting you, just want to better understand the function of the default VLAN

9

There is a very very niche reason for using vlan-id on the bridge, it escapes me at the moment, but your setup is pretty standard and that includes leaving the default vlan ID in place. We use the /interface bridge port and /interface bridge vlan to control traffic flow. If you noticed I did add frame types to the bridge setting which prevents any rare but potential leakage from a device communicating untagged over vlan1.

10

Generally as soon as we start explicitly configuring VLANs, we keep away from using VLAN ID 1 ... not because it's a particularly bad value, but because default config uses it all over the place and (since it's default) export won't show it. So whenever one changes things related to VLAN 1, it's only too easy something to go wrong because one forgot to change it elsewhere.

Now, when it comes to PVID set on bridge interface ... it's more subjective. To me, this might make sense on a switch, which will only have a single interface with IP address (for managment) and that one might as well be bridge interface (and in this case with PVID set to MGMT VLAN ID).
But when we're talking about router with many IP addresses, all (but one[*]) will have to be attached to appropriate VLAN interfaces. Since any of those interfaces can be (from L3 perspective) used for management, none are "more equal than the rest" (which might warrant to place that IP address on bridge). Hence suggestion to use bridge interface as a trunk (frame-types=admit-only-vlan-tagged which makes pvid setting irrelevant). And if PVID setting is irrelevant, then it might be set to default value as well ...

[*] It is possible to make any interface (including bridge interface) untagged member of one single VLAN (by setting pvid and frame-types=admit-all). One must then thing about which VLAN deserves "special" treatment. In addition, L2 and L3 configuraiton of that VLAN will be different that for the rest of VLANs ... which means one has to look for that fragment of config in different place (e.g. corresponding VLAN ID under /interface/bridge looking for pvid as compared to checking /interface/vlan ) or under different names (e.g. IP address set to interface bridge instead of vlanXX ... which by itself adds meta information in case of meaningful VLAN interfae names).

11

When you get a managed switch (from most vendors), the default out of the box configuration will "work" similarly* to a dumb switch, i.e. if you plug one of the ports into the "LAN" port of an upsteam router, and plug PCs into other ports, they will all be able to communicate freely using untagged standard ethernet frames. To allow this, one vlan is pre-defined, vlan 1. And all ports are predefined to be access ports for vlan 1. If you don't specify a different vlan, vlan 1 will be used internally, but externally there is no tagging of any packets.

*Some switches allow you to set the switch to be vlan-transparent (similar to the when vlan-filtering is off and frame-types=admit-all) in which case tagged frames get forwarded as is, the vlan-tag is just ignored, but my HP 1810-24G (J9803A) does not allow that, it always has vlan-filtering=on (always vlan-aware), so in default config, any tagged frames will just be dropped, which is expected behavior when all ports are configured as access ports in the same vlan.

MikroTik also uses the term "Default vlan" in SwOS to mean the PVID, or the vlan that a received untagged ethernet frame will be classified as belonging to.

MikroTik uses the term Hybrid port for a link carrying at least two vlans, where one of the vlans is untagged on the wire. Which vlan in the switch the untagged frames belong to is implicitly defined by the pvid of the receiving switch-port. In Cisco terminology, the untagged vlan is called the "native vlan" when a trunk is involved, and an "access vlan" when it is configured as an access port.

One of the things thats makes learning vlans on MikroTik difficult is because ROS is very flexible, but also has many options. You have controll of many things that are hidden on other vendors equipment. Even in MikroTik's Router OS when you export a config, the default options are not printed. To see all the options you can use export verbose, but expect to be overwhelmed.

If you open a terminal in winbox, and compare the output of /interface bridge export vs /interface bridge export verbose, you can see how many options there are.

12

I appreciate everyone's replies. It's been frustrating, but this has been a good learning experience.

After looking over anav's config, I decided to revert to default config and then adopt the changes they suggested. Unfortunately, I'm still having the same issues as before. Management VLAN is the only VLAN with internet access.

Things I've tried/noticed:

  • I can ping out to the internet (both IPs and domain names) directly from the winbox terminal
  • Temporarily adding Trusted interface to MGMT interface list did nothing
  • Temporarily disabling all firewall rules also did nothing

Included my updated config. Been troubleshooting in my free time the past few days, but I'm just honestly stumped.

# RouterOS 7.20.2
# 
#
# model = RB5009UPr+S+
#
/interface bridge
add admin-mac= auto-mac=no comment=defconf frame-types=\
    admit-only-vlan-tagged name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether2 ] name=OffBridge2
/interface vlan
add interface=bridge name=Camera vlan-id=40
add interface=bridge name=Management vlan-id=10
add interface=bridge name=Trusted vlan-id=20
add interface=bridge name=Untrusted vlan-id=50
add interface=bridge name=VOIP vlan-id=30
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=MGMT
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=Management ranges=192.168.10.2-192.168.10.5
add name=Trusted ranges=192.168.20.2-192.168.20.52
add name=VOIP ranges=192.168.30.2-192.168.30.5
add name=Camera ranges=192.168.40.2-192.168.40.5
add name=Untrusted ranges=192.168.50.2-192.168.50.52
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=Management interface=Management name=Management
add address-pool=Trusted interface=Trusted name=Trusted
add address-pool=VOIP interface=VOIP name=VOIP
add address-pool=Camera interface=Camera name=Camera
add address-pool=Untrusted interface=Untrusted name=Untrusted
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged \
    interface=ether3
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether4 pvid=30
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether5 pvid=40
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether6 pvid=20
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether7 pvid=20
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged \
    interface=ether8
add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge comment=Management tagged=ether8,ether3,bridge vlan-ids=10
add bridge=bridge comment=Trusted tagged=ether8,bridge,ether3 untagged=\
    ether6,ether7 vlan-ids=20
add bridge=bridge comment=VOIP tagged=bridge,ether8 untagged=ether4 vlan-ids=\
    30
add bridge=bridge comment=Camera tagged=ether8,bridge untagged=ether5 \
    vlan-ids=40
add bridge=bridge comment=Untrusted tagged=bridge,ether3 vlan-ids=50
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=OffBridge2 list=LAN
add interface=OffBridge2 list=MGMT
add interface=Trusted list=LAN
add interface=VOIP list=LAN
add interface=Camera list=LAN
add interface=Untrusted list=LAN
add interface=Management list=LAN
add interface=Management list=MGMT
add interface=Trusted list=MGMT
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.77.1/30 interface=OffBridge2 network=192.168.77.0
add address=192.168.10.1/24 comment=Management interface=Management network=\
    192.168.10.0
add address=192.168.20.1/24 comment=Trusted interface=Trusted network=\
    192.168.20.0
add address=192.168.40.1/24 comment=Camera interface=Camera network=\
    192.168.40.0
add address=192.168.30.1/24 comment=VOIP interface=VOIP network=192.168.30.0
add address=192.168.50.1/24 comment=Untrusted interface=Untrusted network=\
    192.168.50.0
/ip dhcp-client
add comment=defconf interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.10.1
add address=192.168.30.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.10.1
add address=192.168.40.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.10.1
add address=192.168.50.0/24 dns-server=9.9.9.9,1.1.1.2 gateway=192.168.10.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,1.1.1.2
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="admin access" in-interface-list=MGMT
add action=accept chain=input comment="users to services" dst-port=53 \
    in-interface-list=LAN protocol=udp
add action=accept chain=input comment="users to services" dst-port=53 \
    in-interface-list=LAN protocol=tcp
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="admin to vlans" in-interface-list=\
    MGMT out-interface-list=LAN
add action=accept chain=forward comment="port forwarding" \
    connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
add action=drop chain=input comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    in-interface-list=LAN ipsec-policy=out,none out-interface-list=WAN
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
set www-ssl disabled=no
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=drop chain=input
add action=drop chain=forward
/system clock
set time-zone-name=America
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=MGMT
13

The issue is probably here. In your DHCP Network entries you must specify the gateway to be the router's address in that subnet (the .1 address in the same subnet as the network address).

In your current config, your copy & paste actions made all the gateway to be 192.168.10.1, which is only valid for the 192.168.10.0/24 subnet, not the rest.

Fix the entries, and make the gateway 192.168.20.1, 192.168.30.1, 192.168.40.1, 192.168.50.1 accordingly.

14

Also, check the output of
/ip route print

15

And on the client PC's that can't get to the internet, open cmd prompt, then

ipconfig/all
route print
tracert 8.8.8.8
16

Changing the default gateways to match the vlan subnets was indeed the issue, and something I overlooked. Once again, I appreciate all the help that's been given in this thread.