I bought a RB2011UAS-2HnD-IN to learn RouterOS.
I have set up three networks and each has its own WLAN+LAN. In order to separate the networks I have created a firewall rule. This works but I would like to work with VLANs.
add action=drop chain=forward comment=“Drop bridge-LAN2 to bridge-LAN1” dst-address=192.168.1.0/24 in-interface=bridge-LAN2
add action=drop chain=forward comment=“Drop bridge-LAN2 to bridge-LAN3” dst-address=10.13.0.0/24 in-interface=bridge-LAN2
add action=drop chain=forward comment=“Drop bridge-LAN3 to bridge-LAN1” dst-address=192.168.1.0/24 in-interface=bridge-LAN3I’ve tried quite a bit but that has everything does not work. I do not understand the logic (VLAN Interface >> bridge or EtherPort / IP address interface >> VLAN or bridge?) The VLANs are only to be used just “Internal” (all Access Ports). If this works I would like LAN1 a switch use with other VLANs (trunk ports or hybrid). But first, step by step, I wont to learn and understand.
Can anyone explain how I can do that with the VLAN in my example? Thanks!
If You use ether6 as Mater interface and attach other etherX to him as SLave - this is Hardware bridge (switch)
If You create Bridge interface and attach Physical interfacaes like etherX - this is Software bridge.
In Your configuration You dont need use VLAN, simple create the Bridges add address to it, add neccessaries interfaces, and separate netwroks with firewall rules (also you can use routing rules for separate).
OK I will try that again. I think I understand it…
VLAN interface attach to BRIDGE >> config VLAN trunk port
IP address attach to VLAN >> config VLAN access port
VLAN interface attach EtherPort >> same as Bridge but only on one port
With the firewall rule I block access from LAN3 (10.13.0.0/24) and LAN2 (10.14.0.0/24) to LAN1 (192.168.1.0/24) etc. LAN1 (192.168.1.0/24) has access to LAN2/3… I would remove it if it works with the VLAN. (oh… I have seen that I have wrong IP addresses in the drawing)
I’m a beginner here (received my router yesterday afternoon) so I might be getting it wrong. I’m migrating from a managed switch to a router, and I had the same questions in mind.
I think for working with VLAN’s the same way you would work in a switch, you need to configure the “switch” tab in RouterOS. There, you can create a VLAN and attach ports to it. You can also choose the tagged/untagged behaviour with the “add if missing/always strip” VLAN header option. This configuration is checked before the master-port one according to the documentation.
