Good evening, gentlemen. Faced with such a task , you need to make the VLANs see each other. At the moment, there are 5 local area networks:
10.0.10.0/24-main
10.0.20.0/24
10.0.30.0/24
100.100.100.0/24
192.168.0.0/24
Here is stuck on what needs to be done so that the main local network sees all the others and has access to them. Help please
Well in general my last rule in the forward chain (forward filter firewall rule) is
add chain=forward action=drop comment=“Drop all else”
So before this last rule make sure you have created and put in rules that will be before the last rule in the order.
Vlanhome to internet (10.0 subnet)
VLANX to internet
VLANY to internet
etc…
Now for the rule you wish,
add chain=forward action= accept in-interface=vlanhome src-address=192.168.10.0/24 dst-address-list=MYOTHERVLANs
You will need to make a firewall address list and all your vlans to it.
192.168.20.0/24=MYOTHERVLANS
192.168.30.0/24=MYOTHERVLANS
etc…
The other way to do this instead is make a interface list called myothervlans
add add vlans to the interface list… then the rule looks like
add chain=forward action= accept in-interface=vlanhome src-address=192.168.10.0/24 out-interface-list=myothervlans
What @anav tried to write is: routing entity of ROS tries to forward traffic between all connected networks (i.e. those that router has own IP address or knows a suitable gateway). And firewall entity of ROS can prevent connectivity if configured appropriately.
But then there are firewalls on individual devices which might drop any inbound (and most outbound) connections if they originate from “alien” subnets … and this part of non-connectiviry has nothing to do with the way routers/firewalls are configured.
It all started after I was helped to solve the issue here: viewtopic.php?f=13&t=158677 . Now, I don 't even have access to my main host(10.0.10.251). If I delete one of the routes, it loses its external IP, but then I can access any of their local networks
You can probably add whole 10.0.0.0/8 and 192.168.0.0/16.
Btw, it would have made more sense to continue in previous thread, because there’s no chance that anyone could help you with this one without additional info.
Sob, you kill me with these routing solutions for everything.
Its like the movie, My BIg Fat Greek Wedding - where I learned the magic properties of windex.
For MT routers apparently all one need is the right route rule. )))
As for MKX, I am still laughing. What I said was clear but somehow you managed to convey what I said to be the most mangled mumbo jumbo you have written lately.
10/10 from the anavconfusometer
First of all, I’m glad OP’s problem is being resolved.
You’re reflecting my own sentiments but for one post earlier so let’s hope some random readers wandering around and stumbling upon this thread will understand one of the two posts. And we can call reader which understands both posts a weirdo
Can you show “/ip route rule” block with exact added rules according to my previous post, that didn’t fix the problem? Because I think it should fix it, just make sure the new ones are before others.
Listen, please tell me one more thing, how can I give the opportunity to exchange packets between devices on different networks? For example, I have a server that has IP 10.0.20.11, and the laptop has 10.0.20.199. I can turn to the gateway, but not to the devices. Is this configurable in the firewall filter?
Both 10.0.20.11 and 10.0.20.199 are in same subnet, router does not do anything with their communication. Depending on how you have things connected, it may not be even passing through router, it could be just through some connected switch.
Even different subnets, those need to pass through router, but you have nothing in filter (/ip firewall filter chain=forward), so everything is allowed.
In any case, don’t forget to check target device’s own firewall, if it allows access from source device.
It won’t help. As I wrote, no rules = everything allowed.
Try some simple debugging, you can watch traffic on interface with Tools->Torch. If you’re going from 10.0.10.100, it will be on bridge-main. If you look there, you should see packets from 10.0.10.100 to 10.0.20.x. Destination is on vlan-srv157, so you should see the same packets there. If you do, it means they passed through router and went to server. And then it’s up to server to send something back (check if rx column shows anything). If the server is not sending anything back, then check server config.