How do I make VLANs see each other?

Good evening, gentlemen. Faced with such a task , you need to make the VLANs see each other. At the moment, there are 5 local area networks:
10.0.10.0/24-main
10.0.20.0/24
10.0.30.0/24
100.100.100.0/24
192.168.0.0/24

Here is stuck on what needs to be done so that the main local network sees all the others and has access to them. Help please

Well in general my last rule in the forward chain (forward filter firewall rule) is
add chain=forward action=drop comment=“Drop all else”

So before this last rule make sure you have created and put in rules that will be before the last rule in the order.

Vlanhome to internet (10.0 subnet)
VLANX to internet
VLANY to internet
etc…

Now for the rule you wish,
add chain=forward action= accept in-interface=vlanhome src-address=192.168.10.0/24 dst-address-list=MYOTHERVLANs

You will need to make a firewall address list and all your vlans to it.
192.168.20.0/24=MYOTHERVLANS
192.168.30.0/24=MYOTHERVLANS
etc…


The other way to do this instead is make a interface list called myothervlans
add add vlans to the interface list… then the rule looks like
add chain=forward action= accept in-interface=vlanhome src-address=192.168.10.0/24 out-interface-list=myothervlans

What @anav tried to write is: routing entity of ROS tries to forward traffic between all connected networks (i.e. those that router has own IP address or knows a suitable gateway). And firewall entity of ROS can prevent connectivity if configured appropriately.

But then there are firewalls on individual devices which might drop any inbound (and most outbound) connections if they originate from “alien” subnets … and this part of non-connectiviry has nothing to do with the way routers/firewalls are configured.

It all started after I was helped to solve the issue here: viewtopic.php?f=13&t=158677 . Now, I don 't even have access to my main host(10.0.10.251). If I delete one of the routes, it loses its external IP, but then I can access any of their local networks

You need other rules before those you have now:

/ip route rule
add dst-address=10.0.10.0/24 action=lookup-only-in-table table=main
...

You can probably add whole 10.0.0.0/8 and 192.168.0.0/16.

Btw, it would have made more sense to continue in previous thread, because there’s no chance that anyone could help you with this one without additional info.

Sob, you kill me with these routing solutions for everything.
Its like the movie, My BIg Fat Greek Wedding - where I learned the magic properties of windex.
For MT routers apparently all one need is the right route rule. :wink:)))

As for MKX, I am still laughing. What I said was clear but somehow you managed to convey what I said to be the most mangled mumbo jumbo you have written lately.
10/10 from the anavconfusometer

First of all, I’m glad OP’s problem is being resolved.


You’re reflecting my own sentiments but for one post earlier :wink: so let’s hope some random readers wandering around and stumbling upon this thread will understand one of the two posts. And we can call reader which understands both posts a weirdo :laughing:

Unfortunately, this method does not work. I can’t even access my main gateway (10.0.10.251). You have to connect to Mikrotik at the mac address

Then we need more info. Config is good start, then some description of exact steps that don’t do what you expect, etc.

Here you are
myconfig.rsc (7.19 KB)

Can you show “/ip route rule” block with exact added rules according to my previous post, that didn’t fix the problem? Because I think it should fix it, just make sure the new ones are before others.

[admin@rd-router] /ip route rule> print
Flags: X - disabled, I - inactive
0 src-address=193.25.176.156/32 action=lookup table=156-ip

1 src-address=193.25.176.157/32 action=lookup table=157-ip

2 src-address=193.25.176.158/32 action=lookup table=158-ip

3 src-address=10.0.10.0/24 action=lookup table=156-ip

4 src-address=10.0.0.0/8 action=lookup-only-in-table table=main

5 src-address=192.168.0.0/24 action=lookup table=156-ip

6 src-address=10.0.20.0/24 action=lookup table=157-ip

7 src-address=10.0.30.0/24 action=lookup table=158-ip

8 src-address=192.168.10.0/24 action=lookup table=156-ip

9 src-address=192.168.0.0/16 action=lookup-only-in-table table=main

Make a small change, drag current rules #4 and #9 to top, so that their new positions are #0 and #1.

And one more thing, these new ones should have dst-address, not src-address.

Completely fucked up… I’m in shock… Sorry for the abusive words, but just no words

Sob, thank you very much! Writte me please your PayPal address, I will thank you

It was quick and simple, “thank you” in words is enough. :slight_smile:

Listen, please tell me one more thing, how can I give the opportunity to exchange packets between devices on different networks? For example, I have a server that has IP 10.0.20.11, and the laptop has 10.0.20.199. I can turn to the gateway, but not to the devices. Is this configurable in the firewall filter?

Both 10.0.20.11 and 10.0.20.199 are in same subnet, router does not do anything with their communication. Depending on how you have things connected, it may not be even passing through router, it could be just through some connected switch.

Even different subnets, those need to pass through router, but you have nothing in filter (/ip firewall filter chain=forward), so everything is allowed.

In any case, don’t forget to check target device’s own firewall, if it allows access from source device.

I try to access these local networks from 10.0.10.100 (dhcp on the main pc gave me such an address). Should I create rules for in the filter?

It won’t help. As I wrote, no rules = everything allowed.

Try some simple debugging, you can watch traffic on interface with Tools->Torch. If you’re going from 10.0.10.100, it will be on bridge-main. If you look there, you should see packets from 10.0.10.100 to 10.0.20.x. Destination is on vlan-srv157, so you should see the same packets there. If you do, it means they passed through router and went to server. And then it’s up to server to send something back (check if rx column shows anything). If the server is not sending anything back, then check server config.