How to access one VLAN from another VLAN (Inter-VLAN Connections)

Thanks for reporting back, and glad to hear it doesn’t allow it for you. How did you try to set it?

But I just did this on my hEX S with v7.2rc7

ubnt@ubnt:~$ ssh demo@192.168.241.94
demo@192.168.241.94's password:

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 7.2rc7 (c) 1999-2022       https://www.mikrotik.com/

Press F1 for help

[demo@MikroTik] > ip address/print
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
#   ADDRESS            NETWORK        INTERFACE
;;; defconf
0   192.168.88.1/24    192.168.88.0   BR-SW
1   192.168.89.1/24    192.168.89.0   ether5-off_bridge_wrk
2 D 192.168.101.87/24  192.168.101.0  ether1-WAN
3 D 192.168.241.94/24  192.168.241.0  vlan241
[demo@MikroTik] > ip address/set address=192.168.89.1/32 interface=ether5-off_bridge_wrk network=192.168.89.1
numbers: 1
[demo@MikroTik] > ip address/print
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
#   ADDRESS            NETWORK        INTERFACE
;;; defconf
0   192.168.88.1/24    192.168.88.0   BR-SW
1   192.168.89.1/32    192.168.89.1   ether5-off_bridge_wrk
2 D 192.168.101.87/24  192.168.101.0  ether1-WAN
3 D 192.168.241.94/24  192.168.241.0  vlan241
[demo@MikroTik] > ip address/set address=192.168.89.1/31 interface=ether5-off_bridge_wrk network=192.168.89.0
numbers: 1
[demo@MikroTik] > ip address/print
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
#   ADDRESS            NETWORK        INTERFACE
;;; defconf
0   192.168.88.1/24    192.168.88.0   BR-SW
1   192.168.89.1/31    192.168.89.0   ether5-off_bridge_wrk
2 D 192.168.101.87/24  192.168.101.0  ether1-WAN
3 D 192.168.241.94/24  192.168.241.0  vlan241
[demo@MikroTik] > ip address/set address=192.168.89.0/31 interface=ether5-off_bridge_wrk network=192.168.89.0
numbers: 1
[demo@MikroTik] > ip address/print
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
#   ADDRESS            NETWORK        INTERFACE
;;; defconf
0   192.168.88.1/24    192.168.88.0   BR-SW
1   192.168.89.0/31    192.168.89.0   ether5-off_bridge_wrk
2 D 192.168.101.87/24  192.168.101.0  ether1-WAN
3 D 192.168.241.94/24  192.168.241.0  vlan241
[demo@MikroTik] > ip address/set address=192.168.89.0/30 interface=ether5-off_bridge_wrk network=192.168.89.0
numbers: 1
[demo@MikroTik] > ip address/print
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
#   ADDRESS            NETWORK        INTERFACE
;;; defconf
0   192.168.88.1/24    192.168.88.0   BR-SW
1   192.168.89.0/30    192.168.89.0   ether5-off_bridge_wrk
2 D 192.168.101.87/24  192.168.101.0  ether1-WAN
3 D 192.168.241.94/24  192.168.241.0  vlan241
[demo@MikroTik] > ip address/set address=192.168.89.3/30 interface=ether5-off_bridge_wrk network=192.168.89.0
numbers: 1
[demo@MikroTik] > ip address/print
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
#   ADDRESS            NETWORK        INTERFACE
;;; defconf
0   192.168.88.1/24    192.168.88.0   BR-SW
1   192.168.89.3/30    192.168.89.0   ether5-off_bridge_wrk
2 D 192.168.101.87/24  192.168.101.0  ether1-WAN
3 D 192.168.241.94/24  192.168.241.0  vlan241
[demo@MikroTik] >

The last two examples 192.168.98.0/30 and 192.168.90.3/30 should not have been allowed.

As far as MikroTik and /31, RFC 3021, @mrz is quite adamant that MikroTik has no plans to support rfc3021 (probably because NIH syndrome?), but want you to use the MikroTik’s non-standard /32 mask (similar to pppoe) ip /32 help. But RouterOS isn’t the only one not to support /31, FRRouting supposedly has problems as well. It seems that /30 is currently the minimum safe interoperable mask for a point-to-point link. Which seem wasteful of scarce ipv4 addresses. Yes, I know we should be using ipv6, but there are problems with that too.