Hi everyone, I created this account recently, I’m a genuine beginner and I’m doing my best to try to understand how to tackle this.
I have a physical setup which I believe is mostly simple to understand.
┌─────────────────────────────────────────────────────────────────┐
│ VLAN Support│
│ ┌───┐ ┌──┐ VLAN1 LAN ┌───────┐ │
│ │ISP│ │PC│ ┌────────────┤WifiAP1│ │
│ └─┬─┘ └┬─┘ │VLAN20 IOT ├───────┤ │
│ │Ether1 │Ether2(Untagged) ├────────────┤WifiAP2│ │
│ │ │ ┌─────────┐ │ └───────┘ │
│ │ │ VLAN1+VLAN20 │ ├─┘ No Support │
│ ┌┴───────┴┐ Untagged │ POE │ Untagged ┌───────┐ │
│ │ MK L009 ├────────────────┤ Switch ├──────────────┤Camera1│ │
│ └─────────┘ Ether4 │Unmanaged│ └───────┘ │
│ │ ├─┐ No Support │
│ └─────────┘ │Untagged ┌───────┐ │
│ └────────────┤Camera2│ │
│ └───────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
The Virtual Goal
┌────────────────────────────────────┐
│ │
│ ┌───────┐ │
│ ┌─┤WifiAP2│ │
│ │ └───────┘ │
│ │ │
│ │ ┌───────┐ │
│ VLAN20 ┌──┼─┤Camera1│ │
│ ┌─────────┐ │ │ └───────┘ │
│ ┌───┐ │ MK L009 ├──┘ │ │
│ │ISP├──┼─────────┤ │ ┌───────┐ │
│ └───┘ │ MK L009 ├──┐ └─┤Camera1│ │
│ └─────────┘ │ └───────┘ │
│ VLAN1 │ │
│ │ ┌───────┐ │
│ ├─┤WifiAP1│ │
│ │ └───────┘ │
│ │ │
│ │ ┌──┐ │
│ └─┤PC│ │
│ └──┘ │
│ │
└────────────────────────────────────┘
My goal here is to separate my IOT devices from my normal network, on a different subnet as well, I still have my other devices connected, but this is a simplification of what I’m looking for.
I’m not sure the best way to approach this, but from what I understand I need to create a Hybrid port that accepts tagged frames as well as untagged frames.
My current configuration is as follows.
/interface bridge
add admin-mac=78:9A:18:62:46:66 auto-mac=no comment=defconf name=bridge \
port-cost-mode=short vlan-filtering=yes
/interface vlan
add interface=bridge name=VLAN_20 vlan-id=20
/ip pool
add name=dhcp ranges=10.0.0.102-10.0.0.254
add name=dhcp_pool4 ranges=10.20.20.2-10.20.20.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
add address-pool=dhcp_pool4 interface=VLAN_20 name=WIFI_VLAN_20
/interface bridge vlan
add bridge=bridge tagged=ether4,bridge vlan-ids=20
/interface bridge vlan
add bridge=bridge tagged=ether4,bridge vlan-ids=20
Currently this works for the devices on WifiAP1 and WifiAP2
However Camera1 and Camera2 both Register on the default VLAN1 which isn’t ideal.
I can change the bridge port on Ether4 to PVID 20, that way the cameras end up on the correct VLAN, which is true in the ARP List, but suddenly I can no longer access WifiAP1 as well as devices on VLAN20.
I can ping between my phone and computer on the WifiAP2 (VLAN20) wifi, but pinging between my phone and the cameras fails.
I feel like there’s something dumb simple I am missing however this is the best I could do with my current knowledge
What would be the best way to setup the goal configuration and what makes it more ideal?
I would also like to understand the flaw in my logic here.
Thanks in advance anyone reading this, I understand this forum probably gets a lot of these.