I had to modify is methods to get the VLAN filtering to work the AX2 and AX3, so not surprised there are better ways to implement things. Can you point me to directions on how to do this?
Thanks
Andrew
Sure, when I get time.
Okay you need to let me know the purpose of each port on the hapax3. To what it leads to, and to what vlan the connected device belongs to.
Remember access between vlans and to their devices is controlled by the firewall rules on the 5009
Great, thanks again.
Andrew
But first, … as stated above…
Okay you need to let me know the purpose of each port on the hapax3. To what it leads to, and to what vlan the connected device belongs to.
Remember access between vlans and to their devices is controlled by the firewall rules on the 5009
ether1 connects to RB5009
ether2 I want as dedicated management port (This is what I don’t know how to do when in switch/AP mode)
ether3-5 connect to PCs and Printers.
Ether3, which subnet???
Ether4, which subnet???
Ether4 which subnet???
Ether5- will add an offbridge subnet for your local access, the ap/switch MT, will be accessible also from the management or trusted subnet it gets its IP from.
ether3-4 are part of the default network/vlan1.
Okay once you go vlans there is no default network, it simply becomes another network like any other vlan subnet, just dont use vlan1.
RB 5009
(1) Added home vlan, so bridge does nothing but bridging and you were missing vlan10 items like dhcp-server and pool !!
(2) Ether2, will be a management port
(3) Ether6, will be an oFF bridge port ( ability for you as admin to access or config router Off the bridge ( safest way to config ).
(4) Quotes are not complete in /interface bridge vlans, each 7/8 interface needs both quote marks. Also you put quote around the bridge interface .......
(5) Is UPNP necessary???
(6) if you want to use the5009 to be an NTP time server for devices on the LAN, then it needs to be a client to a source as well!!!
mainly changes/additions provided.
_model = RB5009UG+S+
serial number = ******_
/interface vlan
add interface=bridge name=Home vlan-id=5
/interface list
add name=MGMT
/ip pool
add name=dhcp_pool10 ranges=192.168.90.2-192.168.90.254
/ip dhcp-server
add add-arp=yes address-pool=dhcp interface=Home
add add-arp=yes address=pool=dhcp-Pool10 interface=Management
/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface="2) Management" pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=3 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=4 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=5 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-tagged-frames interface="7) Main Livingroom"
add bridge=bridge ingress-filtering=yes frame-types=admit-only-tagged-frames interface="8) Front Livingroom"
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=sfp-DS1821+ pvid=5
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/interface bridge vlan
add bridge=bridge tagged=bridge,"7) Main Livingroom,"8) Front Livingroom,bridge"
untagged=ether3,ether4,ether5,sfp-DS1821+ vlan-ids=5
add bridge=bridge tagged=bridge,"7) Main Livingroom,"8) Front Livingroom,bridge"
untagged="2) Management" vlan-ids=10
add bridge=bridge tagged=bridge,"8) Front Livingroom" vlan-ids=100
add bridge=bridge tagged=bridge,"7) Main Livingroom" vlan-ids=101
/interface list member
add comment=defconf interface="1) Internet" list=WAN
add comment=defconf interface=Home list=LAN
add interface="AX2 2G Wifi " list=LAN
add interface="AX3 2G Wifi" list=LAN
add interface=Management list=LAN
add interface="6)" list=LAN
add interface=Management list=MGMT
add interface="6)" list=MGMT
/ip address
add address=192.168.101.1/24 comment=defconf interface=Home network= 192.168.101.0
add address=192.168.55.1/24 comment="off- bridge access" interface="6)" network=192.168.55.0
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.0.1 gateway=10.0.0.1
add address=10.0.10.0/24 dns-server10.0.10.1 gateway=10.0.10.1
add address=192.168.101.0/24 comment=defconf domain=WORKGROUP gateway=
dns-server=192.168.101.1 192.168.101.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="admin access" in-interface-list=MGMT
add action=accept chain=input comment="users to services" dst-port=53,123 protocol=udp in-interface-list=LAN
add action=accept chain=input comment="users to services" dst-port=53 protocol=tcp in-interface-list=LAN
add action=drop chain=input comment="drop all else" { add this rule as our final last rule }
+++++++++++++++++++++++++++++++++++++++++
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=accept chain=forward comment="internet access" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="admin access" in-interface-list=MGMT out-interface-list=LAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=MGMT
HAPAX3 NOTE this is a non capsman config as I have no clue how to do capsman, too complicated for me. Any vlans / data path removed from wifi settings. You should appreciate how uncluttered and quick this is to configure once the 5009 is done.
(1) Will assume etherports 3,4,5 are for home wired network, otherwise they should not be identified on the bridge.
(2) Better to use ether2 for off bridge access as its already accessible on management vlan from the 5009, better to have a local off bridge safe method.
(3) Assuming Bar2G is for guest or IOT, and Bar5G is for home use.
model = C53UiG+5HPaxD2HPaxD
/interface ethernet
set [ find default-name=ether2 ] name=ether2-OffBridge
/interface vlan
add interface=bridge name=Management vlan-id=10
/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether3 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether4 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether5 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=Bar5G2 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=Bar2G2 pvid=101
/interface bridge vlan
add bridge=bridge tagged=ether1 untagged=ether3,ether4,ether5,Bar5G2 vlan-id=5 comment=“home subnet”
add bridge=bridge tagged=ether1,bridge vlan-ids=10
add bridge=bridge tagged=ether1 untagged=Bar2G2 vlan-ids=101
/ip address
add address=192.168.90.2/24 interface=Management network=192.168.90.0
add address=192.168.55.1/24 interface=ether2-OffBridge network=192.168.55.0
/ip dns
set allow-remote-requests=yes servers=192.168.90.1
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.90.1 routing-table=main
/interface list
add name=MGMT
/interface list member
add interface=Management list=MGMT
add interface=ether2-OffBridge list=MGMT
/tool mac-server mac-winbox
set allowed-interface-list=MGMT
/ip neighbor discovery-settings
set discover-interface-list=MGMT