Hello
I’m new to working with Mikrotik gear and I’m trying to set up a small campus network for a local church and daycare. My biggest stumbling block right now is inter-vlan routing, I think. I’m sure I’m missing something, but for the life of me I can’t figure out what. If anyone can drop me some ideas, I’d sure appreciate it. I’ve added The church campus saga to the end of the subject line. This may seem pretentious, but I think this is going to the be the first post in a series of posts as I get this entire network together. Hopefully the extra info in the subject line will help tie these posts together. If this is against any type of forum rules, let me know and I’ll remove it. I just thought it might be helpful in the long run.
Now, on to the details…
Setup
I have a Mikrotik CRS112-8G-4S-IN being used as a layer 3 routing switch, with a pfSense firewall. This is the beginning of a larger and more complex network desigh, but I’m running a minimum working example just to try and iron out all the kinks. There are two vLANs, both with an IP address on each vLAN interface, untagged ports for each vLAN, DHCP server, and default route to the pfSense LAN IP address. I’ll post the Mikrotik export below. One vLAN network (99: Mgmt) has the IP with the pfSense firewall, and pfSense does have a correct route back into the LAN.
When setting all this up, I mostly referenced this wiki page
I don’t know if my basic network diagram will embed itself, but it can be found here if not.
What’s Happening
When I set a static address on a laptop using the same network segment as pfSense but using pfSense as the gateway, everything out to the internet works fine. Local routing of course doesn’t quite work properly. The DHCP addresses are set using the local vLAN interface as their gateway. For the Mgmt network, a laptop receiving DHCP can reach pfSense but not the internet. For the other network, a laptop receiving DHCP doesn’t reach the internet or pfSense. I’ve been able to verify that pfSense is not seeing the traffic. Additionally, inter-vlan routing does not seem to work correctly between the two networks. There are no firewall rules on the Mikrotik. And the final kicker is that sometimes it all actually works as it’s supposed to. I just can’t figure out why, when I only change small things incrementally and re-testing those changes never produce the same result. I’m starting to lose my mind, I believe.
I’m sure I haven’t been as clear here as I should have been, so start firing away questions for clarification. I truly hope someone can provide me with some insight. Thanks in advance!
Mikrotik Export
/interface bridge
add admin-mac=CC:2D:E0:4B:C3:0E auto-mac=no name=bridge
/interface vlan
add interface=bridge name=Mgmt vlan-id=99
add interface=bridge name=vLAN101 vlan-id=101
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp_pool0 ranges=10.10.1.199-10.10.1.200
add name=dhcp_pool1 ranges=10.10.101.50-10.10.101.99
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=Mgmt lease-time=1d name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=vLAN101 name=dhcp2
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=sfp9
add bridge=bridge interface=sfp10
add bridge=bridge interface=sfp11
add bridge=bridge interface=sfp12
/interface ethernet switch egress-vlan-tag
add tagged-ports=switch1-cpu vlan-id=99
add tagged-ports=switch1-cpu vlan-id=101
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=99 ports=ether1
add customer-vid=0 new-customer-vid=99 ports=ether7
add customer-vid=0 new-customer-vid=101 ports=ether5
/interface ethernet switch vlan
add ports=switch1-cpu,ether1,ether7 vlan-id=99
add ports=switch1-cpu,ether5 vlan-id=101
/ip address
add address=10.10.1.254/24 interface=Mgmt network=10.10.1.0
add address=10.10.101.254/24 interface=vLAN101 network=10.10.101.0
/ip dhcp-server network
add address=10.10.1.0/24 dns-server=208.67.220.123,208.67.222.123 gateway=10.10.1.254
add address=10.10.101.0/24 dns-server=208.67.220.123,208.67.222.123 gateway=10.10.101.254
/ip route
add distance=1 gateway=10.10.1.1
/system routerboard settings
set silent-boot=no