Hello guys,
I was playing with some VLANs on my router as I intend to transfer everything to a new router and remove one of the switches. For this I’d need few seperate VLANs - main vlan, survaliance, IoT, etc.
I followed the main topic for VLAN setups and also dig a lot into the documentation. Currently I’m testing a simple configuration (no trunk ports) on one of my side devices used for testing and I was able to setup 3 VLANs with DHCP servers and everything else. Blocking of internet for separate VLANs works in the forward chain and everything seems to be ok there. However I’d like to have full access from the base VLAN to all of the others and acess blocked from them to the base vlan and here I have a problem. I’ve tried a lot of different things and it seeps that I cannot ping from a machine in one VLNA to one on the other. I does not even work without any firewall rules.
Here is the current configuration - it is rly simple and i’m using dhcp client just for internet tests. I’ll expand this upon transfering to the main router but first I’d like to figure out how to properly separate the network. Would be great if someone could land a hand.
# model = RB760iGS
/interface bridge
add frame-types=admit-only-vlan-tagged name=Main_Bridge protocol-mode=none \
vlan-filtering=yes
/interface vlan
add interface=Main_Bridge name=BaseVlan vlan-id=99
add interface=Main_Bridge name=Vlan10 vlan-id=10
add interface=Main_Bridge name=Vlan20 vlan-id=20
/interface list
add name=WAN
add name=VLAN
add name=BASE
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp_pool_base ranges=192.168.2.2-192.168.2.254
add name=dhcp_pool_vlan10 ranges=10.0.10.2-10.0.10.254
add name=dhcp_pool_vlan20 ranges=10.0.20.2-10.0.20.254
/ip dhcp-server
add address-pool=dhcp_pool_base interface=BaseVlan name=dhcp_base
add address-pool=dhcp_pool_vlan10 interface=Vlan10 name=dhcp_vlan10
add address-pool=dhcp_pool_vlan20 interface=Vlan20 name=dhcp_vlan20
/port
set 0 name=serial0
/interface bridge port
add bridge=Main_Bridge comment=Base_Vlan frame-types=\
admit-only-untagged-and-priority-tagged interface=ether2 pvid=99
add bridge=Main_Bridge comment=Vlan_10 frame-types=\
admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=Main_Bridge comment=Vlan_20 frame-types=\
admit-only-untagged-and-priority-tagged interface=ether4 pvid=20
/interface bridge vlan
add bridge=Main_Bridge tagged=Main_Bridge vlan-ids=99
add bridge=Main_Bridge tagged=Main_Bridge vlan-ids=10
add bridge=Main_Bridge tagged=Main_Bridge vlan-ids=20
/interface list member
add comment=ISP_Interface_List interface=ether1 list=WAN
add comment=VLAN_List interface=Vlan10 list=VLAN
add interface=Vlan20 list=VLAN
add comment=MGMT_List interface=BaseVlan list=BASE
add interface=BaseVlan list=VLAN
add interface=ether5 list=LAN
/ip address
add address=192.168.0.200/24 disabled=yes interface=ether5 network=\
192.168.0.0
add address=192.168.2.1/24 interface=BaseVlan network=192.168.2.0
add address=10.0.10.1/24 interface=Vlan10 network=10.0.10.0
add address=10.0.20.1/24 interface=Vlan20 network=10.0.20.0
/ip cloud
set update-time=no
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=192.168.2.1 gateway=10.0.10.1
add address=10.0.20.0/24 dns-server=192.168.2.1 gateway=10.0.20.1
add address=192.168.2.0/24 dns-server=192.168.2.1 gateway=192.168.2.1
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=192.168.2.0/24 list=Base
add address=10.0.20.0/24 list=vlan20
/ip firewall filter
add action=accept chain=input comment="accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment=" drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=input comment="Accept ether5 for backup" \
in-interface=ether5
add action=drop chain=input comment="drop all not coming from VLAN" \
in-interface-list=!VLAN
add action=accept chain=forward comment="VLAN inter-VLAN routing" \
connection-state=new in-interface-list=VLAN log=yes
add action=accept chain=forward comment=\
"accept established,related, untracked" connection-state=\
established,related,untracked
add action=fasttrack-connection chain=forward comment=" fasttrack" \
connection-state=established,related hw-offload=yes
add action=drop chain=forward comment=" drop invalid" connection-state=\
invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/system clock
set time-zone-name=Europe/
/system note
set show-at-login=no
( in my case more insane )