WAN -> Internet (ether1, PPPoE)
HOME_LAN (ether2,ether3,ether4, SSID HOME)
WORK_LAN (ether5, SSID WORK, IPSEC VPN)
HOME_LAN and WORK_LAN must not be able to see each other, but must be able to access the internet.
WORK_LAN must also be able to route down a VPN.
I am trying to get my head around this still, so have been experimenting with a routerOS vm and some linux vms as clients. What I have so far is what seem to be isolated LANS and both able to access the internet.
My question is, is isolating the LANS using two bridges a legitimate / sensible setup given what I eventually want to achieve?
in the text you write you want to have ether1 part of HOME_LAN while in setup it’s not (and has DHCP client running as if it was still used as WAN interface, src-nat rules imply the same)
you probably don’t need two masquerade rules, you can probably masquerade just anything going out through WAN interface
WORK_LAN consists of one ether port, one wireless interface and one IPSEC interface. The mix won’t benefit from doing the whole stuff using VLANs (all of it would be handled by CPU even on CRS3xx). None of ports are trunk so no benefit of doing it with VLANs either. Doing it with two bridges doesn’t have any benefits either. Other than the fact that enabling vlan-filtering on bridge disables HW offload (except on CRS3xx), but current config allows it on bridge1_home, traffic between ether2 and ether3 will be handled by switch chip alone.
As OP did it already, I don’t see any good reason to tear current config apart. If I were doing it, I’d do it using VLANs though.
@Mehuge: I just remembered a thing which might be of concern in your case: bridge xan offload certain tasks to switching hardware. But it can only be done for ethernet interfaces and single bridge. The bridge2_work knly contains a single ether interface and thus can’t benefit from HW offload. To make sure that HW offload remains available for bridge1_home, set hw=no on line where ether4 gets added to bridge (add bridge=bridge2_work interface=ether4 hw=no).