ISP PPPOE with VLAN filtering

RouterOS Beginner Basics
1

I’m looking for some help with my network setup. I’ve been monkeying around with it for a while now, and its time I ask for a hand. I have a configuration that works, with no vlan separation or filtering. My end goal is to be able to have several different networks established and be able to control the traffic between them. I followed http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 for some basic guidance, but am still at a loss for how I adapt this to me specific needs or if I’m just going down the wrong road all together. My networking knowledge is pretty elementary, so any advice is welcome.

  • ISP has me connecting with PPPOE with a specific vlan id tag and user/pass. I’ve got this working successfully and know it works on their end.
  • Current hardware:
  1. RB4011 Router
  2. ether1: WAN
    2. ether2-5: All under the same vlan, will have hosts
    3. ether6: Unmanaged netgear switch, ideally on its own vlan as it has no need to get to the other. Not essential, nothing important.
    4. ether7: N/A
    5. ether8: CRS1112
    6. ether9: hAP1
    7. ether10: (future) hAP2
  3. CRS112-8P-4S-IN Switch
  4. ether1: In
    2. ether2: NAS, want this separated from rest of network. The cameras below will need access as well as some personal hosts, but I’d like to define those specifically. Utilizing the synology DS Cam app, I’ll want to setup port forwarding to here so i can access off network.
    3. ether3-8: Cameras, nothing but the NAS needs to access.
  5. RB962UiGS-5HacT2HnT-US hAP AC
  6. ethernet port will be used for desktops and can live on same VLAN as RB4011’s 2-5
    2. Ideally setup several networks in here, 2/5Ghz for personal devices and a 2ghz for IoT and Guest

I’ve started cobbling some scripts for the configuration but they, unsurprisingly, don’t work. Current issues seem to be stemming from DHCP not working whether I’m connected to the Router or Switch, not getting an IP. Looking for any kind of pseudo code or assistance that can be offered. Today/Tomorrow are my best window to get this configured, so looking for any help I can get :slight_smile: Happy to upload current scripts, but they’re really just a slightly modified version of the ones uploaded to the referenced article.
switchConfig.rsc (1.52 KB)
routerConfig.rsc (4.5 KB)

2

/export hide-sensitive file=anynameyouwish to see whats going on.

3

Done, I’ve attached both to the first post. This configuration is not the working one, but the in progress, just for clarification.

4

If I have PVID set on a bridge port on the switch, should I be able to see that anywhere on router (maybe packet sniffing/vlan field) if its actually being assigned?

5

For the specific question, YES, if you look at bridge vlan settings you will see what has been entered by you as the admin or dynamically assigned by the router.
Note that when you put a PVID on the Bridge port settings (where they belong), the router will dynamically assign an untagged port on the vlan-id where applicable but I PREFER to do it manually in the bridge vlan settings so they show up in the config script when I am troubleshooting and can visually map the traffic flows easier.

The best article to read is
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

I am assuming the hap devices will be more like switch access points and will not do any routing (not advised anyway as RB4011 is more than up to the task :slight_smile: )

6

Sorry, I meant specifically to be able to inspect if its actually getting from the switch to the router. I’m failing to get an IP assigned from the 10.0.10.0/24 despite the port having pvid of 10 assigned.

And yes, no intention of having anything other than the RB4011 handle the routing.

The linked article is the same one I started with, the scripts uploaded were based on the examples given in that post. Are there any debug tools/tips I can use to help figure out where I’m failing? Ignoring PPPOE, I would assume that the configuration I uploaded should at least get me an internal IP, not necessarily internet access… but thats not working.

7

Its gettng late here but will have a quick look at RB4011 config

(1) You are missing the POOL, address, DHCP etc, for the BASE vlan.

(2) If ether2-5 are the same vlan why does ether2 not have the other settings of vlan filtering tagged frames only??

(3) ON bridge port settings; If ether6 is going to an unmanaged switch why does it have tagged frames it should be untagged or priority frames and the PVID for the appropriate vlan to the unmanaged switch

(4) On the vlan setting side same deal for ether6 ??? It should untagged for the applicable vlanid.

(5) You seem to have many vlans setup not yet made. If all the tagged ports are the same one can group vlan-ids so all that could be put on ONE line.

(6) Input chain fw rules. The second allow base vlan is redundant as you have already done that by allow VLAN.
Light bulb on?
The point is only the admin should have access and everyone else just needs necessary service such as DNS
So see the improvement below which include dropping invalid traffic and all other traffic at the end of the input chain.

/ip firewall filter
add action=accept chain=input comment=“Allow Estab & Related”
connection-state=established,related,untracked
add action=accept chain=input comment=“Allow VLAN” in-interface-list=VLAN
add action=accept chain=input comment=“Allow Base_Vlan Full Access”
in-interface=BASE_VLAN

/ip firewall filter
add action=accept chain=input comment=“Allow Estab & Related”
connection-state=established,related
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“Allow ADMIN to Router” in-interface-list=BASE src-address-list=adminaccess ***
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
connection-state=new dst-port=53 in-interface-list=VLAN protocol=tcp
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
connection-state=new dst-port=53 in-interface-list=VLAN protocol=udp
add action=drop chain=input comment=“drop all else” { only add this AFTER you have the allow admin rule setup! }

*** So now only those with access to the BASE VLAN can access the router itself for config purpose, the source address is optional.
I use to only allow certain IP addresses access (admin desktop, admin laptop, smartphone etc…) However I dont have a separate BASE VLAN and that may be good enough for you.

++++++++++++++++++++++++++++++++++++++++

  1. Forward chain Fw Rules. Also incomplete, and assume you are not doing any port forwarding based on the config thus far and no VPN…
    See below for better config, more complete and safer.

add action=accept chain=forward comment=“Allow Estab & Related”
connection-state=established,related
add action=accept chain=forward comment=“VLAN Internet Access only”
connection-state=new in-interface-list=VLAN out-interface-list=WAN

TO
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=accept chain=forward comment=“VLAN Internet Access only”
in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment=“drop all else”

(8) Note for mac server ---- >winmac Server make sure you select interface BASE.

8

Added with the following block as outlined in the referenced article's example:

Optional: Create a DHCP instance for BASE_VLAN. Convenience feature for an admin.

/ip pool add name=BASE_POOL ranges=192.168.0.10-192.168.0.254
/ip dhcp-server add address-pool=BASE_POOL interface=BASE_VLAN name=BASE_DHCP disabled=no
/ip dhcp-server network add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1

It was commented out in my script while trying things. The following should resolve this, correct?
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether2]

Should these ports have a pvid assigned? Should it just be the base_vlan of 99?

(3) ON bridge port settings; If ether6 is going to an unmanaged switch why does it have tagged frames it should be untagged or priority frames and the PVID for the appropriate vlan to the unmanaged switch

(4) On the vlan setting side same deal for ether6 ???? It should untagged for the applicable vlanid.

I believe the following line will add the tagging, but I'm a little confused ont he tagged/untagged.
add bridge=BR1 interface=ether6 pvid=60
Something like this?
add bridge=BR1 untagged=ether6 vlan-ids=60

(5) You seem to have many vlans setup not yet made. If all the tagged ports are the same one can group vlan-ids so all that could be put on ONE line.

I believe the following is what you're suggesting, if so yes that seems cleaner. I omitted ether 6 from the list, would 2-5 also be omitted? Or do they get moved to untagged. Also wasn't entirely certain if 60 is needed in the list of IDs.
add bridge=BR1 tagged=BR1,ether2,ether3,ether4,ether5,ether7,ether8,ether9,ether10 vlan-ids=10,20,30,99

(6) Input chain fw rules. The second allow base vlan is redundant as you have already done that by allow VLAN.
Light bulb on?
The point is only the admin should have access and everyone else just needs necessary service such as DNS
So see the improvement below which include dropping invalid traffic and all other traffic at the end of the input chain.

/ip firewall filter
add action=accept chain=input comment="Allow Estab & Related"
connection-state=established,related,untracked
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=accept chain=input comment="Allow Base_Vlan Full Access"
in-interface=BASE_VLAN

/ip firewall filter
add action=accept chain=input comment="Allow Estab & Related"
connection-state=established,related
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="Allow ADMIN to Router" in-interface-list=BASE src-address-list=adminaccess ***
add action=accept chain=input comment="Allow LAN DNS queries - TCP"
connection-state=new dst-port=53 in-interface-list=VLAN protocol=tcp
add action=accept chain=input comment="Allow LAN DNS queries-UDP"
connection-state=new dst-port=53 in-interface-list=VLAN protocol=udp
add action=drop chain=input comment="drop all else" { only add this AFTER you have the allow admin rule setup! }

*** So now only those with access to the BASE VLAN can access the router itself for config purpose, the source address is optional.
I use to only allow certain IP addresses access (admin desktop, admin laptop, smartphone etc.........) However I dont have a separate BASE VLAN and that may be good enough for you.

++++++++++++++++++++++++++++++++++++++++

  1. Forward chain Fw Rules. Also incomplete, and assume you are not doing any port forwarding based on the config thus far and no VPN...........
    See below for better config, more complete and safer.

add action=accept chain=forward comment="Allow Estab & Related"
connection-state=established,related
add action=accept chain=forward comment="VLAN Internet Access only"
connection-state=new in-interface-list=VLAN out-interface-list=WAN

TO
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=accept chain=forward comment="VLAN Internet Access only"
in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"

Easy enough change.

(8) Note for mac server ---- >winmac Server make sure you select interface BASE.

Would this be to the list or the interface BASE_VLAN?

Thank you very much for working with me on this, I truly appreciate the help.

9

Uploading current work in progress router configuration script.

  • I assume I need to setup DHCP for the 30 and 60 VLANs, if I intend on having guest/iot vlans will that need to have its own as well?
  • Is BASE_VLAN typically a safe place for all normal desktops etc to live? Any reason to split that out?
10

I dont have a base VLAN because I use my trusted HOME VLAN to assign IPs to any attached smart devices (switches and access points) and limite access to my router only to certain IPs.
So the quick answer if you have a trusted LAN at home you dont really need a management vlan. For a business yes you should have one.

11

How does your HOME VLAN differ? This is just for home, so if its simpler to do so with no real loss I’m game. I just don’t udnerstand the difference. Is your HOME VLAN just specific ports/devices?

12

No but I have approx 4-5 smart switches on the go, about 4 access points and 15 or so vlans.
So my home vlanXX provides dhcp for all the attached smart devices and basically its a trusted LAN.
So no need for a management vlan if you are happy to use your trusted VLAN.

I could and will think about using a base or management vlan, but would have to move all smart devices to it.
I would just have to make sure that from where I am, I can access the base/management vlan, so some forward chain rule for me to access vlan base.
Just lazy I guess not to do it,

Now in my router rules and for any of the above devices that are MT, I also only allow myself access via winbox.

On my main router
I have the default rules plus
add action=accept chain=input comment=“Allow ADMIN to Router”
src-address-list=adminaccess
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
add action=drop chain=input comment=“Drop All Else”


The admin access has all the IPs I use for my devices, laptop, desktop, iphone etc… that I use to configure MT. (set dhcp leases to static)

13

Hi ian, the config looks real good,

(1) The only thing I noticed was the untagged vlan.

/interface bridge port
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether2]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether3]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether4]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether5]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether6]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether7]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether8]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether9]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether10]

should be
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-priority and untagged [find interface=ether6]

(2) I set this to none. (only mac-winbox requires BASE)

/tool mac-server set allowed-interface-list=BASE

14

Thanks Anav, I had had a couple more questions posted above around your first assist. Any guidance?

15

Yes you need a separate vlan with dhcp, pool, ip address, dhcp-server-network settings for each group of users.
or group of like devices etc. whatever you think hey, person A or device P should not talk to others, then you have a vlan requirement

16

Ran as attached. Still not getting an IPs assigned, currently trying attached to ethernet 2 with my PC. Am I making a poor assumption that I can add pvid 99 to ether 2-5?

An error occurred while renewing interface Ethernet 2 : unable to contact your DHCP server. Request has timed out.

I poked around in the packet sniffer as well, only saw tagging 201 on ether 1, everything else was tagless, not sure if thats expected.

Does VLAN filtering need to be enabled for all of this magic to start working?
MikroTikRouter.rsc (8.4 KB)

17

Yes of course, as per the link, its the last step LOL

18

Okay, so I shouldn’t expect an IP address until I enable filtering?

EDIT: Okay, so enabling IP filtering worked and I started getting IPs assigned. Ugh.. can’t believe I missed that, it even says it IN the docs. Anyhow, getting an IP now but no external access. What special thing do I need to do to get my ISP assigned vlan etc working? Also had to switch the bridge ports for 2-5, does this make sense?

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether2]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether3]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether4]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether5]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether6]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether7]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether8]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether9]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether10]
19

Worth mentioning, looking in the logs I can see the pppoe client connected successfully to my ISP.

20

Post the regular complete router config, not the vlan document style
/export hide-sensitive file=anynameyouwish