The WIFI-Networks for VLAN 1 and 5 work as expected. Setting up VLAN 7 in exactly the same way, also using a separate bridge, failed. I cannot get traffic routing. I already failed to ping a single device.
My most recent try was to skip using a bridge and just use the vlan-interface (vlan7-wifi-iot) directly. I also added logging firewall rules and allowing all incoming, outgoing and forwarding traffic for this interface as the top most firewall rules. I can see some broadcast and multicast packages on udp port 5353 and continuously on udp port 67. From any connected device to the WIFI network on VLAN 7 I successfully receive a DHCP response and get an IP address assigned. Resolving DNS or establishing an udp or tcp connection fails with “network unreachable”.
Here is my (simplified) most recent configuration:
thank you for your reply. If I understand you correctly, you advise me to bind practically all ports and VLANs into a single bridge. I assume that I could implement most of the firewall rules and NATs through the bridge configuration. However, I don’t understand how I can now provide, for example, separate DHCP servers for the different networks, since everything is now a single bridge instead of separate bridges and interfaces.
Please note that each VLAN represents a separate network segment, using separate subnets, and should kept isolated as strictly as possible, except of some specific routing/nat for specific protocols and devices.
Create your vlan interfaces on a single bridge device, not ether3. use /interface bridge port and /interface bridge vlan to configure vlans on the switch ports.
p.s. I had a more complete post, but the board went unavailable, and I lost what I entered when I tried to preview.
When this happens, a step back in browser normally takes you back to the edited message - at least this works in Mozilla Firefox. Saved me some nerve multiple times.
I think my mistake was that I did go back and then got the “board in unavailable, please try again in a few minutes” message again. Then I think I must have refreshed the page when the board was still not available.
Next time this happens, I will open a new tab and wait until the the board is available in the new tab, then return to the “preview tab” and go to previous page, then hopefully the page will still be in the browser’s cache, and I can then use preview again.
Post your complete config (hiding any public IPs)
Add network diagram,
and I will take a look. detailed >
Hello anav, thank you for offering your help and sorry for my late reply. I will try to draw down my local network diagram and provide a more complete configuration of the current system within the next week.
In advance in text form:
My network is separated into domains/subnets:
WAN: The only device here is my internet router incl. its telephone system. The IP address space is managed by the internet router itself.
LAN: My local “trusted” network including my PCs and Home Server. Some devices are allowed to join this network via wireless lan. Address space is 10.12.32.0/24 and configured via the Mikrotik DHCP server. All registered devices are allowed to communicate to each other.
Guest: My local “i don’t care” network for guests and their smartphones and tablets. Address space is 10.12.88.0/24 and configured via the Mikrotik DHCP server. All registered devices are allowed to access the WAN, but nothing else.
Echo: All devices on this network join the network via wireless lan, are allowed to communicate with each other and access the WAN. Address space is 10.12.89.0/24 and configured via the Mikrotik DHCP server.
IoT: MY local “semi-trusted” network. All registered devices join this network via wireless lan and should not be able to communicate with each other. Address space is 10.12.90.0/24 and configured via the Mikrotik DHCP server. The registered devices are allowed to access specific targets and ports on WAN (ntp) and LAN (mqtt) in order to operate as expected on per-device rules.
There are multiple external networks connected via Wireguard VPN and IPsec. Limited access is allowed between single devices and networks. Almost all of them do not allow incoming traffic, but only outgoing.
The firewall rules are quite simple, restricting:
access to interfaces and VPNs
denying access to DNS services in order to force Android to use the Mikrotik DNS Server
manipulate / redirect unencrypted DNS packages in order to redirect specific incoming requests via VPN
allowing single devices from “IoT” to access single devices and ports within “LAN”
and after some more simple rules, dropping everything else, since I can’t find a way how to configure the firewall policy itself (assuming this firewall uses something like iptables)
Create your vlan interfaces on a single bridge device, not ether3. use /interface bridge port and /interface bridge vlan to configure vlans on the switch ports.
p.s. I had a more complete post, but the board went unavailable, and I lost what I entered when I tried to preview.
Hello Buckeye, thank you for your reply. I have already read the document, but obviously did not understand the relevant part, if I read that correctly from your response. Too bad that your longer post was lost.
Here a short description of what I remember I tried (and failed):
Enabled safe-mode.
Deleted all existing bridges except of one, called “bridge”.
Deleted all existing vlan-interfaces.
Assigned ether2 (LAN) to the bridge.
Assigned ether3 (WIFI) to the bridge and set PVID to 1, frame_types to “admit only VLAN tagged”, and enabled “Ingress filtering”.
Added VLAN 1 to the bridge (untagged=ether1, tagged=ether3)
Added VLAN 5 to the bridge (tagged=ether3)
Added VLAN 7 to the bridge (tagged=ether3)
Now I don’t get how to assigned the DHCP-Servers to their corresponding VLANs, since there is only one interface (“bridge”) left.
After struggeling a while a gave up again and rolled back my configuration by leaving the safe-mode without committing.
Making a network diagram takes time, but it really helps when you are troubleshooting in the future, at least if you keep your documentation (diagram) current. If it isn’t kept current, it can make troubleshooting harder than without it; this is similar to old obsolete comments in code that can lead you to make incorrect assumptions, but I digress.
IoT: MY local “semi-trusted” network. All registered devices join this network via wireless lan and should not be able to communicate with each other. Address space is 10.12.90.0/24 and configured via the Mikrotik DHCP server. The registered devices are allowed to access specific targets and ports on WAN (ntp) and LAN (mqtt) in order to operate as expected on per-device rules.
The router’s firewall won’t be helpful in preventing wifi devices connected to the same SSID from being able to communicate with each other. That needs to be done by the access point by a client isolation feature.
