(1) Your sffplus setup is hosed and is the core of your issues. Why do you NOT make it a vlan?
You can elect to not do so, but then why do you have it on the bridge… MAkes no sense…
So either make 192.168.3.0/24 another vlan on the bridge or
remove this line.
/interface bridge port
add bridge=BRIDGE-LAN interface=sfp-sfpplus1
(2) Personal preference to make /interface bridge vlan settings clearer so they match bridge ports and are shown on the config export!
Also when doing this it became clear that you forgot to tag a port for vlan id 20??
/interface bridge vlan
add bridge=BRIDGE-LAN tagged=BRIDGE-LAN,ether2,ether6 untagged=ether3 vlan-ids=9
add bridge=BRIDGE-LAN tagged=BRIDGE-LAN,ether2 untagged=ether4 vlan-ids=10
add bridge=BRIDGE-LAN tagged=BRIDGE-LAN,??? vlan-ids=20
add bridge=BRIDGE-LAN tagged=BRIDGE-LAN,ether6 untagged=ether7 vlan-ids=30
add bridge=BRIDGE-LAN tagged=BRIDGE-LAN,ether2,ether6 vlan-ids=100
(3) MISSING persistent keep alive on MT peer settings for nordvpn
(4) The route for NORDVPN does not require distance setting of 5, default of 1 is fine.
(5) DID NORDVPN give you any other information like DNS address ???
(6) Why did you choose DNS server 103.86.96.100 ?
(7) Looking at firewall rules I am puzzled as the logic is missing.
I understand allowing all to a specific server OKAY
I understand allowing all from 192.168.3.0 vlan to all other vlans - I assume you are on that vlan and thus as admin want access to all vlans.
(See option 2 in firewall rules below for better way to do this)
WHAT I DONT UNDERSTAND is allow all of vlan9 to 192.168.3 IF FULL access goes both ways, then ONLY HAVE ONE SUBNET ???
WHAT I DONT UNDERSTAND is allow all of vlan9 to vlan 10 and all of vlan10 to vlan9 , WHY NOT JUST HAVE ONE SUBNET ???
(8) Firewall rules NEED WORK should look like.
/ip firewall address-list
add address=admin-IP1 list=Admin comment=“admin desktop”
add address=admin-IP2 list=Admin comment=“admin laptop”
add address=admin-IP2 list=Admin comment=“admin smartphone”
/ip firewall filter
{Input Chain}
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=accept chain=input src-address-list=Admin
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
dst-port=53 in-interface-list=VLAN protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
dst-port=53 in-interface-list=VLAN protocol=tcp
add action=drop chain=input comment=“drop all else”
{forward chain
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“server traffic” in-interface-list=VLAN dst-address=192.168.10.2
add action=accept chain=forward comment=“admin-access” src-address-list=Admin out-interface-list=VLAN
add action=accept chain=forward comment=“internet traffic” in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment=“wireguard traffic” in-interface-list=VLAN out-interface=WG-NORDVPN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”
