Hi all,
I’m looking for pointers/help to get a transparent bridge (with vlan’s) working.
I have a setup where my own router (2x asus RT-ac68u) is behind the provider’s router (genexis) but this causes double natting. Of course i could setup the asus routers in access point mode but then i lose parental controls. The idea is to replace the Genexis router with a transparent bridge as this would resolve the issue until Mikrotik releases 802.11ax access points. The targer infrastructure is shown in the attachment.
(IPTV and Internet traffic can go over the same LAN)
Can someone help me here/point me in the right direction?
Thanks,
Pasc.
Code wise i have the following config. What do i need to change to make transparent bridging happen?
/interface bridge
add comment=Bridge-IPTV fast-forward=no name=bridge-iptv protocol-mode=none igmp-snooping=yes
add comment=Bridge-LAN name=bridge-lan
/interface ethernet
set [ find default-name=ether1 ]
set [ find default-name=ether2 ]
set [ find default-name=ether3 ]
set [ find default-name=ether4 ]
set [ find default-name=ether5 ] comment="Amino"
set [ find default-name=sfp1 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full,2500M-full,5000M-full,10000M-full comment="Caiway Glasvezel" rx-flow-control=auto speed=100Mbps tx-flow-control=auto
/interface vlan
add comment="WAN Internet VLAN 100" interface=sfp1 name=WAN-INTERNET-100 vlan-id=100
add comment="WAN IPTV VLAN 101" interface=sfp1 name=WAN-IPTV-101 vlan-id=101
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool add name=dhcp ranges=192.168.88.10-192.168.88.100
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge-lan lease-time=1d name=dhcp-thuis
/interface bridge port
add bridge=bridge-lan comment=defconf interface=ether2
add bridge=bridge-lan comment=defconf interface=ether3
add bridge=bridge-lan comment=defconf interface=ether4
add bridge=bridge-iptv comment=defconf interface=ether5
add bridge=bridge-iptv interface=WAN-IPTV-101 trusted=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge-lan list=LAN
add comment=defconf interface=WAN-INTERNET-100 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge-lan network=192.168.88.0
/ip dhcp-client
add add-default-route=no comment=defconf disabled=no interface=sfp1
add dhcp-options=clientid,hostname disabled=no interface=WAN-INTERNET-100 use-peer-dns=no
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN