mDNS VLAN Setup Help

NetFailure · December 4, 2024, 7:43pm

I have a Mikrotik hEX with VLANs to separate smart TVs, wireless security cameras, printer, and trusted devices. Any wired devices are assigned to the default (192.168.88.1/24) DHCP range.Wireless devices are assigned a VLAN from the ubiquiti access point based on the wireless network they sign onto.

I’m trying to get the new mDNS feature to allow casting and printing to devices on other VLANs.

So far I am able to communicate with my Roku using the remote control app from the default DHCP range. I can do this with or without the firewall rules in place that specifically open port 5353.

I am not able to cast to my Samsung television or the Roku unless I log into the wireless network that contains the TV VLANS. In my mind this kind of defeats the purpose of keeping smart TVs on their own network. I’d like to be able to get all functionality across the VLANs.

Can anyone give me any direction on what I am doing wrong here?

Thank you!

# 2024-12-04 11:21:52 by RouterOS 7.16.2
# software id = XXXXXXX
#
# model = RB750Gr3
# serial number = xxxxxxxxxxx
/interface bridge
add name=BR-CAM-VL20
add name=BR-PTR-VL40
add name=BR-TV-VL30
add admin-mac=xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge \
    port-cost-mode=short
/interface vlan
add interface=ether2 name=VLAN_Cameras vlan-id=20
add interface=ether2 name=VLAN_MAIN vlan-id=10
add interface=ether2 name=VLAN_Printer vlan-id=40
add interface=ether2 name=VLAN_TVs vlan-id=30
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=WAN2
/interface lte apn
set [ find default=yes ] default-route-distance=3
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool2 ranges=192.168.96.2-192.168.96.254
add name=dhcp_pool3 ranges=192.168.91.2-192.168.91.254
add name=dhcp_pool4 ranges=192.168.32.2-192.168.32.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=1d14h name=defconf
add address-pool=dhcp_pool2 interface=BR-TV-VL30 lease-time=1d12h30m name=\
    dhcp2
add address-pool=dhcp_pool3 interface=BR-CAM-VL20 lease-time=1d12h20m name=\
    dhcp3
add address-pool=dhcp_pool4 interface=BR-PTR-VL40 name=dhcp4
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \
    path-cost=10
add bridge=BR-TV-VL30 interface=VLAN_TVs
add bridge=BR-CAM-VL20 interface=VLAN_Cameras
add bridge=BR-PTR-VL40 interface=VLAN_Printer
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add comment=defconf interface=lte1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.87.1/24 interface=VLAN_MAIN network=192.168.87.0
add address=192.168.91.1/24 interface=BR-CAM-VL20 network=192.168.91.0
add address=192.168.96.1/24 interface=BR-TV-VL30 network=192.168.96.0
add address=192.168.32.1/24 interface=BR-PTR-VL40 network=192.168.32.0
/ip dhcp-client
add add-default-route=no comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.16 comment="Netgear Switch" mac-address=\
    94:18:65:6E:1A:1B server=defconf
add address=192.168.96.253 mac-address=D4:E2:2F:99:D2:A1 server=dhcp2
/ip dhcp-server network
add address=192.168.32.0/24 gateway=192.168.32.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
add address=192.168.91.0/24 gateway=192.168.91.1
add address=192.168.96.0/24 gateway=192.168.96.1
/ip dns
set allow-remote-requests=yes mdns-repeat-ifaces=VLAN_TVs,bridge
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=drop chain=input comment="Drop Winbox Port not coming from LAN" \
    dst-port=8291 protocol=tcp src-address=!192.168.88.0/24
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=input comment="Allow MDNS" connection-type="" \
    dst-address=224.0.0.251 dst-port=5353 log=yes log-prefix=mDNS protocol=\
    udp src-port=5353
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
    9.9.9.9 routing-table=main scope=30 suppress-hw-offload=no target-scope=\
    11 vrf-interface=ether1
add disabled=no distance=1 dst-address=9.9.9.9/32 gateway=10.0.0.1 \
    routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add disabled=no distance=2 dst-address=1.1.1.1/32 gateway=10.0.0.1 \
    routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=\
    1.1.1.1 routing-table=main scope=30 suppress-hw-offload=no target-scope=\
    11 vrf-interface=ether1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.88.0/24,192.168.87.0/24
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=America/Los_Angeles
/system identity
set name="MikroTik"
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

rplant · December 5, 2024, 10:37am

You could perhaps see if configuring source nat on packets leaving the LAN for the VLAN_TVs helps.

NetFailure · December 5, 2024, 3:16pm

Thanks for the reply. Could you expand a little bit on that thought? I’m not sure what you mean by “configuring source nat on packets leaving the LAN for the VLAN_TVs”.

I’m not extremely fluent in Mikrotik, but I can generally follow a video guide if you know of one that covers that topic.

BillyBlaze · December 5, 2024, 4:29pm

I just configured this myself so maybe I can help. Disclaimer: I am totally new to the Mikrotik ecosystem so if anybody spots any mistakes I highly appreciate the feedback!

I have 4 VLANS

vlan10_main
vlan20_iot
vlan30_guest
vlan99_mgnt

First thing is to set up the mDNS (like you did), in my case I want it to broadcast it to all VLANs except the management one:

/ip dns
set mdns-repeat-ifaces=vlan10_main,vlan20_iot,vlan30_guest

Then we need to allow mDNS in the firewall:

/ip firewall filter
add action=accept chain=input comment="Allow mDNS" dst-address=224.0.0.251 dst-port=5353 log-prefix=mDNS protocol=udp src-port=5353

After adding firewall, go to IP > Firewall and move the new rule all the way at the bottom to the top (as number 1)

After setting this, you will be able to find your devices (such as Chromecast or Spotify Connect) across the VLAN’s but you cannot play (yet)

In order to play we need to give access from other VLAN’s by setting a firewall rule, first thing is to assign static IP’s to your devices, in my case I have 2 devices. My TV is 10.0.10.21 and my soundbar is 10.0.10.22. I assigned this static address in IP > APR: (I tried to configure this rule on interface but I wasn’t able to figure a ‘dynamic’ way)

/ip firewall filter
add action=accept chain=forward comment="Allow connections to TV and Speakers (Chromecast)" connection-state=new dst-address=10.0.10.21-10.0.10.22 in-interface=all-vlan

After adding this, go to your firewall (IP > Firewall) and move the new firewall rule all the way at the bottom to be above your current firewall rule:

action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid

After this you should be able to also play across VLAN’s!

NetFailure · December 5, 2024, 9:39pm

I tried those settings, but I still came up with no options when I tried to cast from another VLAN.

Thanks for the try.

I just configured this myself so maybe I can help. Disclaimer: I am totally new to the Mikrotik ecosystem so if anybody spots any mistakes I highly appreciate the feedback!

I have 4 VLANS

vlan10_main

vlan20_iot

vlan30_guest

vlan99_mgnt

First thing is to set up the mDNS (like you did), in my case I want it to broadcast it to all VLANs except the management one:
/ip dns
set mdns-repeat-ifaces=vlan10_main,vlan20_iot,vlan30_guest
Then we need to allow mDNS in the firewall:
/ip firewall filter
add action=accept chain=input comment="Allow mDNS" dst-address=224.0.0.251 dst-port=5353 log-prefix=mDNS protocol=udp src-port=5353
After adding firewall, go to IP > Firewall and move the new rule all the way at the bottom to the top (as number 1)

After setting this, you will be able to find your devices (such as Chromecast or Spotify Connect) across the VLAN’s but you cannot play (yet)

In order to play we need to give access from other VLAN’s by setting a firewall rule, first thing is to assign static IP’s to your devices, in my case I have 2 devices. My TV is 10.0.10.21 and my soundbar is 10.0.10.22. I assigned this static address in IP > APR: (I tried to configure this rule on interface but I wasn’t able to figure a ‘dynamic’ way)
/ip firewall filter
add action=accept chain=forward comment="Allow connections to TV and Speakers (Chromecast)" connection-state=new dst-address=10.0.10.21-10.0.10.22 in-interface=all-vlan
After adding this, go to your firewall (IP > Firewall) and move the new firewall rule all the way at the bottom to be above your current firewall rule:
action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
After this you should be able to also play across VLAN’s!

rplant · December 6, 2024, 4:09am

I was thinking something like.

/ip firewall nat
add action=masquerade chain=srcnat comment=“Nat lan to wan tvs”
out-interface=VLAN_TVs

You could also filter by src-ip address, or src ip address list.

On review, I notice you have a bunch of bridges on this system.
And assorted vlans connecting them to a port.

This is not a recommended setup, especially for the Hex.
This unit does hardware offloaded vlan filtering quite well, so most switched (non routed) traffic does not use up any CPU.

You should consider moving in that direction.

NetFailure · December 6, 2024, 4:52am

Thanks for that tip. I’ll try to find a better setup for the VLANs. Maybe that would fix my issue by itself. I don’t find I’m hitting any limits with my minimal network usage.

NetFailure · December 6, 2024, 5:11am

One more question. Can you suggest a good resource for setting up my VLANs in a recommended fashion?

Thanks