Mikrotik Switch - How to bind to VLAN and make itself (e.g. webfig) accessible to devices connected to it?

Hi there,

Got another problem re the switch. I was able to separate the MGMT port from main bridge and assign to it a static IP, so that I could always gain access via that port.

Now I want to make my life easier and have the webui (webfig) and other services exposed to clients in the same VLAN.

Again, the setup was a virtualized opnsense instance. All traffic coming out of LAN port was tagged VLAN. One of the VLANs (VLAN10) is combined with a VLAN-Aware VMBR so that Proxmox VMs can be in the same network. (VLAN 10 - 192.168.10.0/24) There’s also a VLAN 88 with static IP range / DHCP server set up that was unused. (192.168.88.0/24) I have Proxmox itself sitting on that with a static IP, but would need static outside DNS to get internet access.

The closest I am to success is -
Set up a VLAN interface under Interfaces with VLAN ID = 10, do nothing with the bridge, assign a static IP to the VLAN interface (say 192.168.10.10) and manually set a remote DNS. This way the switch is connected to the Internet, and Proxmox VMs can ping it / access webui. However, none of the devices connected to the switch itself on the same subnet can ping 192.168.10.10 .

I then tried to bind the switch to VLAN 88, using the same strategy, it is not reachable at all by Proxmox. By no means it could reach the internet either. If I set up a bridge VLAN interface with ID = 88, tag both combo1 (trunk) and bridge, and try assigning an IP to the bridge interface, it still doesn’t work. The switch is completely unreachable by other hosts nor it can ping others in the 88 subnet.

I’m wondering if there’s a way to achieve my goal? Also how to make the switch obtain its own IP automatically over a specific VLAN? I tried “IP config” under “Quick Setup” but it seems it always binds itself to ether2 for some reason and it is pretty wonky.

FYR there’s no FW rules set up.

Many thanks!!!

Update - I tried to add a VLAN interface with VLAN ID = 88 bound to the trunk port, and then a DHCP client on the same VLAN.

The DHCP server sees the DHCPDISCOVERY request coming from the switch and offered an address, but seems it never reached the switch. It was stuck in the “searching” state…

An export of the current attempt would be very helpfull:

/export file=anynameyoulike

Remove serial and any other private info.

Also add model number and version of RouterOS.

Your (anyones) VLAN reference (which should be obliged to read):
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

Thank you. I ended up figuring it out myself again.

It turns out I wasn’t following the video https://m.youtube.com/watch?v=4Z32oOPqCqc closely enough…

To recap, I was pretty close during the VLAN10 exploratory stage.

The Interface -> VLAN10 interface should be bound to the bridge & All I needed was to add Tagged=Bridge in bridge VLAN10 interface (so needed both VLAN interface AND bridge VLAN interface). Lastly assign IP to the VLAN interface itself. Now everyone’s happy.

Learned a ton from this experience.

Or read…
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1