New to the Mikrotik Routerboard series, but not new to networking
I am planning to get more knowledge about Microtik Routers, currently using Draytek series routers on our bussiness customers.
See my attachement:
I need to built the following configuration: I have setup my Mikrotik Routerboard so the the device “laptop” connected to ETH 4 is using the internet connection connected to ETH 1
Laptop can do everything on the mighty internet.
The system connected to ETH 5 is my question:
This situation is placed in a so called bussiness center, different small bussinesses using the single powerfull internet connection in place.
I need VLAN separation, because on 2 of the 4 VLAN’s there are running file servers with Active Directory forests and other file and print services.
Since these 4 companies are not working toghether (4 separate bussinesses) i want them not to allow to access each other networks, but they must be able to use the powerfull internet connection.
Can someone give me some directions on how
to set this up?
Create the needed VLANs on Eth5 and give each VLAN interface a dedicated address (use separate subnets).
Build firewall rules in such a way that the traffic can only go outside
/ip firewall filter
add chain=forward in-interface=vlan-x out-interface=ether1 action=allow
add chain=forward in-interface=vlan-x out-interface=ether1 action=allow
add chain=forward in-interface=vlan-x out-interface=ether1 action=allow
add chain=forward action=drop
Also bear in mind your laptop and the input-chain.
On the switch side put the port connecting to the routerboard in trunk mode.
Assign needed ports to designated vlan.
The device “laptop” was just plugged in to manage the routerboard and configure it, and to see my initial setup was running as it shoud.
In the final setup the Routerboard and switch are placed behind locked door with our company owning the key.
The "device “laptop” is only for configuration and management. It iwll not stay in place.
I will try the steps you mentioned Rudios! thanx for the assistance so far!
You add VLAN interfaces in the interface menu for the router purposes as shown above.
The VLAN confguration in the switch is only for the switch itself, you can just leave it alone as this
means the switch is in fully transparent mode and passes on all traffic to your own VLAN switch.
In your case you can also detach ether5 from the switch (by setting parent interface to none) and
put the VLAN interfaces directly on ether5 (not ether2-master as you normally would do) and you
keep the built-in switch with ports 2/3/4 for future use. You can also keep the management network
on that so that you can always connect the laptop to manage the router no matter what is happening
on the other networks.
I think i am quiet on the way to get this running.
My current setup is:
Created the VLAN interdaces and gave them IP’s in different subnets.
eg:
Vlan 10 192.168.1.1/24
On the switch i have some ports added to VLAN 10, where the uplink to the routerboard has it’s port Tagged in VLAN 10
Currently i am missing something, The device laptop is now connected to the switch to one of the ports in vlan 10. That port is in untagged mode.
I am NOT able to run a succesfull ping to the routerboard (192.168.1.1)
Not setup the firewall rules yet, first wanting a working situation that my device “laptop” can use internet.
I had something working before adding the VLAN\s , The laptop was in the same range as the Original IP of the routerboard (192.168.88.x) The laptop was hooked up to the switch and using internet.
i have it working.
yesterday i was assisted by one of my friends who also owns a Mikrotik Routerboard (He has more devices like Mikrotik cloud cores etc.)
He indeed detached port 5 from the bridge. He concluded that the Basic setup which comes default with the Routerboard was causing me trouble.
The config what i did with the help here pressed me indeed very far in the right direction. Thanx for all your help!
(i have no reputation points already, so sadly i can’t add positive reputation points to your posts guys (or girls?? )
On the switch side it had gone wrong that the switches software made the uplink port hynrid. (HP5120-49G managed L3 switch)
It was changed from hybrid to trunk port mode.
The project is installed next week on the customers place. will install a brand new routerboard at my home short afterwards)
