As it always happens, everything worked fine before I touched it…lol
I’ve got 2 networks I want to separate, ether port 5 - 10.0.1.1 (wireless) and ether port 4 - 192.168.20.1 (wired) with a common internet connection ether port 1
I created vlans for each network, gave address 10.0.1.10 (vlan1) and 192.168.20.10 (vlan2) When both are enabled the networks were unable to communicate with each other, which is what I wanted.. BUT when both are enabled the 10.0.1.1 (wireless) network can access the internet with no issues. The 192.168.20.1 (wired) network loses it’s connection to the internet.
If I disable 192.168.20.10 (vlan2) everything goes back to the way it was, everything works, the wireless can see the wired and the wired can see the wireless again.
/interface ethernet
set 0 comment="Time Warner Internet connection" name="ether2 - Internet"
speed=1Gbps
set 4 comment="Internal Network " name=ether4-local speed=1Gbps
set 5 comment="Wireless Network" name=ether5-local
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip neighbor discovery
set ether3-local disabled=no
set vlan1 disabled=yes
set vlan2 disabled=yes
+1. My guess is that you have the VLANs configured as “trunk” ports instead of “access” ports. Meaning that your MikroTik is sending “tagged” packets to the devices on those ports and that the devices need to understand VLANs which I am guessing they don’t. Usually you want the ports connected to computers etc as access ports and not trunk ports, or at the least hybrid ports (e.g. untagged and tagged data over the same port).
But I agree, to really tell you “why” it is wrong we need to see how you have things connected (e.g. a diagram).
It didn’t work because you have the same subnets applied to two distinct interfaces. e.g. subnet 192.168.20.0/24 is on both interface ether4-local and interface vlan1.
By default RouterOS will route among connected networks. To stop it doing so use filters in the forward chain.
No, they are useless in your setup. You just have different ports with different networks.
Your firewall rules should prevent inter range communication.
Vlan’s come into the picture when different networks need to be spread over several devices.
Based on your diagram one thing isn’t clear. I assume that the devices on each network don’t understand VLANs correct? e.g. ether ports 4 and 5 should be access ports and not trunk ports?
Oh yeah. I completely agree with that, but the whole trunk port vs access port certainly doesn’t help make it at least functional. I entirely agree that VLANs offer no benefit here.
