Looks normal despite I could access the router with the Ethernet address of the raw ethernet port on a port configured as plain access port. So it is accessable with the configured vlan/ip on this port and additional I see discovery packets from the mac of the ethernet port. Doing mac-ping on bridge mac or ethernet mac I get double packets answered. Could login on both MAC-Adresses.
Expected behavior I have to work around with Layer2 filtering?
The expected behavior all depends on how you did the configuration and without seeing this makes it impossible to comment.
I do suspect that you stopped halfway, if you read further in the quoted URL, you will see where it talks about “Unintentionally allowed management access…” And explains how to correct this
This is neighbor discovery from another MT box reachable via ether3. 48:8F:5A:11:F1:C2 is MAC of ether3, 48:8F:5A:11:F1:C1 is MAC of ether2/bridge interface.
Reason for tagged and untagged access to device is your bridge vlan configuration, currently it is on default which is “Admit all” frame types
The “bridge” interface provides access to the CPU, i.e. the Mikrotik itself. As per the artile you quoted in OP, if you change the setting to the below it will correct this.
Above explained here in article you quoted / followed
Before making this config change, read below suggestion, especially point 2, depending on your config, you can lose access to the device if you don’t have a management vlan
2 suggestions:
Stay away from using vlan id “1”, not saying it cant be used, but this is the “native” vlan id and can confuse matters.
Not a suggestion, more a really MUST do, create a management vlan and access device using that to manage the device and prevent unauthorized access
Read the article you quoted again to make sure you understand it, if more questions, welcome to ask here
So all these vlans have access to the device itself. If these vlans need access to the “Bridge”, for i.e. pppoe termination, or DHCP, etc, only you can tell.
So if above is the case, then you must create a “Management Vlan” and add “Management Access Limits” using Discovery, Mac-Tel, Firewall rules, etc
In default config, MNDP broadcasts on all interfaces except dynamic ones, so in this case, the ether interface as well as the “bridge interface”, so yes, you will see both
