Dear community,
I’m new to Mikrotik (not new in the networking field though ) and I’m really struggling to add basic vlan support to my CCR2004-16G-2S+
Basically I will use it as a standard NAT router and I will need a few VLANs on my LAN to have AP management and User traffic on 2 different VLANs.
I can’t even make the 1st vlan to work (untagged)…
Trying to ping 192.168.88.1 from a laptop (192.168.88.5) connected on ether2.
Can you please assist? I’m sure I’m missing some obvious part here but can’t figure out what
Here is the config I tested:
admin@MikroTik] > export
# 1970-01-02 00:28:55 by RouterOS 7.12.1
# software id = NCR8-KCMM
#
# model = CCR2004-16G-2S+
/interface bridge
add name=WIFI vlan-filtering=yes
/interface vlan
add interface=WIFI name=users vlan-id=8
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/port
set 0 name=serial0
set 1 name=serial1
/interface bridge port
add bridge=WIFI interface=ether2 pvid=8
add bridge=WIFI interface=ether4 pvid=8
add bridge=WIFI interface=ether6 pvid=8
add bridge=WIFI interface=ether8 pvid=8
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=WIFI untagged=ether2,ether4,ether6,ether8 vlan-ids=8
/ip address
add address=192.168.88.1/24 interface=users network=192.168.88.0
/system note
set show-at-login=no
/system routerboard settings
set enter-setup-on=delete-key
Ahh okay, I see you only have one subnet and are using a vlan for that. A bit unusual but perfectly fine.
My question is, where are your firewall rules?
Where is your internet connection??
I voluntarily removed all other parts to isolate my issue but basically port 1 will be my WAN interface with classic NAT.
I’ll then have 2 vlans: one for users and one for wifi management
Here is a more comprehensive config I’m trying without success: connecting a laptop to access port 2 or 4 doesn’t work: it cannot get any IP from DHCP server.
I tried assigning an IP manually and it cannot ping .1 in any vlan (not DHCP related)
The doc shows it but your config still not correct. /interface bridge port
add bridge=br-dcwifi ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether2 pvid=9
add bridge=br-dcwifi ingress-filtering=yes frame-types=admit-priority-and-untagged i interface=ether4 pvid=8
add bridge=br-dcwifi ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether6
add bridge=br-dcwifi ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether8
Ok, I see yours is more strict but the one I pasted seems to work too: it looks like untagged is inferred from the PVID field of this interface
meaning that port 2 and 4 are shown as currently untagged in winbox when active whereas 6 and 8 as tagged which is correct.
Correct, I prefer to manually insert the untagging as a visual crosscheck to make sure my bridge ports and bridge interfaces line up.
Also the untagging doesnt show up when exporting a config…
) and I’m really struggling to add basic vlan support to my CCR2004-16G-2S+
