Once and for all COMPLETE Offbridge Port setup

[jaclaz]

This is "another" method making use of VLANs, now verified and double checked, originally suggested by CGGXANNX in post

Once and for all COMPLETE Offbridge Port setup

Also my personal opinion, but with the current version von RouterOS 7, I don’t really see the appeal of moving a port out of the bridge for management anymore. It’s not more complicated or error prone to keep the management port in the bridge at all. Let’s look at the starting point of the defconf configuration where most the ports are in the default bridge bridge and some other port are WAN port. Instead of moving a port out of the bridge, my “guide” would be the following, based on your guide…

From reading the first post, you may have come to the conclusions that:

1. Implementing VLANs is complex
2. Implementing VLANs is dangerous and you risk locking yourself out of a Mikrotik router if you make even a teeny-tiny mistake
3. You should NOT EVEN THINK of implementing VLANs unless you have a safe way to connect to your router

Well, you would be right, but this doesn't mean that VLANs are evil (though Mikrotik's ways to deal with them sometimes can be border line with hell).

If properly used VLANs can actually be a precious resource.

To prove this, here is a way that makes use of a VLAN to give you a possible way out in case of (other) VLAN misconfigurations, ouroboros anyone? https://en.wikipedia.org/wiki/Ouroboros

BTW, this approach would solve the (not common, still ...) issue with devices that only have two ethernet ports (we take here the wAP Ax as an example, but the reasoning is the same for many other devices, from the mAP to various cAP models).

So, you have your brand new wAP Ax and you want to prepare it for one of its intended environments (countryside getaway, bus stop or rural gas station ), as an all in one device router/AP, possibly coupled with a separate (managed) switch for - say - IP cameras, NVR, cash register, whatever.

Typically you would have a bridge to which both the two radios and one ethernet port (ether2) are added (LAN) and the other ethernet port (ether1) as self-standing and connected to the ISP ONT/modem/router/whatever (WAN).

You don't have any spare port to reserve to management.

So you can create such a port virtually, by creating a VLAN interface on top of the bridge.

As seen in Rules #1 and #2:

The twelve Rules of Mikrotik Club

Preamble and disclaimer: The following is a set of Rules that are intended as advice useful to avoid the most common errors observed in configuration posted on this forum. It is my personal take on the matter, and in no way approved, endorsed or recommended, officially or unofficially, by Mikrotik or their partners or by anyone else. In other words you are perfectly free to ignore them, though they represent (IMHO) a sort of (good) cheat sheet/reminder for people starting to use these devices…

1. You do not use VLAN1.

2. You DO NOT use VLAN1.

exception made for VLAN 1, any other number is game, you have available a 2-4094 range, we will use here 999, but you can change this as you like, as well the interface name (vlan-mgmt here) can be changed at will.

So, first thing we create a new VLAN interface on top of the bridge:

/interface vlan
add interface=bridge name=vlan-mgmt vlan-id=999 

then we repeat the same steps as in the guide above from A2 to A5, only changing the name of the interface from ether5 to vlan-mgmt:

#A2 categorize correctly the newly added interface
/interface list
add comment="Management only" name=MGMT
add comment="Management and LAN" name=MGMTandLAN

/ip neighbor discovery-settings
set discover-interface-list=MGMTandLAN

/tool mac-server
set allowed-interface-list=MGMTandLAN

/tool mac-server mac-winbox
set allowed-interface-list=MGMTandLAN

/interface list member
add comment=OffBridge interface=vlan-mgmt  list=LAN

#A3 add a suitable IP address to the interface
/ip address
add address=10.10.10.1/24 interface=vlan-mgmt

#A4  configure a suitable DHCP server on the interface, ONLY IF you cannot remember that your PC should have
#a static IP of 10.10.10.10/24 to connect
/ip pool
add name=Offbridge-dhcp-pool ranges=10.10.10.1-10.10.10.254

/ip dhcp-server network
add address=10.10.10.0/24 gateway=10.10.10.1 dns-server=10.10.10.1,10.10.10.1

/ip dhcp-server
add address-pool=offbridge-dhcp-pool interface=vlan-mgmt name=offbridge-dhcp-server

/ip firewall filter
add place-before=0 chain=input action=accept in-interface-list=MGMT comment="modconf: allow from MGMT interface vlan-mgmt"

Now the additional step, make sure that ether2 (as port of the bridge) is correctly configured for VLAN 999 with frame-types admit-all (which basically means "do not be too picky with what you connect to")

/interface bridge port set [find interface=ether2] frame-types=admit-all pvid=999

At this point your wAP Ax will have 6 interfaces in total, of which only 3 are categorized as either WAN or LAN:

   -------------|   |
1. |ether1 (WAN)| F |
   -------------| i |-----------------------|
2.              | r |    vlan-mgmt (LAN)    |
                | e |-----------------------|
                | w |               |ether2 |
3.              | a |  bridge (LAN) |wlan1  |
                | l |               |wlan2  |
                | l |-----------------------|

The above (poor?) attempt at ASCII art should convey the idea that ether2, wlan1 and wlan2 are INSIDE (or slave to) the bridge whilst the vlan-mgmt one "SITS ON TOP" (or is at the same level) of the bridge.

This virtual interface is right now "inactive/doing nothing" because the bridge has by default a setting (that is usually not shown in a simple /export) of "vlan-filtering=no".

Until you leave that setting as is, this VLAN interface is like as if it wasn't existing at all.
The device conected through a physical ethernet cable to interface ether2 (actually the port ether2 of the interface bridge) will "see" the IP address assigned to the bridge, will receive from the DHCP running on the bridge (if any), etc.

Now what happens the moment you change the setting of the bridge to "vlan-filtering" on?

Actually nothing that you can see, but the vlan-mgmt interface is now ready to connect on VLAN 999, so if you change the settings on the connected device to use VLAN 999, the connection will "switch" to VLAN 999 and the connected device will get a new IP address from the "other" DHCP (the one running on VLAN 999) as soon as you unplug/replug the network cable or run commands like ipconfig /renew (if you don't "refresh" the connection the client device will keep the old IP address in the "wrong" subnet until the half of the lease time has elapsed).

In CGGXANNX's original post Once and for all COMPLETE Offbridge Port setup - #14 by CGGXANNX (all the credit for this should go to him):

Now you can do whatever other setups as you wish.
As long as the bridge still has vlan-filtering=no as the starting value, the behavior of this port has not changed (still in the IP subnet of the original bridge interface).
Once you turn on vlan-filtering=yes, this port behaves exactly the same as the port that you’ve taken out of the bridge from your guide.
But with the following advantages:

1. It’s in the bridge so can have hardware offload with most of MikroTik devices with support for Bridge VLAN Filtering HW offload.
2. You don’t have to play DJ with your cable and ports while doing the configuration move, the PC used for configuration can be plugged to that same port from the beginning.
3. If you use MAC WinBox to connect to the router then you don’t even have to do anything when switching from vlan-filtering=no to vlan-filtering=yes, WinBox will be shortly disconnected and will reconnect automatically. This is useful if your device is in a cabinet or in another room.
4. You have also already created your management VLAN, ready to be moved to other ports / switches.
   You can use the port to test the other VLANs (or have quick access to other VLANs) in the future, as hybrid port.
   Also, in case you run out of ports in the future and no longer have the luxury of a dedicated port for management, then the config change is much easier. You don’t need to hunt your config and remove the added entries that directly reference etherx at all.

Again, the difference in the steps required to be taken is instead of removing a port from the bridge, we add an entry under /interface vlan and change the pvid value of a port.