Hello everyone,
I’m using OPNsense as a firewall with 2 interfaces: enp2s0 (192.168.1.254) as WAN and enp3s0 as LAN (10.0.1.2). Everything is good on this side. If I connect a device (without using my layer 3 switch) to the LAN side within the same subnet, I can access the web through my firewall. However, when I connect it to my Mikrotik device, I cannot even ping the LAN side.
I have 4 VLANs: 3 for devices and services, and 1 “Base” VLAN for all my nodes (Firewall, Switches, Routers). I bridged all my VLANs into 1 bridge named LAN. Three VLANs have specific Ethernet ports, and the base VLAN has 1 specific Ethernet port, which is used to be directly connected to the firewall on the LAN side.
(the 10.0.1.4 is actually 10.0.1.2)
I am a bit confused about the trunk configuration and VLAN access. My current objective is to establish internet access from my VLANs through the firewall. Initially, I want every VLAN to be pingable from any other VLAN. I’ll implement restrictions later once the basic connectivity is confirmed.
You can find my commented configuration bellow :
#######################################
# Name
#######################################
# Change the Switch name
/system identity set name=Intranet
#######################################
# VLAN
#######################################
# 10 = BASE_VLAN
# 20 = SERVICES
# 30 = TESTS
# 40 = HQ
#######################################
# Bridge
#######################################
# Create the bridge
/interface bridge add name=LAN protocol-mode=none vlan-filtering=no
#######################################
# Access Ports
# Note: Set the ports here if they already exist by default.
# If they don't exist, create them with 'add interface=etherX'
#######################################
# Port for debug, connection via IP (Web) or MAC (Winbox)
/interface bridge port set 0 bridge=bridge disabled=no comment=Debug
# Ports VLAN Services
/interface bridge port set 2 bridge=LAN disabled=no pvid=20 comment=DHCP/DNS
/interface bridge port set 3 bridge=LAN disabled=yes pvid=20 comment=EMPTY
/interface bridge port set 4 bridge=LAN disabled=yes pvid=20 comment=EMPTY
/interface bridge port set 5 bridge=LAN disabled=no pvid=20 comment=Printer
/interface bridge port set 6 bridge=LAN disabled=yes pvid=20 comment=EMPTY
/interface bridge port set 7 bridge=LAN disabled=yes pvid=20 comment=EMPTY
# Ports VLAN Tests
/interface bridge port set 8 bridge=LAN disabled=no pvid=30 comment=Switch
/interface bridge port set 9 bridge=LAN disabled=no pvid=30 comment=AP_TESTS
/interface bridge port set 10 bridge=LAN disabled=yes pvid=30 comment=EMPTY
/interface bridge port set 11 bridge=LAN disabled=yes pvid=30 comment=EMPTY
/interface bridge port set 12 bridge=LAN disabled=yes pvid=30 comment=EMPTY
/interface bridge port set 13 bridge=LAN disabled=yes pvid=30 comment=EMPTY
/interface bridge port set 14 bridge=LAN disabled=yes pvid=30 comment=EMPTY
/interface bridge port set 15 bridge=LAN disabled=yes pvid=30 comment=EMPTY
# Ports VLAN HQ
/interface bridge port set 16 bridge=LAN disabled=no pvid=40 comment=AP_OFFICE
/interface bridge port set 17 bridge=LAN disabled=no pvid=40 comment=AP_BASEMENT
/interface bridge port set 18 bridge=LAN disabled=yes pvid=40 comment=EMPTY
/interface bridge port set 19 bridge=LAN disabled=yes pvid=40 comment=EMPTY
/interface bridge port set 20 bridge=LAN disabled=yes pvid=40 comment=EMPTY
/interface bridge port set 21 bridge=LAN disabled=yes pvid=40 comment=EMPTY
/interface bridge port set 22 bridge=LAN disabled=yes pvid=40 comment=EMPTY
/interface bridge port set 23 bridge=LAN disabled=yes pvid=40 comment=EMPTY
#######################################
# Trunk Ports
#######################################
/interface bridge port set 1 bridge=LAN disabled=no pvid=10 comment=TRUNK
/interface bridge vlan add bridge=LAN tagged=LAN,ether2 vlan-ids=10
/interface bridge vlan add bridge=LAN tagged=LAN,ether2 vlan-ids=20
/interface bridge vlan add bridge=LAN tagged=LAN,ether2 vlan-ids=30
/interface bridge vlan add bridge=LAN tagged=LAN,ether2 vlan-ids=40
#######################################
# Addressing and Routing
#######################################
/interface vlan add interface=LAN name=BASE_VLAN vlan-id=10
/ip address add address=10.0.1.1/24 interface=BASE_VLAN
# DNS caching server for LAN
/ip dns set allow-remote-requests=yes servers="10.0.2.2"
# Create Interface, IP, and DHCP for SERVICES
/interface vlan add interface=LAN name=SERVICES vlan-id=20
/ip address add interface=SERVICES address=10.0.2.1/24
/ip pool add name=SERVICES_POOL ranges=10.0.2.3-10.0.2.254
/ip dhcp-server add address-pool=SERVICES_POOL interface=SERVICES name=SERVICES_DHCP disabled=no lease-time=192h
/ip dhcp-server network add address=10.0.2.0/24 dns-server=10.0.2.2 gateway=10.0.1.2
# Create Interface, IP, and DHCP for TESTS
/interface vlan add interface=LAN name=TESTS vlan-id=30
/ip address add interface=TESTS address=10.0.3.1/24
/ip pool add name=TESTS_POOL ranges=10.0.3.3-10.0.3.254
/ip dhcp-server add address-pool=TESTS_POOL interface=TESTS name=TESTS_DHCP disabled=no lease-time=192h
/ip dhcp-server network add address=10.0.3.0/24 dns-server=10.0.2.2 gateway=10.0.1.2
# Create Interface, IP, and DHCP for HQ
/interface vlan add interface=LAN name=HQ vlan-id=40
/ip address add interface=HQ address=10.0.4.1/24
/ip pool add name=HQ_POOL ranges=10.0.4.4-10.0.4.254
/ip dhcp-server add address-pool=HQ_POOL interface=HQ name=HQ_DHCP disabled=no lease-time=192h
/ip dhcp-server network add address=10.0.4.0/24 dns-server=10.0.2.2 gateway=10.0.1.2
#######################################
# Enable VLAN
#######################################
/interface bridge set LAN vlan-filtering=yes
Can someone tell my what’s wrong with my conf and help me ?
Feel free to ask for specific details or configurations, and I’ll provide them promptly.
Thank you in advance for your help!
pandaBolide
