I apologize firstly, as I’m not sure I can adequately explain what I need. Hopefully this doesn’t come across as a bad question!
First of all, I have a Mikrotik CRS switch where I have implemented this VLAN strategy titled VLAN Example - Trunk and Access Ports.
I also have a Mikrotik CCR router that is aware of each of the VLANs coming in over the trunk port from the switch. I’ve created an interface on this router for each VLAN and assigned it an ip (such as 10.10.10.1/24 for VLAN 10). I then setup a corresponding DHCP server to hand out IPs in that same range for the given VLAN.
I have a small home office router plugged into the switch that normally gets tagged with VLAN 10, then assigned an ip of 10.10.10.25. I’d like that router to be assigned a public IP while keeping all the other devices coming into that access port on VLAN 10. One way I’d prefer to accomplish it is by logging into the router and having the router tag itself with VLAN 100, then make the Mikrotik router aware of VLAN 100 and have a DHCP server setup to assign from the pool of public IPs. When I try this now, the home office router loses all access to the network until I remove the VLAN 100 tag.
My questions:
Is it possible to have untagged traffic coming into that access port and get tagged with VLAN 10, while at the same time having another device “self-tagging” with vlan 100 and then still get it back to the router?
Are there alternatives to what I’m hoping to accomplish with the DHCP server? I do like the idea of a DHCP server because it’ll allow me to manage the IP assignments since I can set them as static after the fact and then still know which device is using it.
1 - Yes. Use a hybrid port which supports untagged and one or more tagged VLANs, an access port is untagged only.
2 - It depends on how your public IPs are delivered. If they are a routed subnet separate from the WAN transit, or the WAN connection is PPPoE, you can simply have a public LAN/VLAN and DHCP server plus suitable firewall rules, however if they are part of a WAN subnet it is more complex but can be done.
A sketch of the network setup and posting your configs (the output of /export hide-sensitive with the serial number and any other identifying information such as public IP addresses redacted) would provide a clearer picture.
If I’m not mistaken, the only difference between a hybrid and access port is the frame types that it allows? Hybrid appears to “allow all” while the access is set to “admit-only-untagged-and-priority-tagged”? Is there anything else I would need to do on the switch to allow VLAN 100 to leave via the trunk?
The /interface bridge vlan settings should include the interface in the tagged= list for the VLAN (assuming it’s a CRS3xx using a VLAN aware bridge, CRS1xx/2xx use a different setup for hardware-offloaded VLAN switching)
I’ve attempted to disable the ingress filter and modified the frame type. It still seems that when I go to vlan=100 from my home router, it doesn’t allow traffic through the switch. Granted, my only real proof of this is that I don’t get a response from a DHCP server. I also tried to torch the vlan-100 interface from the router but don’t see any packets tagged with vlan 100.
My home router is plugged into ether4. My trunk port to the Mikrotik router is combo2.
Switch Config
# nov/27/2022 15:11:40 by RouterOS 6.49.7
# software id =
#
# model = CRS312-4C+8XG
# serial number =
/interface bridge
add admin-mac=DC:2C:6E:28:C4:4F auto-mac=no comment=defconf ingress-filtering=yes name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=combo1 ] comment="Garage Switch"
set [ find default-name=combo2 ] comment="to Dell QoE"
set [ find default-name=combo3 ] comment="Attic switch"
set [ find default-name=combo4 ] comment="Tower Switch"
set [ find default-name=ether1 ] comment="Emergency / Empty"
set [ find default-name=ether2 ] comment="Port 1 - office"
set [ find default-name=ether3 ] comment="Port 2 wire - Garage 60LR Quinton"
set [ find default-name=ether4 ] comment="Home Office - Port 3 Wire"
set [ find default-name=ether8 ] comment="QoE Management 10.0.1.5"
/interface list
add name=WAN
add name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4-ipv6
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=bridge comment="Garage Switch Mikrotik" edge=yes frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=combo1 pvid=50
add bridge=bridge comment="Going to Mikrotik Router (via Dell QoE)" frame-types=admit-only-vlan-tagged \
ingress-filtering=yes interface=combo2
add bridge=bridge comment="Attic Switch" frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes \
interface=combo3 pvid=40
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes \
interface=combo4 pvid=9
add bridge=bridge comment=defconf ingress-filtering=yes interface=ether1
add bridge=bridge comment="Office - VL78" interface=ether2 pvid=78
add bridge=bridge comment="VL20- Quinton" frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes \
interface=ether3 pvid=20
add bridge=bridge comment="VL78 Home Connection" edge=yes interface=ether4 pvid=78
add bridge=bridge comment=defconf edge=yes frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes \
interface=ether5 pvid=78
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes \
interface=ether6 pvid=78
add bridge=bridge comment="VL78: UISP / UNMS" ingress-filtering=yes interface=ether7 pvid=78
add bridge=bridge comment="VL78: QoE" ingress-filtering=yes interface=ether8 pvid=78
add bridge=bridge comment=defconf ingress-filtering=yes interface=ether9
/ip settings
set max-neighbor-entries=2048
/interface bridge vlan
add bridge=bridge tagged=combo2 untagged=ether4,ether6,ether5 vlan-ids=78
add bridge=bridge tagged=combo2 vlan-ids=20
add bridge=bridge tagged=combo2 vlan-ids=10
add bridge=bridge tagged=combo2 vlan-ids=30
add bridge=bridge tagged=combo2 vlan-ids=40
add bridge=bridge tagged=combo2 vlan-ids=50
add bridge=bridge tagged=combo2 untagged=ether6 vlan-ids=9
add bridge=bridge tagged=combo2 vlan-ids=1
add bridge=bridge comment="vlan 100 will be used when we need an ip from the public pool" tagged=combo2 vlan-ids=100
/interface list member
add interface=ether9 list=WAN
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=combo1 list=LAN
add interface=combo2 list=LAN
add interface=combo3 list=LAN
add interface=combo4 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=10.0.1.6/24 comment=defconf interface=ether1 network=10.0.1.0
add address=10.10.10.12 interface=bridge network=10.10.10.12
add address=10.10.78.2 interface=bridge network=10.10.78.2
add address=10.255.1.2/30 interface=ether1 network=10.255.1.0
/ip dns
set servers=8.8.8.8,1.1.1.1
/ip route
add distance=1 gateway=10.255.1.1
/system clock
set time-zone-name=America/Denver
/system identity
set name=MikroTik-CRS
/system routerboard settings
set boot-os=router-os
Per my previous post you have to explicitly add tagged port membership in /interface bridge vlan, just changing frame-types is insufficient. The switch only has tagged VLANs on combo2.
Why are you adding VLAN interfaces with an ID of 1 to various ports, it is unusual and not recommended unless you have a very specific use case.
Are you referring to the /interface/bridge/vlan section where vlanid exists on combo2? Or do you refer to /bridge/ports where the PVID is set to 1? When I couldn’t remove the PVID value, I had assumed I needed to add vlan 1 to the interface/bridge/vlan area. Am I safe to remove it from the vlan list for combo2?
Ah, I think I understand. I had originally thought that meant I needed combo2 to allow vlan 100 to go out. You are saying that in addition to that, I need to set ether4 to also be “Current tagged” since it’ll come in from outside through ether4. Right?