Problem with bridge vlan

RouterOS General
1

Hello,

I am trying to configure bridge vlan on my mikrotik RB5009 router since a while now and I’m stuck with it.
Here is what I want to do :
I have a RB5009 router and a managed switch.
WAN come to Eth1 with a bridge for WAN.
All interfaces except Eth1 and Eth8 (my “backup” port) are in a “lan bridge”.
I want to create vlan10, 20, 100, 200.
Interface 2 to 5 can communicate with vlan 10, interfaces 6&7 to vlan 20, 100 and 200.
The SFP+ port can transport all vlans.

I’m stucking at this step, I have a server with fixed address on 192.168.20.250, I can ping it with the router when the IP is on a physical interface but not anymore when I attribute the IP on the vlan 20.

I have tried many think but I’m stucking on this step.
I would like to have your help, so here is my configuration if you see some mistakes.

/interface bridge
add frame-types=admit-only-vlan-tagged name=br-lan port-cost-mode=short
vlan-filtering=yes
add admin-mac=98:42:65:15:93:60 auto-mac=no name=br-wan port-cost-mode=short

/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=sfp-sfpplus1 ] comment=LAN-SFP

/interface vlan
add interface=br-lan name=vlan10 vlan-id=10
add interface=br-lan name=vlan20 vlan-id=20
add interface=br-lan name=vlan100 vlan-id=100
add interface=br-lan name=vlan200 vlan-id=200
add comment=“Internet ONT” interface=ether1 loop-protect-disable-time=0s
loop-protect-send-interval=1s name=vlan832-internet vlan-id=832

/interface list
add name=LAN

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik

/interface bridge filter
add action=set-priority chain=output dst-port=67 ip-protocol=udp log=yes
log-prefix=“Set CoS6 on DHCP request” mac-protocol=ip new-priority=6
out-interface=vlan832-internet passthrough=yes
add action=set-priority chain=output dst-port=547 ip-protocol=udp
mac-protocol=ipv6 new-priority=6 out-interface=vlan832-internet

/interface bridge port
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1
internal-path-cost=10 path-cost=10
add bridge=br-wan comment=WAN interface=vlan832-internet internal-path-cost=
10 path-cost=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether2 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether3 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether4 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether5 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether6 pvid=20
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether7 pvid=20

/interface list member
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=sfp-sfpplus1 list=LAN
add interface=ether8 list=LAN
add interface=br-lan list=LAN
add interface=vlan10 list=LAN
add interface=vlan20 list=LAN
add interface=vlan100 list=LAN
add interface=vlan200 list=LAN

/ip address
add address=192.168.1.254/24 comment=LAN-DEFAULT disabled=yes interface=
br-lan network=192.168.1.0
add address=192.168.88.1/24 interface=ether8 network=192.168.88.0
add address=192.168.10.254/24 comment=LAN interface=vlan10 network=
192.168.10.0
add address=192.168.20.254/24 comment=SERVEUR interface=vlan20 network=
192.168.20.0
add address=192.168.100.254/24 comment=DMZ interface=vlan100 network=
192.168.100.0
add address=192.168.200.254/24 comment=MGMT interface=vlan200 network=
192.168.200.0

/ip firewall address-list
add address=192.168.1.0/24 list=support
add address=192.168.88.0/24 list=support
add address=0.0.0.0/8 comment=“Self-Identification [RFC 3330]” list=bogons
add address=10.0.0.0/8 comment=“Private[RFC 1918] - CLASS A” disabled=yes
list=bogons
add address=127.0.0.0/16 comment=“Loopback [RFC 3330]” list=bogons
add address=169.254.0.0/16 comment=“Link Local [RFC 3330]” list=bogons
add address=172.16.0.0/12 comment=“Private[RFC 1918] - CLASS B” disabled=yes
list=bogons
add address=192.168.0.0/16 comment=“Private[RFC 1918] - CLASS C” disabled=yes
list=bogons
add address=192.0.2.0/24 comment=“Reserved - IANA - TestNet1” list=bogons
add address=192.88.99.0/24 comment=“6to4 Relay Anycast [RFC 3068]” list=
bogons
add address=198.18.0.0/15 comment=“NIDB Testing” list=bogons
add address=198.51.100.0/24 comment=“Reserved - IANA - TestNet2” list=bogons
add address=203.0.113.0/24 comment=“Reserved - IANA - TestNet3” list=bogons
add address=224.0.0.0/4 comment=“MC, Class D, IANA” disabled=yes list=bogons
add address=192.168.20.0/24 list=support
add address=192.168.30.0/24 list=support
add address=192.168.200.0/24 list=support
add address=192.168.100.0/24 list=support
/ip firewall filter
add action=add-src-to-address-list address-list=Syn_Flooder
address-list-timeout=30m chain=input comment=
“Add Syn Flood IP to the list” connection-limit=30,32 protocol=tcp
tcp-flags=syn
add action=drop chain=input comment=“Drop to syn flood list”
src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner
address-list-timeout=1w chain=input comment=“Port Scanner Detect”
protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment=“Drop to port scan list”
src-address-list=Port_Scanner
add action=jump chain=input comment=“Jump for icmp input flow” jump-target=
ICMP protocol=icmp
add action=drop chain=input comment=“Block all access to the winbox - except t
o support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUP
PORT ADDRESS LIST” dst-port=8291 protocol=tcp src-address-list=!support
add action=jump chain=forward comment=“Jump for icmp forward flow”
jump-target=ICMP protocol=icmp
add action=drop chain=forward comment=“Drop to bogon list” dst-address-list=
bogons
add action=add-src-to-address-list address-list=spammers
address-list-timeout=3h chain=forward comment=
“Add Spammers to the list for 3 hours” connection-limit=30,32 dst-port=
25,587 limit=30/1m,0:packet protocol=tcp
add action=drop chain=forward comment=“Avoid spammers action” dst-port=25,587
protocol=tcp src-address-list=spammers
add action=accept chain=input comment=“Accept DNS - UDP” port=53 protocol=udp
add action=accept chain=input comment=“Accept DNS - TCP” port=53 protocol=tcp
add action=accept chain=input comment=“Accept to established connections”
connection-state=established
add action=accept chain=input comment=“Accept to related connections”
connection-state=related
add action=accept chain=input comment=“Full access to SUPPORT address list”
src-address-list=support
add action=drop chain=input comment=“Drop anything else! # DO NOT ENABLE THIS
RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED”
add action=accept chain=ICMP comment=“Echo request - Avoiding Ping Flood”
icmp-options=8:0 limit=1,5:packet protocol=icmp
add action=accept chain=ICMP comment=“Echo reply” icmp-options=0:0 protocol=
icmp
add action=accept chain=ICMP comment=“Time Exceeded” icmp-options=11:0
protocol=icmp
add action=accept chain=ICMP comment=“Destination unreachable” icmp-options=
3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment=“Drop to the other ICMPs” protocol=icmp
add action=jump chain=output comment=“Jump for icmp output” jump-target=ICMP
protocol=icmp
add action=drop chain=input comment=“drop ssh brute forcers” dst-port=22
protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist
address-list-timeout=1w3d chain=input connection-state=new dst-port=22
protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3
address-list-timeout=1m chain=input connection-state=new dst-port=22
protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2
address-list-timeout=1m chain=input connection-state=new dst-port=22
protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1
address-list-timeout=1m chain=input connection-state=new dst-port=22
protocol=tcp
add action=drop chain=forward comment=“drop ssh brute downstream” dst-port=22
protocol=tcp src-address-list=ssh_blacklist
/ip firewall nat
add action=masquerade chain=srcnat out-interface=br-wan to-addresses=0.0.0.0
/ip service
set telnet disabled=yes
set ftp disabled=yes

Thanks a lot !

2

Hello,

so looking at your configuration I have few suggestions and questions.

Why separate bridge for WAN and why are you don’t use ports 2-5 as access ports ? You only have 1 VLAN here that needs to be accessed

Then I would change from this:

/interface bridge port
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 \
internal-path-cost=10 path-cost=10
add bridge=br-wan comment=WAN interface=vlan832-internet internal-path-cost=\
10 path-cost=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether2 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether3 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether4 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether5 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether6 pvid=20
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether7 pvid=20

To this:

/interface bridge port
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 \
internal-path-cost=10 path-cost=10
add bridge=br-wan comment=WAN interface=vlan832-internet internal-path-cost=\
10 path-cost=10
add bridge=br-lan frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether2 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=br-lan frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=br-lan frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether4 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=br-lan frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether5 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether6
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether7

Now your ports 2-5 are access ports for VLAN10, and ports 6-7 are trunk ports for VLANs 20,100 and 200 (well they are not quite yet trunk ports, that we will solve in next line)

So after we are done with setup as above you only need to do one thing:

/interface bridge vlan
add bridge=bridge tagged=bridge,sfp-sfpplus1 untagged=ether2,ether3,ether4,ether5 vlan-ids=10
add bridge=bridge tagged=bridge,sfp-sfpplus1,ether6,ether7 vlan-ids=20
add bridge=bridge tagged=bridge,sfp-sfpplus1,ether6,ether7 vlan-ids=100
add bridge=bridge tagged=bridge,sfp-sfpplus1,ether6,ether7 vlan-ids=200

Also you don’t need to add every interface to LAN list as you have them as bridge members, so change from this:

/interface list member
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=sfp-sfpplus1 list=LAN
add interface=ether8 list=LAN
add interface=br-lan list=LAN
add interface=vlan10 list=LAN
add interface=vlan20 list=LAN
add interface=vlan100 list=LAN
add interface=vlan200 list=LAN

To this(ether8 must stay separate as is not part of a bridge):

/interface list member
add interface=ether8 list=LAN
add interface=br-lan list=LAN
add interface=vlan10 list=LAN
add interface=vlan20 list=LAN
add interface=vlan100 list=LAN
add interface=vlan200 list=LAN

Did you removed parts of configuration ?

3

I see that you have a complete mess in the “Firewall filter” section. You can safely discard the redundant rules. For example - “drop ssh brute force” you can block the RAW chain because it will be more correct and it will cause less load.

/ip firewall raw
add action=drop chain=prerouting dst-port=22 in-interface-list=WAN protocol=\
    tcp

ICMP ping flood protection in such a configuration will not help you either, because the order of the rules is not correct. Blocking ICMP completely causes many things to stop working (most notably, path MTU discovery); blocking ping requests completely doesn’t prevent other methods of discovery that your device exists, so you may get too little benefit for too much work.

If we specify an allowed DNS flow in the Input chain, then we must specify specifically what it will apply to. It would be correct to specify in-interface-list=LAN
The filter section must always start with the ``Input’’ chain. It will conclude with the provision -
add action=drop chain=input comment=“drop all else”
After that, the “Forward” chain will follow and the last rule for this section will also be “drop all else”. Firewall rules are executed from top to bottom and - order matters.
In your case, there is no correct traffic flow and of course also protection, because there are no final rules.

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input src-address-list=Admin comment="Config Access"
add action=accept chain=input comment="Allow LAN DNS queries-UDP" \
dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries - TCP" \
dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="drop all else"
and  ...(=Forward chai= )
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow dst-nat from both WAN and LAN (including port forwarding)" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
4

Hello,

Thanks both of you for your help !

I have a bridge for the WAN because the authentication at the level of my network operator (Orange) is particular in France, it is necessary to fiddle, I followed documentation on a forum to enable me to obtain an ipv4 and an ipv6 from my network operator. Without this, I can’t get an aftermarket router.

I’ve followed your advice and now I’m able to communicate with a PC connected to ports 2 to 5 in the 192.168.10.0 network (vlan10).
These ports are in “access” mode.

I’ve trunked ports SFP+, 6 and 7 (admit only vlan tagged) and left pvid on 1 and I followed your recommendations for configuring vlan bridges.

Here is my bridge configuration :



I’ve just realized that I can get an IP on the eth6 and eth7 interfaces in vlan 20 ONLY if I manually set vlan 20 on my PC’s RJ45 adapter.
I assume this is normal, and that if I want to have IPs in vlan 20, 100 and 200 on my servers, I need to create 3 virtual interfaces by assigning the vlan to them.
Typically, I’d have to aggregate a link on my Proxmox server in vlan 200 (management) and then create virtual interfaces in vlan 20 (server) and 100 (dmz) to enable packet flow to my VMs.

I’ve also been able to make this work with the switch: the SFP+ port is trunked and the others are accessed on vlan 10.
It works perfectly.

Thanks so much for your help, I’ve been struggling with this for a while.



To be honest, I was very heavily inspired by a configuration I found on another forum, I wanted to improve the security of my network, there is also a script running that adds IPs in DROP automatically.

I’ll follow your advice and take stock of all these rules and come back. I did notice some ICMP problems during my tests.

5

No problem, glad I was able to help. Never really played with VLANs in Proxmox as my server have about 8 NICs installed (4 on the motherboard and another 4 in PCI-e card) so I just give each VM their own NIC.

6

Notes:

  1. One bridge get rid of wan bridge (sometimes needed but rare" EDIT UNDERSTOOD FRANCE ORANGE REQUIREMENT]
  2. Remove admit only vlan tagged from bridge setting. If you need to apply frame types do so on the /interface bridge ports for standard results.
  3. Understood ether8 off the bridge for external access to config/router off bridge.
  4. Added WAN and MGMT to interface list
  5. Removed bridge filters EDIT UNDERSTOOD TIED TO FRANCE ORANGE"
  6. dont know if ip dhcp client setting is needed added in case…
  7. Figured out you have a floating lan not assigned to vlan, not a good plan once you go vlans assigned it vlan11 ( five addresses for example )
  8. MISSING POOLS, DHCP-SERVER, DCHP-SERVER NETWORK for vlans 10,11,100,200
  9. Firewall cleaned up. We can add additional rules, with a solid core set of rules.
  10. Additions here and there to complete config.
  11. In regard to bridge ports 6.7. Chasing truth. :slight_smile: Your initial config has them as access ports for vlan20.
    It seems somewhere along the way you changed your mind and now want it to be a trunk port carrying 20,100,200.
    If you have a smart device at the other end that can handle tagged vlans, no problem, if not you will have to stick to access port. Alternate option provided.


  /interface bridge
    add name=br-lan port-cost-mode=short  vlan-filtering=yes
   add bridge=br-wan comment=WAN interface=vlan832-internet
    /interface ethernet
    set [ find default-name=ether1 ] comment=WAN
    set [ find default-name=sfp-sfpplus1 ] comment=LAN-SFP
    set [ find default-name=ether8] name=configaccess8 comment=offbridge-acces
    /interface vlan
    add interface=br-lan name=vlan10 vlan-id=10
    add interface=br-lan name=vlan11 vlan-id=11  comment="default-lan"
    add interface=br-lan name=vlan20 vlan-id=20
    add interface=br-lan name=vlan100 vlan-id=100
    add interface=br-lan name=vlan200 vlan-id=200
    add comment="Internet ONT" interface=ether1 loop-protect-disable-time=0s \
    loop-protect-send-interval=1s name=vlan832-internet vlan-id=832
    /interface list
    add name=LAN
    add name=WAN
    add name=MGMT
    /ip dhcp-client
   add comment=defconf disabled=no interface=vlan832  ?????
   /interface bridge filter
   add action=set-priority chain=output dst-port=67 ip-protocol=udp log=yes \
   log-prefix="Set CoS6 on DHCP request" mac-protocol=ip new-priority=6 \
   out-interface=vlan832-internet passthrough=yes
   add action=set-priority chain=output dst-port=547 ip-protocol=udp \
   mac-protocol=ipv6 new-priority=6 out-interface=vlan832-internet
    /interface bridge port
    add bridge=br-lan  ingress-filtering=yes frame-types=admit-prioirity-and-untagged interface=ether2 pvid=10
    add bridge=br-lan  ingress-filtering=yes frame-types=admit-prioirity-and-untagged interface=ether3 pvid=10
    add bridge=br-lan  ingress-filtering=yes frame-types=admit-prioirity-and-untagged interface=ether4 pvid=10
    add bridge=br-lan  ingress-filtering=yes frame-types=admit-prioirity-and-untagged interface=ether5 pvid=10
    add bridge=br-lan  ingress-filtering=yes frame-types=admit-prioirity-and-untagged interface=ether6 pvid=20
        add bridge=br-lan  ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether6   { alternate if trunk port }
    add bridge=br-lan  ingress-filtering=yes frame-types=admit-prioirity-and-untagged interface=ether7 pvid=20
        add bridge=br-lan  ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether7  { alternate if trunk port } 
    add bridge=br-lan  ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 
    /interface bridge vlan  { option 1:  ether6,7 are access ports }
   add bridge=br-lan tagged=br-lan,sfp-sfpplus1 untagged=ether2,ether3,ether4,ether5  vlan-ids=10
   add bridge=br-lan tagged=br-lan,sfp-sfpplus1 untagged=ether6,ether7  vlan-ids=20
   add bridge=br-lan tagged=br-lan,sfp-sfpplus1 vlan-ids=100,200
   { alternate option: ether6,7 are trunk ports }
   add bridge=br-lan tagged=br-lan,sfp-sfpplus1 untagged=ether2,ether3,ether4,ether5  vlan-ids=10
   add bridge=br-lan tagged=br-lan,sfp-sfpplus1,ether6,ether7  vlan-ids=20,100,200
    /interface list member
    add interface=vlan832 list=WAN
    add interface=br-wan=WAN
    add interface=vlan10 list=LAN
    add interface=vlan11 list=LAN
    add interface=vlan20 list=LAN
    add interface=vlan100 list=LAN
    add interface=vlan200 list=LAN
    add interface=configaccess8 list=LAN
    add vlan11 list=MGMT
    add vlan200 list=MGMT
    add configaccess8 list=MGMT
   /ip dns
   set allow-remote-requests=yes  servers=1.1.1.1
    /ip address
    add address=192.168.10.254/24 comment=LAN interface=vlan10 network=\
    192.168.10.0
    add address=192.168.1.254/24 comment=LAN-default interface=\
    vlan11 network=192.168.1.0
    add address=192.168.20.254/24 comment=SERVEUR interface=vlan20 network=\
    192.168.20.0
    add address=192.168.100.254/24 comment=DMZ interface=vlan100 network=\
    192.168.100.0
    add address=192.168.200.254/24 comment=MGMT interface=vlan200 network=\
    192.168.200.0
    add address=192.168.88.1/24 interface=accessconfig8 network=192.168.88.0
    /ip firewall address-list  { based mostly on static dhcp leases }
    add address=adminIP1 list=Admin comment="admin desktop local"
    add address=adminIP2 list=Admin comment="admin laptop local"
    add address=adminIP3 list=Admin comment="admin lipad/smartphone local"
    add address=adminIP4 list=Admin comment="remote admin VPN for example if you had one"
    /ip firewall filter
{Input Chain}
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input src-address-list=Admin comment="Authorized to modify config" 
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=udp comment=DNS
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=tcp comment=DNS
add action=drop chain=input  comment="drop all else"  { put this rule in last of all rules }
{forward chain}
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="allow internet traffic"  in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat
add action=drop chain=forward  comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface-list=WAN
/ip neighbor discovery-settings
set discover-interface-list=MGMT  comment='helps winbox discovery"
/tool mac-server mac-winbox
set allowed-interface-list=MGMT  comment="limits winbox access"