I’ve got an RB1100 setup with a fairly basic config, essentially we’ve got an uplink to the internet and then three separate subnets (separate bridges) hanging off different ports on the RB (the rest of the ports are also in use but the configuration of them is not relevant to this question).
We’re looking at hanging some more kit off the router which will necessitate chucking a switch into the mix, and in order to make it work we basically need to push those subnets over a VLAN trunk to our switch ideally retaining the “local” port access (though worst case I’ll just move everything to the switch).
The naive way to do this would just be to define VLAN interfaces on ether5 and drop those onto the relevant bridges, however in reading a bit further I ran across this https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration#VLAN_in_bridge_with_a_physical_interface which tells me that is a problem.
With the solution presented in the article, I can successfully get ONE of the bridge networks pushed out over the VLAN trunk, but I run into issues when it’s time to bring the second and subsequent networks onto that trunk, in a nutshell;
Yeah, the Router-Switch-AP is the closest to what I want to achieve, but I’ll have to rework my existing config a bit to make it work with that, thanks.
To be frank Satman your example is overly complicated (I would use the term butt ugly) for what I see to be no gain?
you only need a single bridge on each device.
All subnets separated by Vlans. Ports assigned as trunk or access as required.
Not saying it wouldn’t work nor that its not a valid approach, but unless there is a valid reason, simpler/cleaner is usually better and easier to manage??
I do like your diagram skills!
When you are doing it for yourself, it could be done simpler, I agree. But whe you expect someone else to work on router after yourself, I prefer to do it like it is described in the example, and believe me this is easier to manage than the simple solution.
Why?
If at any moment you will need additional access or trunk port you can just add it to bridge and the job is done, while in simple solution (VLAN created on Ethernet port) you will have to reconfigure it and in the process you will have to disconnect the port which will cause inconvenience for the already connected users.
Once again, if it is a home network and your personal needs, no problem but if it is a larger network…
There’s also a secondary configuration parallel to this but using ether6-10 and obviously different IP ranges, and a sprinkling of route rules and such to make things go the right direction.
For just the trunking stuff you don’t need the wan/lan/mgmt_bridge bridges (you’ll obviously have to tweak the srcnat rule if you drop wan_bridge), they’re in our configuration because we have OpenVPN profiles attached to those bridges, so that remote users can be dropped on an appropriate bridge for their access requirements (it’s an atypical environment).
Very interesting setup.
Not being converse with the requirements of OPEN VPN, I do not understand at all what you have done with WAN bridge.
Is ether1 not from your ISP? How many IP addresses are you getting?
The diagram shows the uplink separate from networks 1,2,3 so that in of itself was confusing.
Finally the line in red below is completely bamboozling. How can your WANIP have anything to do with ether ports 2,3 etc or the trunk port 5 to the switch.
I have no clue as to what has been done here
I showed ether2 as a separate network in the original post to avoid this type of confusion getting in the way of an answer (and for the purposes of the question it was functionally equivalent)
But for the sake of your sanity, there’s a /28 routed to each of the uplink ports and there’s no downstream DHCP server, instead the RB1100 serves out IP addresses on that segment to allow us to stand up hosts “parallel” to the RB1100 on public IPs when needed.
