I looked through anav’s config snippets and read through this forum post about configuring VLANs using a “Switch with a separate router (RoaS)”: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Note: The Infrastructure contains the IPs I give out to my router, switch, and access point.
A few things I updated from my last config post:
- Updated the vlan named ‘Trusted’ to ‘Main’.
- Changed trunk ports to use bridge port VLAN frame types ‘admit only VLAN tagged’.
- Changed access ports to use bridge port VLAN frame types ‘admit only untagged and priority tagged’.
- On the router, I set the Neighbor List Discovery Settings to only use the Interface tied to the Infrastructure VLAN.
- On the switch, I also set the Neighbor List Discovery Settings to only use the Interface tied to the Infrastructure VLAN.
- On the switch, the router’s IP (192.168.99.1) was set as the gateway for the default Dst. Address.
My scenario:
I have a device connected to the router on the Infrastructure VLAN (192.168.99.26), and am trying to ping a PC connected to the switch on the Main VLAN (192.168.50.239). The packets are hitting my firewall rule:
add action=accept chain=forward connection-state="" dst-address=\
192.168.50.239 src-address=192.168.99.26
But no response is allowed. The switch seems to eat the response.
Based on the responses from anav and sid5632, i feel like I am missing something while thinking through how my switch handles a packet in response to a request.
Any insights, docs, or forum posts on this issue would be very helpful.
Thank you!
Updated configs (sorry about any strange config formatting, it is the output directly from exporting from the WinBox GUI):
Router:
# 2025-01-27 13:32:56 by RouterOS 7.17
# software id = SOFTWARE_ID
#
# model = CCR2004-1G-12S+2XS
# serial number = SERIAL_NUMBER
/interface bridge
add name="bridge[LAN]" vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name="ether1[INFRA]"
set [ find default-name=sfp-sfpplus1 ] name="sfp-sfpplus1[WAN]"
set [ find default-name=sfp-sfpplus11 ] name="sfp-sfpplus11[UPLINK_TRUENAS]"
set [ find default-name=sfp-sfpplus12 ] name=\
"sfp-sfpplus12[UPLINK_SWITCH_2.5G]"
/interface vlan
add interface="bridge[LAN]" name=Guest vlan-id=98
add interface="bridge[LAN]" name=Infrastructure vlan-id=99
add interface="bridge[LAN]" name=IoT vlan-id=30
add interface="bridge[LAN]" name=Main vlan-id=50
add interface="bridge[LAN]" name=Security vlan-id=101
add interface="bridge[LAN]" name=Servers vlan-id=100
add interface="bridge[LAN]" name=Work vlan-id=20
add interface="sfp-sfpplus1[WAN]" name=pppoe-vlan vlan-id=201
/interface pppoe-client
add add-default-route=yes disabled=no interface=pppoe-vlan name=\
"pppoe-out1[CL]" use-peer-dns=yes user=PPPOE_USERNAME
/interface list
add name=WAN
add name=ALL_VLANS
add name=Infra
/ip pool
add name=dhcp_pool_infra ranges=192.168.99.100-192.168.99.254
add name=dhcp_pool_guest ranges=192.168.98.2-192.168.98.254
add name=dhcp_pool_main ranges=192.168.50.100-192.168.50.254
add name=dhcp_pool_servers ranges=192.168.100.100-192.168.100.254
add name=dhcp_pool_security ranges=192.168.101.100-192.168.101.254
/ip dhcp-server
add address-pool=dhcp_pool_infra interface=Infrastructure lease-time=8h name=\
"dhcp[INFRA]"
add address-pool=dhcp_pool_guest interface=Guest name="dhcp[GUEST]"
add address-pool=dhcp_pool_main interface=Main lease-time=1h name=\
"dhcp[MAIN]"
add address-pool=dhcp_pool_servers interface=Servers lease-time=8h name=\
"dhcp[SERVERS]"
add address-pool=dhcp_pool_security interface=Security lease-time=4h name=\
"dhcp[SECURITY]"
/port
set 0 name=serial0
/interface bridge port
add bridge="bridge[LAN]" interface="ether1[INFRA]" pvid=99
add bridge="bridge[LAN]" frame-types=admit-only-vlan-tagged interface=\
"sfp-sfpplus12[UPLINK_SWITCH_2.5G]"
add bridge="bridge[LAN]" interface="sfp-sfpplus11[UPLINK_TRUENAS]"
/ip neighbor discovery-settings
set discover-interface-list=Infra
/ip settings
set rp-filter=strict
/interface bridge vlan
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" untagged="ether1[INFRA]" \
vlan-ids=99
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" vlan-ids=20
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" vlan-ids=30
add bridge="bridge[LAN]" tagged="bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]\
,sfp-sfpplus11[UPLINK_TRUENAS]" vlan-ids=50
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" vlan-ids=98
add bridge="bridge[LAN]" tagged="bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]\
,sfp-sfpplus11[UPLINK_TRUENAS]" vlan-ids=100
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" vlan-ids=101
/interface list member
add interface="pppoe-out1[CL]" list=WAN
add interface=Infrastructure list=ALL_VLANS
add interface=Main list=ALL_VLANS
add interface=Servers list=ALL_VLANS
add interface=Security list=ALL_VLANS
add interface=IoT list=ALL_VLANS
add interface=Work list=ALL_VLANS
add interface=Guest list=ALL_VLANS
add interface=Infrastructure list=Infra
/ip address
add address=192.168.99.1/24 interface=Infrastructure network=192.168.99.0
add address=192.168.20.1/24 interface=Work network=192.168.20.0
add address=192.168.30.1/24 interface=IoT network=192.168.30.0
add address=192.168.50.1/24 interface=Main network=192.168.50.0
add address=192.168.98.1/24 interface=Guest network=192.168.98.0
add address=192.168.100.1/24 interface=Servers network=192.168.100.0
add address=192.168.101.1/24 interface=Security network=192.168.101.0
/ip dhcp-server lease
add address=192.168.101.2 mac-address=MAC_ADDRESS_HERE server=\
"dhcp[SECURITY]"
add address=192.168.101.3 client-id=CLIENT_ID_HERE mac-address=\
MAC_ADDRESS_HERE server="dhcp[SECURITY]"
add address=192.168.99.50 client-id=CLIENT_ID_HERE mac-address=\
MAC_ADDRESS_HERE server="dhcp[INFRA]"
add address=192.168.50.2 client-id=CLIENT_ID_HERE mac-address=\
MAC_ADDRESS_HERE server="dhcp[MAIN]"
add address=192.168.50.26 client-id=CLIENT_ID_HERE mac-address=\
MAC_ADDRESS_HERE server="dhcp[MAIN]"
add address=192.168.50.4 client-id=CLIENT_ID_HERE mac-address=\
MAC_ADDRESS_HERE server="dhcp[MAIN]"
add address=192.168.99.26 client-id=1CLIENT_ID_HERE mac-address=\
MAC_ADDRESS_HERE server="dhcp[INFRA]"
/ip dhcp-server network
add address=192.168.50.0/24 gateway=192.168.50.1
add address=192.168.98.0/24 gateway=192.168.98.1
add address=192.168.99.0/24 gateway=192.168.99.1
add address=192.168.100.0/24 gateway=192.168.100.1
add address=192.168.101.0/24 gateway=192.168.101.1
/ip firewall address-list
add address=192.168.100.99 list=IPs_Servers
add address=192.168.101.2 list=IPs_SimpliSafe
add address=192.168.101.3 list=IPs_Nest
add address=192.168.50.4 list=IPs_NordVPN
add address=192.168.50.3 list=IPs_NordVPN
add address=192.168.99.0/24 list=IPs_Infrastructure
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid log=yes log-prefix=\
"Invalid input:"
add action=accept chain=input in-interface="!pppoe-out1[CL]" protocol=icmp
add action=drop chain=input in-interface="pppoe-out1[CL]" log=yes log-prefix=\
"Dropped by input from WAN catch-all"
add action=fasttrack-connection chain=forward comment=Forward \
connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid log=yes log-prefix=\
"Invalid forward:"
add action=accept chain=forward connection-state="" dst-address=\
192.168.50.239 src-address=192.168.99.26
add action=accept chain=forward comment="VLAN Internet Access Only" \
connection-state=new in-interface-list=ALL_VLANS out-interface-list=WAN
add action=drop chain=forward comment="Drop all inter-VLAN traffic" disabled=\
yes in-interface-list=ALL_VLANS log=yes log-prefix=\
"Dropped by inter-vlan" out-interface-list=ALL_VLANS
add action=drop chain=forward connection-state=new in-interface=\
"pppoe-out1[CL]"
add action=drop chain=forward comment="Forward Drop Catch-All" log=yes \
log-prefix="Dropped by forward catch-all"
/ip firewall nat
add action=masquerade chain=srcnat out-interface="pppoe-out1[CL]"
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Chicago
/system identity
set name=WilderRouter
/system note
set show-at-login=no
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=Infra
/tool mac-server mac-winbox
set allowed-interface-list=Infra
Switch:
# 1970-01-12 03:32:20 by RouterOS 7.17
# software id = SOFTWARE_ID
#
# model = CRS310-8G+2S+
# serial number = SERIAL_NUMBER
/interface bridge
add admin-mac=MAC_ADDRESS_HERE auto-mac=no comment=defconf name=\
"bridge[LAN]" vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name="ether1[INFRA]"
set [ find default-name=ether2 ] name="ether2[AP_BASEMENT]"
set [ find default-name=ether3 ] name="ether3[UPLINK_STUDY]"
set [ find default-name=ether5 ] name="ether5[MAIN_VLAN_TEMP]"
set [ find default-name=ether7 ] name="ether7[SERVER_VLAN_TEMP]"
set [ find default-name=ether8 ] name="ether8[TRUENAS_SERVER]"
set [ find default-name=sfp-sfpplus2 ] name="sfp-sfpplus2[UPLINK_ROUTER]"
/interface vlan
add interface="bridge[LAN]" name=Infrastructure vlan-id=99
/interface list
add name=LAN
add name=Infra
/interface bridge port
add bridge="bridge[LAN]" comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface="ether1[INFRA]" pvid=99
add bridge="bridge[LAN]" comment=defconf interface="ether2[AP_BASEMENT]"
add bridge="bridge[LAN]" comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface="ether3[UPLINK_STUDY]" \
pvid=50
add bridge="bridge[LAN]" comment=defconf interface=ether4
add bridge="bridge[LAN]" comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=\
"ether5[MAIN_VLAN_TEMP]" pvid=50
add bridge="bridge[LAN]" comment=defconf interface=ether6
add bridge="bridge[LAN]" comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=\
"ether7[SERVER_VLAN_TEMP]" pvid=100
add bridge="bridge[LAN]" comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=\
"ether8[TRUENAS_SERVER]" pvid=100
add bridge="bridge[LAN]" comment=defconf interface=sfp-sfpplus1
add bridge="bridge[LAN]" comment=defconf frame-types=admit-only-vlan-tagged \
interface="sfp-sfpplus2[UPLINK_ROUTER]"
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=Infra
/interface bridge vlan
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus2[UPLINK_ROUTER],ether2[AP_BASEMENT]" untagged=\
"ether1[INFRA]" vlan-ids=99
add bridge="bridge[LAN]" tagged=\
"sfp-sfpplus2[UPLINK_ROUTER],ether2[AP_BASEMENT]" vlan-ids=98
add bridge="bridge[LAN]" tagged="sfp-sfpplus2[UPLINK_ROUTER]" vlan-ids=20
add bridge="bridge[LAN]" tagged="sfp-sfpplus2[UPLINK_ROUTER]" vlan-ids=30
add bridge="bridge[LAN]" tagged=\
"sfp-sfpplus2[UPLINK_ROUTER],ether2[AP_BASEMENT]" untagged=\
"ether3[UPLINK_STUDY],ether5[MAIN_VLAN_TEMP]" vlan-ids=50
add bridge="bridge[LAN]" tagged="sfp-sfpplus2[UPLINK_ROUTER]" untagged=\
"ether8[TRUENAS_SERVER],ether7[SERVER_VLAN_TEMP]" vlan-ids=100
add bridge="bridge[LAN]" tagged=\
"sfp-sfpplus2[UPLINK_ROUTER],ether2[AP_BASEMENT]" vlan-ids=101
/interface list member
add interface="bridge[LAN]" list=LAN
add interface=Infrastructure list=LAN
add interface=Infrastructure list=Infra
/interface ovpn-server server
add mac-address=MAC_ADDRESS_HERE name=ovpn-server1
/ip address
add address=192.168.99.2/24 interface=Infrastructure network=192.168.99.0
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add distance=1 gateway=192.168.99.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system identity
set name=WilderSwitch2.5G
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=Infra
/tool mac-server mac-winbox
set allowed-interface-list=Infra