RB-2011L-RM : VLAN + DHCP problem

RouterOS Beginner Basics
1

Dear,

I use a RB-2011L-RM here at home, and i have a problem with the vlan configuration…
On interface 2, i have created 3 vlans:

  • Wifi Private (vlan id 101 - interface ether 2 - ARP enabled)
  • Wifi Public (vlan id 102 - interface ether 2 - ARP enabled)
  • Wif Trusted (vlan id 103 - interface ether 2 - ARP enabled)

Then, i’ve created 3 DHCP Pools:

  • DHCP Wifi Private (Adresses : 10.101.0.100-10.101.0.254)
  • DHCP Wifi Public (Adresses : 10.102.0.100-10.102.0.254)
  • DHCP Wifi Trusted (Adresses : 10.103.0.100-10.103.0.254)

Then, i’ve assinged the DHCP pools to the correct Vlan in DHCP Server (tab DHCP):

  • Wifi Private (interface Wifi Private, address pool DHCP Wifi Private, add ARP for leases on)
  • Wifi Public (interface Wifi Public, address pool DHCP Wifi Public, add ARP for leases on)
  • Wifi Trusted(interface Wifi Trusted, address pool DHCP Wifi Trusted, add ARP for leases on)

Then, in DHCP server, i choose tab “networks”

  • Address 10.101.0.0/24, Gateway 10.101.0.1, Netmask 24, DNS servers 8.8.8.8 and 8.8.4.4)

When i let my pc scan for SSID’s, i can see the 3 ssid’s (Wifi Private, Wifi Public and Wifi Trusted), but i don’t get an ip address of it. I am 100% sure that the problem isn’t located on my Wifi device (meraki MR12) because the router that i’ve used before, a PFSense setup, had the same configuration and it worked out well.

Does somebody have any idea what i do whrong?

Kris

2

You show the same VLAN ID on those 3 VLAN interfaces… typo?

3

That was indeed a mistake, i’ve corrected my text.

4

Are the VLANs ports on bridges for any reason? If not I suggest looking on the VLAN interfaces using Torch to see if you are even seeing the DHCP packets.

Output from /export compact may be a faster path to the answer. (/export compact file somefilename)

5

Dear,

This is the output

# dec/04/2012 12:09:06 by RouterOS 5.22
# software id = 0UVM-G6HX
#
/interface bridge
add l2mtu=1598 name="Bridge Internet"
/interface ethernet
set 0 name="ether1 - Intern" speed=1Gbps
set 1 name="ether2 - Wifi" speed=1Gbps
set 2 speed=1Gbps
set 3 speed=1Gbps
set 4 name="ether5 - Cross" speed=1Gbps
set 5 speed=1Gbps
set 6 speed=1Gbps
set 7 speed=1Gbps
set 8 name="ether9 - Modem" speed=1Gbps
set 9 name="ether10 - Openweb" speed=1Gbps
/interface pppoe-client
add add-default-route=yes disabled=no interface="ether10 - Openweb" name=\
    "PPPoE - Openweb" password=kdr091111 user=username@openweb.fix
/interface 6to4
add comment="Hurricane Electric IPv6 Tunnel Broker" disabled=no \
    local-address=217.145.41.x mtu=1280 name="Tunnelbroker IPv6" \
    remote-address=216.66.84.46
/interface vlan
add interface="ether2 - Wifi" l2mtu=1594 name="Wifi Public" use-service-tag=\
    yes vlan-id=102
add interface="ether2 - Wifi" l2mtu=1594 name="Wifi Private" use-service-tag=\
    yes vlan-id=101
add interface="ether2 - Wifi" l2mtu=1594 name="Wifi Trusted" use-service-tag=\
    yes vlan-id=103
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m
/ip pool
add name="DHCP Lan" ranges=10.0.0.101-10.0.0.254
add name="DHCP Wifi Private" ranges=10.101.0.101-10.101.0.254
add name="DHCP Wifi Public" ranges=10.102.0.101-10.102.0.254
add name="DHCP Wifi Trusted" ranges=10.103.0.101-10.103.0.254
/ip dhcp-server
add add-arp=yes address-pool="DHCP Lan" disabled=no interface=\
    "Bridge Internet" lease-time=1h name=Lan
add add-arp=yes address-pool="DHCP Wifi Private" disabled=no interface=\
    "Wifi Private" lease-time=1h name="Wifi Private"
add add-arp=yes address-pool="DHCP Wifi Public" disabled=no interface=\
    "Wifi Public" lease-time=1h name="Wifi Public"
add add-arp=yes address-pool="DHCP Wifi Trusted" disabled=no interface=\
    "Wifi Trusted" lease-time=1h name="Wifi Trusted"
/queue simple
add burst-limit=5M/5M burst-threshold=5M/5M burst-time=1m/1m disabled=yes \
    interface="PPPoE - Openweb" max-limit=2M/2M name="Limit servers" time=\
    0s-1d,sun,mon,tue,wed,thu,fri,sat
add disabled=yes name=Openweb target-addresses=217.145.41.x/32
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" \
    paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no \
    permissions=owner signup-allowed=no time-zone=-00:00
/interface bridge port
add bridge="Bridge Internet" interface="ether1 - Intern"
add bridge="Bridge Internet" interface="ether5 - Cross"
add bridge="Bridge Internet" interface="ether2 - Wifi"
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/ip address
add address=10.0.0.1/24 interface="Bridge Internet"
add address=10.101.0.1/24 interface="Wifi Private"
add address=10.102.0.1/24 interface="Wifi Public"
add address=10.103.0.1/24 interface="Wifi Trusted"
/ip dhcp-client
add add-default-route=no disabled=no interface="ether9 - Modem"
/ip dhcp-server lease
add address=10.0.0.111 client-id=1:0:23:5a:e4:15:d8 mac-address=\
    00:23:5A:E4:15:D8 server=Lan
add address=10.0.0.54 client-id=1:0:18:a:21:53:d mac-address=\
    00:18:0A:21:53:0D server=Lan
add address=10.0.0.23 client-id=\
    52:49:50:45:2d:41:74:6c:61:73:2d:50:72:6f:62:65:2d:32:34:32:33 \
    mac-address=00:20:4A:E0:21:9F server=Lan
add address=10.0.0.53 client-id=1:0:18:a:21:64:d7 mac-address=\
    00:18:0A:21:64:D7 server=Lan
add address=10.0.0.51 client-id=1:0:18:a:21:4b:ea mac-address=\
    00:18:0A:21:4B:EA server=Lan
add address=10.0.0.52 client-id=1:0:18:a:21:67:9d mac-address=\
    00:18:0A:21:67:9D server=Lan
add address=10.0.0.22 client-id=\
    52:49:50:45:2d:41:74:6c:61:73:2d:50:72:6f:62:65:2d:32:32:30:32 \
    mac-address=00:20:4A:E0:25:02 server=Lan
add address=10.0.0.31 client-id=1:4c:60:de:24:ab:14 mac-address=\
    4C:60:DE:24:AB:14 server=Lan
add address=10.0.0.21 client-id=\
    52:49:50:45:2d:41:74:6c:61:73:2d:50:72:6f:62:65:2d:32:36:38:33 \
    mac-address=00:20:4A:E0:21:CD server=Lan
add address=10.0.0.61 client-id=1:0:15:6d:ad:c7:e6 mac-address=\
    00:15:6D:AD:C7:E6 server=Lan
add address=10.0.0.11 client-id=1:0:1d:7e:d0:55:7f mac-address=\
    00:1D:7E:D0:55:7F server=Lan
add address=10.0.0.13 client-id=1:68:7f:74:5a:5c:9f mac-address=\
    68:7F:74:5A:5C:9F server=Lan
add address=10.0.0.12 client-id=1:68:7f:74:5a:5c:ad mac-address=\
    68:7F:74:5A:5C:AD server=Lan
add address=10.0.0.14 client-id=1:68:7f:74:5a:5c:3c mac-address=\
    68:7F:74:5A:5C:3C server=Lan
add address=10.0.0.101 client-id=1:0:24:21:10:fd:1 mac-address=\
    00:24:21:10:FD:01 server=Lan
add address=10.0.0.102 client-id=1:0:24:21:10:fd:2 mac-address=\
    00:24:21:10:FD:02 server=Lan
add address=10.0.0.71 client-id=1:0:22:75:6b:9a:57 mac-address=\
    00:22:75:6B:9A:57 server=Lan
/ip dhcp-server network
add address=10.0.0.0/24 dns-server="81.95.126.162,85.17.239.174,91.121.116.217\
    ,8.8.8.8,8.8.4.4,208.67.222.222,208.67.220.220" domain=it2go.eu gateway=\
    10.0.0.1 netmask=24 ntp-server=46.28.43.66
add address=10.101.0.0/24 dns-server="81.95.126.162,85.17.239.174,91.121.116.2\
    17,8.8.8.8,8.8.4.4,208.67.222.222,208.67.220.220" domain=it2go.eu \
    gateway=10.101.0.1 netmask=24 ntp-server=46.28.43.66
add address=10.102.0.0/24 dns-server="81.95.126.162,85.17.239.174,91.121.116.2\
    17,8.8.8.8,8.8.4.4,208.67.222.222,208.67.220.220" domain=it2go.eu \
    gateway=10.102.0.1 netmask=24 ntp-server=46.28.43.66
add address=10.103.0.0/24 dns-server="81.95.126.162,85.17.239.174,91.121.116.2\
    17,8.8.8.8,8.8.4.4,208.67.222.222,208.67.220.220" domain=it2go.eu \
    gateway=10.103.0.1 netmask=24 ntp-server=46.28.43.66
/ip dns
set allow-remote-requests=yes servers="81.95.126.162,85.17.239.174,91.121.116.\
    217,8.8.8.8,8.8.4.4,208.67.222.222,208.67.220.220"
/ip firewall nat
add action=masquerade chain=srcnat out-interface="PPPoE - Openweb"
add action=masquerade chain=srcnat out-interface="ether9 - Modem"
/ip neighbor discovery
set "Wifi Public" disabled=yes
set "Wifi Private" disabled=yes
set "Wifi Trusted" disabled=yes
/ip route
add distance=1 gateway="PPPoE - Openweb"
add disabled=yes distance=1 dst-address=85.234.197.0/26 gateway=\
    "ether5 - Cross"
/ip service
set telnet port=1223
set ftp disabled=yes
set ssh disabled=yes port=1222
/ipv6 address
add address=2001:470:1f14:8e1::2/64 interface="Tunnelbroker IPv6"
add address=2001:470:1f15:8e1::1/64 interface="Bridge Internet"
add address=2001:470:1f15:8e1:101::1/64 interface="Wifi Private"
add address=2001:470:1f15:8e1:102::1/64 interface="Wifi Public"
add address=2001:470:1f15:8e1:103::1/64 interface="Wifi Trusted"
/ipv6 route
add distance=1 dst-address=2000::/3 gateway=2001:470:1f14:8e1::1
add distance=1 dst-address=2000::/3 gateway=2001:470:1f14:8e1::1
/lcd
set enabled=no
/system clock
set time-zone-name=Europe/Brussels
/system gps
set set-system-time=no
/system identity
set name=openweb.gw.be.it2go.eu
/system lcd
set contrast=0 enabled=no port=parallel type=24x4
/system lcd page
set time disabled=yes display-time=5s
set resources disabled=yes display-time=5s
set uptime disabled=yes display-time=5s
set packets disabled=yes display-time=5s
set bits disabled=yes display-time=5s
set version disabled=yes display-time=5s
set identity disabled=yes display-time=5s
set "Bridge Internet" disabled=yes display-time=5s
set "ether1 - Intern" disabled=yes display-time=5s
set "ether2 - Wifi" disabled=yes display-time=5s
set ether3 disabled=yes display-time=5s
set ether4 disabled=yes display-time=5s
set "ether5 - Cross" disabled=yes display-time=5s
set ether6 disabled=yes display-time=5s
set ether7 disabled=yes display-time=5s
set ether8 disabled=yes display-time=5s
set "ether9 - Modem" disabled=yes display-time=5s
set "ether10 - Openweb" disabled=yes display-time=5s
set "PPPoE - Openweb" disabled=yes display-time=5s
set "Tunnelbroker IPv6" disabled=yes display-time=5s
set "Wifi Public" disabled=yes display-time=5s
set "Wifi Private" disabled=yes display-time=5s
set "Wifi Trusted" disabled=yes display-time=5s
/system leds
set 0 interface="ether10 - Openweb" leds=user-led type=interface-activity
/system ntp client
set enabled=yes primary-ntp=85.234.197.2 secondary-ntp=195.130.132.18
/tool graphing interface
add
/tool graphing resource
add
/tool sniffer
set filter-direction=any
6

Looks like you are bridging the interface that has the VLANs. Try moving the 3 VLANs from “Ether 2 - WiFi” to “Bridge Internet”.

7

Dear CelticComms,

I’ve did that, but the devices connecting to these wifi hotspots, don’t get an ip address. So i suppose there is something wrong with the DHCP server and the connection of that with the VLAN?

8

use-service-tag=no

9

As decribed in wiki use-service-tag=yes setting used in qinq trunks, for regular tagged wlans should be set to NO.

10

The configuration that you showed above will produce exactly the symptoms you are seeing - clients never receive DHCP responses.

If you want DHCP servers to run on these VLANS then the VLAN interfaces need to be assigned to the bridge.

Also use:

use-service-tag=no

as drpater spotted. Changing that and assigning the VLANs to the bridge should clear the problems up.

I suggest that you test again with the VLANs assigned to the bridge & use-service-tag=no. Then check proper assignment of the IP Pool & Network details and upload that config if it isn’t working.

11

Dear,

When i’ve set the service tag to no, everything worked out well.

Thank you, everyone, very muchto help me out with this!

12

I just spent an hour wrestling with this same issue–and I have been using this same configuration successfully for the past year or more!

The key: on the DHCP server, enable “Add ARP For Leases”

add-arp=yes

So if you’re bridging VLANs and VAPs, and plan to serve DHCP from another box, remember to “Add ARP”!

13

I have many VAPs bridged to VLANs where the DHCP server is on a remote system and don’t have “Add ARP” set on any of those DHCP servers, so there has to be more to it.

If the DHCP server is having to add the ARP entry that suggests that the normal ARP requests are not resulting in responses. Did you check all relevant interfaces/bridges for ARP enabled?

14

Yes, ARP is enabled on all the interfaces and bridges. It wouldn’t surprise me if there were other settings that make up for it being disabled on your system. In my case, that was the one change that I made between it not working, and working. I always enable that setting; not sure why I forgot to this time around.

15

If the router has an L2 path to the device then it ought to be able to ARP…