Good evening,
I have already followed some wikis and been able to move my first steps in RouterOS, but the hard is putting everything together, so I kindly ask for help…
The target is to use my RB2011UiAS-2HnD-IN to drive an home network in this way:
ether1 is WAN
ether2 + ether3 + wlan1 on VLAN1 with 192.168.3.0/24
ether4 + ether5 + sfp1 on VLAN2 with 192.168.103.0/24
opt: ether6 to ether10 can be on VLAN1 or disabled
Both VLAN with their dhcp server, can browse WWW, must be separated between each other, with exception that I want to manage (single clients from VLAN2 can access defined ports on servers on VLAN1).
A basic firewall setup should be enough.
Last, I want to reach VLAN1 clients from remote through VPN tunnel (using nomad clients, not PTP)
Fully agree.
What’s the fun in there ?
And how would one learn not trying, failing, getting up again, seeing the light, understanding and applying knowledge ?
Of course not. Just some directions on which direction to take.
Just to clarify, I have tried to replicate (from commandline, to learn more..) the instructions on Router-Switch-AP (all in one) (http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1) but as soon as I apply them, the interfaces are not working anymore (seems that DHCP server is not active on BLUE or GREEN) and MAC connectivity is locked out…
I can understand the “mission”, being in IT world for the last 30 years. Learnt Linux from scratch when everybody else was bullying with Windows. But sometimes you need to get straight to the point: I need a setup for the router because it ONE part of my domotic project. Hence I cannot spend weeks just for the router. If you can help, as I have always seen in forums like this one, I’m grateful. If the scope is to show how hard is the path to the Grail, I pass: Thanks anyway. This would not prevent me to provide support should you need to KNX your house…
Hi and thanks.
I re-made the whole config this morning following the Router-Switch-AP (all in one) guide from http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 but this time I tried to “Bridge-Off” the ether10 of my RB2011.
While I have the same issues as before, I can now connect to the router via MAC address (Winbox)
Issue1:
there must be something wrong in how I set up the dhcp for ether10-safe, Winbox tell me DHCP server can not run on slave interface. (I did it to avoid setting a manual IP on my laptop…).
As you can see, the router is now getting WAN from another router (just “LAB” mode), and I can connect even from “my” LAN 192.168.1.0/24: log say I’m in from local…
Issue2:
I actually don’t need the BASE VLAN other than to get SAFE access to the router: can it be simplified?
Issue3:
clients connected to ether2, ether3 or ether4, ether5, DON’T receive any address…
(1) Not a problem.
Once you have made the necessary corrections, the final step will be this… /interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
++++++++++++++++++++++++++++++++
(2) Strangely you have 3 vlans but four of everything else… I hope you didnt keep one subnet without a vlan, will have to zap you with a taser…
Ahh I see the problem, YOU ONLY need to set the IP address on ether10 nothing else… for a safe entry point to the router.
(3) Without a network diagram little harder to discern intent but looks like you have vlan10 going to dumb devices on ether2, ether3 and wlan1, and you have vlan20 going to dumb devices on ether4,5 and then you have vlan99 going to dumb devices on ether9, ether10.
Mistake, you dont want vlan99 going to ether10 because ITS NOT SUPPOSED TO BE ON THE BRIDGE!
(4) Forgot to add BASE vlan to BASE interface list as a member.
(5) Add a few missing items that are not visible on the config.
/ip neighbor discovery-settings and /tool mac-server mac-winbox
To enter the router and config from ether 10, just set an ipv4 IP address of 10.0.10.0.5 on the laptop or PC connecting up on ether10 for example.
What you are missing completely is firewall rules, so this should not be hooked up directly to the internet. Thus ensure you read this
and add as appropriate… https://forum.mikrotik.com/viewtopic.php?t=180838
Thats because the router has a self-preservation mode.
If there is no firewall or a crappy firewall it doesnt permit people to be connected to such a poor setup.
Seriously, you were supposed to read the link and put in a firewall rule… how disappointing you were so lazy.
I’m sorry you think it was lazyness. I just wanted to limit the field for troubleshooting: my fault.
Made the adjustment you suggested, now I got IP address and basically working.
I’m now going to invest some time in firewalling (forward some services out of BLUE..) and then start with the VPN (probably AFTER setup in production).
