The easiest way to group the two sets of ports would be to create two bridges. Then add the two ports to the appropriate bridge. The bridge is now the Master Interface, so when adding IPs (or anything else like the DHCP servers) add them to the bridge interfaces.
Some people prefer using the switching capabilities of the routers instead of bridging like this, but it will work either way. If you switch them, just use the Master Port as the Master Interface as described above.
As far as the NAT goes, I’m not really clear on what you are trying to do. Are you trying to masquerade the traffic? If that is the case create rule in IP->Firewall->NAT that says:
In switching vs. bridging, which would result in the most throughput, or would they both be similar capacity?
Yes, I want to masquerade outbound packets to eth0, er, 0/0, er, WAN, er ether1 I guess in Mikrotik world
For outbound traffic ether2-3 → ether1, would I need NAT/policy/whatever for each port group (2-3, 4-5) with a destination interface of ether1 (or its upstream gateway), or how would p2-3 outbound traffic know where to go next?
Would ether1 still need to be a member if bridge-local, or should I remove it?
I think I tried to remove ether2 from bridge-local like (from memory)
That’s debatable, but if you are not maxing out the router, which you really don’t want to do anyway, then no, it really doesn’t matter. With a Cisco or Juniper device, of course you would use the switching features. In this application it is 6 one way and half a dozen the other.
No, you do not need a NAT policy for each port group/ sunbet unless you specify which subnet to NAT. If you add the subnet in the src-address of the rule, then you will need one for each. The rule I posted earlier will NAT all traffic. The port groups are going to know where to go based on the routing table and if you have a default gateway that equals ether1 then the NAT rule with the out-interface of ether1 will compliment it.
No, ether1 should not be in any bridge group. It should have it own IP address.
Use this command to remove the port:
/interface bridge port print
Identify which number or port is assigned to and then:
/interface bridge port remove numbers=X
You also should create a default static route for your traffic
You have configured 192.168.10.0/20 and 192.168.5.0/24.
If you want to reach anything else but those two networks, there need to be a route for those other networks.
I also doubt you have your subnet of your 10.0 network correct, is it really /20?
@Rudios: thanks, will add that. I actually do need a /20, this project is part of a project to re-subnet a production /24 that ran out IP’s a couple years before I thought it would, hence the /20, that should carry us until I get the next staging router (catalyst 4500) up and running, then we’ll plan a staging/failover. In the meantime I want to see how the Mikrotik boxes hold up under heavy load while I’m planning ways to phase out the upstream Juniper gear, which is also starting to max out, hence the whole planning on this. If the Mikrotiks are solid, we’ll plan on rolling them out as customer units for this ISP, so we’re also becoming familiar with how they work, and the nuances of really running them.
So you’re really using a 192.168.10.0/20 subnet. That actually means you are using subnet 192.168.0.0/20, reaching from 192.168.0.1 - 192.168.15.254.
This automatically implies that it includes the 192.168.5.0/24 subnet and I do not know how this is handled by the RouterBoard.
For better understanding, could you share your config with us?
@Rudios: thanks for pointing out my insanity I have now changed my subnet to 192.168.16.0/20 and my bridge for ports 2-3 to name 16.0 to avoid problems.
I added a route of 192.168.16.0/20 to 10.1.10.1 (my upstream router) and now I can ping 10.1.10.1 (and others on that upstream subnet) from ports 2-3 from a client IP of 192.168.16.33/20, so thanks for the help there too. For some reason, although I can ping 10.1.10.1 upstream (perimeter FW), it won’t pass traffic to the public Internet, i.e. if I try to:
ping 8.8.8.8
Is this likely a problem with the Mikrotik config, or do I need to add something on my upstream router? Here’s my config (I haven’t reconfigured DHCP yet):
