I’m in the process of setting up my MikroTik RB5009ug. I’m aiming for a VLAN-based setup like this:
Router --- Port 0: WAN
--- Port 1: Router management VLAN (access port)
--- Port 2-7: Main VLAN (access port)
--- Port 8: Main VLAN, Guest VLAN (trunk port to WiFi AP)
VLANs: router management, main, guest.
My actual configuration would be slightly more complex but I reckon this minimum example is a fair representation of my scenario.
I’m aware of this thread, which I’ve followed and taken inspiration from. I’ve come up with a script (link below) but there’s a few points I’m not sure about (marked as FIXME). I’d be very grateful for any feedback that people might want to give me.
Good point re the spurious port and noted re the code snippet on an external site.
Please, find an updated version of the diagram below:
Router --- Port 1: WAN
--- Port 2: Router management VLAN (access port)
--- Port 3-7: Main VLAN (access port)
--- Port 8: Main VLAN, Guest VLAN (trunk port to WiFi AP)
VLANs: router management, main, guest.
And here’s the tentative configuration that I’ve put together so far:
# Custom configuration for a MikroTik RB5009ug. Adapted from
# http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
# ------------------------------------------------------------------------------
# Router ports and VLANs.
# | Port | Device | VLANs |
# |--------+---------+------------------------|
# | ether1 | WAN | |
# | ether2 | | router-management-vlan |
# | ether3 | | main-vlan |
# | ether4 | | main-vlan |
# | ether5 | | main-vlan |
# | ether6 | | main-vlan |
# | ether7 | | main-vlan |
# | ether8 | WiFi AP | main-vlan, guest-vlan |
# | VLAN id | VLAN name | Ports | IPv4 net | IPv6 net |
# |---------+------------------------+----------+-----------------+----------|
# | VLAN-10 | router-management-vlan | ether2 | 192.168.10.0/24 | FIXME |
# | VLAN-20 | main-vlan | ether3-8 | 192.168.20.0/24 | FIXME |
# | VLAN-30 | guest-vlan | ether8 | 192.168.30.0/24 | FIXME |
# ------------------------------------------------------------------------------
# Initial setup.
/system reset-configuration
/system identity set name="router"
# ------------------------------------------------------------------------------
# Bridge.
# Create one bridge. Set VLAN mode off while we configure.
/interface bridge add name=br1 protocol-mode=none vlan-filtering=no
# ------------------------------------------------------------------------------
# Ports.
# Ingress behavior: access ports.
/interface bridge port add bridge=br1 interface=ether2 pvid=10
/interface bridge port add bridge=br1 interface=ether3 pvid=20
/interface bridge port add bridge=br1 interface=ether4 pvid=20
/interface bridge port add bridge=br1 interface=ether5 pvid=20
/interface bridge port add bridge=br1 interface=ether6 pvid=20
/interface bridge port add bridge=br1 interface=ether7 pvid=20
# Ingress behavior: trunk ports.
/interface bridge port add bridge=br1 interface=ether8
# Egress behaviour. L3 switching so bridge must be a member.
/interface bridge vlan add bridge=br1 tagged=br1 vlan-ids=10
/interface bridge vlan add bridge=br1 tagged=br1,ether8 vlan-ids=20
/interface bridge vlan add bridge=br1 tagged=br1,ether8 vlan-ids=30
# FIXME: Do I need to explicitly set this?
# /interface/ethernet/switch set 0 l3-hw-offloading=yes
# ------------------------------------------------------------------------------
# IP addressing and routing.
# WAN facing port with IP address and route provided by ISP.
/ip address add interface=ether1 address=192.168.0.143/24 network=192.168.0.0
# FIXME: I've removed distance=1 from the line below, is that ok?
/ip route add gateway=192.168.0.1
# Use the router as a DNS server.
/ip dns set allow-remote-requests=yes servers="9.9.9.9"
# Management VLAN.
/interface vlan add interface=br1 name=router-management-vlan vlan-id=10
/ip address add address=192.168.10.1/24 interface=router-management-vlan
/ip pool add name=router-management-pool ranges=192.168.10.2-192.168.10.254
/ip dhcp-server add address-pool=router-management-pool interface=router-management-vlan name=router-management-dhcp disabled=no
/ip dhcp-server network add address=192.168.10.0/24 dns-server=192.168.10.1 gateway=192.168.10.1
# Main VLAN.
/interface vlan add interface=br1 name=main-vlan vlan-id=20
/ip address add interface=main-vlan address=192.168.20.1/24
/ip pool add name=main-pool ranges=192.168.20.2-192.168.20.254
/ip dhcp-server add address-pool=main-pool interface=main-vlan name=main-dhcp disabled=no
/ip dhcp-server network add address=192.168.20.0/24 dns-server=192.168.20.1 gateway=192.168.20.1
# Guest VLAN.
/interface vlan add interface=br1 name=guest-vlan vlan-id=30
/ip address add interface=guest-vlan address=192.168.30.1/24
/ip pool add name=guest-pool ranges=192.168.30.2-192.168.30.254
/ip dhcp-server add address-pool=guest-pool interface=guest-vlan name=guest-dhcp disabled=no
/ip dhcp-server network add address=192.168.30.0/24 dns-server=192.168.30.1 gateway=192.168.30.1
# ------------------------------------------------------------------------------
# Firewall.
/interface list add name=vlans
/interface list member add interface=router-management-vlan list=vlans
/interface list member add interface=main-vlan list=vlans
/interface list member add interface=guest-vlan list=vlans
# Input chain.
/ip firewall filter add chain=input connection-state=invalid action=drop comment="Drop Invalid connections"
/ip firewall filter add chain=input connection-state=established,related action=accept comment="Allow established and related traffic"
/ip firewall filter add chain=input in-interface-list=vlans protocol=udp dst-port=67 action=accept comment="Allow DHCP traffic from all VLANs"
/ip firewall filter add chain=input in-interface-list=vlans protocol=tcp,udp dst-port=53 action=accept comment="Allow DNS traffic from all VLANs"
/ip firewall filter add chain=input in-interface=router-management-vlan protocol=tcp dst-port=22 action=accept comment="Allow SSH traffic from the router-management VLAN"
/ip firewall filter add chain=input action=drop comment="Drop"
# Forward chain.
/ip firewall filter add chain=forward connection-state=invalid action=drop comment="Drop Invalid connections"
/ip firewall filter add chain=forward connection-state=established,related action=accept comment="Allow established and related traffic"
/ip firewall filter add chain=forward connection-state=new in-interface-list=vlans out-interface=ether1 action=accept comment="Allow VLAN-to-internet traffic"
/ip firewall filter add chain=forward action=drop comment="Drop"
# NAT.
/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1 comment="Default masquerade"
# ------------------------------------------------------------------------------
# VLAN security.
# Only allow ingress packets without tags on access ports.
/interface bridge port
set bridge=br1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether2]
set bridge=br1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether3]
set bridge=br1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether4]
set bridge=br1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether5]
set bridge=br1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether6]
set bridge=br1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether7]
# ------------------------------------------------------------------------------
# Turn on VLAN mode.
/interface bridge set br1 vlan-filtering=yes
/interface/ethernet/switch set 0 l3-hw-offloading=yes
No. Where did you get this from ? Certainly not from the VLAN guide...
FIXME: I've removed distance=1 from the line below, is that ok?
/ip route add gateway=192.168.0.1
There will be a default distance anyhow.
Diagonally scanned the rest, looks ok at first sight.
Does this config work for you or not ?
Why separate VLAN for Mgmt access instead of simply taking the port off bridge (and own DHCP server) ?
Might be better/safer when initially setting things up.
Hi, thanks for all the feedback, this is super helpful!
Sorry for creating confusion with the
/interface/ethernet/switch set 0 l3-hw-offloading=yes
question. For clarity, that was not in the original file I took inspiration from. It’s something that I found in some other configuration. I added it as a note-to-self/prompt for further investigation. Thanks for confirming it’s something I should not be using in my context.
@holvoetn: Thanks for suggesting the possibility of using an off-bridge port for router management instead of using a VLAN.
I’ll import the file to the device for a first run later and report back.
Ok, I fine-tuned my script a little bit (including following advice from this thread) but I’m a bit lost when it comes to deploying it on the RB5009.
I guess the way of applying the script is to upload it to the router, e.g. via the web interface, and then to launch it from a terminal with the ‘import’ command - which I did. However, this seems to only result in a system reset.
Now, the very first script command is indeed a reset, fair enough, but I was expecting the rest of the script would be executed after that!
Hi, thanks! That’s interesting. I also tried to manually apply the script, in steps. In my case, that approach fails with some parts of the script that assume a “blank” device.
May I ask if you first reset the device with ‘no-defaults=yes’? Then I guess one can connect to the device via MAC-telnet (or similar). At that point my script should run, as there’s no prior configuration.
Incidentally, I’m now stuck because after a ‘no-defaults’ reset I can no longer access the device: “MacConnection syn timeout”.
I rarely start from a blank device since with some ROS versions default settings can change.
I mostly start from default config when setting up a new device or when doing a major overhaul (tip: enable “keep users” )
I’m still in the process of configuring my RB5009 with VLANs (learning quite a bit along the way).
I’d like to set up two VLANs, vlan-10 and vlan-20. It should be possible to connect to vlan-10 from ether2 and to vlan-20 from ether3. It should also be possible to connect to vlan-10 and vlan-20 from a WiFi AP connected to ether7. The VLANs should be isolated from each other but connected to the internet.
In this scenario, if I understand correctly, ether2 and ether3 are access ports whereas ether7 is a trunk port, right?
My plan is to start from the default configuration that’s present on a newly-reset RB5009 and apply the smallest amount of changes to get to my objective.
This is an extract from my configuration script:
/interface bridge port {
set [find where bridge=bridge and interface=ether2] pvid=10;
set [find where bridge=bridge and interface=ether3] pvid=20;
set bridge=bridge ingress-filtering=yes \
frame-types=admit-only-untagged-and-priority-tagged [find interface=ether2];
set bridge=bridge ingress-filtering=yes \
frame-types=admit-only-untagged-and-priority-tagged [find interface=ether3];
}
/interface bridge vlan {
add bridge=bridge tagged=bridge,ether7 vlan-ids=10;
add bridge=bridge tagged=bridge,ether7 vlan-ids=20;
}
/interface vlan {
add interface=bridge name=main-vlan vlan-id=10;
add interface=bridge name=guest-vlan vlan-id=20;
}
# IP addressing and routing.
# ...
# Firewall rules.
# ...
I’m reusing the bridge ‘bridge’ from the default configuration. Is that ok? In particular, I notice that the default bridge has ‘protocol-mode=rstp’ instead of ‘none’ as I’ve seen in some VLAN tutorials. Is that ok?
In the script above, this bit seems a bit verbose: ‘set [find where bridge=bridge and interface=ether2] pvid=10;’. Is it possible to replace it with ‘set [find interface=ether2] pvid=10;’? This is also something I can check when near my RB5009, checking if there’s any difference in the output of the two commands (‘find interface …’ and ‘find where …’) but I thought of asking anyway.
Yes, that’s absolutely fine.
RSTP is the new default (remember: that VLAN tutorial was written when ROS7 wasn’t really mainstream yet).
Why all the theoretical scripting and asking ?
Have you already applied the config and tested it ? If it doesn’t work, see if you can find the mistake, apply the correction and test again.
Hi holvoetn, thanks, really appreciate all the help. Good to know re ‘rstp’, excellent. In terms of the series of slightly theoretical questions, yes, I’ve deployed the script. No errors and it seems to mostly work. There are still a few aspects that I want to improve and properly understand, but I guess I’m making good progress.
Thanks anav, nice tip. Yes, this is something I’ve been doing and I find it useful. As you say, I set ether8 aside for direct management (no VLAN and no bridge). That part seems to work fine now. Thank you!
Hi All, quick update on my VLAN-on-a-RB5009 experiments (and current failures, doh!).
This is the series of commands that I run on my newly-reset RB5009. The objective is to set ether8 aside (off-bridge) for management and, most importantly, to define a few VLANs. One VLAN is meant to be accessed on ether2, one on ether3, and both of them via a WiFi AP connected on ether7.
After running these commands I can access the router via the management port but I don’t seem to be able to connect via either VLAN. DHCP doesn’t seem to work. I’ve also tried with a manually assigned IP address (instead of DHCP) but that doesn’t work either.
I’ve tried relaxing the firewall a bit but that didn’t help. I’ve also tried with the packet sniffer, which seems unable to detect any traffic (e.g. DHCP requests) on either ether2 and ether3.
I assume there’s something wrong with the way I define the two VLANs?
Any hint would be greatly appreciated. Thank you so much.
# To be applied onto a newly-reset RB5009.
# ------------------------------------------------------------------------------
# Undo some defconf defaults.
# Configure ether8 as out-of-band management.
/interface bridge port remove [find interface="ether8"];
/ip address add address=192.168.1.1/24 interface=ether8 network=192.168.1.0;
# Remove the default DHCP configuration.
/ip/pool/remove default-dhcp;
/ip/dhcp-server/remove defconf;
/ip/dhcp-server/network/remove [find];
/ip/dhcp-client/remove ether1;
# ------------------------------------------------------------------------------
# Ports.
# Ingress behaviour.
/interface bridge port {
set [find interface=ether2] pvid=10;
set [find interface=ether3] pvid=20;
set bridge=bridge ingress-filtering=yes \
frame-types=admit-only-untagged-and-priority-tagged [find interface=ether2];
set bridge=bridge ingress-filtering=yes \
frame-types=admit-only-untagged-and-priority-tagged [find interface=ether3];
}
# Egress behaviour.
/interface bridge vlan add bridge=bridge tagged=bridge,ether7 vlan-ids=10,20;
/interface vlan {
add interface=bridge name=main-vlan vlan-id=10;
add interface=bridge name=guest-vlan vlan-id=20;
}
# ------------------------------------------------------------------------------
# IP addressing and routing.
# WAN.
/ip address add address=192.168.0.143/24 interface=ether1 network=192.168.0.0;
/ip route add gateway=192.168.0.1;
/ip dns set allow-remote-requests=yes servers="9.9.9.9";
# Main VLAN.
/ip address add interface=main-vlan address=192.168.10.1/24;
# ... DHCP setup ...
# Guest VLAN.
/ip address add interface=guest-vlan address=192.168.20.1/24;
# ... DHCP setup ...
# ------------------------------------------------------------------------------
# Firewall.
/interface list {
add name=management;
member add interface=ether8 list=management;
add name=vlans;
member add interface=main-vlan list=vlans;
member add interface=guest-vlan list=vlans;
}
# Input chain.
/ip firewall filter {
add chain=input in-interface-list=management protocol=tcp dst-port=22 \
action=accept comment="Allow SSH from management";
add chain=input in-interface-list=vlans protocol=udp dst-port=67 \
action=accept comment="Allow DHCP from VLANs";
add chain=input in-interface-list=vlans protocol=tcp dst-port=53 \
action=accept comment="Allow DNS from VLANs";
add chain=input in-interface-list=vlans protocol=udp dst-port=53 \
action=accept comment="Allow DNS from VLANs";
add chain=input action=drop comment="Drop";
remove [find comment="defconf: drop all not coming from LAN"];
}
# Forward chain.
/ip firewall filter {
add chain=forward connection-state=new in-interface-list=vlans \
out-interface-list=WAN action=accept comment="Allow VLAN-to-WAN";
add chain=forward action=drop comment="Drop";
}
# ... IPv6 firewall here ...
# ------------------------------------------------------------------------------
# Turn on VLAN mode.
/interface bridge set bridge vlan-filtering=yes
)