I have tried to get the vlan working on an RB750, but no success. I’m not able to ping the vlan interface no matter what. What I want is ports 2 to 5 to all be trunked and have both vlan1 and vlan129 on them. This would allow the Unifi router to be plugged into any of the ports and for the guest wireless network to be separate from internal lan.
Could someone please look at this config and tell me what’s wrong?
/interface print
Flags: D - dynamic, X - disabled, R - running, S - slave
# NAME TYPE ACTUAL-MTU L2MTU MAX-L2MTU MAC-ADDRESS
0 R ether1-gateway ether 1500 1600 4076 4C:5E:0C:C2:3F:79
1 RS ether2-master-local ether 1500 1598 2028 4C:5E:0C:C2:3F:7A
2 S ether3-slave-local ether 1500 1598 2028 4C:5E:0C:C2:3F:7B
3 RS ether4-slave-local ether 1500 1598 2028 4C:5E:0C:C2:3F:7C
4 S ether5-slave-local ether 1500 1598 2028 4C:5E:0C:C2:3F:7D
5 R br-Guest-WiFi bridge 1500 65531 00:00:00:00:00:00
6 R bridge1 bridge 1500 1598 4C:5E:0C:C2:3F:7A
7 RS vlan-WiFi vlan 1500 65527 00:00:00:00:00:00
/interface bridge print
Flags: X - disabled, R - running
0 R name="br-Guest-WiFi" mtu=auto actual-mtu=1500 l2mtu=65531 arp=enabled mac-address=00:00:00:00:00:00 protocol-mode=rstp priority=0x8000 auto-mac=yes
admin-mac=00:00:00:00:00:00 max-message-age=20s forward-delay=15s transmit-hold-count=6 ageing-time=5m
1 R name="bridge1" mtu=1500 actual-mtu=1500 l2mtu=1598 arp=enabled mac-address=4C:5E:0C:C2:3F:7A protocol-mode=rstp priority=0x8000 auto-mac=yes
admin-mac=00:00:00:00:00:00 max-message-age=20s forward-delay=15s transmit-hold-count=6 ageing-time=5m
/interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic
# INTERFACE BRIDGE PRIORITY PATH-COST HORIZON
0 ether2-master-local bridge1 0x80 10 none
1 I vlan-WiFi br-Guest-WiFi 0x80 10 none
/interface vlan print
Flags: X - disabled, R - running, S - slave
# NAME MTU ARP VLAN-ID INTERFACE
0 R vlan-WiFi 1500 enabled 129 br-Guest-WiFi
/ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 ;;; default configuration
10.103.0.250/24 10.103.0.0 ether2-master-local
1 10.103.129.1/24 10.103.129.0 br-Guest-WiFi
2 D publicIP/29 gateway ether1-gateway
/interface ethernet print
Flags: X - disabled, R - running, S - slave
# NAME MTU MAC-ADDRESS ARP MASTER-PORT SWITCH
0 R ether1-gateway 1500 4C:5E:0C:C2:3F:79 enabled none
1 RS ether2-master-local 1500 4C:5E:0C:C2:3F:7A enabled none switch1
2 S ether3-slave-local 1500 4C:5E:0C:C2:3F:7B enabled ether2-master-local switch1
3 RS ether4-slave-local 1500 4C:5E:0C:C2:3F:7C enabled ether2-master-local switch1
4 S ether5-slave-local 1500 4C:5E:0C:C2:3F:7D enabled ether2-master-local switch1
How it’s seen from yours prints - there many errors:
main error VLAN is on incorrect bridge..
Please change interface of VLAN (from br-guest-WiFi to bridge1 )
IP addresses is on incorrect interfaces, pleas check what is needed.
For now - I don’t see need in br-guest-WiFi and bridge1 , you can remove it and set up IP on VLAN interface itself and on ether2-master.
Bridge is needed when you use one LAN over multiple interface (for example ether2-master and wlan )
Thank you. This helped it. I had setup the DHCP from before, so I set to the vlan129 and everything was working. Including internet. And I could not ping to the internal lan, so I’m hoping that’s good.
Could you explain what the
vlan remove [find ]
means?
Then just for clarification, since ports 3 to 5 are slaves to port 2, that means it’s basically a switch? So then the master port 2 can be set to have vlan129 and it’s available on all ports? That’s how it seems to be working now.
I also want to make sure that the vlan129 does not have access to the IPSec tunnel. I’ll need to create a rule for that? Or because the src and dst are not including the 129 subnet, it will automatically not work?
That means remove all vlan entries (in this case from HW switch configuration).
Correct.
Traffic that does not match IPsec policy will leave your device unencrypted. If you want to drop it instead either add a corresponding firewall filter rule, or another IPsec policy with action=discard.
