Dear Support,
I have configured different gateways on different VLANs which are tagged through the bridge. When I untagged any of the VLANs all gateways are reachable from the endpoint PC.
I tried to isolate gateways from each other but not able to do, configuration in the below, please follow and provide the solution.
This forum is not a vendor support in the traditional sense. Some more (or even less) experienced users volunteer to help others by giving their advice.
The purpose of VLANs is to isolate the traffic at L2 (MAC address) level - two hosts connected to access ports to different VLANs are unable to talk directly to each other using their MAC addresses. But if a device (like your router) has access interfaces to both those VLANs and has an IP address attached to each of those interface, in the same subnet like other hosts in the respective VLAN, it will accept traffic whose destination is any of those IP addresses. And if such multi-subnet device is a router, it will also be able to forward traffic among all the subnets it has its own addresses in. To eventually prevent this, you have to use firewall rules to filter the traffic depending on some criteria.
The fact that the router itself responds to a given host from IP addresses outside the subnet of that host causes no issue; the fact that said host can reach other hosts is the actual issue you might want to resolve.
So what are the actual requirements regarding where the hosts in various subnets and VLANs should be able to get and where they shouldn’t?
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)
The MT config is interrelated just showing one part is not going to cut it.
The requirements for user traffic requested by Sindy is also critical.
I would add
any external users?? either going to servers on LAN, or the admin to reach the router for config purposes.
How many WANs??
Which device?
You cannot have more than one untagged pvid assigned to any port and thus this fails /interface bridge vlan
add bridge=Bridge-LAN tagged=Bridge-LAN,ether8-test_bablu untagged=ether7-out_test_bablu vlan-ids=1833,3375,3376
should be for example: