ROUTER
1- MISSING~~ You have five vlans
- missing vlan99 pool
- missing vlan99 dhcp server
- missing vlan99 dhcp server-network
- at least you do have the iP address LOL…
2- INCORRECT Sloppy!!!
add bridge=LAN_BRIDGE comment=“HOME Access Port, access port” frame-types=
admit-only-vlan-tagged interface=ether2 internal-path-cost=10 path-cost=
10 trusted=yes
Should be:
add bridge=LAN_BRIDGE comment=“HOME Access Port, access port” frame-types=
admit-priority-and-untagged interface=ether2 internal-path-cost=10 path-cost=
10 trusted=yes pvid=10
3- INCORRECT AGAIN… you state
set [ find default-name=ether5 ] comment=“Mgmt Access Port”
add bridge=LAN_BRIDGE comment=“Mgmt Access Port, access port” frame-types=
admit-only-vlan-tagged interface=ether5 internal-path-cost=10 path-cost=
10 trusted=yes
should be: ( just like ether4 )
add bridge=LAN_BRIDGE comment=“Mgmt Access Port, access port” frame-types=
admit-priority-and-untagged interface=ether5 internal-path-cost=10 path-cost=
10 trusted=yes pvid=99
BUT WAIT!! Similar to the AP/Switch, there is no point in having two mgmt ports on the same device…
Instead use ether5, for an OFF BRIDGE emergency access or config access.
SO RECOMMEND REMOVING ETHER5 from the bridge. ( and add to management interface list !! )
/ip address
add address=192.168.55.1/24 interface=ether5 network=192.168.55.0
4- Should be MGMT
/ip neighbor discovery-settings
set discover-interface-list=MGMT_LIST
5- Interface list members - removed bridge etc… only need one WAN list…!!
/interface list member
add interface=ether1 list=WAN_LIST
add interface=MGMT_VLAN list=VLAN_LIST
add interface=HOME_VLAN list=VLAN_LIST
add interface=NOT_VLAN list=VLAN_LIST
add interface=IOT_VLAN list=VLAN_LIST
add interface=GUEST_VLAN list=VLAN_LIST
add interface=MGMT_VLAN list=MGMT_LIST
add interface=HOME_VLAN list=MGMT_LIST { if required }
add interface=ether5 list=MGMT_LIST { if ether5 is off bridge access }
6- firewall rules…
NO to this rule - if you want home vlan to access router for config purposes as well then add it to the interface list → MGMT_LIST which you already have !!!
add action=accept chain=input comment=“Allow all non-guest”
in-interface-list=HOME_LIST
NO to this rule, You do NOT want to give all vlans access to MGMT vlan…wrongO
add action=accept chain=forward in-interface-list=VLAN_LIST out-interface=
MGMT_VLAN
Missing invalid rule in forward chain… Dont need connection=new in rules, its redundant!
/ip firewall filter
add action=accept chain=input comment=“accept established,related,untracked”
connection-state=established,related,untracked
add action=drop chain=input comment=“drop connection-state=invalid”
connection-state=invalid
add action=accept chain=input comment=“check ICMP” protocol=icmpadd action=accept chain=input comment=“Allow all authorized”
in-interface-list=MGMT_LIST
add action=accept chain=input comment=“accept DNS (LAN only)” dst-port=53
in-interface-list=VLAN_LIST protocol=udp
add action=accept chain=input comment=“accept DNS (LAN only)” dst-port=53
in-interface-list=VLAN_LIST protocol=tcp
add action=drop chain=input
++++++++++++++++
add action=fasttrack-connection chain=forward comment=“established, related”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
“accept established, related, untracked” connection-state=
established,related,untrackedadd action=drop chain=forward comment=“drop connection-state=invalid”
connection-state=invalid
add action=accept chain=forward comment=“VLAN internet access only”
in-interface-list=VLAN_LIST out-interface-list=WAN_LIST
add action=accept chain=forward comment=“MGMT access all LAN devices”
in-interface=MGMT_VLAN out-interface-list=VLAN_LIS
add action=accept chain=forward comment=“For port forwarding to VLANs”
connection-nat-state=dstnat
add action=drop chain=forward comment=Drop
6- ADD!!
/tool mac-server mac-winbox
set allowed-interface-list=MGMT_LIST
