Howdy,
/interface bridge
anav
February 7, 2025, 5:06pm
2
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/310
Use two bridge max on RB4011, most routers its one, but RB4011 has two different switch chips one for ports 1-5 and one for ports 6-10
I believe that in the NAT rule you need to use a concrete IP address and not the default masquerade because of the many addresses on the ether1 interface:
/ip firewall nat
add action=src-nat chain=srcnat ipsec-policy=out,none out-interface-list=WAN to-addresses="specific_public_IP"
rplant
February 7, 2025, 11:29pm
4
Hi,@TheCat12 )
The other subnets you list and attach to bridges are all on the router only, and there is only a single active address for each of them.
Perhaps a diagram or something would be good.
The only thing I can guess/think of is that maybe for some unusual reason you want all these LAN IP ranges on one LAN network segment.
If you really do want/need them all on the one LAN segment, you probably need to attach all the LAN IP addresses onto the bridge Bridge.
My final guess would then be that you then want the Lan IP addresses to map to the corresponding Wan IP addresses sort of, you likely can use a bunch of netmap NAT rules to do this.
Perhaps I am approaching the configuration in the wrong way? Should I just have one bridge, then use VLANs to map each physical ether port? If so, I do not know how to do that–even after reading documentation and other forum posts.
Here’s what I am trying to do:Goal 1:
xxx.yyy.zzz.11 ↔ 10.11 .0.0./22 [ether2]
xxx.yyy.zzz.50 ↔ 10.50 .0.0./22 [ether3]
xxx.yyy.zzz.55 ↔ 10.55 .0.0/22 [ether4]
xxx.yyy.zzz.60 ↔ 10.60 .0.0./22 [ether5]
xxx.yyy.zzz.73 ↔ 10.73 .0.0./22 [ether6]
xxx.yyy.zzz.74 ↔ 10.74 .0.0./22 [ether7]
Goal 2:
Thank you in advance for any assistance.
Lai jūsu zirgs ir stabils un taka paliek brīva
anav
February 9, 2025, 9:17pm
6
Good, the requirement discussion has started.
Are they all from the same Gateway IP on ether1 ??
Assuming there is no need for failover (as all from same ISP and same modem so if one goes they all go).
WHY this approach.
Urajmal
February 9, 2025, 11:10pm
7
Hi!
You have only one functioning DHCP server, and that is on the bridge. So, you will get the IPs on every port from 2-10 and also wifi 2G and 5G.
I am not entirely understand what the Goal 1 is? You’re trying to set the IP on the input interface, the same as is from outside devices subnet?
Regarding Goal 2, you can find a lot of MUMs presentation, how to configure the Capsman with 3 SSIDs.
jaclaz
February 10, 2025, 8:43am
8
But the issue that you do not get the internet is your masquerade rule. It is set to Out-Interface-List=WAN, but you have a DHCP client set on ether1, but you do not have ether1 under WAN interface list.
But there is an entry alright
/interface list memberadd comment=vejaconf interface=ether1 list=WAN
Urajmal
February 10, 2025, 9:43am
9
Thanks for that, I have missed it somehow!
jaclaz
February 10, 2025, 10:10am
10
Yes, the problem must be somewhere else.
I don’t understand the bridgexx’s they all seem empty (with no real interfaces added to them), all interfaces but ether1 are added to the bridge “bridge”.
Yes, all public IPs share the same gateway (xxx.yyy.zzz.1)
This is not a failover configuration.
Each of the subnets goes to separate physical ethernet wiring to separate physical areas. The sharing of IPs is not appropriate, due to the need for specific public IPs from each group–and corresponding rDNS.
LdB
February 11, 2025, 4:16am
12
Goal 1: each of the 6 static public IPs should traffic to/from its own LAN subnet assuring that all traffic from each LAN subnet uses the corresponding public IP. i.e.:
xxx.yyy.zzz.11 <--> 10.11.0.0./22 [ether2]
xxx.yyy.zzz.50 <--> 10.50.0.0./22 [ether3]
xxx.yyy.zzz.55 <--> 10.55.0.0/22 [ether4]
xxx.yyy.zzz.60 <--> 10.60.0.0./22 [ether5]
xxx.yyy.zzz.73 <--> 10.73.0.0./22 [ether6]
xxx.yyy.zzz.74 <--> 10.74.0.0./22 [ether7]
That requires 6 source nats exactly as you have shown
/ip firewall nat
add action=src-nat chain=srcnat src-address= 10.11.0.0/22 to-addresses=xxx.yyy.zzz.11
add action=src-nat chain=srcnat src-address= 10.50.0.0/22 to-addresses=xxx.yyy.zzz.50
add action=src-nat chain=srcnat src-address= 10.55.0.0/22 to-addresses=xxx.yyy.zzz.55
add action=src-nat chain=srcnat src-address= 10.60.0.0/22 to-addresses=xxx.yyy.zzz.60
add action=src-nat chain=srcnat src-address= 10.73.0.0/22 to-addresses=xxx.yyy.zzz.73
add action=src-nat chain=srcnat src-address= 10.74.0.0/22 to-addresses=xxx.yyy.zzz.74
Shouldn’t require explanation but anyhow anything coming to router from the given LAN ip range is translated to the given WAN ip
rplant
February 11, 2025, 5:42am
13
Hi,
The following are my changes to the configuration.@anav is much better at this…)
You will need to apply it slowly piece by piece.
#xxx.yyy.zzz.11 <--> 10.11.0.0/22 [ether2]
#xxx.yyy.zzz.50 <--> 10.50.0.0/22 [ether3]
#xxx.yyy.zzz.55 <--> 10.55.0.0/22 [ether4]
#xxx.yyy.zzz.60 <--> 10.60.0.0/22 [ether5]
#xxx.yyy.zzz.73 <--> 10.73.0.0/22 [ether6]
#xxx.yyy.zzz.74 <--> 10.74.0.0/22 [ether7]
#add ether8 = trunk port, (so can connect all IP ranges/vlans to a downstream managed switch)
#add ether10 = management port.
#use vlan filtering which works well on the RB4011
#(mostly hardware offloaded)
#Create a bunch of vlans corresponding to IP's
/interface vlan
add interface=bridge name=vlan11 vlan-id=11
add interface=bridge name=vlan50 vlan-id=50
add interface=bridge name=vlan55 vlan-id=55
add interface=bridge name=vlan60 vlan-id=60
add interface=bridge name=vlan73 vlan-id=73
add interface=bridge name=vlan74 vlan-id=74
#Remove ether 10 (management) from bridge. (disable its bridge port entry)
/interface bridge port
set [find where interface=ether10] disabled=yes
#make interfaces members of lan
/interface list member
add comment=vejaconf interface=bridge list=LAN
add comment=vejaconf interface=ether1 list=WAN
add interface=ether10 list=LAN
add interface=vlan11 list=LAN
add interface=vlan50 list=LAN
add interface=vlan55 list=LAN
add interface=vlan60 list=LAN
add interface=vlan73 list=LAN
add interface=vlan74 list=LAN
#add a bunch of ip addresses
#likely need to remove existing.
/ip address
add address=192.168.88.1/24 comment=vejaconf interface=bridge network=\
192.168.88.0
add address=10.11.0.1/22 interface=vlan11 network=10.11.0.0
add address=10.50.0.1/22 interface=vlan50 network=10.50.0.0
add address=10.55.0.1/22 interface=vlan55 network=10.55.0.0
add address=10.60.0.1/22 interface=vlan60 network=10.60.0.0
add address=10.73.0.1/22 interface=vlan73 network=10.73.0.0
add address=10.74.0.1/22 interface=vlan74 network=10.74.0.0
#give management port an IP address
add address=192.168.12.1/24 interface=ether10
#setup access ports
#(likely need to remove existing ports from bridge before run this section)
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=\
ether2 pvid=11
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=\
ether3 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=\
ether4 pvid=55
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=\
ether5 pvid=60
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=\
ether6 pvid=73
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=\
ether7 pvid=74
#add trunk port to bridge
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether8
#setup ports as access and trunk
/interface bridge vlan
add bridge=bridge tagged=bridge,ether8 untagged=ether2 vlan-ids=11
add bridge=bridge tagged=bridge,ether8 untagged=ether3 vlan-ids=50
add bridge=bridge tagged=bridge,ether8 untagged=ether4 vlan-ids=55
add bridge=bridge tagged=bridge,ether8 untagged=ether5 vlan-ids=60
add bridge=bridge tagged=bridge,ether8 untagged=ether6 vlan-ids=73
add bridge=bridge tagged=bridge,ether8 untagged=ether7 vlan-ids=74
#setup dhcp servers for each vlan (optional??)
/ip pool
add name=pool11 ranges=10.11.0.100-10.11.3.200
add name=pool50 ranges=10.50.0.100-10.50.3.200
add name=pool55 ranges=10.55.0.100-10.55.3.200
add name=pool60 ranges=10.60.0.100-10.60.3.200
add name=pool73 ranges=10.73.0.100-10.73.3.200
add name=pool74 ranges=10.74.0.100-10.74.3.200
/ip dhcp-server
add address-pool=pool11 interface=vlan11 name=dhcp11
add address-pool=pool50 interface=vlan50 name=dhcp50
add address-pool=pool55 interface=vlan55 name=dhcp55
add address-pool=pool60 interface=vlan60 name=dhcp60
add address-pool=pool73 interface=vlan73 name=dhcp73
add address-pool=pool74 interface=vlan74 name=dhcp74
/ip dhcp-server network
add address=10.11.0.0/22 dns-server=10.11.0.1 gateway=10.11.0.1
add address=10.50.0.0/22 dns-server=10.50.0.1 gateway=10.50.0.1
add address=10.55.0.0/22 dns-server=10.55.0.1 gateway=10.55.0.1
add address=10.60.0.0/22 dns-server=10.60.0.1 gateway=10.60.0.1
add address=10.73.0.0/22 dns-server=10.73.0.1 gateway=10.73.0.1
add address=10.74.0.0/22 dns-server=10.74.0.1 gateway=10.74.0.1
#Also need some srcnat firewall rules per @LdB
/ip firewall nat
add action=src-nat chain=srcnat src-address=10.11.0.0/22 to-addresses=xxx.yyy.zzz.11
add action=src-nat chain=srcnat src-address=10.50.0.0/22 to-addresses=xxx.yyy.zzz.50
add action=src-nat chain=srcnat src-address=10.55.0.0/22 to-addresses=xxx.yyy.zzz.55
add action=src-nat chain=srcnat src-address=10.60.0.0/22 to-addresses=xxx.yyy.zzz.60
add action=src-nat chain=srcnat src-address=10.73.0.0/22 to-addresses=xxx.yyy.zzz.73
add action=src-nat chain=srcnat src-address=10.74.0.0/22 to-addresses=xxx.yyy.zzz.74
#enable vlan filtering.
/interface bridge
set [find name=bridge] vlan-filtering=yes
#if you get thrown off permanently at this point you may need to plug into ether10
#and connect via mac address, or setup an appropriate ip address on your device.
anav
February 11, 2025, 3:10pm
14
LdB is bang on, I was heading towards a complicated route of masquerade and table/routing rules but the direct sourcenat rules are better.
: