Routing Different Network Segments to specific Ports

RB450Gx4
Primary ISP:
Starlink 100.64.0.0/10 Dynamic IP GW 10.64.0.1 on WAN %ether1

Lan Default 192.168.88.0/24
Bridge/LAN
%ether1, 2, 3 & 4.

%ether5
172.16.16.3/24 and GW of 172.16.16.1(to reach the 172.16.16.0/24 network available on ETH cable plugged into the 172.16.16.0/24 LAN Port)

Now the ringer. 192.168.100.1/32 aka Dishy.Starlink.Com to get local direct access to the Starlink High Performance on %ether1

If I ping 192.168.100.1 it’s currently routing it out %ether5 to Dishy 192.168.100.1 the Starlink HP feeing the 172.16.16.0/24 subnet.

I can’t seem to say if I’m on the bridge/LAN 192.168.88.xx IP’s I want to route to the local Dishy(192.168.100.1 via %ether1) I can tell from the opstruciton map which unit I’m actually looking at. And if I remove the cable on %ether5 my ping/access to 192.168.100.1 goes away. So I’m sure the RB450G2x4 is somehow picking up the LAN route from %ether5 and not the static I point to %ehter1

Thoughts on how to get this to work?

Or am I going about this all wrong?
Is there a simple way to say %ether5 is plugged into the 172.16.16.0/24 LAN Segment(Set a Static IP, or DHCP is available on the port).
And add a route from the main WAN/LAN/Bridge %ether1, %ether2, %ether3 & %ether4192.168.88.0/24 to 192.168.100.1 so I can talk directly from my LAN, via the WAN to 192.168.100.1

Greg

# nov/20/2023 10:26:30 by RouterOS 7.8
# software id = ICFP-ZCGB
#
# model = RB450Gx4
# serial number = {removed}
/interface bridge
add admin-mac=18:FD:74:DA:3B:21 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.11-192.168.88.99
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/port
set 0 name=serial0
/zerotier
set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" \
    identity="{removed}" name=zt1 \
    port=9993
/zerotier interface
add disabled=no instance=zt1 name=zerotier1 network={removed}
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set accept-redirects=no accept-router-advertisements=yes \
    max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add comment=172.16.16.0/24 interface=ether5 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=172.16.16.3/24 comment="GW to the 172.16.16.0/24 Network" \
    interface=ether5 network=172.16.16.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server config
set accounting=no store-leases-disk=immediately
/ip dhcp-server lease
add address=192.168.88.254 client-id=\
    ff:31:11:0:2b:0:1:0:1:26:f8:6e:ef:20:6d:31:11:0:2b comment=\
    "Firewalla Blue+" mac-address=20:6D:31:11:00:2B server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=forward in-interface=zerotier1
add action=accept chain=input in-interface=zerotier1
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip route
add disabled=no distance=1 dst-address=172.16.16.0/24 gateway=172.16.16.1 \
    pref-src="" routing-table=main suppress-hw-offload=no
add check-gateway=none comment="Dishy.Starlink.Com - 192.168.100.1" disabled=\
    no distance=1 dst-address=192.168.100.1/32 gateway=ether1 routing-table=\
    main suppress-hw-offload=no vrf-interface=ether1
/ip ssh
set always-allow-password-login=yes
/ipv6 address
add address=::5 from-pool=StarLink-IPv6 interface=bridge
/ipv6 dhcp-client
add add-default-route=yes interface=ether1 pool-name=StarLink-IPv6 \
    rapid-commit=no request=prefix use-peer-dns=no
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input dst-port=5678 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface=!bridge
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface=!bridge
/ipv6 nd
set [ find default=yes ] advertise-mac-address=no dns=2606:4700:4700::1111 \
    hop-limit=64 interface=bridge mtu=1280 other-configuration=yes \
    ra-interval=3m20s-8m20s
/ipv6 nd prefix default
set preferred-lifetime=10m valid-lifetime=15m
/system clock
set time-zone-name=America/Anchorage
/system identity
set name=RouterOS
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes multicast=yes
/system ntp client servers
add address=us.pool.ntp.org
/system routerboard settings
set cpu-frequency=716MHz
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

The obvious question is why you are trying to break the network into segments per port why not just run different networks per port.
It’s generally easier to connect already segmented networks because it just requires basic routing.

I have two homes linked by a near Gb wireless link. Some of my networking gear is on the 172.16.16.0/24 network across the LAN. At the moment I have to switch SSID’s on my wireless or change ports on ethernet to get to the other gear. And the second “remote/network” is already fully functional and is served via a Ubiquiti Dream Machine SE at the remote location. If I’m on the Ubiquiti network I have the 192.168.100.1/32 routed out the WAN port and I can see the Starlink HP#2, statistics page, configuration(Turn the Dishy’s Heat On/Off}.

So I guess not specifically by port but Bridge/Switching/LAN Group. On the Ubiquiti Dream Machine SE it was as easy as adding a route and telling it to route to a specific port ie WAN1 and presto it works flawlessly.

Local RB450G2x4
WAN/ether1 ↔ Starlink HP#1 in Bypass Mode (100.64.0.0/10 Dynamic Ipv4 & IPv6, and 192.168.100.1/32(Dishy Management)
LAN ether2, ether3 & ether 4 192.168.88.0/24

My config at the moment I can get to the 172.16.16.0/24 via ether2, 3 & 4 but the 192.168.100.1/32 is routed out ether5 and across the wireless link to Starlink HP#2 at the 2nd home. It may be that I removed ether5 from the bridge, I did not create a unique name for the 2nd LAN, possibly the RB450G2x4 seeing the routing from the Ubiquiti that has a route for the 192.168.100.1/32.

I’m stuck thus I have tried to make a clear picture of what I’m trying to accomplish.

LAN/(LAN2 do I need new name?) ether5 ↔ Ubiquiti Dream Machine SE/LAN (Should I re-name the 2nd LAN to a unique name ie LAN2?)
172.16.16.0/24 I need to route this segment.
192.168.100.1/32 This should not be routed out ether5 but out the WAN/ether1 ie Local Dishy#1, not Remote Dishy#2.
available but no need to be routed 192.168.4.0/24
available but no need to be routed 192.168.7.0.24

It’s just a straight source route from the IP ranges exactly as you described.
The exact how depends on mikrotik router OS version but search source-routing for OS6 or OS7 whichever you are on.

Latest OS7 link which covers both ways mark and route table OR route rules
https://help.mikrotik.com/docs/display/ROS/Policy+Routing

Ok and If I want to plug ether5 into another routers LAN port questions I have.

Do I just want to setup a static IP on the port?
Do I want to have is part of the ether2, 3 & 4 Bridge.
Remove it from the Bridge as I have done and name in something other than LAN ie LAN2

I think I can now get the routing sorted out. Just not sure how to configure the GW/ether5 to properly just act as a LAN client to my other router. Static IP of can I simply say DHCP somehow and route to ether5 with the routing statements.

This seems to work as I anticipated. Thanks for the pointers.

/interface list member add interface=ether1 list=WAN
/interface list member add interface=ether5 list=WAN
/ip dhcp-client add interface=ether1 default-route-distance=1 comment "Starlink @5514"
/ip dhcp-client add interface=ether5 default-route-distance=1 comment "Starlink @5506"
/routing table add name=myTable fib
/routing rule add dst-address=172.16.16.0/24 action=lookup-only-in-table table=myTable interface=ether5
/routing rule add dst-address=192.168.100.1 action=lookup-only-in-table table=myTable interface=ether1