So, I have fiber, and public 3 IPs from the ISP.
I connect the ONT to WAN - single cable.
Now on LAN ports, I need to connect the 3 servers/subnets, each to it’s own public IP.
I defined 3 PPPoE interfaces, defined (I think) the 3 VLANs. How to connect them, it escapes me.
Would really appreciate the help.
Not essential, but if anyone needs it, some censored config containing the eth port allocation to the 3 subnets.
# feb/27/2022 21:39:29 by RouterOS 6.49.3
# software id = 8M9R-5B02
#
# model = RB3011UiAS
# serial number = E7E90F0F9E2E
/interface bridge
add admin-mac=DC:2C:6E:65:1A:C5 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether01-WAN1
set [ find default-name=ether2 ] name=ether02-WAN2
set [ find default-name=ether3 ] name=ether03
set [ find default-name=ether4 ] name=ether04
set [ find default-name=ether5 ] name=ether05
set [ find default-name=ether6 ] name=ether06
set [ find default-name=ether7 ] name=ether07
set [ find default-name=ether8 ] name=ether08
set [ find default-name=ether9 ] name=ether09
/interface pppoe-client
add add-default-route=yes interface=ether01-WAN1 keepalive-timeout=disabled \
name=pppoe-out1-54 user=A
add add-default-route=yes interface=ether01-WAN1 keepalive-timeout=disabled \
name=pppoe-out2-55 user=B
add add-default-route=yes disabled=no interface=ether01-WAN1 name=\
pppoe-out3-56 use-peer-dns=yes user=C
/interface vlan
add interface=ether03 name=vlan1A-54 vlan-id=1
add interface=ether04 name=vlan1B-54 vlan-id=1
add interface=ether05 name=vlan1C-54 vlan-id=1
add interface=ether06 name=vlan2A-55 vlan-id=2
add interface=ether07 name=vlan2B-55 vlan-id=2
add interface=ether08 name=vlan3A-56 vlan-id=3
add interface=ether09 name=vlan3B-56 vlan-id=3
add interface=ether10 name=vlan3C-56 vlan-id=3
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.0.100-192.168.0.199
add name=vpn ranges=192.168.89.2-192.168.89.255
/ip dhcp-server
add add-arp=yes address-pool=dhcp always-broadcast=yes disabled=no interface=\
bridge name=defconf
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/interface bridge port
add bridge=bridge comment=defconf interface=ether02-WAN2
add bridge=bridge comment=defconf interface=ether03
add bridge=bridge comment=defconf interface=ether04
add bridge=bridge comment=defconf interface=ether05
add bridge=bridge comment=defconf interface=ether06
add bridge=bridge comment=defconf interface=ether07
add bridge=bridge comment=defconf interface=ether08
add bridge=bridge comment=defconf interface=ether09
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface ethernet switch vlan
add comment="IP 54" independent-learning=yes ports=ether03,ether04,ether05 \
switch=switch1 vlan-id=1
add comment="IP 55" independent-learning=yes ports=ether06,ether07 switch=\
switch2 vlan-id=2
add comment="IP 56" independent-learning=yes ports=ether08,ether09,ether10 \
switch=switch2 vlan-id=3
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether01-WAN1 list=WAN
add interface=pppoe-out3-56 list=WAN
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/ip accounting
set account-local-traffic=yes enabled=yes
/ip address
add address=192.168.0.1/24 comment=defconf interface=bridge network=\
192.168.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether01-WAN1
/ip dhcp-server lease
add address=192.168.0.105 client-id=0:8:f1:ea:f4:95:16:0:0:0 mac-address=\
08:F1:EA:F4:95:16 server=defconf
add address=192.168.0.127 client-id=1:8c:89:a5:3f:87:fa mac-address=\
8C:89:A5:3F:87:FA
add address=192.168.0.124 client-id=1:88:d7:f6:57:23:3e mac-address=\
88:D7:F6:57:23:3E server=defconf
add address=192.168.0.100 mac-address=98:F2:B3:26:2B:0F
add address=192.168.0.125 client-id=1:d4:3d:7e:63:97:f1 mac-address=\
D4:3D:7E:63:97:F1 server=defconf
add address=192.168.0.123 client-id=1:e0:3f:49:79:49:c8 mac-address=\
E0:3F:49:79:49:C8 server=defconf
add address=192.168.0.122 client-id=1:88:d7:f6:57:23:2f mac-address=\
88:D7:F6:57:23:2F server=defconf
add address=192.168.0.203 client-id=1:8c:b8:4a:80:98:f7 mac-address=\
8C:B8:4A:80:98:F7 server=defconf
add address=192.168.0.141 client-id=1:ec:e5:12:13:d7:f3 mac-address=\
EC:E5:12:13:D7:F3 server=defconf
add address=192.168.0.126 client-id=1:50:2b:73:c5:d:7c mac-address=\
50:2B:73:C5:0D:7C server=defconf
add address=192.168.0.133 client-id=1:0:22:58:58:11:2f mac-address=\
00:22:58:58:11:2F server=defconf
add address=192.168.0.132 client-id=1:3c:2a:f4:37:19:e0 mac-address=\
3C:2A:F4:37:19:E0 server=defconf
add address=192.168.0.131 client-id=1:9c:ae:d3:ea:29:c6 mac-address=\
9C:AE:D3:EA:29:C6 server=defconf
add address=192.168.0.205 client-id=1:8c:25:5:ca:f7:58 mac-address=\
8C:25:05:CA:F7:58 server=defconf
add address=192.168.0.206 mac-address=10:7B:44:68:92:03 server=defconf
add address=192.168.0.204 client-id=1:82:cc:88:c7:16:f mac-address=\
82:CC:88:C7:16:0F server=defconf
add address=192.168.0.121 mac-address=98:29:A6:8F:BE:71 server=defconf
/ip dhcp-server network
add address=192.168.0.0/24 gateway=192.168.0.1 netmask=24
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.0.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input dst-port=80 protocol=tcp
add action=accept chain=input dst-port=8291 protocol=tcp
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="SB Server e pe vechiul IP" \
dst-address=x.x.x.x dst-port=22 log=yes log-prefix=vlad_ protocol=tcp \
to-addresses=192.168.0.103 to-ports=22
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
192.168.89.0/24
/lcd
set time-interval=hour
/ppp secret
add name=vpn
/system clock
set time-zone-name=Europe/Bucharest
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN