Hi, I have a Samsung Frame TV and a hAP ax^2 running RouterOS 7.15.3. The Mikrotik router is plugged into the ISPs router (which I cannot get rid off unfortunately).
When I plug the TV in the last port it connects to the network, but does not get internet. If I connect the TV to wifi, it works. If I connect a PC to the same port it works. Both wifi and the last port is set to vlan30. Also, the TV gets internet if connected with cable directly to the ISP router…
Kindly do let me know what kind settings that needs to be checked or if I need to do an export. Much appreciated, thank you!
Does the TV get an IP address? Is the light of the port on?
The config would be helpfull:
/export file=anynameyoulike
Remove serial and any other private info.
It shows up with an IP in the dhcp lease. The light does blink on the front.
Here is the export:
# 2024-09-19 09:02:48 by RouterOS 7.15.3
# software id = 96MA-U4HF
#
# model = C52iG-5HaxD2HaxD
# serial number =
/interface bridge
add admin-mac= auto-mac=no comment=defconf \
ingress-filtering=no name=bridge port-cost-mode=short vlan-filtering=yes
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
10min-cac .width=20/40/80mhz configuration.country= .mode=ap \
.ssid= datapath.vlan-id=30 disabled=no \
security.authentication-types=wpa2-psk .disable-pmkid=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
10min-cac .width=20mhz configuration.country= .mode=ap .ssid=\
datapath.vlan-id=30 disabled=no security.authentication-types=\
wpa2-psk .disable-pmkid=yes
/interface vlan
add interface=bridge name=vlan10 vlan-id=10
add interface=bridge name=vlan20 vlan-id=20
add interface=bridge name=vlan30 vlan-id=30
add interface=bridge name=vlan40 vlan-id=40
add interface=bridge name=vlan50 vlan-id=50
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp ranges=10.0.0.50-10.0.0.200
add name=dhcp_pool_vlan10 ranges=10.0.10.50-10.0.10.200
add name=dhcp_pool_vlan20 ranges=10.0.20.50-10.0.20.200
add name=dhcp_pool_vlan30 ranges=10.0.30.50-10.0.30.200
add name=dhcp_pool_vlan40 ranges=10.0.40.50-10.0.40.200
add name=dhcp_pool_vlan50 ranges=10.0.50.50-10.0.50.200
/ip dhcp-server
add address-pool=dhcp_pool_vlan10 interface=vlan10 name=dhcp_server_vlan10
add address-pool=dhcp_pool_vlan20 interface=vlan20 name=dhcp_server_vlan20
add address-pool=dhcp_pool_vlan30 interface=vlan30 name=dhcp_server_vlan30
add address-pool=dhcp_pool_vlan40 interface=vlan40 name=dhcp_server_vlan40
add address-pool=dhcp_pool_vlan50 interface=vlan50 name=dhcp_server_vlan50
/ip smb users
set [ find default=yes ] disabled=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \
path-cost=10 pvid=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \
path-cost=10 pvid=20
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \
path-cost=10 pvid=20
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \
path-cost=10 pvid=30
add bridge=bridge comment=defconf interface=wifi1 internal-path-cost=10 \
path-cost=10 pvid=30
add bridge=bridge comment=defconf interface=wifi2 internal-path-cost=10 \
path-cost=10 pvid=30
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=all lldp-med-net-policy-vlan=1
/interface bridge vlan
add bridge=bridge tagged=ether2,bridge vlan-ids=10
add bridge=bridge tagged=ether3,ether4,bridge vlan-ids=20
add bridge=bridge tagged=bridge,ether5,wifi1,wifi2 vlan-ids=30
add bridge=bridge tagged=bridge vlan-ids=40
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=vlan10 list=LAN
add interface=vlan20 list=LAN
add interface=vlan30 list=LAN
add interface=vlan40 list=LAN
add interface=vlan50 list=LAN
/ip address
add address=10.0.0.1/24 comment=defconf interface=bridge network=10.0.0.0
add address=10.0.10.1/24 interface=vlan10 network=10.0.10.0
add address=10.0.20.1/24 interface=vlan20 network=10.0.20.0
add address=10.0.30.1/24 interface=vlan30 network=10.0.30.0
add address=10.0.40.1/24 interface=vlan40 network=10.0.40.0
add address=10.0.50.1/24 interface=vlan50 network=10.0.50.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=10.0.0.0/24 comment=defconf dns-server=10.0.0.1 gateway=10.0.0.1 \
netmask=24
add address=10.0.10.0/24 dns-server=10.0.10.1 gateway=10.0.10.1
add address=10.0.20.0/24 dns-server=10.0.20.1 gateway=10.0.20.1
add address=10.0.30.0/24 dns-server=10.0.30.1 gateway=10.0.30.1
add address=10.0.40.0/24 dns-server=10.0.40.1 gateway=10.0.40.1
add address=10.0.50.0/24 dns-server=10.0.50.1 gateway=10.0.50.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1
/ip dns static
add address=10.0.0.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=forward comment="Allow VLAN20 to VLAN10" \
in-interface=vlan20 out-interface=all-ethernet
add action=accept chain=forward disabled=yes dst-address=10.0.20.0/24 \
protocol=tcp src-address=10.0.10.0/24
add action=accept chain=forward disabled=yes dst-address=10.0.10.0/24 \
protocol=tcp src-address=10.0.20.0/24
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip smb shares
set [ find default=yes ] directory=/pub
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Ether5 is an access port so it should handle untagged frames coming in.
Your TV doesn’t know a thing about VLAN.
So Ether5 needs to be untagged.
Normally for wifi-interfaces it should also be like this but the underlying wifi-driver may take care of that.
That fixed it! I simply removed ether5 as a tag from vlan30. The TV now connects and ends up on vlan30 still. Thank you!
Does that mean that simply putting pvid on the ports is enough? No need to tag anything? At least with “smart” devices?
If you do not specify it, it will be default untagged for the pvid linked to that port.
Best to specify it anyhow so it will show in export of config and gui-screens. Then you will most likely remember why you made that change 