Hi, I am trying to set up VLANs to isolate subnets for my wifi network (vlanWifi with ID=300, 172.27.6.0/24) and my lan network (vlanInfra with ID=100, 172.27.7.0/24). vlanWifi has ether3 as an untagged port, vlanInfra has ether1 as an untagged port, and ether4 is a trunk port with both vlan IDs. I added all the ports to a bridge bridgeVlan with the vlan tag details, set two vlan interfaces on top of the bridge, assigned IPs to the vlan interfaces and set up my DHCP servers, and then enabled the bridge vlan filtering.
This works well for the untagged ports (ether1 and ether3), where the DHCP servers are picking up clients, but I can’t ping a static Linux client I connected to ether4, the trunk port.
I configured the Linux client using systemd syntax based on the Archlinux Wiki page on VLAN to have static IPs 172.27.7.2 for VLAN ID=100/ 172.27.6.2 for VLAN ID=300, with two systemd netdevs. I installed the right packages for vlan usage, and loaded the 8021q module, and these interfaces are up.
Could you please help me out? I am not sure what is wrong with my configuration.
Mikrotik configuration
# oct/01/2018 23:29:27 by RouterOS 6.43.2
# model = RouterBOARD 750G r3
/interface bridge
add admin-mac=64:D1:54:B3:82:21 auto-mac=no comment=defconf name=bridge
add fast-forward=no name=bridgeVlan pvid=2 vlan-filtering=yes
/interface vlan
add interface=bridgeVlan name=vlanInfra vlan-id=100
add interface=bridgeVlan name=vlanWifi vlan-id=300
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=pool-infra ranges=172.27.7.5-172.27.7.254
add name=pool-wifi ranges=172.27.6.5-172.27.6.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
add address-pool=pool-wifi disabled=no interface=vlanWifi name=dhcp-wifi
add add-arp=yes address-pool=pool-infra disabled=no interface=vlanInfra name=\
dhcp-infra
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridgeVlan interface=ether1 pvid=100
add bridge=bridgeVlan interface=ether3 pvid=300
add bridge=bridgeVlan interface=ether4 pvid=2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridgeVlan comment="Wifi vlan" tagged=ether4,bridgeVlan untagged=\
ether3 vlan-ids=300
add bridge=bridgeVlan comment="Infra vlan" tagged=ether4,bridgeVlan untagged=\
ether1 vlan-ids=100
/interface list member
add comment=defconf interface=bridge list=LAN
add comment="mod from defconf" interface=ether5 list=WAN
add interface=bridgeVlan list=LAN
add interface=vlanInfra list=LAN
add interface=vlanWifi list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=172.27.7.1/24 comment=Infra interface=vlanInfra network=\
172.27.7.0
add address=172.27.6.1/24 comment=Wifi interface=vlanWifi network=172.27.6.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\
ether5 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=172.27.6.0/24 comment=Wifi domain=.wifi.test gateway=172.27.6.1 \
netmask=24
add address=172.27.7.0/24 comment=Infra domain=.infra.test gateway=172.27.7.1 \
netmask=24
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-mac-protocol=vlan
Systemd-networkd configuration
eth0.network
------------
[Match]
Name=eth0
[Network]
DHCP=no
VLAN=eth0.100
VLAN=eth0.300
eth0.100.netdev
---------------
[NetDev]
Name=eth0.100
Kind=vlan
[VLAN]
Id=100
eth0.100.network
----------------
[Match]
Name=eth0.100
[Network]
DHCP=no
[Address]
Address=172.27.7.2/24
Gateway=172.27.7.1
eth0.300.netdev
---------------
[NetDev]
Name=eth0.300
Kind=vlan
[VLAN]
Id=300
eth0.300.network
----------------
[Match]
Name=eth0.300
[Network]
DHCP=no
[Address]
Address=172.27.6.2/24
Gateway=172.27.6.1