Set VLAN in eth ports

kubhanus · January 1, 2024, 12:05pm

Hello,

I am doing my first setup of Microtic router and being stuck with this problem for 3 days now. I want to setup 3 VLANs for my network - Main (10), Guest(20) and IoT(30).
Ports on my Microtic:

eth1 - PC - VLAN 10
eth2+3 ->bonding NAS - VLAN 10
eth 4 - Unifi AP - all VLANs
eth 7 - Zyxel Switch - all VLANs
eth 8 - WAN

I was starting with default conf. And my PC is still getting IP adress from default conf (as well as Unify AP). VLANs are working properly on my Wifi network (from Unifi) and as well from my Zyxel Switch. My only trouble now is eth1 + bonding - NAS (and IP of Unifi AP)

Here is my config (def. DHCP is desibled here, but my PC is not getting any IP in this settings)

# 2024-01-01 12:50:47 by RouterOS 7.13
# software id = 7C6J-WVMS
#
# model = RB5009UG+S+
/interface bridge
add admin-mac=78:9A:18:77:7F:16 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name="ether1 - PC"
set [ find default-name=ether4 ] name="ether4 - unifi"
set [ find default-name=ether7 ] name="ether7 - switch"
set [ find default-name=ether8 ] name="ether8 - wan"
/interface veth
add address=10.42.0.100/24 gateway=10.42.0.1 gateway6="" name=adguard
add address=10.42.0.3/24 gateway=10.42.0.1 gateway6="" name=unifi
/interface vlan
add interface=bridge name=Guest vlan-id=20
add interface=bridge name=IoT vlan-id=30
add interface=bridge name=Main vlan-id=10
/interface bonding
add mode=802.3ad name="bonding - NAS" slaves=ether2,ether3
/container mounts
add dst=/unifi name=unifi-controller_config src=/usb1/containers/unifi
/disk
set usb1 type=hardware
set usb2 type=hardware
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name="guest - pool" ranges=10.42.20.2-10.42.20.254
add name="IoT - pool" ranges=10.42.30.2-10.42.30.254
add name="Main - pool" ranges=10.42.10.2-10.42.10.254
/ip dhcp-server
add address-pool="guest - pool" interface=Guest name="Guest - DHCP"
add address-pool="IoT - pool" interface=IoT name="IoT - DHCP"
add address-pool="Main - pool" interface=Main name="Main - DHCP"
/container
add interface=adguard start-on-boot=yes workdir=/opt/adguardhome/work
add hostname=unifi interface=unifi logging=yes mounts=unifi-controller_config \
    root-dir=usb1/containers/unifi-controller start-on-boot=yes workdir=\
    /unifi
/container config
set ram-high=600.0MiB registry-url=https://registry.hub.docker.com/v2/ \
    tmpdir=usb1/pull
/interface bridge port
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged \
    interface="ether4 - unify"
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged \
    interface="ether7 - switch"
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface="ether1 - PC" pvid=10 \
    trusted=yes
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="bonding - NAS" pvid=10
add bridge=bridge interface=adguard
add bridge=bridge interface=unifi
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged="ether7 - switch,ether4 - unify" vlan-ids=20
add bridge=bridge tagged="ether7 - switch,ether4 - unify" vlan-ids=30
add bridge=bridge tagged="ether4 - unify,ether7 - switch" untagged=\
    "ether1 - PC,bonding - NAS" vlan-ids=10
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface="ether8 - wan" list=WAN
add interface=Main list=LAN
add interface=IoT list=LAN
add interface=Guest list=LAN
add interface=sfp-sfpplus1 list=WAN
/ip address
add address=10.42.0.1/24 comment=defconf disabled=yes interface=bridge \
    network=10.42.0.0
add address=10.42.20.1/24 interface=Guest network=10.42.20.0
add address=10.42.30.1/24 interface=IoT network=10.42.30.0
add address=10.42.10.1/24 interface=Main network=10.42.10.0
/ip dhcp-client
add comment=defconf interface="ether8 - wan" use-peer-dns=no
/ip dhcp-server
add address-pool=*2 disabled=yes interface=bridge name="LAN - DHCP"
/ip dhcp-server network
add address=10.42.0.0/24 dns-server=10.42.0.100 gateway=10.42.0.1
add address=10.42.10.0/24 dns-server=10.42.0.100 gateway=10.42.10.1
add address=10.42.20.0/24 dns-server=10.42.0.100 gateway=10.42.20.1
add address=10.42.30.0/24 dns-server=10.42.0.100 gateway=10.42.30.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=443 in-interface-list=WAN protocol=\
    tcp to-addresses=10.42.30.253 to-ports=443
add action=redirect chain=dstnat comment="Intercept DNS queries UDP" \
    dst-port=53 protocol=udp src-address=!10.42.0.100 to-ports=53
add action=redirect chain=dstnat comment="Intercept DNS queries TCP" \
    dst-port=53 protocol=tcp src-address=!10.42.0.100 to-ports=53
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Prague
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

I didnt do anything with firewall settings yet. They are from default conf.

Thank you for your help!

BartoszP · January 1, 2024, 12:43pm

http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

anav · January 1, 2024, 4:34pm

(1) This open ended nonsense sourcenat rule is from the default rules… ??

/ip firewall nat
add action=masquerade chain=srcnat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN

(2) No idea what you are doing with these seeminlyg bogus etherports/wlan ports ???
add bridge=bridge interface=adguard
add bridge=bridge interface=unifi

(3) Forgot to tag bridge in /interface bridge vlans!!

(4) Interface member vlans are all present, no need to have bridge as an interface member, does nothing…
It looks like at one time the bridge had its own DHCP, I noted disabled address…
Either add another vlan if you need another subnet or get rid of all the noise.

(5) Why is this default setting still hanging about??
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan

(6) BIG SECURITY MISTAKE!!!

add action=dst-nat chain=dstnat dst-port=443 in-interface-list=WAN protocol=
tcp to-addresses=10.42.30.253 to-ports=443
add action=redirect chain=dstnat comment=“Intercept DNS queries UDP”
dst-port=53 protocol=udp src-address=!10.42.0.100 to-ports=53
add action=redirect chain=dstnat comment=“Intercept DNS queries TCP”
dst-port=53 protocol=tcp src-address=!10.42.0.100 to-ports=53

In effect you are allowing the entire INTERNET to use your DNS SETUP.
Any address that is not 10.42.0.100 You forgot to provide context and limits since this is aimed at your LAN side but inadvertently opened it up to LAN and WAN!!!

What you need to do / modify ASAP !!!
add action=redirect chain=dstnat comment=“Intercept DNS queries UDP”
dst-port=53 protocol=udp src-address=!10.42.0.100 to-ports=53 in-interface-list=LAN
add action=redirect chain=dstnat comment=“Intercept DNS queries TCP”
dst-port=53 protocol=tcp src-address=!10.42.0.100 to-ports=53 in-interface-list=LAN

kubhanus · January 1, 2024, 5:31pm

Thank you for your comments. Especially for the last one. I didnt noticed that.

I got rid of all the noise and started fresh without default conf. and followed this - the Router-Switch-AP (all in one) part

But without success. My computer on eth1, my NAS on bonding interface and Unifi AP on eth4 still doesnt get IP. All other devices on Zyxel switch has it.

What am I missing here?

# 2024-01-01 18:21:35 by RouterOS 7.13
# software id = 7C6J-WVMS
#
# model = RB5009UG+S+
/interface bridge
add name=bridge protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] name="ether1 - PC"
set [ find default-name=ether4 ] name="ether4 - Unifi"
set [ find default-name=ether7 ] name="ether7 - switch"
set [ find default-name=ether8 ] name="ether8 - WAN"
/interface vlan
add interface=bridge name=IoT vlan-id=30
add interface=bridge name=guest vlan-id=20
add interface=bridge name=main vlan-id=10
/interface bonding
add mode=802.3ad name="Bonding - NAS" slaves=ether2,ether3
/disk
set usb1 type=hardware
set usb2 type=hardware
/interface list
add name=WAN
add name=VLAN
add name=MAIN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=guest_pool ranges=10.42.20.2-10.42.20.254
add name=IoT_pool ranges=10.42.30.2-10.42.30.254
add name=Main_pool ranges=10.42.10.2-10.42.10.254
/ip dhcp-server
add address-pool=guest_pool interface=guest name="DHCP - Guest"
add address-pool=IoT_pool interface=IoT name="DHCP - IoT"
add address-pool=Main_pool interface=main name="DHCP - Main"
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether1 - PC" pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="Bonding - NAS" pvid=10
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "ether4 - Unifi"
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "ether7 - switch"
/interface bridge vlan
add bridge=bridge untagged="ether1 - PC,Bonding - NAS" vlan-ids=10
add bridge=bridge tagged="ether4 - Unifi,ether7 - switch" vlan-ids=20
add bridge=bridge tagged="ether4 - Unifi,ether7 - switch" vlan-ids=30
/interface list member
add interface="ether8 - WAN" list=WAN
add interface=IoT list=VLAN
add interface=main list=VLAN
add interface=guest list=VLAN
add interface=main list=MAIN
/ip address
add address=10.42.10.1/24 interface=main network=10.42.10.0
add address=10.42.20.1/24 interface=guest network=10.42.20.0
add address=10.42.30.1/24 interface=IoT network=10.42.30.0
/ip dhcp-client
add interface="ether8 - WAN"
/ip dhcp-server network
add address=10.42.10.0/24 dns-server=10.42.10.1 gateway=10.42.10.1
add address=10.42.20.0/24 dns-server=10.42.10.1 gateway=10.42.20.1
add address=10.42.30.0/24 dns-server=10.42.10.1 gateway=10.42.30.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9
/ip firewall filter
add action=accept chain=input comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=accept chain=input comment="Allow main VLAN Full Access" \
    in-interface=main
add action=drop chain=input comment=Drop
add action=accept chain=forward comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=forward comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=forward comment="VLAN Internet Access only" \
    connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment=Drop
/ip firewall nat
add action=masquerade chain=srcnat comment="Default masquerade" \
    out-interface-list=WAN
/system clock
set time-zone-name=Europe/Prague
/system note
set show-at-login=no

anav · January 1, 2024, 11:04pm

(1) You have two rules and the second one is redundant on input chain.
add action=accept chain=input comment=“Allow VLAN” in-interface-list=VLAN { allows all VLANS full access to the ROUTER }
_add action=accept chain=input comment=“Allow main VLAN Full Access” _ { allows main VLAN full access to the ROUTER }
in-interface=main

The second rule will never be used as main is also included in the prior rule, so get rid of the second rule.

(2) Did I not state you forgot to tag the bridge in your rules… You seem to like either not to listen or to repeat mistakes.
Not sure if you actually read the article either?
FROM:
/interface bridge vlan
add bridge=bridge untagged=“ether1 - PC,Bonding - NAS” vlan-ids=10
add bridge=bridge tagged=“ether4 - Unifi,ether7 - switch” vlan-ids=20
add bridge=bridge tagged=“ether4 - Unifi,ether7 - switch” vlan-ids=30

TO:
/interface bridge vlan
add bridge=bridge tagged=bridge untagged=“ether1 - PC,Bonding - NAS” vlan-ids=10
add bridge=bridge tagged=bridge,“ether4 - Unifi,ether7 - switch” vlan-ids=20
add bridge=bridge tagged=bridge,“ether4 - Unifi,ether7 - switch” vlan-ids=30

Further…
If you want to also carry vlan10 to unifi and zyxel switches you should add.
add bridge=bridge tagged=bridge**,ether4- Unifi,ether7- switch"** untagged=“ether1 - PC,Bonding - NAS” vlan-ids=10

Finally while looking at the first line, look how you screwed the dumb way ( prone to errors) you name interfaces using quotes and spaces etc…
set [ find default-name=ether7 ] name=“ether7 - switch”
add mode=802.3ad name=“Bonding - NAS” slaves=ether2,ether3

Look at the result…
/interface bridge vlan
add bridge=bridge untagged=“ether1 - PC,Bonding - NAS” vlan-ids=10

Fixed:
/interface bridge vlan
add bridge=bridge untagged=“ether1 - PC**”,“**Bonding - NAS” vlan-ids=10

Rinse and repeated error for the other two lines in the config, missing quote marks, which I will let you fix.

add bridge=bridge tagged=“ether4 - Unifi,ether7 - switch” vlan-ids=20
add bridge=bridge tagged="ether4 - Unifi,ether7 - switch" vlan-ids=30