All my current attempts following this guide have ended up with me getting locked up each time. I tried to follow some YouTube videos, and in these cases, I didn’t get locked out, but as soon as I enabled VLAN filtering, I no longer had access to VLAN 2.
What I want to achieve is this:
Networks (for the sake of this exercise, all the networks share the 192.168.0.0/16 subnet):
- Client machines - no VLAN/default network - 192.168.1.0/26
- Servers - VLAN 2 - 192.168.2.0/26
- Untrusted IoT crap - VLAN 254 - 192.168.254.0/29
Requirements:
- Clients will have access to VLAN 2. Firewall on the Unifi gateway will see to it that only trusted hosts can actually access the servers.
- VLAN 254 will be able to access VLAN 2 (TV access to DLNA service on the NAS. NAS and Unifi firewalls will restrict access only to the TV.)
With the default config on the switch, I can access all the VLANs.
My current state:
After applying VLAN filtering on the bridge, TCP/ICMP against VLAN 2 will be unsuccessful from the 192.168.1.0/26 subnet, including the switch.
# 2025-06-08 01:14:58 by RouterOS 7.19.1
# software id = 619I-3SLA
#
# model = CRS312-4C+8XG
# serial number =
/interface bridge
add admin-mac=MA:CA:DD:RE:SS auto-mac=no comment=defconf name=bridge \
vlan-filtering=yes
/interface ethernet
set [ find default-name=ether9 ] name=Management
set [ find default-name=combo1 ] disabled=yes
set [ find default-name=combo2 ] disabled=yes
set [ find default-name=combo3 ] disabled=yes
set [ find default-name=combo4 ] disabled=yes
set [ find default-name=ether1 ] comment=Gateway
set [ find default-name=ether2 ] comment=Telekas
set [ find default-name=ether3 ] disabled=yes
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=ether6 ] comment=Lauakas
set [ find default-name=ether7 ] comment="Suur Synology"
/interface vlan
add interface=bridge name="Internet of Crap" vlan-id=254
add interface=bridge name=Servers vlan-id=2
/interface list
add name="Management List"
add name=LAN
add name=Incoming
/port
set 0 name=serial0
/user group
add name=custom policy="local,telnet,ssh,reboot,read,write,policy,test,winbox,\
password,sniff,sensitive,!ftp,!web,!api,!romon,!rest-api"
/ip smb
set enabled=no
/interface bridge port
add bridge=bridge comment=defconf interface=combo1
add bridge=bridge comment=defconf interface=combo2
add bridge=bridge comment=defconf interface=combo3
add bridge=bridge comment=defconf interface=combo4
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether2 pvid=254
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether7 pvid=2
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether8 pvid=254
/ip neighbor discovery-settings
set discover-interface-list=none
/interface bridge vlan
add bridge=bridge tagged=ether1,bridge untagged=ether2,ether8 vlan-ids=254
add bridge=bridge tagged=ether1,bridge untagged=ether7 vlan-ids=2
/interface list member
add interface=Management list="Management List"
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether1 list=Incoming
/ip address
add address=192.168.88.1/24 comment=defconf interface=Management network=\
192.168.88.0
add address=192.168.1.2/26 interface=bridge network=192.168.1.0
add address=192.168.254.6/29 interface="Internet of Crap" network=192.168.254.0
add address=192.168.2.63/26 interface=Servers network=192.168.2.0
/ip dns
set servers=192.168.2.2,192.168.2.3
/ip firewall address-list
add address=192.168.1.0/26 list=Clients
add address=192.168.2.0/26 list=Servers
add address=192.168.254.0/29 list="Internet of Crap"
add address=192.168.1.10/31 list="Trusted Hosts"
/ip firewall service-port
set ftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main \
suppress-hw-offload=no
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=Europe/Tallinn
/system identity
set name=Svits
/system swos
set address-acquisition-mode=static static-ip-address=192.168.1.2
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list="Management List"
/tool mac-server mac-winbox
set allowed-interface-list="Management List"
/user settings
set minimum-password-length=20
Visual guide:
All the VLANs come from the Unifi gateway to the first port. In the future, I want to limit the VLANs only to 2 and 254, or the ones that are actually used on the switch.
NAS’s main VLAN is 2, but for DLNA to work, I added another port to VLAN 254, where the TV is.
