I have a RB750Gr3 that I’m setting up to serve one trusted, and one untrusted subnet. Both have full access to the ethernet. Both are wired, but both also have an associated SSID on a single AP. (That’s what drives needing vlans, otherwise this would be a simple routing setup.) In addition, this is replacing a very similar setup with a different (aging) router, so I have some older hardware (switches) to contend with.
A picture. Pardon my drawing program – its label placement isn’t perfect. Labels on lines are all to the right of the line they’re labeling.
I have existing unmanaged switches on both the trusted and untrusted nets, so I can’t rely on (and don’t really need) a vlan tag being carried across those networks reliably.
I’ve gone through examples in other people’s posts, and read (what I think are) the relevant manual sections, but I’m stuck at this point. A device on ether3 doesn’t get an address from the DHCP server on that interface. If I watch the traffic counters, ether3 does get traffic, but the vlan10-untrusted interface does not. (BTW, there’s no DHCP server on the 211 side. That’s intentional – I have a different server for that network.)
I started from the default MikroTik config, and shrank the default bridge down to just ether1, and renamed it “bridge-safe”. So ether1 still has the .88 net on it. (I only locked myself out several times before realizing that was a good idea. 
Here’s what I have:
# feb/19/2022 09:44:55 by RouterOS 6.49.3
# software id = M4E2-6RER
#
# model = RB750Gr3
# serial number = D5030F1290A5
/interface bridge
add name=bridge-mine vlan-filtering=yes
add admin-mac=DC:2C:6E:7B:22:DE auto-mac=no comment=defconf name=bridge-safe
/interface vlan
add interface=bridge-mine name=vlan10-untrusted vlan-id=10
add interface=bridge-mine name=vlan11-trusted vlan-id=11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=untrusted-dhcp ranges=192.168.210.100-192.168.210.240
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge-safe name=defconf
add address-pool=untrusted-dhcp disabled=no interface=vlan10-untrusted name=dhcp-untrusted
/interface bridge port
add bridge=bridge-safe comment=defconf interface=ether2
add bridge=bridge-mine interface=ether3 pvid=10
add bridge=bridge-mine interface=ether4
add bridge=bridge-mine interface=ether5 pvid=11
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge-mine tagged=ether4 untagged=ether5 vlan-ids=11
add bridge=bridge-mine tagged=ether4 untagged=ether3 vlan-ids=10
/interface list member
add comment=defconf interface=bridge-safe list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=vlan10-untrusted list=LAN
add interface=vlan11-trusted list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge-safe network=192.168.88.0
add address=192.168.210.1/24 interface=vlan10-untrusted network=192.168.210.0
add address=192.168.211.1/24 interface=vlan11-trusted network=192.168.211.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
add address=192.168.210.0/24 dns-server=8.8.8.8,4.4.4.4 gateway=192.168.210.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,4.4.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
Once I have this working, I’ll need to figure out how to give the trusted net access to the untrusted side (but not vice versa), and also how to allow ssh to a single host on the trusted net, both from the untrusted net, and the WAN. So pointers to good examples of doing those things would be welcome, but getting the subnets working in the first place comes first.
Many thanks in advance!!
paul
