EDIT: Please see my follow-up before spending time on this.
Hi Guys, I’m new around here and hoping for sage advice. Yesterday I took delivery of a RB4011iGS+RM as replacement for a Ubiquiti ERPOE5 and have been slowly working my way through set-up and have run into a VLAN issue. I’ve read through this whole thread and a number of others (this and this), with this one probably being closest to what I’m trying to do, but I’m still having trouble.
My set-up is pretty simple really, I have the RB4011 eth1 hooked up to WAN, eth9 and eth10 to a pair of Unifi APs, eth7 and eth8 to a pair of dumb switches. The Unifi APs have SSIDs enabled, essentially home and guest with guest using VLAN ID 67. Everything is working as I think it should except the guest wifi has no internet access. Also, when I hook up to the guest wifi I can’t ping the DHCP server even though I am getting an IP in the valid range served up.
I’m hoping that whatever is wrong in the config is obvious to someone, even if not to me and I can be pointed in the right direction.
Config:
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 use-peer-dns=yes user=XXXXXX
/interface vlan
add interface=bridge name=vlan67 vlan-id=67
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment="All VLAN interfaces" name=all_vlan
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.66.50-192.168.66.254
add name=dhcp_vlan67_pool ranges=192.168.67.2-192.168.67.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
add address-pool=dhcp_vlan67_pool disabled=no interface=vlan67 name=dhcp_vlan67
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add interface=*E
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge untagged=ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10 vlan-ids=1
add bridge=bridge tagged=bridge,ether9,ether10 vlan-ids=67
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add comment="Include VLAN 67 in all_vlan" interface=vlan67 list=all_vlan
/ip address
add address=192.168.66.1/24 comment=defconf interface=ether2 network=192.168.66.0
add address=192.168.67.1 interface=vlan67 network=192.168.67.1
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server lease
add address=192.168.66.10 address-lists=CleanBrowsing comment="Frasers Laptop" mac-address=4C:BB:58:A1:21:DD server=defconf use-src-mac=yes
add address=192.168.66.2 client-id=1:80:2a:a8:c9:8:ff comment="Unifi ACAP Laundry" mac-address=80:2A:A8:C9:08:FF server=defconf
add address=192.168.66.3 client-id=1:78:8a:20:80:47:35 comment="Unifi ACAP Activity" mac-address=78:8A:20:80:47:35 server=defconf
/ip dhcp-server network
add address=192.168.66.0/24 comment=defconf gateway=192.168.66.1 netmask=24
add address=192.168.67.0/24 dns-server=8.8.8.8 gateway=192.168.67.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.66.1 comment=defconf name=router.lan
/ip firewall address-list
add address=192.168.66.10 list=CleanBrowsing
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="Accept DHCP requests on VLAN interfaces" dst-port=67 in-interface-list=all_vlan protocol=udp src-port=68
add action=accept chain=input comment="Accept DNS requests (UDP) from VLAN interfaces" dst-port=53 in-interface-list=all_vlan protocol=udp
add action=accept chain=input comment="Accept DNS requests (TCP) from VLAN interfaces" dst-port=53 in-interface-list=all_vlan protocol=tcp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Clean Browsing DNS" dst-port=53 log=yes protocol=udp src-address-list=CleanBrowsing to-addresses=185.228.168.168 to-ports=53
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Clean Browsing DNS" dst-port=53 log=yes protocol=udp src-address-list=CleanBrowsing to-addresses=185.228.168.168 to-ports=53
/system clock
set time-zone-name=Australia/Sydney
/system identity
set name=Mikrotik
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
My config is pretty much out-of-the-box with only the additional things added that I think I need over the next few days as I play and get used to it. The intention is try to get to a place where I have a completely custom config, or at least ready to attempt it on the coming weekend - wish me luck!
Thanks for taking the time to look, I really appreciate any help / advice anyone can offer.