Hello,
I have asked about setting up VLAN’s in the past on this forum, but I have hit roadblocks due to other parts of my network (AP’s, switches etc.) not being VLAN-aware. I recently upgraded to a set of Unifi Switches & AP’s and thought to try again. Unfortunately, I have not had much luck this time either.
Symptom: Client in VLAN is assigned an IP in VLAN range by the Router, but client cannot ping gateway or internet hosts.
Network Diagram: Click here.
Config export (stripped down):
# jun/30/2018 15:50:42 by RouterOS 6.42.3
# model = CCR1009-8G-1S-1S+
# serial number = 606F04BDA7AE
/interface ethernet
set [ find default-name=ether1 ] name="ether1-switch master"
set [ find default-name=ether5 ] comment=\
"Study Room Switch Copper SFP upstream-1"
set [ find default-name=ether6 ] comment=\
"Study Room Switch Copper SFP upstream-2" mac-address=4C:5E:0C:03:20:26
set [ find default-name=ether8 ] comment="WAN Interface" name=ether8-gateway
/interface bonding
add lacp-rate=1sec mode=802.3ad name="Home Network Trunk Ports" slaves=\
ether5,ether6
/interface vlan
add interface="Home Network Trunk Ports" name=test-vlan vlan-id=5
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=home-iprange ranges=192.168.48.100-192.168.48.200
add name=test-iprange ranges=192.168.54.0/24
/ip dhcp-server
add address-pool=home-iprange authoritative=after-2sec-delay disabled=no \
interface="Home Network Trunk Ports" lease-time=3d name=home-dhcp
add address-pool=test-iprange disabled=no interface=test-vlan lease-time=1h \
name=test-dhcp
/system logging action
add disk-file-name=disk1/log name=sdcard target=disk
/ip address
add address=192.168.48.1/24 comment="Home Network" interface=\
"Home Network Trunk Ports" network=192.168.48.0
add address=192.168.54.1/24 comment="Guest Network" interface=test-vlan \
network=192.168.54.0
/ip arp
add address=192.168.48.255 comment="Broadcast MAC for WOL" interface=\
"Home Network Trunk Ports" mac-address=FF:FF:FF:FF:FF:FF
add address=192.168.48.21 interface="Home Network Trunk Ports" mac-address=\
78:8A:20:C5:4B:40
add address=192.168.48.51 interface="Home Network Trunk Ports" mac-address=\
FC:EC:DA:3A:96:66
add address=192.168.48.50 interface="Home Network Trunk Ports" mac-address=\
FC:EC:DA:3A:9A:8B
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether8-gateway
add dhcp-options=hostname,clientid interface=sfp1
/ip dhcp-server network
add address=192.168.48.0/24 comment="Home DHCP Pool" dns-server=192.168.48.1 \
gateway=192.168.48.1 netmask=24
add address=192.168.54.0/24 comment="Guest DHCP Pool" dns-server=8.8.8.8 \
gateway=192.168.54.1
/ip dns
set allow-remote-requests=yes servers=132.147.113.3,54.254.156.43
/ip dns static
add address=192.168.48.194 name=unifi
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=accept chain=input protocol=icmp
add action=drop chain=input in-interface=ether8-gateway
add action=drop chain=forward disabled=yes in-interface=ether8-gateway
add action=accept chain=forward in-interface=all-vlan out-interface=all-vlan
/ip firewall nat
add action=masquerade chain=srcnat comment="NAT to WAN Interface" \
out-interface=ether8-gateway
/ip service
set telnet address=192.168.0.0/16
set ftp disabled=yes
set ssh address=192.168.0.0/16
set winbox address=192.168.0.0/16
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=ether8-gateway type=external
add interface="Home Network Trunk Ports" type=internal
/lcd
set backlight-timeout=10m default-screen=stat-slideshow time-interval=hour
/lcd interface
set sfp-sfpplus1 disabled=yes
set sfp1 disabled=yes
/routing filter
add chain=dynamic-in distance=3 set-routing-mark=wan1
add chain=dynamic-in distance=4 set-routing-mark=wan2
/system clock
set time-zone-name=Asia/Singapore
/system identity
set name="MikroTik Router"
/system leds
set 0 interface=sfp-sfpplus1
set 1 interface=sfp-sfpplus1
set 2 interface=sfp1
/system logging
set 0 action=sdcard
add action=sdcard topics=script
add action=sdcard topics=interface
/system ntp client
set enabled=yes primary-ntp=139.59.219.101 secondary-ntp=172.104.34.215
/system ntp server
set enabled=yes
/system routerboard settings
set silent-boot=no
/system scheduler
add name=ntp-pool-resolve on-event="/system ntp client set primary-ntp=[:resol\
ve 0.pool.ntp.org] secondary-ntp=[:resolve 1.pool.ntp.org]" policy=\
read,write,test start-date=jan/12/2017 start-time=02:00:00
/tool romon port
add
Screenshot of IP>Routes:
In order to test my configuration, I’ve setup a VM and set the VLAN on the VM’s ethernet connection. The VM does have an IP address in the VLAN range, but it cannot ping the gateway or any external IP.
~# ip address
39: eth0@if40: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 0a:06:aa:86:9a:a9 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 192.168.54.255/24 brd 192.168.54.255 scope global dynamic eth0
valid_lft 1027sec preferred_lft 1027sec
inet6 fe80::806:aaff:fe86:9aa9/64 scope link
valid_lft forever preferred_lft forever
~# ip route
default via 192.168.54.1 dev eth0 proto dhcp src 192.168.54.255 metric 1024
192.168.54.0/24 dev eth0 proto kernel scope link src 192.168.54.255
192.168.54.1 dev eth0 proto dhcp scope link src 192.168.54.255 metric 1024
~# ping 192.168.54.1
PING 192.168.54.1 (192.168.54.1) 56(84) bytes of data.
From 192.168.54.255 icmp_seq=1 Destination Host Unreachable
From 192.168.54.255 icmp_seq=2 Destination Host Unreachable
From 192.168.54.255 icmp_seq=3 Destination Host Unreachable
^C
--- 192.168.54.1 ping statistics ---
4 packets transmitted, 0 received, +3 errors, 100% packet loss, time 3068ms
If anyone can help me figure out what I am doing wrong, I would highly appreciate it!