Stuck with inter-VLAN routing

dmitriyt · February 27, 2025, 12:45pm

Hi, I’ve built a basic configuration with VLANs (see simplifyed diagram below

), and while it mostly works, as all VLANs can communicate with the Internet, communicate normally within the VLAN, the inter-vlan routing is just not working (except it works within a switch, but not within the router or between the switch and router). The setup is very simple, practically “by the book”, but it seems I made a mistake somewhere. Could you please help me with that?

Configuration:
Router is RB5009, switch is CRS310, both on the latest stable firmware 7.18.
Notes about configuration:

IPv6 is disabled for both router and switch for simplicity. So, IPv6 firewall configuration has been removed from the router config output to make it shorter.
Firewall configuration is default except added a rule for the VLAN routing. Interestingly, this rule never sees virtually any traffic. This is probably a hint, but I didn’t get it so far.
I have tested all variants for the STP on the bridges (incl. none), but no luck.

Router config:

# ... by RouterOS 7.18
# software id = QHY4-TJ92
#
# model = RB5009UG+S+
# serial number = HF109XXXXXX
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:94 auto-mac=no comment=defconf mvrp=yes name=\
    bridge-rb vlan-filtering=yes
/interface vlan
add interface=bridge-rb name=MGMT vlan-id=99
add interface=bridge-rb name=PCs vlan-id=20
add interface=bridge-rb name=Servers vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=pool-bridge ranges=192.168.5.10-192.168.5.100
add name=pool-management ranges=192.168.99.10-192.168.99.100
add name=pool-PCs ranges=192.168.20.10-192.168.20.100
add name=pool-servers ranges=192.168.10.10-192.168.10.100
/ip dhcp-server
add address-pool=pool-bridge interface=bridge-rb name=bridge
add address-pool=pool-management interface=MGMT name=management
add address-pool=pool-servers interface=Servers name=servers
add address-pool=pool-PCs interface=PCs name=pcs
/system ntp key
add key-id=1
/disk settings
set auto-media-interface=bridge-rb auto-media-sharing=yes auto-smb-sharing=\
    yes
/interface bridge port
add bridge=bridge-rb comment="Trunc to switch" interface=ether2
add bridge=bridge-rb comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=bridge-rb comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether4 pvid=10
add bridge=bridge-rb comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether5 pvid=10
add bridge=bridge-rb comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether6 pvid=20
add bridge=bridge-rb comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether7 pvid=20
add bridge=bridge-rb comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether8 pvid=99
add bridge=bridge-rb comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=sfp-sfpplus1 pvid=10
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge-rb tagged=bridge-rb,ether2 untagged=ether8 vlan-ids=99
add bridge=bridge-rb tagged=ether2,bridge-rb untagged=\
    ether3,ether4,ether5,sfp-sfpplus1 vlan-ids=10
add bridge=bridge-rb tagged=ether2,bridge-rb untagged=ether6,ether7 vlan-ids=\
    20
/interface list member
add comment=defconf interface=bridge-rb list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=MGMT list=LAN
add interface=PCs list=LAN
add interface=Servers list=LAN
add interface=PCs list=VLAN
add interface=Servers list=VLAN
add interface=MGMT list=VLAN
/ip address
add address=192.168.5.1/24 comment=defconf interface=bridge-rb network=\
    192.168.5.0
add address=192.168.99.1/24 comment=management interface=MGMT network=\
    192.168.99.0
add address=192.168.20.1/24 comment=pcs interface=PCs network=192.168.20.0
add address=192.168.10.1/24 comment=servers interface=Servers network=\
    192.168.10.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.5.3 client-id=x:xx:xx:xx:xx:xx:4a comment=CRS310 \
    mac-address=XX:XX:XX:XX:XX:4A server=bridge
add address=192.168.10.120 comment="server0" mac-address=\
    XX:XX:XX:XX:XX:1F server=servers
add address=192.168.10.110 client-id=x:xx:xx:xx:xx:xx:5b comment=\
    "server1" mac-address=XX:XX:XX:XX:XX:5B server=servers
/ip dhcp-server network
add address=192.168.5.0/24 comment=bridge dns-server=192.168.5.1 gateway=\
    192.168.5.1
add address=192.168.10.0/24 comment=servers gateway=192.168.10.1
add address=192.168.20.0/24 comment=pcs gateway=192.168.20.1
add address=192.168.99.0/24 comment=management gateway=192.168.99.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.5.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward connection-state=new in-interface-list=VLAN \
    out-interface-list=VLAN
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set h323 disabled=yes
set sip disabled=yes
/system clock
set time-zone-name=XXXXXXXXXX
/system identity
set name=RB5009
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set auth-key=1 broadcast=yes enabled=yes manycast=yes multicast=yes
/system ntp client servers
add address=pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Switch config

# ... by RouterOS 7.18
# software id = Z8R7-YY9K
#
# model = CRS310-8G+2S+
# serial number = HG909XXXXXX
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:4A auto-mac=no comment=defconf mvrp=yes name=\
    bridge-crs vlan-filtering=yes
/interface vlan
add interface=bridge-crs name=MGMT vlan-id=99
add interface=bridge-crs name=PCs vlan-id=20
add interface=bridge-crs name=Servers vlan-id=10
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/system ntp key
add key-id=1
/interface bridge port
add bridge=bridge-crs comment="Trunc to router" interface=ether1
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether2 pvid=20
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 pvid=20
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether4 pvid=20
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether5 pvid=20
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether6 pvid=20
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether7 pvid=10
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether8 pvid=99
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=sfp-sfpplus1 pvid=10
add bridge=bridge-crs comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=sfp-sfpplus2 pvid=10
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge-crs tagged=ether1 untagged=ether8 vlan-ids=99
add bridge=bridge-crs tagged=ether1 untagged=\
    ether2,ether3,ether4,ether5,ether6 vlan-ids=20
add bridge=bridge-crs tagged=ether1 untagged=ether7,sfp-sfpplus1,sfp-sfpplus2 \
    vlan-ids=10
/ip address
add address=192.168.5.3/24 comment=defconf interface=bridge-crs network=\
    192.168.5.0
add address=192.168.99.3/24 interface=MGMT network=192.168.99.0
add address=192.168.10.3/24 interface=Servers network=192.168.10.0
add address=192.168.20.3/24 interface=PCs network=192.168.20.0
/ip firewall filter
/system clock
set time-zone-name=XXXXXXXXXX
/system identity
set name=CRS310
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.5.1 auth-key=1

Thank you.

anav · February 27, 2025, 5:45pm

Best guide for understanding
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
and for switch this is good.
https://www.youtube.com/watch?v=YLtGQAQ8iS0&t=1023s

anav · February 27, 2025, 6:10pm

Trunk port on switch should be like
/interface bridge port
add bridge=bridge-crs comment=“Trunc to router” ingress-filtering=yes frame-type=admit-only-vlan-tagged interface=ether1

As well all the /interface bridge port entries ( access ports) are missing ingress-filtering=yes !!

On the bridge the vlan for the management vlan, the bridge IS tagged!
Should be:
/interface bridge vlan
add bridge=bridge-crs tagged=bridge-crs,ether1 untagged=ether8 vlan-ids=99
THe bridge does not get an IP address, the Switch gets its IP address from the management VLAN!!
/ip address
add address=192.168.99.3 interface=MGMT network=192.168.99.0
Only the management vlan needs identification in /interface vlan, as it interacts with the Bridge/cpu.
The other vlans are basically coming in ether1 and going out the assigned ports like a switch…

OTHER SETTINGS NEEDED ON BRIDGE
/interface list
add name=TRUSTED
/interface list member
add interface=MGMT list=TRUSTED

/ip neighbor discovery-settings
set discover-interface-list=TRUSTED

/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED

/system ntp client servers
add address=192.168.99.1 auth-key=1

/ip dns
set server=192.168.99.1

/ip route
add dst-address=0.0.0.0/0 gateway=192.168.99.1

+++++++++++++++++++++++++++++++++++++++++++++

I also recommend, in case there are issues with the bridge or getting locked out of the management network ,
assuming you can spare a port ( and if not take ether8 as you can access the config through the bridge and the router via the management vlan ).
that you have an off bridge port … ( removed from /interface bridge port

/interface ethernet
set [ find default-name=etherX] name=OffBridgeX

/interface list member
add interface=OffBridgeX list=TRUSTED

/ip address
add address=192.167.77.1/30 interface=OffBridgeX network=192.168.77.0

All one needs to do is plug their laptop into etherX and change IPV4 settings to 192.168.77.2

dmitriyt · February 28, 2025, 11:48am

Thank as lot! It works now.

Couple of comments:

Thanks for the materials! I was aware of and read pcunite’s megapost (and can recommend it to those who haven’t seen it) and learned a lot from it. Video was something new and useful.
Regarding point 1: Somehow I missed this. Normally these parameters were exactly as you recommended, but I changed them back and forth experimenting and they were as they were.
Interestingly, even after implementing all of your suggestions, it didn’t start working right away. The reason was comical.
I have a secondary network card connected to another network (with totally different subnets range and no VLANs or anything). I disabled the network adapter card in Control panel before starting all the efforts to set up the VLANs. But I didn’t manage to finish all the work in one day, sooooo… I do not know exactly what happened overnight, but it seems that either Windows Update or something else happened and turned the network adapter back on without me noticing. As a result, part of the whole VLAN setup was not working, even though it was set up correctly. Conclusion: fellow newbies! Check your network adapter settings! Or, even better, just unplug the cable you don’t need.

Again, thanks a lot for your help and all the best.