Time Machine backup / Chromecast - mDNS over VLAN

RouterOS General
1

I dusted off an rb4011 after a while and have custom configured it; still on routerOS v.6.49.19 LTS.

The below is how the current configuration looks like (stubbed) and it is restrictive just the way needed. The

But I am looking as to how can:

1. a macOS machine (in vlan-id=11) continue to do it's time machine backups on a NAS in another vlan (vlan-id=14). the mac refuses to detect the time machine backup folder/drive. (basically nas.local doesn't work, nas.lan does resolve but backup folder is unreachable by time machine (manual smb browsing works fine); even though DNS server already resolves both nas.lan & nas.local to the correct IP)

2. and have a chromecast connect to a mobile device within a vlan (vlan-id=12).

It turns out to be mDNS traffic destined for port 5353 and I could see packets going around for port 5353 from both sides/devices in either cases above. Did play around with some* firewall rules allowing traffic for port 5353 in LAN interface but no bueno.

I would prefer to avoid:

a. keep WLAN / wifi settings as-is as much as possible

b. spinning up a docker container just for this

c. and to keep firewall / packet filtering restrictive as-is as much possible, only to allow needed traffic to get the job done. Also, upgrading to v.7.xx is not in the workx at the moment, unfortunately.

I did see an old thread https://forum.mikrotik.com/t/mdns-between-vlans-with-just-bridge-filters-look-mum-no-containers/ but still wanted to start afresh as it already predates v.6.49.19 LTS release.

I do not have extensive experience with routerOS, and so here I am seeking solid help (appreciated!).

# by RouterOS 6.49.19
/interface bridge
add admin-mac=ADMIN_MAC_ADDRESS auto-mac=no name=bridge vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX country=no_country_set disabled=no distance=indoors \
    frequency=auto installation=indoor mode=ap-bridge skip-dfs-channels=all \
    ssid=ssid1 wireless-protocol=802.11 wmm-support=enabled wps-mode=\
    disabled
set [ find default-name=wlan2 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    country=no_country_set disabled=no distance=indoors frequency=auto \
    installation=indoor mode=ap-bridge skip-dfs-channels=all ssid=ssid1 \
    wireless-protocol=802.11 wps-mode=disabled
/interface vlan
add arp=reply-only interface=bridge name=vlan_1 vlan-id=11
add arp=reply-only interface=bridge name=vlan_2 vlan-id=12
add arp=reply-only interface=bridge name=vlan_3_docker vlan-id=13
add arp=reply-only interface=bridge name=vlan_4_nas vlan-id=14
add arp=reply-only interface=bridge name=vlan_5 vlan-id=15
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
add name=MGMT
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk disable-pmkid=yes \
    management-protection=allowed mode=dynamic-keys supplicant-identity=\
    MikroTik wpa2-pre-shared-key=\
    pwd1
add authentication-types=wpa2-psk disable-pmkid=yes management-protection=\
    allowed mode=dynamic-keys name=guest-profile supplicant-identity=MikroTik \
    wpa2-pre-shared-key=pwd2
/interface wireless
add default-forwarding=no disabled=no keepalive-frames=disabled mac-address=\
    MAC_ADDRESS_WLAN1 master-interface=wlan1 multicast-buffering=disabled \
    name=wlan1-guest security-profile=guest-profile ssid=ssid2 \
    wps-mode=disabled
add default-forwarding=no disabled=no keepalive-frames=disabled mac-address=\
    MAC_ADDRESS_WLAN2 master-interface=wlan2 multicast-buffering=disabled \
    name=wlan2-guest security-profile=guest-profile ssid=ssid2 \
    wps-mode=disabled
/ip dhcp-server
add add-arp=yes disabled=no interface=vlan_1 lease-time=1d name=dhcp_vlan1
add add-arp=yes disabled=no interface=vlan_2 lease-time=1d name=dhcp_vlan2
add add-arp=yes disabled=no interface=vlan_3_docker lease-time=1d name=\
    dhcp_vlan3_docker
add add-arp=yes disabled=no interface=vlan_4_nas lease-time=1d name=\
    dhcp_vlan4_nas
/ip pool
add name=pool_vlan5 ranges=10.1.15.10-10.1.15.254
/ip dhcp-server
add add-arp=yes address-pool=pool_vlan5 disabled=no interface=vlan_5 \
    lease-time=1d name=dhcp_vlan5
/interface bridge port
add bridge=bridge interface=ether8 pvid=11
add bridge=bridge interface=wlan1 pvid=15
add bridge=bridge interface=wlan2 pvid=15
add bridge=bridge interface=wlan1-guest pvid=15
add bridge=bridge interface=wlan2-guest pvid=15
add bridge=bridge comment="unused ether2" interface=ether2 pvid=15
add bridge=bridge comment="unused ether4" interface=ether4 pvid=15
add bridge=bridge comment="unused ether5" interface=ether5 pvid=15
add bridge=bridge comment="unused ether7" interface=ether7 pvid=15
add bridge=bridge comment=bridge_vlan_3_docker interface=ether3 pvid=13
add bridge=bridge comment=bridge_vlan_4_nas interface=ether6 pvid=14
add bridge=bridge comment=bridge_vlan_4_nas_2 interface=ether9 pvid=14
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/interface bridge vlan
add bridge=bridge tagged=bridge,wlan1,wlan2 untagged=ether8 vlan-ids=11
add bridge=bridge tagged=bridge,wlan1,wlan2 vlan-ids=12
add bridge=bridge tagged=bridge,wlan1,wlan2 untagged=ether3 vlan-ids=13
add bridge=bridge tagged=bridge,wlan1,wlan2 untagged=ether6,ether9 vlan-ids=\
    14
add bridge=bridge tagged=bridge untagged=\
    wlan1,wlan2,wlan1-guest,wlan2-guest,ether2,ether4,ether5,ether7 vlan-ids=\
    15
/interface list member
add interface=ether1 list=WAN
add interface=vlan_1 list=LAN
add interface=vlan_1 list=MGMT
add interface=vlan_2 list=LAN
add interface=vlan_3_docker list=LAN
add interface=vlan_4_nas list=LAN
add interface=vlan_5 list=LAN
add interface=ether8 list=MGMT
/interface wireless access-list
add forwarding=no mac-address=MAC_ADDRESS_1 vlan-id=11 vlan-mode=use-tag
add forwarding=no mac-address=MAC_ADDRESS_2 vlan-id=11 vlan-mode=use-tag
add forwarding=no mac-address=MAC_ADDRESS_3 vlan-id=11 vlan-mode=use-tag
add mac-address=MAC_ADDRESS_4 vlan-id=12 vlan-mode=use-tag
add mac-address=MAC_ADDRESS_5 vlan-id=12 vlan-mode=use-tag
/ip address
add address=10.1.11.1/24 interface=vlan_1 network=10.1.11.0
add address=10.1.12.1/24 interface=vlan_2 network=10.1.12.0
add address=10.1.13.1/24 interface=vlan_3_docker network=10.1.13.0
add address=10.1.14.1/24 interface=vlan_4_nas network=10.1.14.0
add address=10.1.15.1/24 interface=vlan_5 network=10.1.15.0
/ip dhcp-client
add disabled=no interface=ether1 use-peer-dns=no
/ip dhcp-server lease
add address=10.1.11.11 mac-address=MAC_ADDRESS_1 server=dhcp_vlan1
add address=10.1.13.13 mac-address=MAC_ADDRESS_6 server=dhcp_vlan3_docker
add address=10.1.14.14 mac-address=MAC_ADDRESS_7 server=dhcp_vlan4_nas
add address=10.1.14.24 mac-address=MAC_ADDRESS_8 server=dhcp_vlan4_nas
add address=10.1.11.20 mac-address=MAC_ADDRESS_2 server=dhcp_vlan1
add address=10.1.11.21 mac-address=MAC_ADDRESS_3 server=dhcp_vlan1
add address=10.1.12.20 mac-address=MAC_ADDRESS_4 server=dhcp_vlan2
add address=10.1.12.22 mac-address=MAC_ADDRESS_5 server=dhcp_vlan2
/ip dhcp-server network
add address=10.1.11.0/24 dns-server=10.1.13.13 gateway=10.1.11.1
add address=10.1.12.0/24 dns-server=10.1.13.13 gateway=10.1.12.1
add address=10.1.13.0/24 dns-server=10.1.13.1 gateway=10.1.13.1
add address=10.1.14.0/24 dns-server=10.1.13.13 gateway=10.1.14.1
add address=10.1.15.0/24 dns-server=10.1.13.13 gateway=10.1.15.1
/ip dns
set servers=1.1.1.1
/ip firewall filter
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment=\
    "ACCEPT: Established, Related, Untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="DROP: ALL INBOUND WAN INSTANTLY" \
    in-interface-list=WAN
add action=accept chain=input comment="ACCEPT: DHCP Requests from LAN" \
    dst-port=67 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="ACCEPT: ICMP (Ping) from LAN only" \
    in-interface-list=LAN limit=50/5s,2:packet protocol=icmp
add action=accept chain=input comment=\
    "ACCEPT: Strict Management (VLAN 1 only)" dst-address=10.1.11.1 dst-port=\
    22,80,443,8291 in-interface=vlan_1 protocol=tcp src-address=10.1.11.11
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=drop chain=input in-interface-list=WAN src-address=10.0.0.0/8
add action=drop chain=input in-interface-list=WAN src-address=172.16.0.0/12
add action=drop chain=input in-interface-list=WAN src-address=192.168.0.0/16
add action=drop chain=input comment="DROP: All other Input (Catch-All)"
add action=fasttrack-connection chain=forward comment="FASTTRACK: Est/Rel" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "ACCEPT: Established, Related, Untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment=\
    "ACCEPT: All VLANs -> VLAN 3 DNS Server" dst-address=10.1.13.13 dst-port=\
    53 protocol=udp
add action=accept chain=forward comment=\
    "ACCEPT: All VLANs -> VLAN 3 DNS Server" dst-address=10.1.13.13 dst-port=\
    53 protocol=tcp
add action=drop chain=forward comment="DROP: Rogue DNS queries (UDP)" \
    disabled=yes dst-address=!10.1.13.13 dst-port=53 protocol=udp \
    src-address=!10.1.13.13
add action=drop chain=forward comment="DROP: Rogue DNS queries (TCP)" \
    disabled=yes dst-address=!10.1.13.13 dst-port=53 protocol=tcp \
    src-address=!10.1.13.13
add action=accept chain=forward comment=\
    "ACCEPT: VLAN 1 -> VLAN 3 (DNS/Docker)" in-interface=vlan_1 \
    out-interface=vlan_3_docker
add action=accept chain=forward comment="ACCEPT: VLAN 1 -> VLAN 4 (NAS)" \
    in-interface=vlan_1 out-interface=vlan_4_nas
add action=accept chain=forward comment=\
    "ACCEPT: VLAN 1 -> VLAN 1 (Intra-VLAN)" in-interface=vlan_1 \
    out-interface=vlan_1
add action=accept chain=forward comment=\
    "ACCEPT: VLAN 2 -> VLAN 2 (Intra-VLAN)" in-interface=vlan_2 \
    out-interface=vlan_2
add action=drop chain=forward comment="DROP: VLAN 5 -> VLAN 5 (L3 Isolation)" \
    in-interface=vlan_5 out-interface=vlan_5
add action=accept chain=forward comment="ACCEPT: VLANs -> WAN" \
    in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward in-interface-list=WAN src-address=10.0.0.0/8
add action=drop chain=forward in-interface-list=WAN src-address=172.16.0.0/12
add action=drop chain=forward in-interface-list=WAN src-address=\
    192.168.0.0/16
add action=drop chain=forward comment="DROP: Default Deny All Forwarding"
/ip firewall nat
add action=masquerade chain=srcnat comment="NAT: Masquerade LAN to WAN" \
    out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address=!10.1.13.13 dst-port=53 \
    in-interface-list=LAN protocol=udp src-address=!10.1.13.13 to-addresses=\
    10.1.13.13
add action=dst-nat chain=dstnat dst-address=!10.1.13.13 dst-port=53 \
    in-interface-list=LAN protocol=tcp src-address=!10.1.13.13 to-addresses=\
    10.1.13.13
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh address=10.1.11.11/32
set api disabled=yes
set winbox address=10.1.11.11/32
set api-ssl disabled=yes
/system clock
set time-zone-name=America/NY
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-le\
    d,wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive
/tool mac-server
set allowed-interface-list=MGMT
/tool mac-server mac-winbox
set allowed-interface-list=MGMT
/tool mac-server ping
set enabled=no

Layout:

Basically, everything falls to vlan_5 (vlan-id=15) if not assigned/IP/ MAC address bounded.

2

I don't use apple devices so I cannot check if mdns is a hard requirement for time machine backups.
If you want to have mdns working across vlans newer routeros versions have a setting /ip/dns/set mdns-repeat-ifaces=net1,net2,net3 where net1, net2 and net3 would be your vlans.

This makes mdns work cross vlan. That does not mean traffic can flow, only that mdns resources are advertised cross- vlan.

If there is not a strong reason to stay at routeros 6 I would suggest upgrading to ros 7 (LTS). The solution you linked that uses bridge filters is something I would avoid.

3

@subnetmask Check this Brother “Scan to PC” button not working across VLANs/separate networks on RB5009 — mDNS RouterOS 7.20.8 - #7 by Victor_21

4

You need couple of things:

  • An input rule (or rules) accepting traffic to 224.0.0.251, port 5353 for UDP traffic from your consumer vlan
  • A forward rule that allow allowing IP from vlan A to reach IP to VLAN B or specific IP.

An example of rules for connecting guest vlan to printer (normally disabled, just enabled by script)

/ip firewall filter
# ...
add action=accept chain=input comment=allow-guest-printing disabled=yes \
    dst-address=224.0.0.251 dst-port=5353 in-interface=vguest protocol=udp
# End of input...
# Some other forward rules... 192.168.77.8 = printer
add action=accept chain=forward comment=allow-guest-printing disabled=yes \
    dst-address=192.168.77.8 in-interface=vguest
# ... end of forward

And, if need it, the repeater for mDNS across VLANs.

5

still trying to wrap around author's last update here:

Looking for a simpler way out

6

I did try similar rules before but those didn't really help.

Now I tried the below as with the same result:

/ip firewall filter
add action=accept chain=input comment=allow-lan-mdns dst-address=224.0.0.251 dst-port=5353 in-interface-list=LAN protocol=udp

add action=accept chain=forward comment=allow-lan-mdns dst-address=10.1.14.14 in-interface-list=LAN

add action=accept chain=forward comment=allow-lan-mdns dst-address=10.1.11.11 in-interface-list=LAN

# even allowing tcp traffic destined for 5354 Multicast for Apple's Bonjour
add action=accept chain=input comment=allow-lan-mdns dst-address=224.0.0.251 dst-port=5354 in-interface-list=LAN protocol=tcp
7

This might not be applicable as the router is still on routerOS v.6.

So this won't work with routerOS v.6 since mdns functionality was baked in starting v.7.xx ?

8

Unfortunately, this won't work with routerOS v.6 since mdns was baked in starting v.7.xx ?

9

Yep. It won't work with v6.

There were some truly ugly (but clever) hacks before the mdns repeater was added, but they also require v7-only functionality.

Apple stuff pretty much really wants/needs mdns, but as I have seen, they work fine once that's available.

As for doing it on Mikrotik, only enabling the repeater and allowing the advertisements in the firewall are necessary.

I know this is a bit of an aside, but I don't think holding on to v6 is really all that reasonable at this point, unless you have some very specific reason for it.

10

You're tying your hands behind your back to do this in V6. The RB4011 should run V7 just fine, and it should upgrade your config just fine. Up to you, but you also say...

...which is why I point out the using the suggestion mdns-repeat-ifaces solves most of the problem, and it's an upgrade away. Now granted that even with V7, you may have firewall filters to deal with too. But multicast on 224.0.0.0/24 is defined to be link-local, so things like IGMP don't help with mDNS, so this all get to be tricky quickly.

11

Then your best option is for sure to update to v7 and use mDNS repeater function. I do have this working with apple devices and a brother printer (AirPrint) with no issues across vlans.

12

The mdns repeater in Mikrotik is a proper application-level proxy, so it receives on one interface and sends on the other (so no packet forwarding as such is performed.) The application also does proper igmp subscriptions on each interface. The firewall just has to allow it to receive the packets.

13

just saw an opportunity for a tiny cleanup

mDNS multicast traffic does not traverse the "forward" chain.

at: DNS - RouterOS - MikroTik Documentation

so will likely delete the forward chain mdns rule

14

@mikesaxl @Amm0 please see my reply above

15

@lurker888 @jhbarrantes

Apologies for this late reply. Life happened and I got lost.

I picked up where I left the configuration; seeing no way out with my previous config and macvlan not being available on v.6.49.19 I have now jumped ship and upgraded to the latest LTS v.7.21.4 to make this work.

With the below it still isn't working...

  1. enabling mDNS bouncing for both vlan_1 and vlan_4_nas under IP> DNS (tried the entire bridge together with these two..didn't budge)

  2. explicit forwarding between the two MAC address in the access list (macOS and NAS)

  3. with the below firewall/configuration (also tried disabling the 2x "Drop all other input & Drop default deny forwarding" rules from my original config above)

  4. ...even the dns server has a A record for both nas.lan and nas.local pointing to the correct IP (nslookup resolves to both, but macOS simply refuses to ping nas.local whereas nas.lan hops fine). The time machine app simply refuses to connect either to nas.local or nas.lan

Current configuration (did notice few duplicate rules?; might need cleanup):

# RouterOS 7.21.4
/interface bridge
add admin-mac=ADMIN_MAC_ADDRESS auto-mac=no ingress-filtering=no name=bridge \
    port-cost-mode=short vlan-filtering=yes
/interface wireless
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX country=no_country_set disabled=no distance=indoors \
    frequency=auto installation=indoor mode=ap-bridge name=wlan1 \
    skip-dfs-channels=all ssid=SSID_1 wireless-protocol=802.11 wmm-support=\
    enabled wps-mode=disabled
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    country=no_country_set disabled=no distance=indoors frequency=auto \
    installation=indoor mode=ap-bridge name=wlan2 skip-dfs-channels=all ssid=\
    SSID_1 wireless-protocol=802.11 wps-mode=disabled
/interface vlan
add arp=reply-only interface=bridge name=vlan_1 vlan-id=11
add arp=reply-only interface=bridge name=vlan_2 vlan-id=12
add arp=reply-only interface=bridge name=vlan_3_docker vlan-id=13
add arp=reply-only interface=bridge name=vlan_4_nas vlan-id=14
add arp=reply-only interface=bridge name=vlan_5 vlan-id=15
/interface list
add name=WAN
add name=LAN
add name=MGMT
add name=LIST_MDNS_INTERFACE
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk disable-pmkid=yes \
    management-protection=allowed mode=dynamic-keys supplicant-identity=\
    MikroTik
add authentication-types=wpa2-psk disable-pmkid=yes management-protection=\
    allowed mode=dynamic-keys name=guest-profile supplicant-identity=MikroTik
/interface wireless
add default-forwarding=no disabled=no keepalive-frames=disabled mac-address=\
    WLAN_MAC_ADDRESS_1 master-interface=wlan1 multicast-buffering=disabled \
    name=wlan1-guest security-profile=guest-profile ssid=SSID_2 \
    wps-mode=disabled
add default-forwarding=no disabled=no keepalive-frames=disabled mac-address=\
    WLAN_MAC_ADDRESS_2 master-interface=wlan2 multicast-buffering=disabled \
    name=wlan2-guest security-profile=guest-profile ssid=SSID_2 \
    wps-mode=disabled
/ip dhcp-server
add add-arp=yes interface=vlan_1 lease-time=1d name=dhcp_vlan1
add add-arp=yes interface=vlan_2 lease-time=1d name=dhcp_vlan2
add add-arp=yes interface=vlan_3_docker lease-time=1d name=dhcp_vlan3_docker
add add-arp=yes interface=vlan_4_nas lease-time=1d name=dhcp_vlan4_nas
/ip pool
add name=pool_vlan5 ranges=10.1.15.10-10.1.15.254
/ip dhcp-server
add add-arp=yes address-pool=pool_vlan5 interface=vlan_5 lease-time=1d name=\
    dhcp_vlan5
/ip smb users
set [ find default=yes ] disabled=yes
/routing bgp template
set default as=65530 disabled=no name=default output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/interface bridge port
add bridge=bridge ingress-filtering=no interface=ether8 internal-path-cost=10 \
    path-cost=10 pvid=11
add bridge=bridge ingress-filtering=no interface=wlan1 internal-path-cost=10 \
    path-cost=10 pvid=15
add bridge=bridge ingress-filtering=no interface=wlan2 internal-path-cost=10 \
    path-cost=10 pvid=15
add bridge=bridge ingress-filtering=no interface=wlan1-guest \
    internal-path-cost=10 path-cost=10 pvid=15
add bridge=bridge ingress-filtering=no interface=wlan2-guest \
    internal-path-cost=10 path-cost=10 pvid=15
add bridge=bridge comment="unused ether2" ingress-filtering=no interface=\
    ether2 internal-path-cost=10 path-cost=10 pvid=15
add bridge=bridge comment="unused ether4" ingress-filtering=no interface=\
    ether4 internal-path-cost=10 path-cost=10 pvid=15
add bridge=bridge comment="unused ether5" ingress-filtering=no interface=\
    ether5 internal-path-cost=10 path-cost=10 pvid=15
add bridge=bridge comment="unused ether7" ingress-filtering=no interface=\
    ether7 internal-path-cost=10 path-cost=10 pvid=15
add bridge=bridge comment=bridge_vlan_3_docker ingress-filtering=no \
    interface=ether3 internal-path-cost=10 path-cost=10 pvid=13
add bridge=bridge comment=bridge_vlan_4_nas ingress-filtering=no interface=\
    ether6 internal-path-cost=10 path-cost=10 pvid=14
add bridge=bridge comment=bridge_vlan_4_nas_2 ingress-filtering=no interface=\
    ether9 internal-path-cost=10 path-cost=10 pvid=14
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192 soft-max-neighbor-entries=8191
/interface bridge vlan
add bridge=bridge tagged=bridge,wlan1,wlan2 untagged=ether8 vlan-ids=11
add bridge=bridge tagged=bridge,wlan1,wlan2 vlan-ids=12
add bridge=bridge tagged=bridge,wlan1,wlan2 untagged=ether3 vlan-ids=13
add bridge=bridge tagged=bridge,wlan1,wlan2 untagged=ether6,ether9 vlan-ids=\
    14
add bridge=bridge tagged=bridge untagged=\
    wlan1,wlan2,wlan1-guest,wlan2-guest,ether2,ether4,ether5,ether7 vlan-ids=\
    15
/interface list member
add interface=ether1 list=WAN
add interface=vlan_1 list=LAN
add interface=vlan_1 list=MGMT
add interface=vlan_2 list=LAN
add interface=vlan_3_docker list=LAN
add interface=vlan_4_nas list=LAN
add interface=vlan_5 list=LAN
add interface=ether8 list=MGMT
add interface=vlan_1 list=LIST_MDNS_INTERFACE
add interface=vlan_4_nas list=LIST_MDNS_INTERFACE
/interface ovpn-server server
add auth=sha1,md5 mac-address=OVPN_MAC_ADDRESS name=ovpn-server1
/interface wireless access-list
add mac-address=MAC_ADDRESS_1 vlan-id=11 vlan-mode=use-tag
add mac-address=MAC_ADDRESS_2 vlan-id=11 vlan-mode=use-tag
add forwarding=no mac-address=MAC_ADDRESS_3 vlan-id=11 vlan-mode=use-tag
add mac-address=MAC_ADDRESS_4 vlan-id=12 vlan-mode=use-tag
add mac-address=MAC_ADDRESS_5 vlan-id=12 vlan-mode=use-tag
/ip address
add address=10.1.11.1/24 interface=vlan_1 network=10.1.11.0
add address=10.1.12.1/24 interface=vlan_2 network=10.1.12.0
add address=10.1.13.1/24 interface=vlan_3_docker network=10.1.13.0
add address=10.1.14.1/24 interface=vlan_4_nas network=10.1.14.0
add address=10.1.15.1/24 interface=vlan_5 network=10.1.15.0
/ip dhcp-client
add interface=ether1 use-peer-dns=no
/ip dhcp-server lease
add address=10.1.11.11 mac-address=MAC_ADDRESS_1 server=dhcp_vlan1
add address=10.1.13.13 mac-address=MAC_ADDRESS_DOCKER server=dhcp_vlan3_docker
add address=10.1.14.14 mac-address=MAC_ADDRESS_NAS server=dhcp_vlan4_nas
add address=10.1.11.20 mac-address=MAC_ADDRESS_2 server=dhcp_vlan1
add address=10.1.11.21 mac-address=MAC_ADDRESS_3 server=dhcp_vlan1
add address=10.1.12.20 mac-address=MAC_ADDRESS_4 server=dhcp_vlan2
add address=10.1.12.22 mac-address=MAC_ADDRESS_5 server=dhcp_vlan2
/ip dhcp-server network
add address=10.1.11.0/24 dns-server=10.1.13.13 gateway=10.1.11.1
add address=10.1.12.0/24 dns-server=10.1.13.13 gateway=10.1.12.1
add address=10.1.13.0/24 dns-server=10.1.13.1 gateway=10.1.13.1
add address=10.1.14.0/24 dns-server=10.1.13.13 gateway=10.1.14.1
add address=10.1.15.0/24 dns-server=10.1.13.13 gateway=10.1.15.1
/ip dns
set mdns-repeat-ifaces=vlan_1,vlan_4_nas servers=1.1.1.1
/ip firewall filter
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment=\
    "ACCEPT: Established, Related, Untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="DROP: ALL INBOUND WAN INSTANTLY" \
    in-interface-list=WAN
add action=accept chain=input comment="ACCEPT: DHCP Requests from LAN" \
    dst-port=67 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="ACCEPT: ICMP (Ping) from LAN only" \
    in-interface-list=LAN limit=50/5s,2:packet protocol=icmp
add action=accept chain=input comment=\
    "ACCEPT: Strict Management (VLAN 1 only)" dst-address=10.1.11.1 dst-port=\
    22,80,443,8291 in-interface=vlan_1 protocol=tcp src-address=10.1.11.11
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=drop chain=input in-interface-list=WAN src-address=10.0.0.0/8
add action=drop chain=input in-interface-list=WAN src-address=172.16.0.0/12
add action=drop chain=input in-interface-list=WAN src-address=192.168.0.0/16
add action=accept chain=input comment="allow mDNS" dst-address=224.0.0.251 \
    dst-port=5353 in-interface-list=LIST_MDNS_INTERFACE protocol=udp
add action=accept chain=forward comment="allow mDNS" dst-address=224.0.0.251 \
    dst-port=5353 in-interface-list=LIST_MDNS_INTERFACE protocol=udp
add action=accept chain=forward comment="ACCEPT: VLAN 1 -> VLAN 4 (NAS)" \
    in-interface=vlan_1 out-interface=vlan_4_nas
add action=accept chain=forward comment="ACCEPT: VLAN 4 (NAS) -> VLAN 1" \
    in-interface=vlan_4_nas out-interface=vlan_1
add action=drop chain=input comment="DROP: All other Input (Catch-All)"
add action=fasttrack-connection chain=forward comment="FASTTRACK: Est/Rel" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "ACCEPT: Established, Related, Untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment=\
    "ACCEPT: All VLANs -> VLAN 3 DNS Server" dst-address=10.1.13.13 dst-port=\
    53 in-interface-list=LAN protocol=udp
add action=accept chain=forward comment=\
    "ACCEPT: All VLANs -> VLAN 3 DNS Server" dst-address=10.1.13.13 dst-port=\
    53 in-interface-list=LAN protocol=tcp
add action=drop chain=forward comment="DROP: Rogue DNS queries (UDP)" \
    disabled=yes dst-address=!10.1.13.13 dst-port=53 protocol=udp \
    src-address=!10.1.13.13
add action=drop chain=forward comment="DROP: Rogue DNS queries (TCP)" \
    disabled=yes dst-address=!10.1.13.13 dst-port=53 protocol=tcp \
    src-address=!10.1.13.13
add action=accept chain=forward comment=\
    "ACCEPT: VLAN 1 -> VLAN 3 (DNS/Docker)" in-interface=vlan_1 \
    out-interface=vlan_3_docker
add action=accept chain=forward comment=\
    "ACCEPT: VLAN 1 -> VLAN 1 (Intra-VLAN)" in-interface=vlan_1 \
    out-interface=vlan_1
add action=accept chain=forward comment=\
    "ACCEPT: VLAN 2 -> VLAN 2 (Intra-VLAN)" in-interface=vlan_2 \
    out-interface=vlan_2
add action=drop chain=forward comment="DROP: VLAN 5 -> VLAN 5 (L3 Isolation)" \
    in-interface=vlan_5 out-interface=vlan_5
add action=accept chain=forward comment="ACCEPT: VLANs -> WAN" \
    in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward in-interface-list=WAN src-address=10.0.0.0/8
add action=drop chain=forward in-interface-list=WAN src-address=172.16.0.0/12
add action=drop chain=forward in-interface-list=WAN src-address=\
    192.168.0.0/16
add action=drop chain=forward comment="DROP: Default Deny All Forwarding"
/ip firewall nat
add action=masquerade chain=srcnat comment="NAT: Masquerade LAN to WAN" \
    out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address=!10.1.13.13 dst-port=53 \
    in-interface-list=LAN protocol=udp src-address=!10.1.13.13 to-addresses=\
    10.1.13.13
add action=dst-nat chain=dstnat dst-address=!10.1.13.13 dst-port=53 \
    in-interface-list=LAN protocol=tcp src-address=!10.1.13.13 to-addresses=\
    10.1.13.13
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set ssh address=10.1.11.11/32
set telnet disabled=yes
set www disabled=yes
set winbox address=10.1.11.11/32
set api disabled=yes
set api-ssl disabled=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=America/
/system leds
add interface=wlan2 leds="wlan1_signal1-led,wlan1_signal2-led,wlan1_signal3-le\
    d,wlan1_signal4-led,wlan1_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan1_tx-led type=interface-transmit
add interface=wlan2 leds=wlan1_rx-led type=interface-receive
/system package update
set channel=long-term
/tool mac-server
set allowed-interface-list=MGMT
/tool mac-server mac-winbox
set allowed-interface-list=MGMT
/tool mac-server ping
set enabled=no

Update 1: upgraded to latest LTS 7.21.5

16

Life happens to all of us, so no worries there.

There are some things in your config that are a bit strange, but I'm not sure which of these is causing your problem.

You will have to do a bit of old fashioned debugging. First you should find out if mdns is actually being repeted between subnets. You can do this with any of the regular programs that do packet capture - wireshark is a popular option. You can/should also check the counters on your 5353 input rule. It should increase steadily.

The other part is allowing the actual traffic between the devices.

And then comes one of the frustrating reasons: many mdns enabled devices have a default firewall that only allows connections from their own subnet. Manufacturers seem to assume that people only have single lan setups. You have the best chance of finding out whether your devices are like this by googling.

Many os drivers simply assume that they shouldn't add out of subnet devices automatically. Usually these can be added manually.

17

I decided to step back and just go for independent SSIDs for the purposes I am trying to solve.

Let's see how that goes.