I’m working on my lab where I have ROS 6.48.1.
Before I had one subnet for all, wifi guest clients and my lab servers. What I did now is separate those with different subnets.
What I did:
-Added new bridge - WIFI
-added new ip pool (10.10.10.10-10.10.10.254)
-added new gw addres for that pool - 10.10.10.1
-added dhcp-server for that address pool
-added wifi1 interface from bridge_local to new WIFI bridge
reconnected/renewed leases for wifi clients, they are now receiving new IPs.
But in some cases I still need communication between 192.168.88.0/24 and 10.10.10.0/24. For example I have a debian server on 192.168.88.150 and want to communicate to a smart home GW which is on 10.10.10.121.
I added a static route on debian server to 10.10.10.0/24 via gw 192.168.88.1
I tried with FW rules on Mikrotik to allow traffic to 10.10.10.0/24 from 192.168.88.150/32
Added static routes on Mikrotik from WIFI bridge to bridge_local and vice versa
I probably did a stupid fail somewhere in between or I misexplained to myself what I want.
Bottom line, wifi clients should be on 10.10.10.0/24, Ethernet clients on 192.168.88.0/24, and still some traffic communication between them.
I apologize if I (probably) opened a new topic which was already discussed.
Hosts in both subnets should not need any special setup (e.g. static route) if your RB is default gateway for both subnets. You probably need to adjust other settings on RB device, such as firewall settings, interface list memberships etc. It’s hard to tell what and how without seeing your current settings. Execute /export hide-sensitive file=anynameyouwish in terminal window, fetch resulting file to management PC, open it in a text editor, redact public IP address (if it’s present in export), wireless passwords. Then post it in [__code] [/code] environment.
No, you can’t “see” what’s in backup file. Configuration export created by executing /export file=myexport.rsc is, OTOH, plain text file and you can easily use its contents when doing some configuration … If you only have backup file, you’ll have to restore device configuration from it, make text export and reset device to factory default again.
A bit complicated for me in that I dont have any vlans associated with my ethernet port to the ISP modem for the purposes of IPTV.
I do have a vlan associated with my WAN port but it is not attached to my bridge, it only is visible in my DHCP client and stops there and its master interface is the etherport.
WHY DO you have management vlan associated with ether1 AND a data vlan on ether1.
So confusing!!
Also most here are a proponent of a single bridge!
(1) I am guessing that IPTV is a different beast and needs to be part of the bridge but how?
What I would do is associate those vlans with the bridge and the management vlan? to ether1 and dhcp client settings.
/interface vlan
add interface=ether1-gateway name=DATA-60 vlan-id=60 ??? PURPOSE??
add interface=one_bridge name=IPTV-62 vlan-id=62
add interface=one_bridge name=IPTV-SW-102 vlan-id=102
add interface=ether1-gateway name=MGMT-4010 vlan-id=4010 ??? PURPOSE??
What I can say is definitely wrong is associating vlans in the bridge port settings, they are not bridge ports (only physical ports and WLANS count)
/interface bridge port
add bridge=IPTV interface=IPTV-62
add bridge=IPTV interface=IPTV-SW-102
Finally, I don’t see have corresponding bridge vlan rules so a whole section of configuration is missing.
Lots of work to do on firewall rules… but first need to sort out the above.
Normally one does ALL input chain and the forward chain but as long as they are grouped together thats good. Removed fluff including all the forward chain rules that looked like dst nat rules.
/ip firewall filter
{input chain}
add action=accept chain=input comment=“default configuration”
connection-state=established
add action=accept chain=input comment=“default configuration”
connection-state=related
add action=drop chain=input comment=“Drop invalid connections”
connection-state=invalid
add action=accept chain=input comment=“default configuration” protocol=icmp
add action=accept chain=input comment=“allow l2tp” dst-port=1701 protocol=udp
add action=accept chain=input comment=“allow pptp” dst-port=1723 protocol=tcp
add action=accept chain=input comment=“allow sstp” dst-port=443 protocol=tcp add action=accept chain=input comment="allow Admin access in-interface=bridge source-address-list=adminIPs add two RULES FOR ALL USERS TO ACCESS DNS service on the router tcp&udp add rule for all users to access NTP service on the router add action=drop chain=input comment=“Drop All else”
One should add the admin access rule FIrst and the last rule otherwise you will lock yourself out of the router.
firewall address list
add address=IPofadminDesktop list=adminIPs
add address=IPofadminLaptop list=adminIPs
add address=IPofIpad list=adminIPs
add address=IPofsmartphone list-adminIPs
(assumed these have been made static entries in your dhcp server lease list).
The above last rule will stop all other traffic from occurring to or from the router.
{forward chain}
add action=accept chain=forward comment=“default configuration”
connection-state=established
add action=accept chain=forward comment=“default configuration”
connection-state=related
add action=drop chain=forward comment=“default configuration”
connection-state=invalid
add action=drop chain=input comment=“Drop invalid connections”
connection-state=invalid
ADD RULES FOR USERS TO ACCESS INTERNET (all users LAN to WAN etc.)
ADD RULES FOR USERS TO ACCESS SHARED DEVICES ( one vlan access to a shared printer on another vlan for example)
add action=log chain=input comment=“Log everything else” log-prefix=
“DROP INPUT”
add action=drop chain=input comment=“Drop everything else”
WHY DO you have management vlan associated with ether1 AND a data vlan on ether1.
I work for an ISP, MGMT vlan is for remote management purposes. If you got a laptop with no ETH port, sometimes you need to be creative.
DATA vlan is for internet access as the description suggests.
(1) I am guessing that IPTV is a different beast and needs to be part of the bridge but how?
What I would do is associate those vlans with the bridge and the management vlan? to ether1 and dhcp client settings.
/interface vlan
add interface=ether1-gateway name=DATA-60 vlan-id=60 ??? PURPOSE??
add interface=one_bridge name=IPTV-62 vlan-id=62
add interface=one_bridge name=IPTV-SW-102 vlan-id=102
add interface=ether1-gateway name=MGMT-4010 vlan-id=4010 ??? PURPOSE??
As said. DATA-60 for DATA access over ISPs DHCP, MGMT vlan for remote management in case I cut myself out of wifi access.
IPTV-62 and IPTV-102 are IPTV vlans. Vlan62 is in trunk on uplink side, eth1. Vlan102 I added (got it working that way, hope it’s the correct way) as vlan that I use further on a mikrotik switch. Vlan interface is on ETH5 which I have as uplink for switch. Default vlan is data, iptv is tagged on switch.
So basic config is ok and in my case I need to tweak only the FW rules?
