So after years of using single LAN for all devices I decided to separate them with VLANs. I have hAP ac so after checking some tutorials I decided to give it a try. Here is my target setup:
Basically my mobile phone, computer and proxmox servers should use 192.168.1.0 network, IoT devices 192.168.2.0, proxmox VMs either 192.168.5.0 or 192.168.6.0.
I’ve created following basic configuration - it is enough or I should add something more? I’m pretty sure I need to set something under /interface ethernet switch port but I’m not sure what exactly should I put there Of course i will prepare corresponding firewall rules later.
First mistake is mixing apples and oranges, once you have vlans, remove subnet from bridge so it does no dhcp, much less confusing.
Bridge ports are wrong
Not sure why you are even touching ethernet switch settings of any ILK be it ethernet switch vlan or port ???
Clearly you chose the wrong youtube article. :-0
++++++++++++++++++++++++++++++++++
Another pointer… the config is all interconnected, posting only part of the config is not a recipe for success.
Certainly should have the default set of firewall rules on the config before attaching anything to the WWW.
/export file=anynameyouwish (minus router serial n umber, any public WANIP information, keys etc. )
Looking at your config, it looks like you have followed or are applying what I see as “v6” logic to this. Nothing wrong with that at all unless you are running v7 or you want to get this done this year.
To cut a very long story short(er) - Once you go VLAN, you drive those VLAN’s from your bridge menu, in Bridge > VLANs you’ll find you can set tagged and untagged ports per vlan as well in ports you can set pvid for untagged traffic (not that you need to as your additional networks will all be tagged).
Couple of advisories though:
ALWAYS use safe mode, when you think you have VLAN configured and you turn on vlan filtering in bridge as it is needed - first time round you rarely have it configured well so safe mode will bail you out.
If you are tagging all other traffic, change your native vlan to something other than 1, it’s better practise to do this.
I would be tempted to run ether3 and 4 as untagged vlan 5 & 6 respectively, it’s an “easier” config to and your Proxmox setup will be simpler. You’re not gaining anything by having 2 ports with trunked network unless Proxmox is sitting on 3 networks, untagged and the 2 tagged?
I just want to say that I have never been able to get a useful environment using VLANs.
I’ve read the always-recommend post here, reads tons of other articles, watched videos and there is nothing that explains it and instructs in their construction clearly enough.
I don’t know why, and I can’t suggest how to improve it, but, as I leaned in college, graduate school (2 different programs), and decades in business, if I am confused about something, other people are also.
I worked for 5 years with Mikrotik daily and didn’t mnage to grasp VLAN. I have had a 5 year hiatus and then recently only after learning and implementing Cisco VLAN have I gone back over MikroTik VLAN in order to get it right. It’s not the same but the difference was I understood the concepts better. (I maintain Cisco VLAN is so much more natural and less convoluted).
VLANs are easy once you get the hang of it. I am a little odd that I don’t use a bridge in my router at all. However the router is not doing any switch functions - every port is a different LAN or VLAN trunk. All switch functions are done in separate managed switches (CSS326 running SwitchOS).
Couldn’t agree more. Glad to see more people who recognize NYC as the center of the English speaking world and the only non-accented English speakers (
Whether its a hex router with 3 vlans, a hex acting as a switch with X vlans, or my ccr1009 with 20 vlans. All works like butta.
the linked article is gold.
Well, VLAN is a tool … Most people use tools because they have a task to do and certain tools fit the task perfectly (but one has to know different tools reasonably well to identify best tool for certain task). Some people use tools for fun and to learn how to use them properly. And some people use a tool (or two) they are familiar with to perform all sorts of tasks.[*]
So either you never ran into situation which calls for VLANs … or you didn’t see that VLANs are perfect fit and you solved tasks with other networking tricks (perhaps less perfect, but good enough). Or VLANs was not the perfect tool. Or you simply didn’t work the rask properly because of your flakey knowledge of VLANs.
[*] There was a period if time when our BFF @anav answered “use VLANs” to every question. Since he learned about wireguard, he’s split between both answers.
hahaha… listen if you only need two subnets, nothing wrong with one bridge and one separate subnet or two separate subnets and no bridge.
But if you choose any of the above, you are denying yourself the satisfaction of using vlans, and the sense of accomplishment and the ability to lord such skills over the masses, who are clearly inept, incapable or insane.
Of course i will prepare corresponding firewall rules later.
)
)