two internet interfaces and vlan config

snowch · November 12, 2023, 9:47am

I have a basic MikroTik config that has been modified to add two WAN interfaces for my internet connections that are 5g cell phone networks in the UK; EE and Vodafone.

On my home WIFI network I have two SSID’s each having their own VLAN tag, e.g. 10 and 20

My goal is to route to the WAN interface based on the VLAN ID, e.g.

EE_SSID = VLAN10 → wlan_ee
VF_SSID = VLAN20 → wlan_vf

The objective is to allow my family to switch between SSID’s if their current cell connectivity becomes unreliable.

I have tried to do load balancing and failover automatically in the past, but could not get it working satisfactory due to the huge variability in bandwidth depending on how busy the cell network is.

The WIFI network connects to the LAN interface.

Is my goal possible? Can anyone help with the configuration I would need to support my goal?

/interface bridge
add ... comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=wlan_ee
set [ find default-name=ether5 ] name=wlan_vf
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=wlan_ee list=WAN
add interface=wlan_vf list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=wlan_ee
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=Europe/London
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

anav · November 12, 2023, 12:44pm

To confirm.
a. you have TWO WANS for internet (both cellular)
b. the Cell service tends to be spotty at times and thus you want the PEOPLE to be able to switch to the other WAN.
c. you will use two different WLANs to offer this option.

Not a problem
there is no primary or secondary WAN, both should be available for use as decided by which WLAN folks connect to.
Thus this is really a situation of
a. assigning WLANee to WAN1
b. assiging WLANvf to WAN2

anav · November 12, 2023, 12:45pm

What is missing is that you need two subnets! ( and most likely vlans )
What is not clear is whether you are wired to ONE ACCESS POINT or TWO ACCESS POINTs.
The diagram says PLURAL s!! but you only have two WLANS, so clarification is needed.
Furthermore if its to ONE access point, is it a smart access point that can read vlans? Access points generally handle multiple subnets only if they can read vlan tags…
(model of AP or APs??)

You cannot assign the same IP address to two different interfaces…
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0

snowch · November 12, 2023, 1:35pm

my apologies for missing out some info.

I have multiple access points, mostly AX1800. They support multiple SSIDs with each SSID having it’s own optional VLAN ID.

The access points are part of a mesh that is managed by an OC200 cloud controller.

anav · November 12, 2023, 2:28pm

I have something similar but dont use the controller.
So create two vlans vlanEE10 and vlanVF20
192.168.1.0/24
192.168.2.0/24
Trunk the vlans to the ethernet port(s) leading to the AP(s)…

You should have two routes already to the wans either because you have selected - use default route if using IP DHCP client etc.
OR, you have created two routes manually.

Add two tables
add fib name=useEE
add fib name=useVF
Add two routes
add dst-address=0.0.0.0/0 gateway=ISP1gatewayIP table=useEE
add dst-address=0.0.0.0/0 gateway=ISP2gatewayIP table=useVF

Add routing rules.…
add action=lookup-only-in-table dst-address=192.168.1.0/29 table=main comment=“Keep Local Traffic Routed”
add action=lookup-only-in-table src-address=192.168.1.0/24 table=useEE
add action=lookup-only-in-table src-address=192.168.2.0/24 table=useVF

The first rule is needed for any traffic that may be needed between the two subnets so it doesnt go out one of the WANs instead

For vlan setup…
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

snowch · November 12, 2023, 7:54pm

Thanks @anav

I’m now able to connect to a SSID for EE that is configured with a VLAN ID 10 and the client gets an IP address 10.0.10.2. However, the client isn’t able to access the internet.

If I connect to a SSID without a VLAN, the client gets an IP address 192.168.88.x and is able to access the internet.

Any thoughts?

/interface bridge add admin-mac=xxxx auto-mac=no comment=defconf ingress-filtering=no name=bridge vlan-filtering=yes
/interface ethernet set [ find default-name=ether4 ] name=lan
/interface ethernet set [ find default-name=ether1 ] name=wlan_ee
/interface ethernet set [ find default-name=ether5 ] name=wlan_vf
/interface vlan add interface=lan name=vlan_ee vlan-id=10
/interface vlan add interface=lan name=vlan_vf vlan-id=20
/interface list add comment=defconf name=WAN
/interface list add comment=defconf name=LAN
/interface lte apn set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik
/ip pool add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip pool add name=vlan_ee_pool ranges=10.0.10.2-10.0.10.254
/ip dhcp-server add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
/ip dhcp-server add address-pool=vlan_ee_pool interface=vlan_ee lease-time=10m name=vlan_ee_dhcp_server
/routing bgp template set default disabled=no output.network=bgp-networks
/routing ospf instance add disabled=no name=default-v2
/routing ospf area add disabled=yes instance=default-v2 name=backbone-v2
/routing table add fib name=useEE
/routing table add fib name=useVF
/interface bridge port add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
/interface bridge port add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
/interface bridge port add bridge=bridge comment=defconf ingress-filtering=no interface=lan
/ip neighbor discovery-settings set discover-interface-list=LAN
/ip settings set max-neighbor-entries=8192
/ipv6 settings set disable-ipv6=yes max-neighbor-entries=8192
/interface detect-internet set detect-interface-list=WAN internet-interface-list=WAN
/interface list member add comment=defconf interface=bridge list=LAN
/interface list member add interface=wlan_ee list=WAN
/interface list member add interface=wlan_vf list=WAN
/interface ovpn-server server set auth=sha1,md5
/ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
/ip address add address=10.0.10.1/24 interface=vlan_ee network=10.0.10.0
/ip dhcp-client add comment=defconf interface=wlan_ee
/ip dhcp-server network add address=10.0.10.0/24 dns-server=192.168.88.1 gateway=10.0.10.1
/ip dhcp-server network add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns set allow-remote-requests=yes
/ip dns static add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
/ip firewall filter add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
/ip firewall filter add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
/ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
/ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
/ip firewall filter add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
/ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
/ip firewall filter add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
/ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip route add dst-address=0.0.0.0/0 gateway=wlan_ee routing-table=useEE
/ip route add dst-address=0.0.0.0/0 gateway=wlan_vf routing-table=useVF
/routing bfd configuration add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing rule add action=lookup-only-in-table comment="local traffic" dst-address=192.168.88.1/24 table=main
/routing rule add action=lookup-only-in-table src-address=10.0.10.0/24 table=useEE
/routing rule add action=lookup-only-in-table src-address=10.0.20.0/24 table=useVF
/system clock set time-zone-name=Europe/London
/system note set show-at-login=no
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN

anav · November 12, 2023, 8:22pm

Observations

Bad nomenclature to call an etherport a WLAN it will confuse the shit out of everybody.
/interface ethernet set [ find default-name=ether1 ] name=wlan_ee
/interface ethernet set [ find default-name=ether5 ] name=wlan_vf

Instead if you want to name it, ( so its clear that the port is connecting to the ISP and you intend to use for specific WLAN )
name=ether1-WAN-ee
name=ether5-WAN-vf

(2) The Main problem is your mixing apples and oranges, if you are going to use VLANS, use all VLANS, clean simple consistent. EFF the bridge it should not do dhcp just bridging.

/ip dhcp-server add address-pool=default-dhcp interface=vlan_vf lease-time=10m name=defconf
/ip dhcp-server add address-pool=vlan_ee_pool interface=vlan_ee lease-time=10m name=vlan_ee_dhcp_server
/ip address add address=192.168.88.1/24 comment=defconf interface=vlan_vf network=192.168.88.0
/ip address add address=10.0.10.1/24 interface=vlan_ee network=10.0.10.0

(3) What the heck is this… Your ISP is coming in on WIFI ???
/ip dhcp-client add comment=defconf interface=wlan_ee

Oh phuck, got caught by the horrible nameing convention much clearer when stated as:
/ip dhcp-client add comment=defconf interface=ether1-WAN_ee

(4) Interface lists is important to get right. You are missing a vlan should be. (no bridge required)
/interface list members
add interface=ether1-WAN-ee list=WAN
add interface=ether5-WAN-vf list=WAN
add interface=vlan_ee list=LAN
add interface=vlan_vf list=LAN

(5) Set Detect Internet to NONE, known to cause issues.

(6) Your routing rules are incorrect.
/routing rule add action=lookup-only-in-table src-address=10.0.10.0/24 table=useEE
/routing rule add action=lookup-only-in-table src-address=10.0.20.0/24 table=useVF

(7) Error in your config here as well!!
/ip dhcp-server network add address=10.0.10.0/24 dns-server**=192.168.88.1** gateway=10.0.10.1
/ip dhcp-server network add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1

(8) For your routing rules add another one, and the easiest thing to do is COPY the first one as that is the order you want the rule to be added (at the top).
/routing rule add action=lookup-only-in-table comment=“local traffic” dst-address=10.0.10.0/24 table=main

snowch · November 12, 2023, 11:17pm

Thanks so much for the detailed explanation. TBH, I didn’t understand it all - I’m new to VLANs.

Thanks also for the tips for making my configuration more readable.

I’ve tidied things up a bit. I’ve also left the bridge network so that the OC200 can access the internet without having a VLAN.

The wifi connectivity is all working ok, however, I still can’t access the internet - I think it is just the routing but I can’t quite figure it out.

/interface bridge
add admin-mac=xxxx auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1-wlan-ee
set [ find default-name=ether5 ] name=ether5-wlan-vf
set [ find default-name=ether4 ] name=lan
/interface vlan
add interface=lan name=vlan_ee vlan-id=10
add interface=lan name=vlan_vf vlan-id=20
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=vlan_ee_pool ranges=192.168.89.10-192.168.89.254
add name=vlan_vf_pool ranges=192.168.90.10-192.168.90.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
add address-pool=vlan_vf_pool interface=vlan_vf lease-time=10m name=vlan_vf_dhcp_server
add address-pool=vlan_ee_pool interface=vlan_ee lease-time=10m name=vlan_ee_dhcp_server
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/routing table
add fib name=useEE
add fib name=useVF
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=lan
add bridge=bridge comment=defconf interface=ether5-wlan-vf
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1-wlan-ee list=WAN
add interface=vlan_ee list=LAN
add interface=vlan_vf list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.89.1/24 interface=vlan_ee network=192.168.89.0
add address=192.168.90.1/24 interface=vlan_vf network=192.168.90.0
/ip dhcp-client
add comment=defconf interface=ether1-wlan-ee
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
add address=192.168.89.0/24 dns-server=192.168.88.1 gateway=192.168.89.1
add address=192.168.90.0/24 dns-server=192.168.88.1 gateway=192.168.90.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip route
add dst-address=0.0.0.0/0 gateway=ether5-wlan-vf routing-table=useVF
add dst-address=0.0.0.0/0 gateway=ether1-wlan-ee routing-table=useEE
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing rule
add action=lookup-only-in-table dst-address=192.168.88.1/24 table=main
add action=lookup-only-in-table dst-address=192.168.89.1/24 table=main
add action=lookup-only-in-table dst-address=192.168.90.1/24 table=main
add action=lookup-only-in-table src-address=192.168.88.1/24 table=useEE
add action=lookup-only-in-table src-address=192.168.89.1/24 table=useEE
add action=lookup-only-in-table src-address=192.168.90.1/24 table=useVF
/system clock
set time-zone-name=Europe/London
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

anav · November 12, 2023, 11:45pm

You need to clarify your intent…
What do you mean by I’ve also left the bridge network so that the OC200 can access the internet without having a VLAN.
What is OC200.
Where is it located.
Why do you think it needs a bridge network as if that is any better or easier than a vlan once you are using vlans??
Also, you FAILED to describe this requirement and now the config will not cover this item.
Which ISP is it supposed to use, seeing as its probably not connecting via WIFI???

In other words, if you have a device which you dont want to be on either vlan, lets say its connected to to your ether4.
Then, remove ether4 from the bridge and do it directly
/ip address
add address=192.68.200.1/24 interface=ether4 network=192.168.200.0
ip pool
ip dhcp-server
ip-dhcp-server network
interface list member etc…

++++++++++++++++++++++++++++++++++++++++

Im thinking you mean controller…
Well thats another issue, controller and AP probably have to be in the same vlan normally to talk to one another.
The problem you are going to have moving from a flat network is discovery across vlans!!!

Had to come up with similar nonsense for UNIFI… checkout 1-4
https://forum.mikrotik.com/viewtopic.php?t=194646