Not sure is this will be helpful to anyone, but I’ve tried to update the Router-Switch-AP (all in one) to match RoS 7.8 changed commands.
Differences to original:
And I think that’s mostly it. Any comments, suggestions?
RouterSwitchAP.rsc (8.18 KB)
Why is this required?? You already have on the /interface bridge ports, ingress-filtering=yes and frame-types identified ?????
#######################################
#######################################
/interface bridge set BR1 vlan-filtering=yes frame-types=admit-only-vlan-tagged
To be sure ? 
LOL. Well, it shouldn’t have any untagged packets on the bridge if you go “all VLANs”, that just enforces it. But the @pcunite config is pretty well tested, and doesn’t do this.
Setting the PVID of the bridge to an unused VLAN ID is an alternative approach to “blocking” untagged packets. The bridge default is PVID 1, but setting something like 4094 keeps them visible to the router bridge filters if needed. Basically that creates a blackhole for any UNEXPECTED untagged packets, instead of a block from admin-only-vlan-tagged. Basically if you’re not expecting untagged packets on bridge, you’d rather know about it.
Your theories only hurt us practical guys LOL
More practical reasons: one config mistake, your layer 2 winbox options to access the router become harder. And I’m for simplicity, less config changes from defaults is better: there shouldn’t untagged packets if you follow @pcunite & if there were, you’d want to troubleshoot why.
To be clear, you don’t need the PVID change for that – just an alternative approach to frame-type as trunk on bridge IF someone went off the @pcunite track. But that does require a high awareness of how the bridge and the general packet flow operate if you do change it. But also likely do nothing in this config.
I have tried several examples on other boards without success. So far this has been the best I have found. Thank you for putting this together.
I have a RB4011 that I have been using for years. I have an existing configuration customized for VOIP and other requirements, I don’t want to start from scratch. I did not set it back to default. I have followed 3 of the examples, RouterSwitchAP with adjustments from Router, and AccessPoint to add a HAP AC to the RB4011. I have 1 trunk port to the HAP AC instead of all trunk ports.
The RB4011 is successfully running 3 VLAN’s, getting the proper IP address and network. The HAP AC connects with 1 VLAN (the base). When I try to connect to one of the other WAP on the other VLAN’s it does not get a IP address from the router. Using Winbox I can ping the different VLAN addresses on the RB4011 from the HAP AC.
What else can I do to find out why I am not getting an IP address?
Start a new thread on the beginner or general forum
Ensure you post a network diagram and full config
/export file=anynameyouwish ( minus router serial number and any public WANIP information )
As @anav said, please open new topic. And read @anav’s New User Posting For Assistance for good guidelines about “Creating The Perfect Post To Get Assistance!”
This topic is a recipe book, not a cookbook that discusses cooking principles. For the why and background see the MiktoTik documentation.
And I am not sure what all the pronouns in “When I try to connect to one of the other WAP on the other VLAN’s it does not get a IP address from the router.” are referring to, or even where you are trying to connect from. See Getting Answers and at least the last two paragraphs of How to Report Bugs Effectively.
Hi,
Thank you for this comprehensive guide! It helped me a lot in understanding how bridges and VLANS work on RouterOS.
One question: is there any change in behavior when using these configs on RouterOS 7.x? Creating a bridge interface and enabling VLAN filtering through CLI enables ingress-filtering by default on 7.x while 6.x defaults to disabled.
This option has been changed to ‘on’ by default since RouterOS 7.x
As far as I’m aware, the presented configurations work with ROS v7.
While “ingress-filtering=yes” may be the default in some V7…one never knows when defaults change & =yes is required to create an access port. Why still good to be explicit about the showing it in the examples. There is no harm in setting a default value to the same thing via config file.
Disagree, its more important to state WHY ingress filtering=yes is a good idea and why delineating the frame types allowed is a good idea ( with any exceptions 'hybrid port")
The user can then decide/elect to use or not use. Not up to pcunite to prescribe everything.
Wow. Hands down this is THE VERY BEST tutorial and setup guide on VLANS and Mikrotik ROS that I have seen! I attempted to setup VLANs several times before and never could make it work the way I wanted until I read this guide.
@pcunite, THANK YOU for taking the time to put together this comprehensive and organized guide together. I especially like how you break down various different scenarios, document them and provide a sample script for each. The sample diagrams and scripts are what really helped me as I am more of a visual learner/learner by example kind of person. If you have a Patreon or similar please let me know so I can send something your way.
I’m using a single bridge with VLAN filtering, and all the LAN ports are assigned to the bridge.
I get WAN connectivity via PPPoE on a VLAN. The current setup is a VLAN assigned to ether1, which is not a member of the bridge.
Should I assign the WAN ether1 port to the bridge and set the VLAN ID there? Any advantage over my setup?
NO ppoe does its own DHCP setup.
You should not attach the WAN port or VLAN etc, to the bridge.
Also you should ensure IP DHCP client is NOT enabled ( aka should be disabled).
In your case lets say its vlan200. Assign vlan200 to wan ether port lets say ether1
In pppoe settings assign the pppoe interface to VLAN200. Give the PPPOE a name. PPPOE-out1 is the default maybe.
/interface members
add interface=pppoe-out1 list=WAN
add interface=bridge list=LAN
+++++++++++++++++++++++++++
This article is about vlans and bridges so if you have further questions start a new thread.
One thing I did not know and its not clearly written in this thread.
If you set a pvid in /interface bridge port, you do not need to set same port to untagged in /interface bridge vlan. It will show up automatically as current untagged vlan.
So tag a port as untagged ingress, will automatically untag the same port in egress for the same vlan. I have done that manually.
This is true. setting a PVID on bridge port will dynamically create the untagging on a bridge vlan when its needed.
However, I prefer, especially for new users, to manually put the untagging in place on the /interface bridge vlans.
For at least one good reason, the untagging will show up on the config and thus it will be easier to track what the user is attempting to do for troubleshooting purposes.
Without tagging as an observer I am forced to guess whether or not that is what the admin intended, aka do they really understand vlans and bridges.
The second good reason is that even for untagged ports, if vlan it not tagged elswhere on the bridge, the bridge will have to be tagged for this vlan.
If one gets in the habit of “not thinking” about the untagged ports, its easy to miss that the vlan will need to be at least tagged to the bridge even if you dont put in the untagged port.
By the discipline of always including the untagged ports, one is less apt to miss the need to tag the bridge for the vlans in this instance.
It was discussed and the example scripts have a comment noting this behavior.
I’m confused regarding the vlans of the switching equipment themselves.
I get the whole concept of trunk ports, access ports, hybrid ports and currently have my network running from my router itself but I’ll soon be expanding it to have at least one more switch.
Hypothetical scenario.
Router with port 5 as the trunk for 4 vlans (10, 20, 30 and 50 - with 50 being the vlan I want my switches themselves to be a part of for management purposes) to a switch, into port 8.
Port 5 on the router will have vlans 10, 20, 30 and 50 tagged
Port 8 on the switch will have vlans 10, 20, 30, 50 tagged
All other ports will have an untagged vlan based on what I want to have connected to the port, but they’re all irrelevant right now.
In your examples, you have a static IP assigned to the switch, but in your router config, you have a base_vlan dhcp server. But no where can I see where the network knows that the link between port 5 on the router and port 8 on the switch should assign that link to the base vlan (in your case, 99)
Is it as simple as setting up a dhcp server on the vlan interface on the switch and it’ll pick an address up from the base_vlan dhcp server?