VLAN and DHCP Server configuration help

[Panda01]

While what @anav says about ether5 is correct, that if anyone plugs into ether5, they will get an ip address via dhcp, depending on where the router is, and what your requirements are, that may be exactly what you want. One man’s crappy security is another man’s convenience factor (and when you want access in an emergency, trying to remember what ip address you have to set your pc to isn’t what you want to be spending time on). If this is in your home, and you know who will be connecting, I don’t think it is that big of a security issue myself. I mean, if a person has access to the router, all bets are already off.

This is exactly my case. I have the HEX on my desk to learn and play. I want to be able to connect to port 5 and get an ip from the DHCP.
At some point I hope to feel comfortable enought to use Mikrotik products to replace my ISP modem… I want to have an emergency port with DHCP on it.

Visitors should not connect to my network. And if they need access, I should have a Guest WLAN in a seperated and restricted VLAN.

Now to your question. Assuming the config at the end of > post #4 > is your current export, it appears you didn’t make many changes you said you did. This is what your latest post had:

/interface bridge vlan
add bridge=bridge-1 tagged=ether2 vlan-ids=30
add bridge=bridge-1 tagged=ether2 vlan-ids=40

Seems I implemented the changes wrong. I got it now running. see my other post. fresh export, implement changes, hex reset. and copy paste via ssh…

The above has no connection from the CPU (bridge-1) to either vlan 30 or 40. So the dhcp server on the CPU can’t respond. Adding the untagged ports is not a necessity, but makes your intentions explicit and makes reading the config more clear (as to what ports are members of the vlan in question, as well as which are tagged and untagged). If the bridge-1 “cpu port” isn’t specified, that is a valid configuration, it just means that only the members of the the vlan on the switch will be able to communicate with each other. E.g. if you had ports 4 and 5 as access ports to vlan 40, devices connected to ether4 and ether5 would be able to communicate with each other, but not to the CPU. But in your case you do want a connection from ether3 to vlan 30 and a connection from ether4 to vlan40, so the ether (bridge ports) will have access to the internet and dhcp server, therefore you need to add tagged connection via /interface bridge vlan for the bridge-1 “cpu port” that is then “connected” to the /interface vlans (vlan-30 and vlan-40)

Change to the following (to allow a connection from the Router to the “switch”) See > RouterOS bridge mysteries explained

/interface bridge vlan
add bridge=bridge-1 tagged=> bridge-1,> ether2 > untagged=ether3 > vlan-ids=30
add bridge=bridge-1 tagged=> bridge-1,> ether2 > untagged=ether4 > vlan-ids=40

Thank you for the explanation.