I am happy user of rb3011 for more a year now and would like to configure VLANs.
What I want to achieve is to separate guest wifi network from home network (home wifi and cable clients)
The additional requirement is that my chromecast and YouTube enabled TV are in home network and should be accessible from guest (this requires broadcast address to go between vlans).
Questions:
My understanding of bridges is that they are kind of lower layer routers. Now I have eth1 as master of eth2-5 and eth6 as master of eth7-10 (I have SFP as WAN). The only bridge that I have consists of eth1, eth6 - remaining eth ports were added automatically. I understand that traffic between eth2 and eth7 is now going through bridge (i.e. not wire speed but still faster than routing).
If I remove bridge, the traffic will be routed and I will be able to add firewall rules (even if both groups are using the same subnet).
My access point is connected to eth10 - as a first step I want to tag all traffic originating from eth10. In interfaces->Vlan menu I created new vlan-guest and added eth10 to it. Should I now remove eth10 from the bridge (it was automatically added there - should I not use eth6 master for it)? Should I add new vlan interface to the bridge (I guess not, because I want to use firewall to filter traffic between these).
I also want to use separate DHCP pool. My router is 10.1.0.0/16 - in this step I want all wifi (vlan-guest) devices to have IP 10.1.2.x and non wifi devices to have 10.1.1.x. I understand that I need to create new pool. The old pool (10.1.1.x) will be assigned to bridge interface (from which I have removed eth10 and didn’t add vlan-guest), and the new pool (10.1.2.x) will be assigned to vlan-guest interface - is that correct?
Finally I will configure my access point to also tag traffic, guest network will be tagged as vlan-guest and will create new vlan-internal for trusted wifi. At this point it should be enough to add this new vlan-internal to bridge interface → it will use then 10.1.1.x dhcp pool and will not be affected by firewal for internal traffic.
For my chromecast/youtube working from guest net I need to allow traffic from/to my chromecasts (lets say 10.1.1.20-25) and 239.255.255.250 (simple service discovery) in the firewall rules.
Bridge is like a switch, they both connect networks. What switch does in hardware, bridge does using software. Hardware is faster, so you want to prefer it, if it’s possible.
If you remove bridge, you’ll end up with two independent network segments. If you use different IP subnet for each, routing will happen automatically. But if you keep the same IP subnet on both, they won’t see each other. So you want to keep your current bridge.
If you have dedicated AP only for guests connected to ether10, then the easiest way would be to set ether10’s master port to none and make it an independent port. Then you’d add another subnet to it and you’d be done. The interfaces you’d use in firewall rules would be bridge1 and ether10.
If you want to use tagged traffic, it’s possible too. But that means your guest AP must be able to work with tagged traffic. If it can, it doesn’t seem to make much sense to add extra vlan to independent port. You can do it, but I don’t see any advantage. You can add vlan on top of bridge1. It will go to all ports then, but it shouldn’t be a problem.
Yes. One subnet stays on bridge, the other one goes to guest port, either independent ether10 or vlan.
If you add vlan-internal, it will be another interface from firewall’s point of view. Unless you bridge it to something, but you can’t really bridge portX with vlan on portX. What you probably want is main LAN untagged and vlan only for guests.
But if you used one independent port for it, it’s possible to have guest LAN in one vlan and main LAN in another vlan (bridged to main LAN bridge) and let AP take care of it
239.x.x.x is multicast, and I must admit that I’m a little ashamed, but I don’t know much about it. I never needed to route it to different subnets.
Also if you want to use vlans, you should probably be able to do it using RB3011’s hardware switch. Unfortunately, I don’t know anything about that either, as I never had an opportunity to play with vlan-capable hw switch on MikroTik device.
That makes a lot of sense - of course router will not try to transmit traffic between switches, when dest IP belongs to the same network. I have a feeling that the configuration I want to achieve is impossible (multicast might never be routed).
It is not dedicated AP for guests, but AP that can broadcast two networks, and tag traffic originating from each network with a VLAN tag.
\
Can I do filtering on the bridge level (there is a Filters tab in bridge menu). This would allow me to have all networks in the same subnet so the multcast should work out of the box, but still allow to do some guest traffic filetering.
I’m almost sure that multicast is routable. I just don’t know how. You should check “multicast” RouterOS package (not installed by default), I guess it could help.
It shouldn’t be a problem then. Set up vlans and tadaaaa…
You can, but AFAIK it only works between bridged ports and if you also use hw switch, bridged ports are only their master ports.
I tested bridge filter and the traffic does not need to originate from master port. Any of them works as long as bridge is involved (i.e. traffic between eth2 and eth3 is not filtered).
I added new vlan, configured it on the AP and seems to be working - I can create a separate rules for guest network.
If I only enable filter 1 (drop all) I cannot communicate from guest network with any local network host (expected).
If I add filter 0 to allow communication with one specific local network host, the communication still does not work.
In order for my configuration to work I need change filter 1 (specify that only IP protocol should be blocked):
After it first worked, I can remove mac-protocol from the filter 1 and the communication continues to work.
I’d rather block all protocols, and specify whitelisted ones - what is else should I unblock? I added unblock rule for arp/rarp protocols, but it seems something else is required.
Thanks, I spent some time and at the end I ended up with pretty cool configuration.
Internal network:
eth1 (master for eth2 - eth5)
eth10 without vlan tag
Guest network:
eth10 with vlan1
External servers:
eth6 (master for eth7 - eth9)
Internal and guest network are connected to a bridge. They are sharing the same /16 network, and guest traffic filtering is done on bridge filters (packets from vlan1 interface are blocked by default, only chromecast related traffic is allowed).
External servers are in a separate /24 network, the traffic between the internal/guest and external is routed. New connections from external servers to internal/guest networks are blocked.