VLAN Filtering stops DHCP

Rackit · November 15, 2017, 3:06pm

I have been working on trying to get Access ports working on a CRS326 ROS 6.41rc52. I cannot believe this is so hard. I am trying to figure out what I am doing wrong. Any help or CRS3xx example would be helpful. I have been through the wiki and gotten this far.

I have tagging on trunk ports (3 and 4) and untagged on ether16 for vlan 10. With no vlan filtering I can access all 3 vlans with the correct Ip addresses but I cannot obtain an ip address from vlan 10 dhcp scope on ether16.
When I select vlan filtering in the bridge, I lose the connectivity to anything on the trunk ports (3 and 4) and ether16.

[admin@MikroTik] > interface bridge vlan print
Flags: X - disabled, D - dynamic 
 #   BRIDGE                 VLAN-IDS  CURRENT-TAGGED                CURRENT-UNTAGGED               
 0   bridge1                10        ether3UNIFI01                 ether16                        
                                      ether4UNIFI02                
 1   bridge1                30        ether3UNIFI01                
                                      ether4UNIFI02                
 2   bridge1                20        ether3UNIFI01                
                                      ether4UNIFI02                
 3 D bridge1                1                                       bridge1                        
                                                                    ether3UNIFI01                  
                                                                    ether4UNIFI02                  
                                                                    ether2LAN                      
                                                                    ether15

Export

# nov/15/2017 09:49:47 by RouterOS 6.41rc52
# software id = X7SE-9JFU
#
# model = CRS326-24G-2S+
# serial number = 763D0727DCAE
/interface bridge
add igmp-snooping=yes name=bridge1 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1WANFW
set [ find default-name=ether2 ] name=ether2LAN
set [ find default-name=ether3 ] name=ether3UNIFI01
set [ find default-name=ether4 ] name=ether4UNIFI02
/interface vlan
add interface=bridge1 name=vlan10Raven vlan-id=10
add interface=bridge1 name=vlan20Rasputin vlan-id=20
add interface=bridge1 name=vlan30Razzor vlan-id=30
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp_pool6 ranges=10.1.1.26-10.1.1.254
add name=dhcp_pool7 ranges=10.1.10.26-10.1.10.254
add name=dhcp_pool8 ranges=10.1.20.26-10.1.20.254
add name=dhcp_pool9 ranges=10.1.30.26-10.1.30.254
/ip dhcp-server
add address-pool=dhcp_pool6 disabled=no interface=bridge1 name=dhcp1
add address-pool=dhcp_pool7 disabled=no interface=vlan10Raven name=dhcp2
add address-pool=dhcp_pool8 disabled=no interface=vlan20Rasputin name=dhcp3
add address-pool=dhcp_pool9 disabled=no interface=vlan30Razzor name=dhcp4
/interface bridge port
add bridge=bridge1 interface=ether3UNIFI01
add bridge=bridge1 interface=ether4UNIFI02
add bridge=bridge1 interface=ether16 pvid=10
add bridge=bridge1 interface=ether2LAN
add bridge=bridge1 interface=ether15
/interface bridge vlan
add bridge=bridge1 tagged=ether3UNIFI01,ether4UNIFI02 untagged=ether16 vlan-ids=10
add bridge=bridge1 tagged=ether3UNIFI01,ether4UNIFI02 vlan-ids=30
add bridge=bridge1 tagged=ether3UNIFI01,ether4UNIFI02 vlan-ids=20
/ip address
add address=10.1.2.1/24 interface=ether1WANFW network=10.1.2.0
add address=10.1.1.1/24 interface=bridge1 network=10.1.1.0
add address=10.1.10.1/24 interface=vlan10Raven network=10.1.10.0
add address=10.1.20.1/24 interface=vlan20Rasputin network=10.1.20.0
add address=10.1.30.1/24 interface=vlan30Razzor network=10.1.30.0
/ip dhcp-server network
add address=10.1.1.0/24 gateway=10.1.1.1
add address=10.1.10.0/24 gateway=10.1.10.1
add address=10.1.20.0/24 gateway=10.1.20.1
add address=10.1.30.0/24 gateway=10.1.30.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1WANFW
/ip route
add distance=1 gateway=10.1.2.2

Phaere · November 15, 2017, 4:00pm

DHCP processed by CPU, if you want to see VLAN traffic on CPU, add bridge1 to tagged interfaces on needed VLAN.

Rackit · November 15, 2017, 4:47pm

Thanks. I added and when I select VLAN filtering on the bridge, I am now able to get a VLAN10 address from port 16. Progress!

However I cannot access the internet, when I select vlan filtering, it impacts my wan connection-no access. Any ideas?

 [admin@MikroTik] > interface bridge vlan print
Flags: X - disabled, D - dynamic 
 #   BRIDGE                           VLAN-IDS  CURRENT-TAGGED                          CURRENT-UNTAGGED                         
 0   bridge1                          10        bridge1                                 ether16                                  
                                                ether3UNIFI01                           ether15                                  
                                                ether4UNIFI02                          
 1   bridge1                          30        ether3UNIFI01                          
                                                ether4UNIFI02                          
 2   bridge1                          20        ether3UNIFI01                          
                                                ether4UNIFI02                          
 3 D bridge1                          1                                                 bridge1                                  
                                                                                        ether3UNIFI01                            
                                                                                        ether4UNIFI02                            
                                                                                        ether15

Rackit · November 15, 2017, 7:18pm

Update
VLAN filtering is selected
Trunk ports ether3 and 4 assign the correct DHCP scope and they can access the eth1 WAN(internet)which is good.
Access ports 15 and 16 get the correct DHCP scope (GOOD) but cannot access the internet(Boo hoo). If I turn VLAN filtering off these ports can access the internet but are assigned mgmt LAN IP addresses.

Any help or direction is appreciated.

[admin@MikroTik] > interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic, H - hw-offload 
 #     INTERFACE                  BRIDGE                 HW  PVID PRIORITY  PATH-COST INTERNAL-PATH-COST    HORIZON
 0   H ether3UNIFI01              bridge1                yes    1     0x80         10                 10       none
 1   H ether4UNIFI02              bridge1                yes    1     0x80         10                 10       none
 2   H ether16                    bridge1                yes   10     0x80         10                 10       none
 3   H ether2LAN                  bridge1                yes    1     0x80         10                 10       none
 4   H ether15                    bridge1                yes   10     0x80         10                 10       none
[admin@MikroTik] > interface bridge vlan print
Flags: X - disabled, D - dynamic 
 #   BRIDGE                       VLAN-IDS  CURRENT-TAGGED                     CURRENT-UNTAGGED                    
 0   bridge1                      10        bridge1                            ether16                             
                                            ether3UNIFI01                      ether15                             
                                            ether4UNIFI02                     
 1   bridge1                      30        bridge1                           
                                            ether3UNIFI01                     
                                            ether4UNIFI02                     
 2   bridge1                      20        bridge1                           
                                            ether3UNIFI01                     
                                            ether4UNIFI02                     
 3 D bridge1                      1                                            bridge1                             
                                                                               ether3UNIFI01                       
                                                                               ether4UNIFI02                       
                                                                               ether2LAN