This topip is about VLAN so usefull topic to read is: link.
main router: RB750GL with a Atheros 8327 chip
ether 1: WAN connection
ether 2: trunk to AP/switch
ether 3: trunk to switch
ether 4: trunk to AP/switch
ether 5: maintenace port
Vlan configuration done via /interface/ethernet/switch/vlan (–> reason: Hardware offloading is disabled when using vlan via “bridge Vlan filtering” (reference link)). → not done via bridge VLAN filtering as mention in the VLAN Topic
VLAN 10: main vlan
VLAN xx: iot / guest / …
I now want to create a VLAN100 which gives me the posibility to ‘route’ a direct WAN connection to some ports on my AP/switches (a computer connected to those ports must receive an external WAN IP)
What I dit was to add ether 1 to the LAN Bridge and ether1 is an access port for VLAN100. I changed my DHCP client from ether 1 to VLAN100, I changed the firewall settings and de NAT settings (VLAN100 is the WAN network).
Problem: VLAN100 does not receive an IP (no external IP) and no Internet connection is possible anymore.
You should not mix VLAN configuration under /interface ethernet switch and under /interface bridge. If you want to have it on switch chip, then configuration under bridge is straight forward without VLANs. Do keep VLAN interfaces, they are necessary in any config scenario.
The config you posted looks quite complete to me. You only have to add ports to bridge … it’s necessary even if you configure VLANs on switch chip.
RB750GL has got a decent switch chip (AR8327) and a slow MIPSBE CPU. Much like RB951G which I own a few and work great when VLANs are configured on switch chip directly.
@mkx
I didn’t mix /interface ethernet Switch with /interface bridge (I think) → every port in the bridge settings has the “ingress-filtering=no” (I thought it disables all VLAN settings in the bridge part)
The config you posted looks quite complete to me. You only have to add ports to bridge … it’s necessary even if you configure VLANs on switch chip.
the ports are added to the bridge (ether 1 to ether 4)
Everything works great, when I use Ether 1 as a ‘normal’ WAN port, and the VLAN 10-50 on the Bridge. When I try to create the VLAN100 for the WAN, it breaks.
Indeed ports are bridge members. I missed that due to useless crap of VLAN config (which, BTW, doesn’t do anything because bridge doesn’t have vlan-filtering=yes set … nothing to do with ingress-filtering, that’s another functionality).
I think that setting vlan-mode=fallback on ether1 is not correct for access port. I have it set to vlan-mode=secure and works correctly as access port for set default vlan id.
Also verify this: switch1-cpu port (on my RB951G it’s the last port with index 5, 0-4 are ether1-5) should be set to vlan-mode=secure.
BTW, I always recommend to enable safe mode when changing settings on switch chip … if things go wrong, reset to default config (button press or similar) is the only way to regain management access.
But I still have problem getting IP-adresses from my provider.
I receive 1 IP adres for the main router (on the interface VLAN WAN)
But when I connect a computer on ether 5 then he doesn’t receive an address.
When I do the samen on one of my AP/switches, and I snif on ether1 (via mirrorport to ether 5 and Wireshark), I can see the DHCP discovery messages on ether 1 (so the LAN part looks OK), but I do not see any responses.
Even more strange. When I create an VLAN interface on my HapAC2 (one of the switch/AP) and set a DCHP client, → it receives an IP address (and via Wireshark I can see the differnet DCHP handshaking). When I do the samen on the ohter switch/AP hapAX3, no IP-address, and only a DHCP discovery message is ‘sniffed’.
Verify that ether5 really has index number 3 under /interface ethernet switch port, I’m betting it’s index number 4. Executing command print shows port names instead of indices.
Did you perform “cold boot” of your mikrotik after finalizing configuration? In some rare cases actual configuration of hardware (switch chip) did not match shown config. So actual performance seemed to be erratic.
Cold boot (starting from state with power source disconnected) solved that.