VLAN help

RouterOS Beginner Basics
1

I’m definitely a noob to the Mikrotik family…used to working with Nortel ERS switches. I have to say that setting up VLANs is a bit more confusing than the old Nortel equipment, but that’s probably just because I’m new to it. So here’s the issue…

I’m running an RB750GL as my main router. Ether1 is my incoming WAN, ether2 is a trunk to a media center, ether3 will be a trunk to my home office, ether4 trunks to my wireless AP, and ether5 is an access port for a media device in another room. Ether3-5 are slaves to ether2. I was able to get the trunk on ether2 set up (it goes to an RB260GS), but I’m having trouble figuring out how to trunk the same VLANs over to ether5. Essentially, I want to configure ether5 as an access port that will carry the same VLAN as ether2.

Configuration on the 750 is a default install of 6.10, with two VLANs created on ether2. I tried creating the same VLAN on ether5, and configured a DHCP relay on that interface, but the device that’s on that port can’t get an address. I’m further confused by the “Switch” section in the WebFig interface…do I create the VLANs there, or on the Interfaces section (which is where I successfully trunked the router to the 260GS switch)?

Any help is appreciated. Thanks!

RB750GL Vlan + dhcp setup troubles
RB750GL Vlan + dhcp setup troubles
2

Why you need vlan @ home ???

3

I’m running a number of business systems at home and want to keep them separate from my test lab. But why I need VLANs at home isn’t relevant to my question…

4

Are you trying to do the VLANs with the switch chip or with bridges?..

5

I’m looking for the easiest way to set it up. I got my trunk on ether2 set up using the instructions found in this article: http://wiki.mikrotik.com/wiki/SwOS/Router-On-A-Stick

I would assume that I probably want to do it all with the switch chip, but I don’t think that’s what I’ve done as yet.

6

Post your export so I can at least see what you have… VLANs on MikroTik are a little … well… goofy, but once you understand them its not that bad. Basically what your going to want to do is have ether3 to ether5 set with ether2 as their master. Then add all of the VLANs you want to ether2 ONLY. Since ether2 is the master you shouldn’t be adding IPs, DHCP servers, VLANs, or really ANYTHING else on to interfaces other than ether2. You then will use some of the options in the switch menu to actually control what VLANs go where.

Post your export and I’ll help you get it right…

Also post a diagram of what you want coming out of each port… or at least list it… something like

ether2 - 1 Tagged, 3 Tagged, 100 Untagged
ether3 - 3 Tagged, 100 Tagged
ether4 - 100 Untagged
…
etc

so I know exactly what you want on each port.


See: http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features for the switch chip features.

The upside to doing this in the switch chip is that it is near wire speed and doesn’t use the CPU on the box.

7

I’ll post my config as soon as I get home. Thanks!

8

Yep. Sounds good. Just make sure you also post exactly what you want on each port…

9

Ok, attached is my working config.

I know my WAN port (ether1) currently has a private IP address…I’m NAT’d behind my Verizon router at the moment. I’ll be eliminating that in the coming weeks.

Ether2 trunks to an RB260GS that connects to all my media devices. This trunk carries VLANs 1 and 501 (mgmt and mediaLAN, respectively).

Ether3 currently needs to be configured as an access port. My entire home office sits on some unmanaged switches off that port. I’d like to call that VLAN 200. I’ll eventually put a 24 port MikroTik switch back there, at which point I’ll need VLANs 300 (DMZ), 400 (VoIP phones), and 1 trunked back there as well.

Ether4 goes to my Wireless AP (Ubiquiti UAP-AC). I want VLAN 1 (for its mgmt address), 501 (so I can wirelessly add my Wii to the existing pool of media devices on that VLAN), 801 (Internal Wireless), and 901 (guest wireless).

Ether5 is an access point for an AppleTV in a different room. I want VLAN 501 on this port.

I run my own DHCP server - it sits off one of the unmanaged switches connected to Ether3.

The overall IP schema I want to use (for no particular reason) is this:

VLAN 1: 172.16.0.0/28
200: 10.1.150.0/24
300: 172.31.252.0/29
400: 10.22.35.64/28
501: 172.18.0.16/28
801: 10.1.168.0/28
901: 192.168.15.0/27
session.log (7.2 KB)

10

Pretty sure I get it. I’ll look through it after my son goes to bed or early tomorrow.

Sent from my SCH-I545 using Tapatalk

11

Post your export… just just logs… type “/export” and then paste the output into a new message inside of syntax tags.

12

/interface ethernet
set [ find default-name=ether1 ] name=WAN
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether5 ] master-port=ether2
/interface vlan
add interface=ether2 l2mtu=1594 name=Infrastructure vlan-id=1
add interface=ether2 l2mtu=1594 name=MediaLAN vlan-id=501
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=default-dhcp ranges=10.1.150.31-10.1.150.239
/ip dhcp-server
add address-pool=default-dhcp interface=ether2 name=default
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/ip address
add address=10.1.150.254/24 comment=“default configuration” interface=ether2 network=10.1.150.0
add address=172.18.0.30/28 interface=MediaLAN network=172.18.0.16
add address=172.16.0.14/28 interface=ether2 network=172.16.0.0
/ip dhcp-client
add comment=“default configuration” dhcp-options=hostname,clientid disabled=no interface=WAN
/ip dhcp-relay
add dhcp-server=10.1.150.1 disabled=no interface=MediaLAN name=relay1
/ip dhcp-server network
add address=10.1.150.0/24 dns-server=10.1.150.250,10.1.150.1 domain=preissner.us gateway=10.1.150.254 netmask=24
ntp-server=10.1.150.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add chain=input comment=“default configuration” protocol=icmp
add chain=input comment=“default configuration” connection-state=established
add chain=input comment=“default configuration” connection-state=related
add action=drop chain=input comment=“default configuration” in-interface=WAN
add chain=forward comment=“default configuration” connection-state=established
add chain=forward comment=“default configuration” connection-state=related
add action=drop chain=forward comment=“default configuration” connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat comment=“default configuration” out-interface=WAN
add action=dst-nat chain=dstnat dst-port=80 in-interface=WAN protocol=tcp to-addresses=10.1.150.10 to-ports=80
add action=dst-nat chain=dstnat dst-port=443 in-interface=WAN protocol=tcp to-addresses=10.1.150.10 to-ports=443
add action=dst-nat chain=dstnat dst-port=25 in-interface=WAN protocol=tcp to-addresses=10.1.150.249 to-ports=25
add action=dst-nat chain=dstnat dst-port=465 in-interface=WAN protocol=tcp to-addresses=10.1.150.249 to-ports=465
add action=dst-nat chain=dstnat dst-port=587 in-interface=WAN protocol=tcp to-addresses=10.1.150.249 to-ports=587
add action=dst-nat chain=dstnat dst-port=993 in-interface=WAN protocol=tcp to-addresses=10.1.150.249 to-ports=993
/ip service
set telnet disabled=yes
set api disabled=yes
/ip upnp
set allow-disable-external-interface=no
/system clock
set time-zone-name=America/New_York
/system identity
set name=gateway
/system ntp client
set enabled=yes mode=unicast primary-ntp=10.1.150.1
/tool e-mail
set address=10.1.150.249 from=gateway@preissner.us/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2
add interface=ether3
add interface=ether4
add interface=ether5
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2
add interface=ether3
add interface=ether4
add interface=ether5

13

Alright… I’m working on it. Just curious thought… why on earth do you need to actually segregate your home network that much?.. also it seems like your picking just crazy annoying and complex ranges… just my $0.02

-Eric

14

You’ll have to fix the DHCP for whatever you want… but the rest should basically be working.
/interface ethernet
set [ find default-name=ether1 ] name=WAN
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether5 ] master-port=ether2

/interface vlan
add interface=ether2 l2mtu=1594 name=Vlan1 vlan-id=1
add interface=ether2 l2mtu=1594 name=Vlan200 vlan-id=200
add interface=ether2 l2mtu=1594 name=Vlan300 vlan-id=300
add interface=ether2 l2mtu=1594 name=Vlan400 vlan-id=400
add interface=ether2 l2mtu=1594 name=Vlan501 vlan-id=501
add interface=ether2 l2mtu=1594 name=Vlan801 vlan-id=801
add interface=ether2 l2mtu=1594 name=Vlan901 vlan-id=901

/ip pool
add name=vlan200-pool ranges=10.1.150.31-10.1.150.239

/ip dhcp-server
add address-pool=vlan200-pool interface=ether2 name=vlan200-dhcp

/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=WAN

/ip dhcp-relay
add dhcp-server=10.1.150.1 disabled=no interface=MediaLAN name=relay1

/ip dhcp-server network
add address=10.1.150.0/24 dns-server=10.1.150.250,10.1.150.1 domain=preissner.us gateway=10.1.150.254 netmask=24
ntp-server=10.1.150.1

/interface ethernet switch port
add vlan-id=1 switch=switch1 ports=ether2,ether4,cpu
add vlan-id=200 switch=switch1 ports=ether3,cpu
add vlan-id=300 switch=switch1 ports=ether3,cpu
add vlan-id=400 switch=switch1 ports=ether3,cpu
add vlan-id=501 switch=switch1 ports=ether4,ether5,cpu
add vlan-id=801 switch=switch1 ports=ether4,cpu
add vlan-id=901 switch=switch1 ports=ether4,cpu

/interface ethernet switch vlan
set ether2 vlan-mode=secure vlan-header=add-if-missing
set ether3 vlan-mode=secure vlan-header=always-strip default-vlan-id=200
set ether4 vlan-mode=secure vlan-header=add-if-missing
set ether5 vlan-mode=secure vlan-header=always-strip default-vlan-id=501

/ip address
add address=172.16.0.0/28 interface=Vlan1 network=172.16.0.0
add address=10.1.150.0/24 interface=Vlan200 network=10.1.150.0
add address=172.31.252.0/29 interface=Vlan300 network=172.31.252.0
add address=10.22.35.64/28 interface=Vlan400 network=10.22.35.64
add address=172.18.0.16/28 interface=Vlan501 network=172.18.0.16
add address=10.1.168.0/28 interface=Vlan801 network=10.1.168.0
add address=192.168.15.0/27 interface=Vlan901 network=192.168.15.0

/ip firewall filter
add chain=input protocol=icmp
add chain=input connection-state=established
add chain=input connection-state=related
add action=drop chain=input in-interface=WAN

add chain=forward connection-state=established
add chain=forward connection-state=related
add action=drop chain=forward connection-state=invalid

/ip firewall nat
add action=masquerade chain=srcnat comment=“default configuration” out-interface=WAN
add action=dst-nat chain=dstnat dst-port=80 in-interface=WAN protocol=tcp to-addresses=10.1.150.10 to-ports=80
add action=dst-nat chain=dstnat dst-port=443 in-interface=WAN protocol=tcp to-addresses=10.1.150.10 to-ports=443
add action=dst-nat chain=dstnat dst-port=25 in-interface=WAN protocol=tcp to-addresses=10.1.150.249 to-ports=25
add action=dst-nat chain=dstnat dst-port=465 in-interface=WAN protocol=tcp to-addresses=10.1.150.249 to-ports=465
add action=dst-nat chain=dstnat dst-port=587 in-interface=WAN protocol=tcp to-addresses=10.1.150.249 to-ports=587
add action=dst-nat chain=dstnat dst-port=993 in-interface=WAN protocol=tcp to-addresses=10.1.150.249 to-ports=993

15

CISSPs running a business at home tend to have a healthy interest in controls. Personally I would probably dump all use of VLAN 1 and throw some 802.1x in for good measure so the OP isn’t being at all excessive… :wink:

16

I think your problem is that the LAN port are mastered to ether2.

You are trying to config port 5 as if it was independent. When you master ports together only the master port is configurable.

17

Thanks! I’m starting to understand how ROS does this…I’ll probably get the config straightened out tonight (Internet interruptions during the day tend to upset the future Mrs. :open_mouth: )

802.1x is in the roadmap, but I figured I’d go for the low-hanging fruit to start. Next up is EAP-TLS on my internal wireless :sunglasses:

18

Lordzar - Thats actually the point… he is using the switch chip to control the VLANs… not bridges. In order to use the switch chip you set all of them to have the same master port and then use the switch settings to control what goes where.

Sounds good… let me know how it goes.

19

I am having similar issues configuring an RB2011UiAS2HnD. Is there a “clearer” tutorial on how to setup the switching? I have been struggling to understand how to use the switching features vs. the bridge vlan configuration that is shown on the VLAN wiki portion.

Thank you so much!!!

20

Not that I know of. Start a thread and I can try to help you.

Sent from my SCH-I545 using Tapatalk