I have a fundamental problem… I created two vlan ports (vlan 17 and vlan 89) and I have a DHCP server set up separately for VLANs. For vlan17, the network address is 10.0.17.0/24, and for vlan89 it is 10.0.89.0/24. Both have a range of 100-150 and both vlans are located on port number 1 in the microtic RouterBOARD 750GL router. The WAN port, in turn, is on port number 5 and has network addresses of 10.109.3.0/24. I have a question… How to do it so that were these vlans somehow connected to the WAN port and had access to the network from this port? I set NAT rules for these addresses and used the “masquerade” form, but it didn’t help much, unfortunately. Could any of you help me or help me develop a configuration file for this?
After VLAN is “terminated” on a router (by assigning router an IP address on appropriate VLAN interface), packets don’t have VLAN association any more. It’s up to routing and firewall rules to properly pass packets in any direction (including proper SRC NAT and DST NAT if needed).
Default setup (firewall section in particular) heavily relies on interface list membership (LAN and WAN). These two lists are nothing magical, membership has to be maintained manually. If you didn’t do it, then this may be cause for your problems (but might not be the only one).
It’s impossible to say what your setup might be missing based on your description, we’d need to see the config. Open terminal window, execute /export file=anynameyouwish (add hide-sensitive if your device is running ROS v6), fetch resulting file to your PC, open it with text editor, redact any remaining sensitive data (serial number, any public IP addresses - 10.x.y.z are not, wifi passwords, …). Please keep the comment section on the top of file, it includes exact model name of device you’re using (it may be important). Then copy-paste the config inside [__code] [/code] environment (the in the button bar of forum post editor).
Ensure you choose the correct one for your model.MIPSBE
The other alternative is a two step process, to 7.12 and then to 7.13.3 if you want to use version 7 firmware.
One of the main advantages of vers7 is the ability to use wireguard vpn natively. If that’s not a concern than nothing wrong with 6.4.9.10
You didn’t include info about particular device model.
Anyway, as @Mesquite noted, RSO running is awfully old. So it’s really essential to get up to 6.49.10. Config is based on ancient defaults, so it’s actually sub-optimal in the area I mentioned previously (routing, firewalling). The best would be to install recent ROS version and reconfigure device from scratch, based on modern defaults. And only perform minor adjustments, necessary for multiple VLANs.
Currently you’re using ether1 as WAN interface … any you’re adding two VLANs on that port. The question is how should these VLANs be treated (from security point of view)? Since they are transported over interface, which connects to upstream (and should probably not be trusted), how about VLANs?
Your config of NAT doesn’t make much sense to me. It might be OK, but one would have to know the context much better.