I’m having difficulty setting up VLANs to work on my router, mainly DHCP is not working on access ports. I’m well aware that my knowledge is limited. Before someone points me to the other posts I checked the following and many others: 143620 I still can’t wrap my head around the configuration.
I started with default configuration (I know…) and I’d like the following scenario:
eth1 = WAN
sfp, eth2, eth3 = trunk. Switch and access points connect here (different manufacturer, no issues here)
eth4 = access vlan 16
eth5 = access vlan 2
Configuration:
# jan/02/1970 00:33:13 by RouterOS 6.49.8
# software id = 1VVL-D07V
#
# model = RB960PGS
# serial number = 12132132131213
/interface bridge
add admin-mac=99:99:99:99:99:99 auto-mac=no comment=defconf name=bridge \
vlan-filtering=yes
/interface vlan
add interface=bridge name=Machines vlan-id=80
add interface=bridge name=Guest vlan-id=248
add interface=bridge name=Management vlan-id=2
add interface=bridge name=PCs vlan-id=48
add interface=bridge name=Printers vlan-id=32
add interface=bridge name=Servers vlan-id=16
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool1 ranges=10.15.2.70-10.15.2.99
add name=dhcp_pool2 ranges=10.15.50.1-10.15.51.254
add name=dhcp_pool3 ranges=10.15.16.200-10.15.16.230
add name=dhcp_pool4 ranges=10.15.32.200-10.15.32.230
add name=dhcp_pool5 ranges=10.15.80.200-10.15.80.230
add name=dhcp_pool6 ranges=10.15.248.10-10.15.248.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
add address-pool=dhcp_pool1 disabled=no interface=Management name=\
"Managament DHCP" relay=10.15.2.1
add address-pool=dhcp_pool2 disabled=no interface=PCs name="PCs DHCP" relay=\
10.15.48.1
add address-pool=dhcp_pool3 disabled=no interface=Servers name="Servers DHCP" \
relay=10.15.16.1
add address-pool=dhcp_pool4 disabled=no interface=Printers name=\
"Printers DHCP" relay=10.15.32.1
add address-pool=dhcp_pool5 disabled=no interface=Machines name="Machines DHCP" \
relay=10.15.80.1
add address-pool=dhcp_pool6 disabled=no interface=Guest name="Guest DHCP" \
relay=10.15.248.1
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4 pvid=16
add bridge=bridge comment=defconf interface=ether5 pvid=2
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=ether2,ether3,bridge untagged=ether5 vlan-ids=2
add bridge=bridge tagged=ether2,ether3,bridge untagged=ether4 vlan-ids=16
add bridge=bridge tagged=ether2,ether3,bridge vlan-ids=32
add bridge=bridge tagged=ether2,ether3,bridge vlan-ids=48
add bridge=bridge tagged=ether2,ether3,bridge vlan-ids=80
add bridge=bridge tagged=ether2,ether3,bridge vlan-ids=248
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.15.2.1/24 interface=Management network=10.15.2.0
add address=10.15.16.1/24 interface=Servers network=10.15.16.0
add address=10.15.32.1/24 interface=Printers network=10.15.32.0
add address=10.15.48.1/22 interface=PCs network=10.15.48.0
add address=10.15.80.1/24 interface=Machines network=10.15.80.0
add address=10.15.248.1/24 interface=Guest network=10.15.248.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=10.15.2.0/24 dns-server=10.1.16.10,10.1.16.40 domain=example.com \
gateway=10.15.2.1
add address=10.15.16.0/24 dns-server=10.1.16.10,10.1.16.40 domain=example.com \
gateway=10.15.16.1
add address=10.15.32.0/24 dns-server=10.1.16.10,10.1.16.40 domain=example.com \
gateway=10.15.32.1
add address=10.15.48.0/22 dns-server=10.1.16.10,10.1.16.40 domain=example.com \
gateway=10.15.48.1
add address=10.15.80.0/24 dns-server=10.1.16.10,10.1.16.40 domain=example.com \
gateway=10.15.80.1
add address=10.15.248.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=10.15.248.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN