Well we should be talking apples to apples.
Suggest you update your router to 6.43.8 before continuing.
Confirm following
ether2 - connected to managed switch in your diagram, only need vlan5 traffic on this port
ether3 - connected to what looks like an unmanaged switch to connect to PCs only running home network (192.168.88.x)
ether4 - ??
ether5 - ??
You have an additional requirement for users on ether 3, 4, 5 to be able to connect to vlan5 devices?
Did you mean to a specific device or all devices??
I am failing to see why even have a vlan5? If all router users require access to vlan 5 then just make it all one network?
However, I suppose if you want to allow one way traffic only, users to vlan 5 and not the reverse I suppose there may be some merit in that approach.
The same could be accomplished by having a DMZ type LAN off the bridge or in a separate bridge to ensure there is no layer 2 connectivity but allow the router to route traffic between them where appropriate (LAN to DMZ but not the reverse). Which is most efficient in terms of router CPU and performance is above my paygrade.
Okay assuming all on one bridge approach is most efficient…
The following is provided.
Note that until it is confirmed I have assumed that only ether2 is a trunk port and one uncertainty is
how to setup the bridge port. If I put admit tagged frames only I am assuming this means inbound from the managed switch and thus wont prevent Lan traffic to go out of port 2 to the managed switch.)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge
protocol-mode=none vlan-filtering=yes
/interface vlan
add interface=bridge name=vlan5 vlan-id=5
/interface bridge port
add bridge=bridge1 interface=ether2 frames-admit-only-tagged packets ingress-filtering=yes (trunk port connected to managed switch)
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
/interface bridge vlan
add bridge=bridge tagged=bridge, ether2 untagged=ether3, ether4, ether5 vlan-ids=5
/interface list member
add comment=defconf interface=eth1 list=WAN
add interface=bridge list=LAN
add interface=vlan5 list=LAN
/ip dhcp-server
add address-pool=dhcp-HomeLAN disabled=no interface=bridge lease-time=1d
name=HoMeLAN
add address-pool=dhcp_vlan5 disabled=no interface=vlan5
lease-time=1d name=WinpServer
/ip pool
add name=dhcp-HomeLAN ranges=192.168.88.2-192.168.88.100 (for example)
add name=dhcp_vlan5=10.0.2.5-10.0.2.50 (for example)
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
add address=10.0.2.?/24 interface=vlan5 network=10.0.2.? (not sure how to write this one up as your nomenclature is different from what I know)
/ip dhcp-server network
add address=192.168.0.0/24 comment=HomeNetwork dns-server=192.168.0.1 gateway=
192.168.0.1
add address=10.0.2.?/24 comment=WinpNetwork dns-server=10.0.2.?
gateway=10.0.2.?
/IP firewall filter
add action=accept chain=forward comment=
"Allow Port Forwarding " connection-nat-state=dstnat
(you need this rule in the FORWARD chain to allow port forwarding rules to work)
/IP firewall filter
add action=accept chain=forward comment=“LAN to VLAN Access”
src-address=192.168.88.0/24 out-interface=vlan5
(This should allow all LAN computers to access VLAN devices)
/ip firewall nat
add action=dst-nat chain=dstnat comment=WinpAccess-tcp dst-port=4418
in-interface=WAN protocol=tcp to-addresses=10.0.2.5
(if you had a list of allowable external IPs… you would need to create the firewall address list and then modify the rule as follows
add … src-address-list=Allowed_External_Users )
