Vlan Tag injecter

RouterOS Beginner Basics
1

Hi Guys,
I’m reasonably new to this but I am trying to configure my RB750Gr3 to go between my router and my ONT and just inject a vlan tag of 10.

main firewall NAT ect is handled by my router, so only need minimal firewall,

Thanks for any/all advise
Al

2

Assumptions: ether1 will be used to connect to ONT and ether2 will be used to connect to main router.

  1. remove all configuration from RB750Gr3 (reset without configuration)
  2. use winbox to connect to RB … it won’t have any IP address so you’ll have to connect it via MAC address
  3. implement the following configuration:
/interface bridge
add name=VLAN-bridge
/interface vlan
add interface=ether1 name=ether1v10 vlan-id=10
/interface bridge port
# no point in having HW offload active on port ether2, all of traffic needs to travel through CPU anyway
add bridge=VLAN-bridge interface=ether2 hw=no 
add bridge=VLAN-bridge interface=ether1v10

With the configuration above RB will act as tagged-to-untagged converter … everything on ether2 will be untagged and everything on ether1 will be tagged with VLAN ID 10.

Surely the above could be implemented using bridge vlan-filtering, but I don’t see any benefit of doing it that way … the way presented above is quite simpler to set-up.

As the involved ports (ether1 and ether2) only have L2 set-up, you don’t need any firewall there.

If you want to have management access to this device via IP, you can add IP configuration to port ether3 (and use that port to connect RB to your LAN subnet of main router) … either configure DHCP-client on ether3 or add static IP configuration. Or, if you need some more ethernet port for LAN segment, you could actually create another bridge (perhaps named LAN) and add ether3-ether5 to it. Then add IP configuration to “LAN” instead of ether3.
You can add some firewall on management interface if you think it’s necessary to protect RB from LAN users.

3

@mkx: The way presented above is not recommended: https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration#VLAN_in_bridge_with_a_physical_interface
Despite it is easier, vlan filtering on bridge will be safer.

btw: isn’t it weird that there are two practically same questions within few hours? And both had “Layer2 misconfiguration” as a first answer? http://forum.mikrotik.com/t/use-a-routerboard-to-tag-packets-for-a-management-vlan/127497/4

4

Indeed, why not:

  • bridge uplink & downlink interface
  • define vlan on the bridge for management purposes
  • enable “forward to ip firewall” on bridge so transparent firewall can be implemented
5

The way presented in my post is discouraged for a particular reason … which I doubt will kick in in this case. But yes, this kind of setup example should be accompanied by a warning similar to “don’t do it at home, it might explode”.

6

My router is directly connected to the ONT LOL,
Then again most of the persons asking for this type of connection have not yet heard of digital streaming TV and insist of haveing some sort of ISP tv cable settop box that needs special setups to work.