VLAN tagging, untagging

RouterOS General
1

Hi, I’ve been searching the web high and low for tutorials, guides and whatever I could find to help me to no avail.

I’ve been working with VLANs in the past a little bit, I still have problems grasping some details but I get the big picture of VLANs.

What I want to do is, with a 5 port switch :

eth1 - NO VLAN
eth2 - NO VLAN
eth3 - NO VLAN
eth4 - Trunk VLAN 10 and also NO VLAN traffic (to another switch which is in fact a Esxi host)
eth5 - VLAN 10 client

I have 3 normal workstations on ports 1, 2, 3. On port 4 I have a Esxi host hosting 3 clients on a normal network (no VLAN) and 1 Linux client with 2 ethernet interfaces, one interface on the same network as the other VMs (no VLAN), and another interface on another network (VLAN 10).

I want this ethernet interface of this particular VM only to have access to eth5 of my switch. On eth5 I have a modem.

The Linux VM is routing normal traffic through its VLAN 10 interface (modem).

What I found that should get this working as I want is :

  • Remove eth5 from its master so it’s alone
  • create a VLAN interface (VLAN 10) to eth4
  • Create a bridge and add ports eth5 and VLAN 10 to it

But it doesn’t.

I have a hard time understanding how VLANs work with MikroTik, as there’s no tag/untag parameters anywhere.

Can someone help me with my setup?

I would include my config but I don’t know how to see the scripts (I use Winbox) if someone can tell me how I will post them.

Thanks a lot!

2

Found out how to see config, here :

/interface bridge
add l2mtu=1594 name=bridge-vlan10
/interface ethernet
set 0 name=ether1-master-local
set 1 master-port=ether1-master-local name=ether2-slave-local
set 2 master-port=ether1-master-local name=ether3-slave-local
set 3 master-port=ether1-master-local name=ether4-slave-local
set 4 name=ether5
/interface vlan
add interface=ether4-slave-local l2mtu=1594 name=vlan10 vlan-id=10
/interface bridge port
add bridge=bridge-vlan10 interface=ether5
add bridge=bridge-vlan10 interface=vlan10
3

Without a drawing is hard to figure it out.

One thing is vLan on switch and another is vLan inside RouterOS. Good point here, I´ve never seen, but I think should work if you put a switch on eth4 with vLans and setup eth5 to a vlan and make a bridge on eth4,5… if it works, let me know.

In the switch, if you set a port to trunk, I don´t think you can pass anything but vlans packages tagged, the untagged ones will be dropped, so your ideia to pass vLan and no vLans data won´t work.

cheers

4

Here’s a quick plan :

       SWITCH
     _________
    |_|_|_|_|_|
     1 2 3 4 5
     | | | | |
     | | | | |
     | | | | |
    /  | | | |
   /  /  | |  \
  /  /  /  |   \
 /  /  /   |    \
|  |  |    |     \
|  |  |    |      \
|  |  |    |       \
|  |  |    |        \
|  |  |    |         \
PC PC PC  ESXI        MODEM
 |  |  |   |\           |
UT UT UT  UT \          |
 |  |  |   |  \         |
 |  |  |   |   \        |
 |  |  |   |    \       |
 |  |  |   |  VLAN10  VLAN10
 |  |  |   |     |      |
 |  |  |   |     |      |
 |__|__|___|     |______|

I don’t really get what you mean by putting a switch on eth4, I think I only have one switch on this board (RB951G-2HnD).

The split on the ESXI server is 2 networks, one without any VLANs, the other with VLAN 10, both configured on different interfaces on a Linux VM that will work as a router.

5

I removed eth4 from the switch and bridged it instead. I will try the config tonight and see if it works.

6

In your original layout the VLAN was attached to ether4 but ether4 was slaved to ether1 - the VLAN would have to have been attached to ether1. You could then have bridged the VLAN to ether5 which would work, but it would be possible to see the tagged VLAN traffic on ethers1-4 if a device happened to look - so may or may not be a security concern.

7

I tried it last night and still could not get it to work. Here’s the config I tried:

/interface bridge
add l2mtu=1594 name=bridge-vlan10
/interface ethernet
set 0 name=ether1-master-local
set 1 master-port=ether1-master-local name=ether2-slave-local
set 2 master-port=ether1-master-local name=ether3-slave-local
set 3 name=ether4
set 4 name=ether5
/interface vlan
add interface=ether4-slave-local l2mtu=1594 name=vlan10 vlan-id=10
/interface bridge port
add bridge=bridge-vlan10 interface=ether5
add bridge=bridge-vlan10 interface=vlan10

I noticed something though. MTUs of all interfaces, bridges and VLAN are set to 1500 but I have another bridge not shown in my config here to bridge the ports not inside the VLAN (now bridging eth4 too).

The L2MTU of the local bridge and interface eth1-5 is 1598 but the L2MTU of the VLAN and the VLAN bridge is 1594. Should I set the L2MTU of eth4 and 5 to 1594 too?

And also the MAC of the VLAN bridge and the MAC of the VLAN itself is the same as eth4, is this normal?

Here’s the complete config, including the local bridge:

/interface bridge
add admin-mac=00:0C:42:B7:B6:85 ageing-time=5m arp=enabled auto-mac=no disabled=no forward-delay=15s l2mtu=1598 max-message-age=20s mtu=1500 name=bridge-local \
    priority=0x8000 protocol-mode=rstp transmit-hold-count=6
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no forward-delay=15s l2mtu=1594 max-message-age=20s mtu=1500 name=\
    bridge-vlan10 priority=0x8000 protocol-mode=rstp transmit-hold-count=6
/interface ethernet
set 0 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=00:0C:42:B7:B6:84 master-port=none mtu=\
    1500 name=ether1-master-local speed=100Mbps
set 1 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=00:0C:42:B7:B6:85 master-port=\
    ether1-master-local mtu=1500 name=ether2-slave-local speed=100Mbps
set 2 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=00:0C:42:B7:B6:86 master-port=\
    ether1-master-local mtu=1500 name=ether3-slave-local speed=100Mbps
set 3 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=00:0C:42:B7:B6:87 master-port=none mtu=\
    1500 name=ether4 speed=100Mbps
set 4 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=00:0C:42:B7:B6:88 master-port=none mtu=\
    1500 name=ether5 speed=100Mbps
/interface vlan
add arp=enabled disabled=no interface=ether4 l2mtu=1594 mtu=1500 name=vlan10 use-service-tag=no vlan-id=10
/interface ethernet switch
set 0 mirror-source=none mirror-target=none name=switch1
/interface wireless
set 0 adaptive-noise-immunity=none allow-sharedkey=no antenna-gain=0 area="" arp=enabled band=2ghz-onlyn basic-rates-a/g=6Mbps basic-rates-b=1Mbps bridge-mode=\
    enabled channel-width=20/40mhz-ht-above compression=no country=canada default-ap-tx-limit=0 default-authentication=yes default-client-tx-limit=0 \
    default-forwarding=yes dfs-mode=none disable-running-check=no disabled=no disconnect-timeout=3s distance=indoors frame-lifetime=0 frequency=2412 \
    frequency-mode=manual-txpower frequency-offset=0 hide-ssid=no ht-ampdu-priorities=0 ht-amsdu-limit=8192 ht-amsdu-threshold=8192 ht-basic-mcs=\
    mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7 ht-guard-interval=any ht-rxchains=0,1 ht-supported-mcs="mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-\
    8,mcs-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,mcs-18,mcs-19,mcs-20,mcs-21,mcs-22,mcs-23" ht-txchains=0,1 hw-fragmentation-threshold=\
    disabled hw-protection-mode=none hw-protection-threshold=0 hw-retries=7 l2mtu=2290 mac-address=00:0C:42:B7:B6:89 max-station-count=2007 mode=ap-bridge mtu=\
    1500 multicast-helper=default name=wlan1 noise-floor-threshold=default nv2-cell-radius=30 nv2-noise-floor-offset=default nv2-preshared-key="" nv2-qos=\
    default nv2-queue-count=2 nv2-security=disabled on-fail-retry-time=100ms periodic-calibration=default periodic-calibration-interval=60 preamble-mode=both \
    proprietary-extensions=post-2.9.25 radio-name=000C42B7B689 rate-selection=advanced rate-set=default scan-list=default security-profile=default ssid=\
    "Ultra Turbo Fast Internet" station-bridge-clone-mac=00:00:00:00:00:00 supported-rates-a/g=6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps \
    supported-rates-b=1Mbps,2Mbps,5.5Mbps,11Mbps tdma-period-size=2 tx-power-mode=default update-stats-interval=disabled wds-cost-range=50-150 \
    wds-default-bridge=none wds-default-cost=100 wds-ignore-ssid=no wds-mode=disabled wireless-protocol=802.11 wmm-support=disabled
/interface bridge port
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none interface=wlan1 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge-vlan10 disabled=no edge=auto external-fdb=auto horizon=none interface=ether5 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge-vlan10 disabled=no edge=auto external-fdb=auto horizon=none interface=vlan10 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none interface=ether1-master-local path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none interface=ether4 path-cost=10 point-to-point=auto priority=0x80
/interface bridge settings
set use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=no
/interface ethernet switch port
set 0 vlan-header=leave-as-is vlan-mode=disabled
set 1 vlan-header=leave-as-is vlan-mode=disabled
set 2 vlan-header=leave-as-is vlan-mode=disabled
set 3 vlan-header=leave-as-is vlan-mode=disabled
set 4 vlan-header=leave-as-is vlan-mode=disabled
set 5 vlan-header=leave-as-is vlan-mode=disabled
/ip address
add address=10.25.50.3/24 comment="default configuration" disabled=no interface=bridge-local network=10.25.50.0
/queue interface
set ether1-master-local queue=only-hardware-queue
set ether2-slave-local queue=only-hardware-queue
set ether3-slave-local queue=only-hardware-queue
set ether4 queue=only-hardware-queue
set ether5 queue=only-hardware-queue
set wlan1 queue=wireless-default
8

On the Linux client you mentioned 2 Ethernet interfaces. Does it have two actual Ethernet interfaces? Is one of them producing tagged VLAN 10 traffic?

9

The Linux client is a VM inside the ESXI host which will be the router. The VLAN 10 network is configured in ESXI I don’t have anything set in the Linux VM.

10

I think 2fast4youbr meant that you should connect a VLAN capable switch to eth4.

11

OK - but this VLAN 10 is a VLAN virtual interface which will present tagged traffic to the RouterBoard I assume…

Possible the easiest way for you to get to where you want to be is:

  1. Make Ether 4 a slave of Ether 1 again.
  2. Move VLAN 10 interface to Ether 1 (the tagged VLAN will then be available on Ethers 1 - 4.
  3. Bridge VLAN 10 and Ether 5 - that will connected the tagged VLAN traffic with Ether 5 (untagged).
  4. Remove any other bridging.
12

I tried putting the VLAN on the bridge as you suggested and it seems to be working. I gave an IP to the VLAN bridge, could ping it from VLAN10 VM on eth4 and could not ping it from another VM on eth4, and that’s exactly what I want.

Why is it working when I bind the VLAN interface to the bridge bridging eth1-4 but it won’t work when I bind it to eth4 itself?

I will try with my modem this week and see if it’s really working.

Config as of now:

/interface bridge
add l2mtu=1598 name=bridge-local  protocol-mode=rstp
add l2mtu=1594 name=bridge-vlan10 protocol-mode=rstp
/interface wireless
set 0 band=2ghz-onlyn channel-width=20/40mhz-ht-above country=canada disabled=no distance=indoors ht-rxchains=0,1 ht-txchains=0,1 l2mtu=2290 mode=ap-bridge \
    ssid="Ultra Turbo Fast Internet" wireless-protocol=802.11
/interface ethernet
set 0 name=ether1-master-local
set 1 master-port=ether1-master-local name=ether2-slave-local
set 2 master-port=ether1-master-local name=ether3-slave-local
set 3 name=ether4
set 4 name=ether5
/interface vlan
add interface=bridge-local l2mtu=1594 name=vlan10 vlan-id=10
/interface bridge port
add bridge=bridge-local interface=ether1-master-local
add bridge=bridge-local interface=ether4
add bridge=bridge-local interface=wlan1
add bridge=bridge-vlan10 interface=vlan10
add bridge=bridge-vlan10 interface=ether5
13

It’s working with the modem and everything.

I would still like to know if possible why it wasn’t working on eth4?

And if there’s a way that only eth4 see VLAN traffic, at the moment eth1-4 are in the bridge.

Would I have to make a bridge with only eth4 in it and then bridge eth1-3 and the eth4 bridge? Then the VLAN on the eth4 bridge?

I can live with my current setup it’s at home so no big security risk here.

14

Are you actually using the WiFi interface? You didn’t mention it originally.

15

Yes I am using it, sorry for not mentioning it before hand I thought it wasn’t important.

16

Have a look at bridge filters if you want to refine which interface sees which traffic.

17

Olá, Bom dia !
Queria saber como faço uma vlan numa rb 433, que enxergue outras duas rb 433 ?