WARNING - Why is SSH setup without crypto, what is the purpose???
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
{ Another error just noted, is incorrect = /ip address
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0 it should be the bridge for your config setup }
However I am suggesting an alternative approach }
{ Another error noted, REMOVE the IP DHCP client (warning message indicates an issue) it is NOT required as the dhcp client is handled already in pppoe-client settings!! }
/ip dhcp-client
DHCP client can not run on slave interface!
add disabled=no interface=ether1
{ Missing is pppoe-1 as a WAN interface list member }
{ Format for destination nat is **dst-**port = )
{ Also why is this lease time set to 10 seconds, recommend at least 1 day ???
add address-pool=dhcp_pool2 disabled=no interface=vlan10ETH3 lease-time=10s \ }
{ Firewall rules, many small errors, the big one is Port Forwarding DST nat rules dont belong in the input chain! }
In general, there should be a trusted subnet.
It can be the LAN subnet on the RB4011, it could be vlan10 for example or you can add one.
It should be one that your PC is normally connected to as you configure the devices from this pc.
All attached smart devices (such as APs and Switches that can read vlan tags such as the RB95 ) should have an IP address from this subnet.
The solution I would find easiest to implement is to add vlan11
This will be the home vlan currently your 192.168.1.0 subnet.
Router: BEFORE you start, recommend both firmwares should be the same if possible.
***** I include only changed portions for the most part****
# model = RB4011iGS+5HacQ2HnD
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment=LAN
set [ find default-name=ether3 ] comment="VLAN PRUEBAS"
set [ find default-name=ether4 ] comment=LAN
set [ find default-name=ether5 ] comment=LAN
set [ find default-name=ether6 ] comment=LAN
set [ find default-name=ether7 ] comment=LAN
set [ find default-name=ether8 ] comment=LAN
set [ find default-name=ether9 ] comment=LAN
set [ find default-name=ether10 ] comment=eth10-OffBridge
/interface vlan
add interface=ether1 name=vlan6 vlan-id=6
add interface=Puente name=vlanHOME-11 vlan-id-11
add interface=Puente name=vlanCAP-10 vlan-id=10
add name=WAN
add name=LAN
add name=BASE
/interface wireless
/ip pool
add name=dhcp ranges=192.168.1.2-192.168.1.254
add name=dhcp_pool2 ranges=192.168.200.2-192.168.200.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=vlanHome-11 name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface=vlanCAP-10 name=dhcp2
/interface bridge port
add bridge=Puente interface=ether2 pvid=11 ingress-filtering=yes frame-types=admit-priority-and-untagged
add bridge=Puente interface=ether4 pvid=11 ingress-filtering=yes frame-types=admit-priority-and-untagged
add bridge=Puente interface=ether5 pvid=11 ingress-filtering=yes frame-types=admit-priority-and-untagged
add bridge=Puente interface=ether6 pvid=11 ingress-filtering=yes frame-types=admit-priority-and-untagged
add bridge=Puente interface=ether7 pvid=11 ingress-filtering=yes frame-types=admit-priority-and-untagged
add bridge=Puente interface=ether8 pvid=11 ingress-filtering=yes frame-types=admit-priority-and-untagged
add bridge=Puente interface=ether9 pvid=11 ingress-filtering=yes frame-types=admit-priority-and-untagged
add bridge=Puente interface=ether3 ingress-filtering=yes frame-types=admit-only-vlan-tagged
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=Puente tagged=Puente,ether3 vlan-ids=10
add bridge=Puente tagged=Puente,ether3 untagged=ether2,ether4,ether5,ether6,ether7,ether8,ether9 vlan-ids=11
/interface list member
add interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add interface=vlanCAP-10 list=LAN
add interface=vlanHOME-11 list=LAN
add interface=vlanHOME-11 list=BASE
add interface=eth10-OffBridge list=BASE
/interface wireless cap
set bridge=Puente discovery-interfaces=Puente enabled=yes interfaces=\ { maybe vlan10 here is what is needed ?? }
wlan1,wlan2
/ip address
add address=192.168.1.1/24 interface=vlanHOME-11 network=192.168.1.0
add address=192.168.200.1/24 interface=vlanCAP-10 network=192.168.200.0
add address=192.168.5.1/24 interface=ether10-OffBridge
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.1.1
add address=192.168.200.0/24 dns-server=192.168.200.1 gateway=192.168.200.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall filter
{Input Chain}
add action=accept chain=input comment=\
"Regla para aceptar solo las conexiones relacionadas establecidas y untracked:" \
connection-state=established,related,untracked
add action=drop chain=input comment="Regla para denegar conexiones invalidas" \
connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input in-interface-list=BASE comment=\
"Regla para aceptar el trafico que viene de nuestra BASE" \
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=tcp comment=\
"Regla para aceptar el trafico LAN para DNS TCP" \
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=UDP comment=\
"Regla para aceptar el trafico LAN para DNS UDP" \
add action=drop chain=input comment="Drop all else"
{Forward Chain}
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment=\
"Regla para aceptar solo las conexiones relacionadas establecidas y untracked" \
connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid comment=\
"Regla para denegar conexiones invalidas"
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN comment=\
"Regla para aceptar el trafico que saldr\E1 l'internet que viene de LAN" \
add action=accept chain=input connection-state=dstnat comment=\
"entrar lo que este en DST-NAT"
add action=drop comment="Drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1
add action=dst-nat chain=dstnat in-interface=pppoe-out1 dst-port=5000 protocol=\
tcp to-addresses=192.168.1.18
add action=dst-nat chain=dstnat in-interface=pppoe-out1 dst-port=6281 protocol=\
tcp to-addresses=192.168.1.18
add action=dst-nat chain=dstnat in-interface=pppoe-out1 dst-port=6150 protocol=\
tcp to-addresses=192.168.1.40
add action=dst-nat chain=dstnat comment="CAMARA TERRAZA" in-interface=\
pppoe-out1 dst-port=6170,443 protocol=tcp to-addresses=192.168.1.8
/ip ssh
set ????????????
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=BASE
…
The only thing I am not sure about is this line.
_/interface wireless cap
set bridge=Puente discovery-interfaces=Puente enabled=yes interfaces=
wlan1,wlan2_
I am guessing this may what is needed ??
set bridge=Puente discovery-interfaces=vlan10 enabled=yes interfaces=wlan1,wlan2 ???
