Hello all enthusiasts, I have already tried many different configurations and I am kind of stumped, maybe someone will enlighten my life and make me realize what a fool I was
I’ll describe a bit the structure of my wiring.
DHCP router 192.168.0.0/24 (for my understanding i will name it as LAN in bellow description)
I have created a total of 9 VLANs structures:
VLAN10 192.168.10.0/24
VLAN20 192.168.20.0/24
VLAN30 192.168.30.0/24
and so on up to 9.
Now when I am in the router interface I can’t access VLAN20 through the web interface thought https://subdomain.yourdomain.com but I can access directly to ip address like 192.168.20.5:8800 it opens in the web interface and I can work thought server maybe nginx or portainer it doesn’t matter but the idea is that it can.
Even if I directly set forward or input accepted for that network directly and that port so I could not access through the address.
but when I’m out of the network, like a VPN or Tor connection, I can get to the web interface using the full address without a problem.
Now I will try to explain what I would like:
if you are in LAN (you are not in any VLANs interface as all) you can access everywhere (any VLANs interface will response you from any kind of action)
if you are in VLAN 10 or 30,40 you can access to the VLAN 20 of any kind action but VLAN 20 cannot access to others (10,30,40)
because in VLAN20 are servers / virtual machines of any kind.
VLAN 50 and 60 can access only to the internet, nothing inside of LAN or others VLANs
VLAN90 can access anything because its a admin interface which you can manage everyone. (also dedicated ethernet 2)
And also the problem with the web pages what i describe before.
I also got the advice to open tcp and udp port 53 for all due to dns which I did but still did not achieve the result
Thank you so much for any help and especially for your time and patience to help others. I’ve already spent 2 weeks on this and I’m exhausted VLAN_Firewall_update.rsc (18 KB) VLAN_Firewall.rsc (16.8 KB)
You should not be able to access subnets behind the router via your public IP address ( or domain name etc.). If you need to reach servers you would use dstnat rules (port forwarding to do so).
So its not clear what you want to achieve exactly. Do you mean access from external locations, do you meant from internal subnets using domain names.
There are many possibilities and you need to detail them out explicitly.
One mistake is to think there is a magic LAN, no, once you go vlans you go ALL vlans.
Dont make the bridge do anytying but bridge so take your LAN and call it vlan-LAN if you wish.
I am going to call it VHome id=5 and the important part is vlan5 is clearly a trusted vlan as you want to allow it to reach all vlans.
vlans 10,30,40 are in one group because they can access vlan20
vlan50,60 are internet only access.
vlan90 is the admin interface, although its not clear to me why you have differentiated vlan 5 ( or the LAN) and vlan90, they seem to have same access ???
I guess the only difference would be all smart devices downstream get their IP address from vlan90 and vlan5 will NOT have access to vlan90.
Since I dont use capsman I can only provide a config that would work without out. THus I REMOVE datapath and any vlan information from wifi settings, only wifi related settings should be on them.
Remove all bridge filters, not required for this scenario .
Your bridge port and especially /interface bridge vlan rules are a disaster.
Can you please be clear on which ports are supposed to carry many vlans (trunk) or just one vlan (access port).
Remove ip DNS static config line.
Remove all firewall address list entries ( all local subnets), use interface lists instead and only if required based on firewall rules.
What should be clear is that you have so far demonstrated no need for your LAN that is now vlan5 so maybe we can get rid of it!!!
Also there is no where we apply vlans 70.80. or 90 ???
Which port is vlan90 going to???
/ip dhcp-server network
add address=192.168.0.0/24 comment=defconf dns-server=
192.168.0.1,9.9.9.9,9.9.9.11,1.1.1.1 gateway=192.168.0.1 netmask=24
{ if you manually added netmask, remove it }
++++++++++++++++++++++++++++++++++++++++
Once the above is somewhat cleaned up, will focus on firewall rules etc.
For example on this device not sure which wifi exists and which wifi vlans are going to specific ports.
Hello, thank you very much for your efforts and help, I will do these tasks in a moment but now I would like to answer a few of your questions.
Let me clarify my previous question.
It is that when I was in any VLAN I could not access the VLAN20 servers through the domain name but through the IP static and port yes.
Thus for example if I was in VLAN 10 and typed https://portainer.yourhome.net into the browser I was unreachable I was unable to connect but if I typed 192.168.20.10:1856 I was able to connect.
The biggest joke was just that when I used a VPN or TOR browser I was able to connect to the device using the full domain address.
I use these three devices:
Mikrotik-RB5009Pr+S+IN (main router, PPOE connection → Ethernet 1)
Mikrotik-CRS112-8P-4S-IN (switch connected to the router via SFP+)
Mikrotik-cAP ax (Main Wi-Fi, CAps → Ethernet 8)
Thank you for the information regarding that so the LAN will be transformed into a VLAN as well.
On Ethernet 2 it has to be VLAN 90 which can be VLAN5 since the LAN has been transformed into a VLAN it was only that on Ethernet 2 I can control any device on the network from the computer, i.e. management. so for now i used free port ether 7
Yes I am aware that my settings/rules are in a desolate state therefore it is not in the company but in my homelab.
Next I will describe the ports on the router, Ethernet 3 → VLAN 20 server, Ethernet 4 → VLAN 20 server, Ethernet 5 → VLAN 20 server, for now ethernet 6 and 7 are free we can assign VLAN 10. Ethernet 8 → Mikrotik cAP ax providing wifi / capsman which is VLAN 30,40,50,60
sfp-sfpplus1 → connection for Mikrotik CRS112 switch which has trunk on VLAN 10,20,70,80,90 (5) i raname it for my use VHome id=5 to Yggdrasil id=5
If anything is constantly unclear I will be happy to clarify, I really appreciate your support and thank you very much
So at the end i edit the file, so this is how it should looks ?
And i have question for this section:
