Here is my problem. We are moving over to a mikrotik as our main router device. When I plug in the tagged cable on eth3 and my internet on eth1 it eventually gives me internet throughout my network however it is on the wrong network.
Please ignore the eth2 ramblings here as we are in the process of moving to a more organized (and correct) ip ranges and new vlans. What I am going for right now is that if I plug in a tagged cable into eth3 and my internet into eth1 i get my properly segregated network.
Obvious errors are various /interface vlan and /ip address items being attached to interfaces which are members of a bridge, also ether1 which appears to be the WAN connection being a member of the bridge.
Here is my basic network diagram
Sorry the gentleman who introduced me to the mikrotik world always had me put my wan in the bridge to allow internet to the different ports. Was I misinformed?
So i have completely reloaded back to factory then went through the basic vlan configuration with only changing to my information. (see updated config) I am still not getting the vlan traffic to relay to my dhcp server
Any help is appreciated I am underwater here. newsetup.rsc (3.26 KB)
-Get rid of vlan1 for any data purposes change it to vlan11 for example.
-Firewall rules are very sparse, are you presuming an upstream router is taking care of firewall?
-additionally lack of logic, admin is already part of vlan so input chain rule, for admin interface is useless ( note not supporting current fw structure)
-why the duplicate source nat rules
-missing neighbours discovery which should be set to BASE interface.
-all downstream devices should get their IP address on the Admin subnet.
-Get rid of vlan1 for any data purposes change it to vlan11 for example.
Ok ill make that change
-Firewall rules are very sparse, are you presuming an upstream router is taking care of firewall?
first goal will be getting addresses and internet connection working. Then was going to take care of firewall.
-additionally lack of logic, admin is already part of vlan so input chain rule, for admin interface is useless ( note not supporting current fw structure)
Taken care of
-why the duplicate source nat rules
I only see the one on winbox. with it being a sourcnat masquarade on the wan interface list.
-missing neighbours discovery which should be set to BASE interface.
Done
-all downstream devices should get their IP address on the Admin subnet.
Roger that, my error meant to say duplicate IP routes, not sourcnat.
/ip firewall filter
{Input Chain}
(default rules to keep)
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
(admin rules)
add action=accept chain=input in-interface-list=base src-address-list=Authorized
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
dst-port=53 in-interface-list=vlan protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
dst-port=53 in-interface-list=vlan protocol=tcp
add action=drop chain=input comment=“drop all else”
{forward chain}
(default rules to keep)
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
(admin rules)
add action=accept chain=forward comment=“allow internet traffic” in-interface-list=vlan out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat { disable if not required }
add action=drop chain=forward comment=“drop all else”
Note, although the BASE contains the admin subnet, I never assume that all users on the admin network need access to config the router, hence the src-address-list.
Moreover if at somepoint you includes VPN such as wireguard, you will want to add it the potential for you to config the router remotely and thus the obvious thing to do is add the wireguard interface to BASE. However, if you have multiple road warriors, then the others would not need access to the router and again, hence a source address list.
In any case, this probably suffices for now… add action=accept chain=input in-interface-list=base
