Ok, so I did a bit of deleting, and went back to http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 I did a combination of the RoaS and Router-Switch-AP, but they are all pretty similar. Unfortunately, I’m still seeing the same issue as before: the device on ether3 is not in the right VLAN, and everything drops when I enable vlan-filtering on the bridge. [spoiler alert: things changed before I finished writing this post]
Switch config is empty, and bridge config should match my requirements.
[admin@hapac3] > /interface ethernet switch export
# aug/26/2021 22:08:57 by RouterOS 6.48.3
# software id = XXX
#
# model = RBD53iG-5HacD2HnD
# serial number = XXX
[admin@hapac3] > /interface bridge export
# aug/26/2021 22:09:01 by RouterOS 6.48.3
# software id = XXX
#
# model = RBD53iG-5HacD2HnD
# serial number = XXX
/interface bridge
add admin-mac=XXX auto-mac=no comment="CPU port" name=bridge1 protocol-mode=none
/interface bridge port
add bridge=bridge1 comment=defconf interface=wl-3-2g
add bridge=bridge1 comment=defconf interface=wl-3-5g
add bridge=bridge1 interface=ether5
add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=ether2
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether3 pvid=10
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether4 pvid=10
add bridge=bridge1 interface=wl-guest-2g
add bridge=bridge1 interface=wl-guest-5g
The management VLAN is now 99.
[admin@hapac3] > /interface vlan export
# aug/26/2021 22:11:39 by RouterOS 6.48.3
# software id = XXX
#
# model = RBD53iG-5HacD2HnD
# serial number = XXX
/interface vlan
add interface=bridge1 name=vl-dmz vlan-id=2
add interface=bridge1 name=vl-management vlan-id=99
add interface=bridge1 name=vl-trusted vlan-id=3
add interface=bridge1 name=vl-untrusted vlan-id=10
add interface=bridge1 name=vl-work vlan-id=20
For reference, I have multiple DHCP servers running, and the default one still on the bridge itself.
[admin@hapac3] > /ip address export
# aug/26/2021 22:14:20 by RouterOS 6.48.3
# software id = XXX
#
# model = RBD53iG-5HacD2HnD
# serial number = XXX
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge1 network=192.168.88.0
add address=192.168.2.1/24 interface=vl-dmz network=192.168.2.0
add address=192.168.1.1/24 interface=vl-management network=192.168.1.0
add address=192.168.13.1/24 interface=vl-trusted network=192.168.13.0
add address=192.168.10.1/24 interface=vl-untrusted network=192.168.10.0
add address=192.168.20.1/24 interface=vl-work network=192.168.20.0
add address=192.168.99.1 interface=vl-management network=192.168.99.1
[admin@hapac3] > /ip dhcp-server export
# aug/26/2021 22:14:27 by RouterOS 6.48.3
# software id = XXX
#
# model = RBD53iG-5HacD2HnD
# serial number = XXX
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge1 lease-script="/system script run dhcpDnsUpdate" name=dhcp
add address-pool=dp-dmz disabled=no interface=vl-dmz lease-script="/system script run dhcp-dns-update" name=dh-dmz
add address-pool=dp-trusted disabled=no interface=vl-trusted lease-script="/system script run dhcp-dns-update" name=dh-trusted
add address-pool=dp-untrusted disabled=no interface=vl-untrusted lease-script="/system script run dhcp-dns-update" name=dh-untrusted
add address-pool=dp-work disabled=no interface=vl-work lease-script="/system script run dhcp-dns-update" name=dh-work
add address-pool=dp-management disabled=no interface=vl-management lease-script="/system script run dhcpDnsUpdate" name=dh-management
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1 next-server=192.168.88.1 ntp-server=192.168.88.1
add address=192.168.1.0/24 gateway=192.168.1.1 next-server=192.168.1.1 ntp-server=192.168.1.1
add address=192.168.2.0/24 gateway=192.168.2.1 next-server=192.168.2.1 ntp-server=192.168.2.1
add address=192.168.3.0/24 gateway=192.168.3.1 next-server=192.168.3.1 ntp-server=192.168.3.1
add address=192.168.10.0/24 gateway=192.168.10.1 next-server=192.168.10.1 ntp-server=192.168.10.1
add address=192.168.13.0/24 gateway=192.168.13.1 ntp-server=192.168.13.1
dd address=192.168.20.0/24 gateway=192.168.20.1 next-server=192.168.20.1 ntp-server=192.168.20.1
Clients get IPs alright.
[admin@hapac3] > /ip dhcp-server lease print
Flags: X - disabled, R - radius, D - dynamic, B - blocked
# ADDRESS MAC-ADDRESS HOST-NAME SERVER RATE-LIMIT STATUS LAST-SEEN
0 D 192.168.88.237 XX:XX:XX:XX:XX:XX other-device dhcp bound 1m54s
1 D 192.168.88.254 XX:XX:XX:XX:XX:XX laptop dhcp bound 1m38s
2 D 192.168.88.242 XX:XX:XX:XX:XX:XX A dhcp bound 58s
3 D 192.168.13.10 XX:XX:XX:XX:XX:XX C dh-trusted bound 26s
4 D 192.168.2.254 XX:XX:XX:XX:XX:XX D dh-dmz bound 23s
5 D 192.168.10.253 XX:XX:XX:XX:XX:XX B dh-untrusted bound 3m11s
- My laptop accesses the router on Wi-Fi, and gets onto the default DHCP via the bridge, which is expected, and so does the other device.
- Devices B, C, and D are connected to the switch as per my original diagram so the trunk seems to be working ok.
- BUT device A is connected to ether3, which is configured as an untagged port with PVID 10, but it somehow gets an IP address from the default DHCP server, rather than the one on VLAN 10
If I then enable vlan-filtering on the bridge,
[admin@hapac3] > /interface bridge set bridge1 vlan-filtering=yes
…all leases but from the Wi-Fi stop getting renewed.
HOWEVER, I realised I forgot to add the bridge-level VLAN options when reviewing the draft of this post. The following was missing.
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=2
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=3
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=10
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=20
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=99
And all seems to have started working as expected!
[admin@hapac3] > /ip dhcp-server lease print
Flags: X - disabled, R - radius, D - dynamic, B - blocked
# ADDRESS MAC-ADDRESS HOST-NAME SERVER RATE-LIMIT STATUS LAST-SEEN
0 D 192.168.88.237 XX:XX:XX:XX:XX:XX other-device dhcp bound 2m12s
1 D 192.168.88.254 XX:XX:XX:XX:XX:XX laptop dhcp bound 1m56s
2 D 192.168.10.252 XX:XX:XX:XX:XX:XX A dh-untrusted bound 1m30s
3 D 192.168.2.254 XX:XX:XX:XX:XX:XX D dh-dmz bound 27s
4 D 192.168.10.253 XX:XX:XX:XX:XX:XX B dh-untrusted bound 4m18s
5 D 192.168.13.10 XX:XX:XX:XX:XX:XX C dh-trusted bound 17s
[admin@hapac3] > /interface bridge vlan print
Flags: X - disabled, D - dynamic
# BRIDGE VLAN-IDS CURRENT-TAGGED CURRENT-UNTAGGED
0 D bridge1 1 bridge1
wl-3-5g
wl-guest-2g
1 bridge1 2 bridge1
ether2
2 bridge1 3 bridge1
ether2
3 bridge1 10 bridge1 ether3
ether2
4 bridge1 20 bridge1
ether2
5 bridge1 99 bridge1
ether2
For what is worth, the most noticeable difference to what I did before was that the bridge1 interface itself is explicitly tagged on the VLANs.
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=XXX
So my problems look like they were:
- having some stuff hanging on VLAN1 (though I still do, so maybe that’s a red herring),
- forgetting to mark the bridge itself as a tagged interface for all VLAN traffic (that is probably the key thing),
- trying to do VLAN switching with the switch chip (while the Ath8327 supports it, it doesn’t seem to be needed).
This is looking pretty good. I’ll keep and eye on it, and start adding the WLANs to the VLANS, but my problem might just have been solved. I’ll also have to do some performance testing and see how this goes.
PS: For my understanding, why should VLAN1 not be used for management (or at all)? One compelling reason I’ve read is so that other unconfigured devices might be sending tagged traffic to this VLAN by default, thereby making it trivial to get onto the management VLAN. However, it seems VLAN1 might have a more specific role in the case of MikroTik bridges (which @anav seemed to imply, too), what is this role? (I wasn’t able to find any authoritative information about this).