@Zacharias I misunderstood your first comment as a statement that the old wiki documentation was correct. Please accept my apology for the inappropriate response.
If you never plan to use your other ports on the RB750Gr3 to “be” on one of the vlans, then what you have is fine, and probably easier to understand. But what if you need to connect one more thing to your D-Link 10 port switch? If you used the bridge on the RB750Gr3, you could move your Raspberry Pi running Pi-Hole to an available port on the RB750Gr3 since the RPi is probably running “headless”, so where it is physically probably doesn’t matter. As long as the RB750Gr3 port the RPi is connected to has access to the same vlan(s) as it did when connected to the D-Link switch, everything would work identically. In other words, you can use the unused ports on the RB750Gr3 as a logical “extension” to the vlan-aware switch.
Using the bridge is another layer of abstraction between the ports and the CPU. The bridge allows having access to the vlan-aware switch built into the hEX, and then you configure the set of vlans using the “virtual” bridge interface as the base. That builds the “trunk” to the switch ASIC. With ROS you also need to “configure” the internal connections between the CPU and the switch in addition to the bridge port settings.
I am still not sure exactly how the connection from the CPU to a specific port like ether2 works internally. Especially when tagged vlans are being sent.
E.g.
/interface vlan
add interface=ether2 name=GuestWifi vlan-id=30
add interface=ether2 name=LAN vlan-id=10
add interface=ether2 name=Phone vlan-id=40
add interface=ether2 name=Tina-TWORK vlan-id=50
add interface=ether2 name=Wifi vlan-id=20
In other words, I expect that you could do the following, but it won’t behave the way many people would expect it to.
/interface vlan add interface=ether3 name=eth3_tagged_10 vlan-id=10
It would create a new interface eth3_tagged_10 that you could add an ip address to, but it would not be connected in any way to your other tagged vlan 10 on ether2 at layer 2. i.e. it would be on an isolated broadcast domain separate from the vlan 10 on ether2.
The alternative method using the bridge interface, you can have multiple ports on the RB750Gr3 that are members of the same vlan, and you can even have some ports tagged for that vlan and some untagged (access ports).
Then if you wanted to add a second managed switch going in another direction from where the RB750Gr3 is, you could use another port on the RB750Gr3 for a second trunk link going to the new switch, using the same vlans as the other trunk port is using, and have the vlans be the same broadcast domain.
But if you have it working, there isn’t a big need to change it now, it can be done later. But it would probably be easier to do it now if you think you would ever want to, because it is now “fresh” in your mind, and you won’t have to reacquire the context a year from now when you find a need for using another port on the RB750Gr3 to access the existing vlans.
I always configure my ER-Xs using vlans instead of “individual ports removed from switch0” or in MikroTik lingo “ports off the bridge”. It just makes future changes much easier and much more flexible.
It is similar to using a hypervisor between the server hardware and the OS; it allow more flexibility, but has the price of more complexity.
Thank you, Buckeye, you make some valid points. I especially like the idea of being able to free up a port on the switch and move the Pi to port on the MT.
I’ll look into it.
If you want to do this
- under files Backup your config and copy to something off the router
- export file= show-sensitive and copy to something secure off the router (this is not for sharing)
- upgrade to latest stable channel release (as of 2022-03-26 that is v7.1.5), or if you want the bleeding edge testing channel release v7.2rc5
after reboot, test to make sure everything still works as before. VPN, etc.
Then repeat backup/export with new file names
Then login from your off-bridge access port on ether5 to make changes to the bridge (so you don't saw off the branch you are sitting on)
The intent is to chage as little as possible, but since I am new to RouterOS there may be mistakes here, so make sure you have good backup! And hopefully someone else can point out any mistakes before you try. Most of the ideas for this taken from router.rsc from this Switch with a separate router (RoaS) Also from this post in this thread How to create most basic VLAN
#since we are working off bridge, enabling vlan-filtering up front.
/interface bridge add name=BR1 vlan-filtering=yes
ingress behavior
/interface bridge port
Only adding unused ports to bridge at this time. Leave pvid set to default of 1 for ether4 (new trunk to switch). Ether3 will be vlan 10 access port so pvid set to 10
add bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether4
egress behavior
/interface bridge vlan
configure ether4 just like ether 2 was, ether 3 will be an access port for LAN (vlan 10) for RPi to be connected to
add bridge=BR1 tagged=BR1,ether4 untagged=ether3 vlan-ids=10
add bridge=BR1 tagged=BR1,ether4 vlan-ids=20
add bridge=BR1 tagged=BR1,ether4 vlan-ids=30
add bridge=BR1 tagged=BR1,ether4 vlan-ids=40
add bridge=BR1 tagged=BR1,ether4 vlan-ids=50
#Now the part I am least confident about, switching the vlan interfaces from ether5 to BR1 (you may want to make another backup before proceeding)
I am sure this can be done with the CLI, but I don't know the syntax (probably with [ find ...] but I will leave those instructions to someone that knows more about RouterOS scripting than I do.
I did it on my lab router by creating a vlan under my off bridge interface, then using winbox to change the interface
Hopefully by doing this, all the reset of the config will continue to work like it did before. You will have to move the trunk link from ether2 to ether4, then see if things are still working from connections on the D-Link switch. Also you should be able to plug a laptop into ether3 and it should behave like it did when connected to a LAN access port on the D-Link switch.
Anyone have any comments or warnings?
If this works then we can reconfigure ether2 as a trunk port, so you can move the cable from the D-Link switch back to ether2, and you can then reconfigure ether4 to be a spare access port for a wired connection to a vlan of your choice.