Why are Bridge2 Subnet Devices Getting Bridge1 Lan IP on WiFi?

RouterOS General
1

Instead of messing with VLANs, I just segregated ports since I have many open ones. Below are the configs based on the topology flow. Can anyone spot why IoT devices are hopping on WiFi and getting a 192.168.30.x IP on ether2 bridge port?

RB5009>CRS312>CRS328>cAPax 1, 2, and 3.

RB5009

interface bridge
add admin-mac=redacted auto-mac=no comment=LAN.Bridge name=LAN.Bridge
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard-vpn
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=Management
/ip pool
add name=LAN.Pool ranges=192.168.20.10-192.168.20.254
add name=Flint2.Pool ranges=192.168.90.10-192.168.90.254
add name=IoT.Pool ranges=192.168.30.10-192.168.30.254
/ip dhcp-server
add address-pool=LAN.Pool interface=LAN.Bridge lease-time=1d name=LAN.DHCP
# Interface not running
add address-pool=Flint2.Pool interface=ether7 name=Flint.DHCP
add address-pool=IoT.Pool interface=ether6 lease-time=1d name=IoT.DHCP
/system logging action
add email-to=redacted name=EmailAction target=email
/disk settings
set auto-media-interface=LAN.Bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=LAN.Bridge comment=Downlink.CRS312.Ether1 interface=ether2
add bridge=LAN.Bridge comment=defconf interface=ether3
add bridge=LAN.Bridge comment=PP-Ether1.PiHole interface=ether4
add bridge=LAN.Bridge comment=PP.Ether2.HomeAssistant interface=ether5
add bridge=LAN.Bridge comment=PP.Ether18.LaptopDock interface=ether8
add bridge=LAN.Bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=LAN.Bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether7 list=LAN
add interface=ether8 list=Management
add interface=wireguard-vpn list=LAN
add interface=ether6 list=LAN
/interface wireguard peers
add allowed-address=redacted client-allowed-address=::/0 comment= interface=wireguard-vpn name=peer1 public-key="redacted"
add allowed-address=redacted client-allowed-address=::/0 comment= interface=wireguard-vpn name=peer6 public-key="redacted"
/ip address
add address=192.168.20.1/24 comment=LAN.Addresses interface=LAN.Bridge network=192.168.20.0
add address=192.168.90.1/24 comment=Flint.2.Addresses interface=ether7 network=192.168.90.0
add address=10.0.0.1/24 interface=wireguard-vpn network=10.0.0.0
add address=192.168.30.1/24 comment=IoT.Addresses interface=ether6 network=192.168.30.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=ATT.WAN default-route-tables=main interface=ether1
/ip dhcp-server lease
/ip dhcp-server network
add address=192.168.20.0/24 comment=LAN.Network dns-server=192.168.20.12 gateway=192.168.20.1
add address=192.168.30.0/24 comment=IoT.Network dns-server=1.1.1.1,8.8.8.8 gateway=192.168.30.1
add address=192.168.90.0/24 comment=Flint2.Network dns-server=1.1.1.1,8.8.8.8 gateway=192.168.90.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment="Allow WireGuard Handshake" dst-port=13231 protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 in-interface=lo src-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="Allow WireGuard VPN to Route" in-interface=wireguard-vpn
add action=accept chain=forward comment="Allow Home Assistant to IoT Subnet" out-interface=ether7 src-address=192.168.20.11
add action=accept chain=forward comment="Allow IoT .30 Subnet to Internet" out-interface-list=WAN src-address=192.168.30.0/24
add action=drop chain=forward comment="Block Flint2 from initiating talk to Main LAN" in-interface=ether7 out-interface=LAN.Bridge
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="IoT .30 Internet Access" out-interface-list=WAN src-address=192.168.30.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat src-address=192.168.90.0/24
add action=masquerade chain=srcnat comment="Flint 2 Internet Access" src-address=192.168.90.0/24
add action=masquerade chain=srcnat comment="Masquerade WireGuard VPN" src-address=10.0.0.0/24
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set winbox address=192.168.20.0/24,10.0.0.0/24
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=America/Chicago
/system identity
set name=RB5009.CoreRouter
/system logging
add action=EmailAction topics=critical
/system scheduler
add name=RunRebootScript on-event=EmailOnReboot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup
/system script
add dont-require-permissions=no name=EmailOnReboot owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":local count 0;\
    \n:while ([/ping 1.1.1.1 count=1] = 0 && \$count < 30) do={\
    \n    :set count (\$count + 1);\
    \n    :delay 5s;\
    \n}\
    \n/tool e-mail send to=\"redacted\" subject=\"[Alert] RB5009 Power Restored\" body=\"The core router has successfully booted up and internet connectivity is restored.\""
/tool e-mail
set certificate-verification=no from=redacted port=587 server=smtp.protonmail.ch tls=starttls user=redacted
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool netwatch
add disabled=no down-script=":log error \"WAN Gateway down!\"" host=1.1.1.1 http-codes="" interval=30s test-script="" type=simple up-script=\
    "/tool e-mail send to=\"redacted" subject=\"[Alert] WAN Link Restored\" body=\"The primary ISP gateway is back online and passing traffic cleanly.\""

CRS312

/interface bridge
add admin-mac=redacted auto-mac=no comment=defconf name=LAN.Bridge
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=LAN.Bridge comment=defconf interface=combo1
add bridge=LAN.Bridge comment=defconf interface=combo2
add bridge=LAN.Bridge comment=defconf interface=combo3
add bridge=LAN.Bridge comment=defconf interface=combo4
add bridge=LAN.Bridge comment=Uplink.RB5009.Ether2 interface=ether1
add bridge=LAN.Bridge comment=Downlink.CRS328.Ether1 interface=ether2
add bridge=LAN.Bridge comment=defconf interface=ether3
add bridge=LAN.Bridge comment=defconf interface=ether4
add bridge=LAN.Bridge comment=PP.Ether6.NVR interface=ether5
add bridge=LAN.Bridge comment=PP.Ether4.BrotherPrinter interface=ether6
add bridge=LAN.Bridge comment=PP.Ether7.NAS interface=ether7
add bridge=LAN.Bridge comment=defconf interface=ether8
add bridge=LAN.Bridge comment=defconf interface=ether9
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=LAN.Bridge \
    network=192.168.88.0
/ip dhcp-client
add interface=LAN.Bridge
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Chicago
/system identity
set name=CRS312.10GCoreSwitch
/system routerboard settings
set enter-setup-on=delete-key
/tool romon
set enabled=yes

CRS328

/interface bridge
add admin-mac=redacted auto-mac=no name=LAN.Bridge
/interface bridge port
add bridge=LAN.Bridge comment=defconf interface=ether1
add bridge=LAN.Bridge comment=defconf hw=no interface=ether2
add bridge=LAN.Bridge comment=defconf interface=ether3
add bridge=LAN.Bridge comment=PP5.cAPax.1.ether1 interface=ether4
add bridge=LAN.Bridge comment=defconf interface=ether5
add bridge=LAN.Bridge comment=defconf interface=ether6
add bridge=LAN.Bridge comment=defconf interface=ether7
add bridge=LAN.Bridge comment=defconf interface=ether8
add bridge=LAN.Bridge comment=defconf interface=ether9
add bridge=LAN.Bridge comment=defconf interface=ether10
add bridge=LAN.Bridge comment=defconf interface=ether11
add bridge=LAN.Bridge comment=defconf interface=ether12
add bridge=LAN.Bridge comment=defconf interface=ether13
add bridge=LAN.Bridge comment=defconf interface=ether14
add bridge=LAN.Bridge comment=defconf interface=ether15
add bridge=LAN.Bridge comment=defconf interface=ether16
add bridge=LAN.Bridge comment=defconf interface=ether17
add bridge=LAN.Bridge comment=defconf interface=ether18
add bridge=LAN.Bridge comment=defconf interface=ether20
add bridge=LAN.Bridge comment=defconf interface=ether22
add bridge=LAN.Bridge comment=defconf interface=sfp-sfpplus1
add bridge=LAN.Bridge comment=defconf interface=sfp-sfpplus2
add bridge=LAN.Bridge comment=defconf interface=sfp-sfpplus3
add bridge=LAN.Bridge comment=defconf interface=sfp-sfpplus4
add bridge=LAN.Bridge comment="cAP 1 IoT" horizon=10 interface=ether19
add bridge=LAN.Bridge comment="cAP 2 IoT" horizon=10 interface=ether21
add bridge=LAN.Bridge comment="cAP 3 IoT" horizon=10 interface=ether23
add bridge=LAN.Bridge comment="Uplink to RB5009 Ether6" horizon=10 interface=\
    ether24
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=LAN.Bridge \
    network=192.168.88.0
/ip dhcp-client
add interface=LAN.Bridge
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Chicago
/system identity
set name=CRS328.MainPoESwitch
/system routerboard settings
set enter-setup-on=delete-key
/tool romon
set enabled=yes

cAP ax 1 2 and 3 are all the same

/interface bridge
add name=IoT.Bridge
add admin-mac=redacted auto-mac=no comment=defconf name=bridgeLocal
/interface wifi channel
add band=2ghz-ax frequency=2412 name=ch-2g-ap1 width=20mhz
add band=5ghz-ax frequency=5180 name=ch-5g-ap1 width=20/40mhz
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes \
    name=Sec_Profile
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=Sec-IoT
/interface wifi configuration
add country="United States" name=Main_Config security=Sec_Profile ssid=\
    redacted
/interface wifi
set [ find default-name=wifi1 ] channel=ch-5g-ap1 configuration=Main_Config \
    configuration.antenna-gain=9 .mode=ap datapath.bridge=bridgeLocal \
    disabled=no
set [ find default-name=wifi2 ] channel=ch-2g-ap1 configuration=Main_Config \
    configuration.antenna-gain=15 .mode=ap datapath.bridge=bridgeLocal \
    disabled=no
add configuration.hide-ssid=no .mode=ap .ssid=redacted datapath.bridge=\
    IoT.Bridge disabled=no mac-address=redacted master-interface=\
    wifi2 name=IoT.WiFi.2g security=Sec-IoT
add configuration.mode=ap .ssid=redacted datapath.bridge=IoT.Bridge disabled=no \
    mac-address=redacted master-interface=wifi1 name=IoT.WiFi.5g \
    security=Sec-IoT
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=IoT.Bridge comment=defconf hw=no interface=ether2
add bridge=bridgeLocal comment="5GHz WiFi" interface=wifi1
add bridge=bridgeLocal comment="2.4GHz WiFi" interface=wifi2
/interface wifi cap
set discovery-interfaces=none slaves-datapath=capdp
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Chicago
/system identity
set name=cAPax.1
/tool romon
set enabled=yes
2

I assume this is related to your other thread Countless Hours and $500+ on Consultants; Still Can’t Get It

Can you show a diagram of how you think the devices are connected? It appears that ether6 wasn't previously used. But that is the interface you have your dhcp-server for IoT.DHCP using. How is the cAPax connected to the CRS328 getting to ether6 on the RB5009?

3

Yes, and no. I decided to go another route without vlans that I might be more likely to understand/configure correctly. Below is the physical connection layout (skipped ports are empty)

RB5009

  • Ether1:WAN
  • Ether2:CRS312 ether1
  • Ether4:Pi Hole
  • Ether5: Home Assistant
  • Ether6:CRS328 ether24
  • Ether8: Laptop dock

CRS312

  • Ether1:RB5009 ether2
  • Ether2:CRS328 ether1
  • Ether5:NVR
  • Ether6:Printer
  • Ether7:NAS

CRS328

  • Ether1:CRS312 ether2
  • Ether4:cAP1 ether1
  • Ether6:cAP2 ether1
  • Ether8:cAP3 ether1
  • Ether19:cAP1 ether2
  • Ether21:cAP2 ether2
  • Ether21:cAP3 ether2
  • Ether24:RB5009 ether6
4

You appear to have only a single LAN (broadcast domain) on the CRS328.

I see you have bridge horizon set to 10 on the CRS328 ether19, ether21, ether23 and ether24 ports.

I have never used that feature, but it's purpose if for isolating ports in the same horizon from each other. So if would seem to me that anything coming from the cAP devices would not get sent out ether24 (and therefore not to ether6 on the RB5009).

What is the intended purpose of your use of bridge horizon, and what led you to try using this feature?

Because you have one "network" in the CRS328 (you don't have vlan-filtering enabled), an ethernet broadcast from any port will be forwarded out of every other port on the CRS328 by default. You had used bridge horizon to prevent anything on the bridge ports in horizon 10 from forwarding to any other port with bridge horizon 10.

But your latest config allows the cAP to have access to the LAN.bridge on the RB5009 (via CRS328:ether1 to CRS312:ether2 and from there out CRS312:ether1 to RB5009:ether2 which is a member of RB5009 LAN.bridge).

So the cAP dhcp client sends a DHCP discover (which uses ethernet broadcast) and that arrives at the RB5009 dhcp server servicing LAN.bridge.

If you expect dhcp to work, you need to have separate broadcast domains, otherwise you will get inconsistent results (depending on which dhcp server responds first).

Answering specific questions isn't a very effective way to learn networking fundamentals that are not vendor specific. I have no idea what your background is, and how much you know. If you need understanding, I suggest watching Ed Harmoush's free youtube series here.

If you just copy/paste stuff from the net or chatbots without understanding what they do, you will spend a lot of time finding things that don't work as you intend.

5

Chris Greer has a good youtube video on how dhcp works. It goes into more detail than most do. But he explains things well.

How DHCP Works // DHCP EXPLAINED by Chris Greer