Hello folks,
I’m trying to setup my new home network since few weeks now and struggle to be able to ping one WLAN host from another WLAN host.
Current setup
- ROOT router : Mikrotik HEX lite / RouterOS 6.44.5
- DHCP Server
- Bridge home
- Bridge infra
- Bridge management
- HOST C connected on ether3
- WAP router : Mikrotik WAP AC / RouterOS 6.45.4
- HOST A connected to WifiTest with VLAN 50
- HOST B connected to WifiTest with VLAN 51
- SWITCH : Cisco SG350-20
- Trunk ports are configured to allow vlan 50,51 and 20 to go from/to WAP router and ROOT router
- SERVER : Raspberry with debian
- FreeRadius
- WAP router and ROOT router are connected through SWITCH
- Each hosts have their own vlan (wired and wireless devices)
What I try to achieve
I want to be able to ping wireless host from another wireless host. More globally, I want to be able to allow/discard communication between wireless hosts and, if possible manage that on ROOT router (in order to be able to have same rules regardless of if device is wired or not)
What is working fine
- Radius authentication and vlan assignation ✓
- DHCP assignation ✓
What I already tried and works as expected
- Ping from wireless host on VLAN 51 to wired host connected to bridge-home (through ether3 on ROOT router) ✓
- Ping from wireless host on VLAN 50 to wireless host on VLAN 50 ✓
Stuff which could help
With my “normal/expected” conf (each wireless hosts on dedicated vlan) :
- When I ping HOST B from HOST A, WireShark on HOST A shows ARP requests for HOST B mapping, but no ARP response (
arp -a
command on HOST B shows
(incomplete)
for host B entry)
- When I ping HOST A from HOST B, WireShark on HOST A shows ARP requests for HOST A mapping as well as the ARP response
- If I connect HOST B to wifi and then HOST A, HOST A is unable to resolve HOST B MAC address through ARP (
arp -a
command on HOST B shows
(incomplete)
for host B entry)
- BUT, If I connect HOST A to wifi and then HOST B, WireShark on HOST A shows ARP Announcement for HOST B (so HOST A become aware of HOST B MAC address)
Based on that, I guess I have something wrong with ARP (or more globally Layer 2) config, but I don’t get what exactly. It seems to be something around vlan, as if wireless hosts are on same vlan, they can ping both each other.
Current config
- WAP router
# jan/03/1970 06:13:36 by RouterOS 6.45.4
# software id = BIFJ-D5SH
#
# model = RBwAPG-5HacT2HnD
# serial number = BED60B961427
/interface bridge
add comment=defconf disabled=yes name=bridge
add admin-mac=C4:AD:34:39:33:7B auto-mac=no name=bridge-test-1 vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX distance=indoors frequency=auto installation=outdoor mode=ap-bridge name=wlan-B_G_N ssid=MikroTik wireless-protocol=802.11
/interface vlan
add interface=ether1 name=vlan-management-ether1 vlan-id=200
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-eap management-protection=allowed mode=dynamic-keys name=profile1 radius-eap-accounting=yes supplicant-identity=WapIdent tls-mode=verify-certificate
/interface wireless
set [ find default-name=wlan2 ] antenna-gain=2 band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto frequency-mode=regulatory-domain mode=ap-bridge multicast-helper=full name=wlan-A_N_AC security-profile=profile1 ssid=WifiTest \
vlan-mode=use-tag wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/routing bgp instance
set default as=101
/interface bridge port
add bridge=bridge comment=defconf disabled=yes interface=wlan-B_G_N
add bridge=bridge-test-1 interface=wlan-A_N_AC
add bridge=bridge-test-1 hw=no interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=none
/interface bridge vlan
add bridge=bridge-test-1 tagged=ether1,wlan-A_N_AC,bridge-test-1 vlan-ids=50
add bridge=bridge-test-1 tagged=wlan-A_N_AC,ether1,bridge-test-1 vlan-ids=51
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf disabled=yes interface=ether1 list=WAN
add interface=wlan-A_N_AC list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
add dhcp-options=hostname,clientid disabled=no interface=vlan-management-ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="Accept from vlan-management" in-interface=vlan-management-ether1
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN log=yes log-prefix=IN_DROP
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes ipsec-policy=out,none out-interface-list=WAN
/radius
add address=10.30.0.50 service=wireless src-address=10.20.0.251
/routing filter
add action=accept chain=BGP-from-rootRouter prefix=10.50.0.0/24 set-distance=1 set-in-nexthop-direct=*6
add action=accept chain=BGP-from-rootRouter distance=1 prefix=10.30.0.0/24 set-distance=1 set-in-nexthop-direct=bridge
/system logging
add disabled=yes prefix=DHCP topics=dhcp
add disabled=yes prefix=RADIUS topics=radius
add prefix=WIRELESS topics=wireless
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
- ROOT router
# jan/03/1970 12:55:42 by RouterOS 6.44.5
# software id = 6XA4-2QFY
#
# model = RB750r2
# serial number = AA840B20DD35
/interface ethernet
set [ find default-name=ether1 ] name=ether1-slave-LAN
set [ find default-name=ether2 ] name=ether2-slave-bridge-management
/interface bridge
add admin-mac=7E:65:D1:28:12:5B auto-mac=no comment=defconf name=bridge
add admin-mac=FA:CB:4D:78:52:CE auto-mac=no name=bridge-home
add admin-mac=EE:BB:AD:D3:33:B5 arp=reply-only auto-mac=no name=bridge-infra
add admin-mac=C4:AD:34:B8:9D:28 arp=reply-only auto-mac=no name=bridge-management
/interface vlan
add interface=ether1-slave-LAN name=vlan-home-1-ether1 vlan-id=51
add interface=ether3 name=vlan-home-1-ether3 vlan-id=51
add interface=ether1-slave-LAN name=vlan-home-general-ether1 vlan-id=50
add interface=ether5 name=vlan-infra-router-security vlan-id=30
add interface=ether1-slave-LAN name=vlan-management-ether1 vlan-id=20
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=management-interface-list
add comment="Add all interfaces which requires to call this router for DNS" name=dns-client-interface-list
add name=bridge-interface-ist
/ip dhcp-server option
add code=43 name=microsoft-disable-netbios-option value=0x010400000002
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=black-hole ranges=172.16.0.1-172.16.100.250
add name=_Infra next-pool=black-hole ranges=10.30.0.10
add name=Home next-pool=black-hole ranges=10.50.0.10-10.50.0.20
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
add add-arp=yes address-pool=_Infra disabled=no interface=bridge-infra name=Infra
add add-arp=yes address-pool=Home disabled=no interface=bridge-home name=Home
/ip pool
add name=Management next-pool=black-hole ranges=10.20.0.10
/ip dhcp-server
add add-arp=yes address-pool=Management disabled=no interface=bridge-management name=Management
/routing bgp instance
set default as=100 redistribute-connected=yes
/interface bridge filter
add action=accept chain=forward comment="[FORWARD][*] - * - {bridge-management}->{bridge-management} - Allow management to management traffic" in-bridge=bridge-management out-bridge=bridge-management
add action=accept chain=forward comment="HOME - ARP" in-bridge=bridge-home mac-protocol=arp out-bridge=bridge-home
add action=accept chain=forward comment="HOME - RARP" in-bridge=bridge-home mac-protocol=rarp out-bridge=bridge-home
add action=drop chain=forward disabled=yes in-bridge=bridge-home log=yes log-prefix=DROP_INTER_PORT out-bridge=bridge-home
/interface bridge port
add bridge=bridge comment=defconf disabled=yes interface=ether3
add bridge=bridge-infra hw=no interface=ether4
add bridge=bridge-infra interface=vlan-infra-router-security
add bridge=bridge-management interface=vlan-management-ether1
add bridge=bridge-management interface=ether2-slave-bridge-management
add bridge=bridge-infra hw=no interface=ether5
add bridge=bridge-home interface=vlan-home-1-ether1
add bridge=bridge-home interface=vlan-home-general-ether1
add bridge=bridge-home interface=ether3
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface ethernet switch vlan
add disabled=yes ports=ether3,switch1-cpu switch=switch1 vlan-id=51
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=ether1-slave-LAN list=LAN
add interface=ether2-slave-bridge-management list=management-interface-list
add interface=vlan-management-ether1 list=management-interface-list
add interface=bridge-management list=dns-client-interface-list
add interface=bridge-infra list=dns-client-interface-list
add interface=bridge list=dns-client-interface-list
add interface=bridge-infra list=bridge-interface-ist
add interface=bridge-management list=bridge-interface-ist
add interface=bridge list=bridge-interface-ist
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=10.20.0.254/24 interface=bridge-management network=10.20.0.0
add address=10.30.0.254/24 interface=bridge-infra network=10.30.0.0
add address=10.50.0.254/24 interface=bridge-home network=10.50.0.0
add address=10.60.0.254/24 network=10.60.0.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1-slave-LAN
/ip dhcp-server lease
add address=10.20.0.200 client-id=1:d0:ec:35:1d:73:58 comment="Management - MainSwitch" mac-address=XX:XX:XX:XX:XX:XX server=Management
add address=10.20.0.51 client-id=1:78:7b:8a:d3:9a:c6 comment="Management - EtherAdapter1" mac-address=XX:XX:XX:XX:XX:XX server=Management
add address=10.20.0.50 client-id=1:c:4d:e9:c7:e8:20 comment="Management - EtherAdapter2" mac-address=XX:XX:XX:XX:XX:XX server=Management
add address=10.20.0.252 client-id=1:c4:ad:34:f3:c:d9 comment="Management - InternalRouter" mac-address=XX:XX:XX:XX:XX:XX server=Management
add address=10.20.0.253 client-id=1:62:fc:c5:b0:a0:8e comment="Management - EdgeRouter" mac-address=XX:XX:XX:XX:XX:XX server=Management
add address=10.30.0.50 client-id=ff:44:cb:3c:df:0:2:0:0:ab:11:40:f5:fa:4c:ca:3c:c6:df comment="Infra - SecurityServer" mac-address=XX:XX:XX:XX:XX:XX server=Infra
add address=10.20.0.251 client-id=1:c4:ad:34:39:33:7a comment="Management - WapRouter" mac-address=XX:XX:XX:XX:XX:XX server=Management
add address=10.50.0.14 client-id=1:f0:18:98:39:98:62 mac-address=XX:XX:XX:XX:XX:XX server=Home
add address=10.50.0.16 client-id=1:34:a8:eb:92:c0:73 mac-address=XX:XX:XX:XX:XX:XX server=Home
/ip dhcp-server network
add address=10.20.0.0/24 dhcp-option=microsoft-disable-netbios-option dns-server=10.20.0.254 domain=management.local.domain.fr gateway=10.20.0.254 ntp-server=10.20.0.254
add address=10.30.0.0/24 dhcp-option=microsoft-disable-netbios-option dns-server=10.30.0.254 domain=infra.local.domain.fr gateway=10.30.0.254
add address=10.50.0.0/24 dhcp-option=microsoft-disable-netbios-option dns-server=10.50.0.254 domain=home.local.domain.fr gateway=10.50.0.254 ntp-server=10.50.0.254
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="[INPUT][TCP] - HTTP(S)/SSH - {management-interface-list}->{* : 443,22,80}" dst-port=443,22,80 in-interface-list=management-interface-list protocol=tcp
add action=accept chain=input comment="[INPUT][TCP] - HTTP(S)/SSH - {bridge-management}->{* : 443,22,80}" dst-port=443,22,80 in-interface=bridge-management protocol=tcp
add action=accept chain=input comment="[INPUT][UDP] - DNS - {dns-client-interface-list}->{* : 53}" dst-port=53 in-interface-list=dns-client-interface-list protocol=udp
add action=accept chain=input comment="[INPUT][UDP] - DHCP - {bridge-interface-list(* : 68)}->{255.255.255.255 : 67}" dst-address=255.255.255.255 dst-port=67 in-interface-list=bridge-interface-ist protocol=udp src-port=68
add action=accept chain=input comment="[INPUT][UDP] - NETBIOS - {bridge-interface-list(*)}->{* : 137,138,139} Netbios from bridges" dst-port=137,138,139 in-interface-list=bridge-interface-ist protocol=udp
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN log=yes log-prefix=IN_DROP
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="[FORWARD][*] - * - {bridge-management}->{bridge-management} - Allow management to management traffic" in-interface=bridge-management out-interface=bridge-management
add action=accept chain=forward comment="[FORWARD][*] - * - {bridge-management}->{bridge-infra} - Allow management to infra traffic" in-interface=bridge-management log=yes log-prefix=TEST out-interface=bridge-infra
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes in-interface-list=WAN log=yes log-prefix=FW_DROP_WAN
add action=passthrough chain=forward log=yes log-prefix=TO_CHECK
add action=passthrough chain=input disabled=yes log=yes log-prefix=INPUT
add action=passthrough chain=output disabled=yes log=yes log-prefix=OUT
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes ipsec-policy=out,none out-interface-list=WAN
/routing filter
add action=accept chain=BGP-to-wapRouter prefix=10.50.0.0/24
add action=accept chain=BGP-to-wapRouter prefix=10.30.0.0/24
add action=discard chain=BGP-to-wapRouter
/system identity
set name=RootRouter
/system leds
add interface=bridge-management leds=user-led type=interface-activity
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
N.B. : For security purpose, MAC addresses have been obfuscated, vlan IDs and IPs have been slightly updated.
N.B.2 : You can find some remaining BGP configuration added for another test I made before, but peers have been removed so it should not have any impact
Don’t hesitate to ask for additional information if needed
Thanks in advance for your reading/help
yep, again, it comes from my current (getting old) setup where I tried several stuff, some of them are still there (and I used my current configuration as base for the new one). I can remove that.