Hello,
I’m trying to setup my test environment, everything is working (due my test) but I have few questions, because I have doubts.
I followed these tutorials to setup ROS:
Router-Switch-AP (all in one) http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
InterVLAN Routing by Bridge https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#VLAN_Example_#3_(InterVLAN_Routing_by_Bridge)
CAP VLAN configuration example https://help.mikrotik.com/docs/display/ROS/WifiWave2#WifiWave2-CAPsMAN-CAPVLANconfigurationexample:
Networks:
LAN-BRIDGE: 192.168.1.1/24
TEST-VLAN: VLANID:20, 192.168.20.1/24
GUEST-VLAN: VLANID:30, 192.168.30.1/24
IDEA:
ether1 - WAN
ether2 - local server (with linux)
ether3 - test server with vmware ESXi (multiple OS with VLANs) - networks allowed: LAN-BRIDGE, TEST-VLAN, GUEST-VLAN
ether8 - hap ax2 (LAN and GUEST WiFi) - networks allowed: LAN-BRIDGE, GUEST-VLAN
I tried to separate the VLANs and only allow access to internet for every VLAN:
# RouterOS 7.10.2
# model = RB5009UG+S+
/interface bridge
add ingress-filtering=no name=LAN-BRIDGE vlan-filtering=yes
/interface vlan
add interface=LAN-BRIDGE name=GEUST_VLAN vlan-id=30
add interface=LAN-BRIDGE name=TEST_VLAN vlan-id=20
/interface list
add name=WAN
add name=VLAN
add name=GUEST_VLAN
/interface wifiwave2 channel
add disabled=no frequency=2300-7300 name=5GHz width=20/40/80mhz
add disabled=no frequency=2300-7300 name=2GHz width=20/40mhz
/interface wifiwave2 datapath
add bridge=LAN-BRIDGE disabled=no name=GUEST vlan-id=30
/interface wifiwave2 security
add authentication-types=wpa3-psk disabled=no name=WPA3 wps=disable
add authentication-types=wpa2-psk disabled=no name=WPA2 wps=disable
add authentication-types=wpa2-psk disabled=no name=GUEST wps=disable
/interface wifiwave2 configuration
add country="United States" disabled=no name=HOME-5GHz security=WPA3 ssid=\
HOME-5GHz
add country="United States" disabled=no name=HOME-2GHz security=WPA2 ssid=\
HOME-2GHz
add country="United States" datapath=GUEST disabled=no name=GUEST security=\
GUEST ssid=GUEST
/ip pool
add name=dhcp_pool0 ranges=192.168.1.2-192.168.1.254
add name=dhcp_pool1 ranges=192.168.20.2-192.168.20.254
add name=dhcp_pool2 ranges=192.168.30.2-192.168.30.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=LAN-BRIDGE name=dhcp1
add address-pool=dhcp_pool1 interface=TEST_VLAN name=dhcp2
add address-pool=dhcp_pool2 interface=GEUST_VLAN name=dhcp3
/interface bridge port
add bridge=LAN-BRIDGE interface=ether2
add bridge=LAN-BRIDGE interface=ether3
add bridge=LAN-BRIDGE interface=ether8
/interface bridge vlan
add bridge=LAN-BRIDGE tagged=LAN-BRIDGE,ether3 vlan-ids=20
add bridge=LAN-BRIDGE tagged=LAN-BRIDGE,ether3,ether8 vlan-ids=30
/interface list member
add interface=ether1 list=WAN
add interface=GEUST_VLAN list=VLAN
add interface=LAN-BRIDGE list=VLAN
add interface=TEST_VLAN list=VLAN
/interface wifiwave2 capsman
set ca-certificate=auto enabled=yes package-path="" require-peer-certificate=\
no upgrade-policy=none
/interface wifiwave2 provisioning
add action=create-dynamic-enabled disabled=no master-configuration=HOME-5GHz \
supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=HOME-2GHz \
slave-configurations=GUEST supported-bands=2ghz-n
/ip address
add address=192.168.1.1/24 interface=LAN-BRIDGE network=192.168.1.0
add address=192.168.20.1/24 interface=TEST_VLAN network=192.168.20.0
add address=192.168.30.1/24 interface=GEUST_VLAN network=192.168.30.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
add address=192.168.20.0/24 gateway=192.168.20.1
add address=192.168.30.0/24 gateway=192.168.30.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment="ALLOW ESTABLISHED AND RELATED" \
connection-state=established,related
add action=accept chain=input comment="ALLOW VLAN ACCESS ROUTER SERVICES" \
in-interface-list=VLAN
add action=drop chain=input comment=DROP
add action=accept chain=forward comment="ALLOW ESTABLISHED AND RELATED" \
connection-state=established,related
add action=accept chain=forward comment="ALL VLANS INTERNET ACCESS ONLY" \
connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment=DROP
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
Questions:
-
I didn’t followed “Router-Switch-AP (all in one)” at ingress behavior, I didn’t added pvid to interfaces at bridge port because I saw at “CAP VLAN configuration” it’s not needed if multiple VLAN need to access), is this true or is there another solution for it?
-
I didn’t set up frame-types=admit-only-untagged-and-priority-tagged because if I set up it’s stops working on interfaces with multiple VLANs, is this because it’s only interfaces with only one VLAN? Is there a better solution?
-
Overall with my test shows everything is working but did I missed something about security?
Thank You so much!