Yet another VLAN issues topic...

settecplus · April 20, 2021, 11:59am

You are welcome:

#  RouterOS 6.48.1

/interface bridge
add name=bridge1 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
set [ find default-name=ether2 ] name=ether2-RUCKUS
set [ find default-name=ether3 ] name=ether3-SWITCH
set [ find default-name=ether6 ] name=ether6-ADMIN
/interface vlan
add interface=bridge1 name=vlan10 vlan-id=10
add interface=bridge1 name=vlan20 vlan-id=20
/interface list
add name=WAN
add name=LAN
add name=ADMIN
add name=VLAN
/ip pool
add name=dhcp_LAN ranges=192.168.2.100-192.168.2.160
add name=dhcp-vpn ranges=192.168.89.100-192.168.89.140
add name=dhcp_IOT ranges=172.16.1.20-172.16.1.100
/ip dhcp-server
add address-pool=dhcp_LAN disabled=no interface=vlan10 name=dhcp-LAN
add address-pool=dhcp_IOT disabled=no interface=vlan20 name=dhcp-IOT
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=dhcp-vpn
/caps-man manager
set ca-certificate=auto certificate=auto upgrade-policy=suggest-same-version
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no
/interface bridge port
add comment=defconf disabled=yes interface=ether1-WAN
add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether2-RUCKUS
add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether3-SWITCH
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether4 pvid=10
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether5 pvid=10
/ip firewall connection tracking
set tcp-established-timeout=5h
/ip neighbor discovery-settings
set discover-interface-list=ADMIN
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether2-RUCKUS,ether3-SWITCH untagged=ether4 \
    vlan-ids=10
add bridge=bridge1 tagged=bridge1,ether2-RUCKUS vlan-ids=20
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add interface=ether1-WAN list=WAN
add interface=ether6-ADMIN list=ADMIN
add interface=bridge1 list=LAN
add interface=ether6-ADMIN list=LAN
add interface=vlan10 list=ADMIN
add interface=vlan20 list=VLAN
add interface=vlan10 list=VLAN
/interface wireless cap
set caps-man-addresses=127.0.0.1 certificate=request interfaces=wlan1
/ip address
add address=192.168.2.1/24 interface=vlan10 network=192.168.2.0
add address=172.16.1.1/24 interface=vlan20 network=172.16.1.0
add address=192.168.1.2/24 interface=ether1-WAN network=192.168.1.0
add address=10.10.0.1/24 interface=ether6-ADMIN network=10.10.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether1-WAN
/ip dhcp-server network
add address=172.16.1.0/24 dns-server=208.67.222.222,208.67.220.220 gateway=\
    172.16.1.1 netmask=24
add address=192.168.2.0/24 dns-server=208.67.222.222,208.67.220.220 gateway=\
    192.168.2.1 netmask=24
/ip dns
set cache-size=4096KiB servers=208.67.222.222,208.67.220.220,8.8.8.8
/ip firewall address-list
add address=172.16.1.0/24 list=IOT
add address=192.168.2.0/24 list=LAN
add address=192.168.2.11 comment="IOT allowed" list=IOT-allowed
add address=10.10.0.0/24 list=Admin
/ip firewall filter
add action=drop chain=input comment="Block from blocklist" log-prefix=\
    "blk from blocklist" src-address-list=blacklist
add action=accept chain=input comment=\
    "Allow input on ether-6 for Administration" in-interface=ether6-ADMIN \
    src-address-list=Admin
add action=accept chain=input comment="Allow established, related" \
    connection-state=established,related
add action=accept chain=input comment="Allow L2TP VPN (ipsec-esp)" protocol=\
    ipsec-esp
add action=accept chain=input comment="Allow L2TP VPN (1701, 4500, 500 /udp)" \
    dst-port=1701,4500,500 protocol=udp
add action=drop chain=input comment="Deny All input from WAN" \
    in-interface-list=!LAN log-prefix="drop input !LAN"
add action=drop chain=forward comment="Block from blocklist" log=yes \
    log-prefix="blk to blocklist" src-address-list=blacklist
add action=drop chain=forward comment=\
    "Deny new,invalid,untracked connections" connection-state=\
    invalid,new,untracked in-interface=ether1-WAN
add action=fasttrack-connection chain=forward comment=FastTrack \
    connection-state=established,related
add action=accept chain=forward comment="IOT->LAN allowed IPs" \
    dst-address-list=IOT-allowed src-address-list=IOT
add action=drop chain=forward comment="Block IOT ->LAN su VLAN" \
    in-interface=vlan20 log=yes log-prefix="Drop VLAN20 to VLAN10" \
    out-interface=vlan10
add action=accept chain=forward comment=\
    "Allow established,related connections" connection-state=\
    established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward comment="Deny All forward from WAN" \
    in-interface=ether1-WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-WAN
add action=masquerade chain=srcnat comment="Masquerade vpn traffic" \
    src-address=192.168.89.0/24
/ip route
add distance=1 gateway=192.168.1.254
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=222
set api address=192.168.2.11/32
set api-ssl disabled=yes
/ip ssh
set forwarding-enabled=remote strong-crypto=yes
/lcd
set default-screen=stats-all enabled=no
/lcd interface pages
set 0 interfaces=wlan1
/ppp secret
add name=luc
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=Router
/system logging
add disabled=yes prefix="IPSECDBG===>" topics=ipsec
/system ntp client
set enabled=yes primary-ntp=193.204.114.232 secondary-ntp=193.204.114.233
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=ADMIN
/tool mac-server mac-winbox
set allowed-interface-list=ADMIN
/tool mac-server ping
set enabled=no

anav · April 20, 2021, 4:28pm

So far all looks good… but not for long

(1) Dont see this used often?? Purpose?
/ip firewall connection tracking
set tcp-established-timeout=5h

(2) Missing Ether5 if you want to manually insert the untagged vlans (which I prefer)
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether2-RUCKUS,ether3-SWITCH untagged=ether4,ether5
vlan-ids=10

OR this is correct as well (as router dynamically creates them when required)..

/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether2-RUCKUS,ether3-SWITCH vlan-ids=10

(3) MISSING EMERG LAN setup. NOTE, Change ether6-ADMIN to ether6-emerg as its far less confusing, as you have created an interface group called ADMIN and also a source address list with the the word ADMIN. I would refrain from using same nomenclature when it creates confusion.
/ip pool
add name=dhcp_LAN ranges=192.168.2.100-192.168.2.160
add name=dhcp-vpn ranges=192.168.89.100-192.168.89.140
add name=dhcp_IOT ranges=172.16.1.20-172.16.1.100
add name=dhcp-emerg ranges=10.10.0.2-10.10.0.5
/ip dhcp-server
add address-pool=dhcp_LAN disabled=no interface=vlan10 name=dhcp-LAN
add address-pool=dhcp_IOT disabled=no interface=vlan20 name=dhcp-IOT
add address-pool=dhcp_emerg interface=ether6-emerg name=emerg_server
/ip dhcp-server network
add address=172.16.1.0/24 dns-server=208.67.222.222,208.67.220.220 gateway=
172.16.1.1 netmask=24
add address=192.168.2.0/24 dns-server=208.67.222.222,208.67.220.220 gateway=
192.168.2.1 netmask=24
add address=10.10.0.0/24 dns-server=208.67.222.222,208.67.220.220 gateway=
10.10.0.1 netmask=24

(4) Firewall rules - as reccomended you should reset to defaults and start over. They are a mess.

for example why even bother with this rule???
add action=accept chain=input comment=
“Allow input on ether-6 for Administration” in-interface=ether6-ADMIN \

When later on you have this rule…
add action=drop chain=input comment=“Deny All input from WAN”
in-interface-list=!LAN log-prefix=“drop input !LAN”

CLUE: If you don’t understand the question, it means you dont understand firewall rules and should SET DEFAULTS until you learn them.

settecplus · April 20, 2021, 6:57pm

Anav, thank you once again for your help. Unfortunately the configuration is still not working.
Adding a dhcp server to emergency port is certainly useful but won’t change the fact that I cannot access ethernet devices from VLAN10.
Port 5 on the router is not used so its configuration is no big deal.
I do agree firewall rules are a bit messed up (btw, I do understand them, mostly ), that’s because the current configuration has been reworked many times. In any case I even tried disconnecting the WAN port and removing all the firewall rules with no apparent improvement, so in the end, the configuration while correct is not working and I’m clueless

The switch has been configured as per mikrotik suggestion here: https://wiki.mikrotik.com/wiki/SWOS/CSS326-VLAN-Example
I added all the ethernet ports to VLAN10 just for testing.