Hello,

I have this setup:
- Router A ETH2 = 10.30.14.0/24 with DHCP server A for router A, connecting to WAN-A
- Router B ETH2 = 10.30.13.0/24 with DHCP server B for router B, connecting to WAN-B.

What i'm planning/going to do is:
- Clients on Router A will get 10.30.14.0/24 IP addresses & network (with its DHCP server A) and able to communicate with 10.30.13.0/24 clients via router A's ETH5
- Clients on Router B will get 10.30.13.0/24 IP addresses & network (with its DHCP server B) and able to communicate with 10.30.14.0/24 clients via its bridging.
- configurations that need to be done is only on Router A.

Any solution/codes for this.
Note: The device is on default/factory-reset settings at Router A properly setups (IP > IP Address & IP > DHCP Server), and Masquerade enabled on both ETHs in IP>Firewall .

Solutions that have tried:
- used /interface bridge settings set use-ip-firewall=yes (not working)
- bridged TWO EoIPs for both ETH2 & ETH5 on Router A (not working)

The diagram is like this below

Put both on the same bridge (by the way only need one masquerade rule if you only have one WAN interface).
By both being on the same bridge they will be routable by the router.
To explicitly connect them, ensure firewall rules allow it especially if you have drop else rule at the end of the forward rules.

lan1 to lan2 and lan2 to lan1 etc.

Put both on the same bridge (by the way only need one masquerade rule if you only have one WAN interface).
By both being on the same bridge they will be routable by the router.
To explicitly connect them, ensure firewall rules allow it especially if you have drop else rule at the end of the forward rules.

lan1 to lan2 and lan2 to lan1 etc.

i have tried this, but problem is, the clients on ETH3 randomly pull-request from DHCP-A the connecting to WAN-A, and its supposedly uses the DHCP-B & WAN-B instead.

Same goes to clients on ETH1.

"bridge" is L2 feature. You can imagine it as switch with some enhanced abilities to filter/translate data. That means everything will pass through including DHCP requests and responses. You don't want that as you described want two separate LAN, each with own DHCP server.

As long as there are routes for each LAN (which will be there because you have the IP on each interface), router will automatically forward data from one to other. Although, it is better allow only few forward rules (LAN1->WAN1, LAN2->WAN2, LAN1->LAN2, LAN2->LAN1 and finally established+related) and drop everything else.

"bridge" is L2 feature. You can imagine it as switch with some enhanced abilities to filter/translate data. That means everything will pass through including DHCP requests and responses. You don't want that as you described want two separate LAN, each with own DHCP server.

As long as there are routes for each LAN (which will be there because you have the IP on each interface), router will automatically forward data from one to other. Although, it is better allow only few forward rules (LAN1->WAN1, LAN2->WAN2, LAN1->LAN2, LAN2->LAN1 and finally established+related) and drop everything else.

So meaning, i just do the firewall rules instead of bridge+firewall then?

Exactly. Router by default route all networks together (routing = L3 forwarding).

If you bridge it together, it is same as if you plug both ports straight into same switch and then put all clients on the switch as well - it will be mess, right?

Exactly. Router by default route all networks together (routing = L3 forwarding).

If you bridge it together, it is same as if you plug both ports straight into same switch and then put all clients on the switch as well - it will be mess, right?

/ip firewall nat add chain=srcnat action=src-nat to-addresses=10.30.11.0/24 protocol=tcp src-address=10.30.13.0/24 dst-address=!10.30.11.0/24 out-interface=ether3 log=no log-prefix=""
/ip firewall nat add chain=srcnat action=src-nat to-addresses=10.30.11.0/24 protocol=udp src-address=10.30.13.0/24 dst-address=!10.30.11.0/24 out-interface=ether3 log=no log-prefix=""
/ip firewall nat add chain=srcnat action=src-nat to-addresses=10.30.13.0/24 protocol=tcp src-address=10.30.11.0/24 dst-address=!10.30.13.0/24 out-interface=ether1 log=no log-prefix=""
/ip firewall nat add chain=srcnat action=src-nat to-addresses=10.30.13.0/24 protocol=udp src-address=10.30.11.0/24 dst-address=!10.30.13.0/24 out-interface=ether1 log=no log-prefix=""

is this the correct commands to configure the LAN1>LAN2 & LAN2>LAN1 then each LAN has its own network/WAN, which wont effect any others LAN?

My apologies for steering you in the wrong direction I missed the two WANs above in the first post.

The LAN where you want most functionality I would stick on the bridge (at least for my hex I get speed of switch chip that way) and my DMZ is not on the bridge (separate LAN).
As noted they if connected at layer 2 (same bridge) they can see each other regardless of firewall rules (poor or no control), meaning, by decoupling them from the same bridge, you can decide if they can see each other through firewall rules.

If you have explicit drop all else forward rules, they will not talk and you would have to make explicit rules to allow this routing (my preference).
allow lan 1 to lan 2
allow lan2 to lan 1

Alternatively If you dont have a drop else rule as your last forward rule, then the router knows about each LAN and will route a request from one lan to the other.
( if for some reason you didnt want them routable you would have to make explicit block rules. lan 1 to lan 2 drop and lan2 to lan1 drop)

I would be cautious about using ! notation in rules in general, often have weird consequences.

Before going down the source nat rules, do you have one internet provide, ONE WAN interface (physical connection) with two IP addresses from the ISP, or
do you have two separate ISPs?

I will assume the former and thus it would look like
add chain=srcnat source-address=10.30.11.0/24 action=src-nat to-addresses=ipA out-interface=wan
add chain=srcnat source-address=10.30.13.0/24 action=src-nat to-addresses=ipB out-interface=wan

If you have two different ISPs
add chain=srcnat source-address=10.30.11.0/24 action=masquerade out-interface=wanA
add chain=srcnat source-address=10.30.13.0/24 action=masquerade out-interface=wanB

(on my router and considering fail over I just use masquerade rules and do not put source address, meaning whatever Wan interface my traffic goes out on, it will be handled correctly in terms of source nat rules. What you are setting up is a very strict determination that defeats failover for two different ISPs, if your have one WAN (one ISP) and two IP addresses then obviously failover is a moot point.)

In any case, the above is step ONE - to tell the router to mark private to public and back public to private in terms of the packet flow in and out of the router.
One still has to route the packets accordingly.

Step Two is Route rules.
I suspect one has to mangle rules and then use that in route rules and in the rules make use of the preferred source entry.
Read up on that, as I recall there are ways to do this more efficiently, probably using connections vice packets, as once a connection has been identified/established the rest of that connection traffic follows automatically (whereas in packets every packet has to be inspected - at least thats what I recall LOL).

If you have explicit drop all else forward rules, they will not talk and you would have to make explicit rules to allow this routing (my preference).
allow lan 1 to lan 2
allow lan2 to lan 1

Its okay. Anyway, how do I apply this? I have no idea doing these in IP>firewall

Can you post your firewall rules as is............

Can you post your firewall rules as is............

theres no filter rules/NAT for now.. everything is empty and reset.

but the idea diagram is like below:



The problem is, the Router A need to be configured, which there's no filter rules/NAT at the moment.
Router B is fine since its normally bridging.

With your setup, I would have setup the link between the router as an own net (lan C)
So Lan A have a route to Lan C on the Left router and Lan C has a route to Lan B on the right side.

It may also be possible to set this up using all on the same router.
Link to two different ISP
Two VLAN on for A side and one for B side.



It is better to post the picture in the site.
Then the picture would stay in the forum.
For some reason adblock in google removes the site you are using.

It is better to post the picture in the site.
Then the picture would stay in the forum.
For some reason adblock in google removes the site you are using.

screenshot_316.jpg

thnx for reminding. updated the post with attachment included.

I did add som comment in the post as well after you did post yours

With your setup, I would have setup the link between the router as an own net (lan C)
So Lan A have a route to Lan C on the Left router and Lan C has a route to Lan B on the right side.

also possible, but i dont know what commands should i apply to allow them communicating to each other. can u post some of example commands/scripts here?

It may also be possible to set this up using all on the same router.
Link to two different ISP
Two VLAN on for A side and one for B side.

Wanting to do that, but theres limitation due the bandwidth between Router A to B is using PtP wireless connection (max upto 50Mbps). In other word, both routers are installed at different sites.. Anyway, WAN A and B has bandwidth upto 1GBps (with different accounts as well). Since the wireless has limitation to 50Mbps, if I configure 2 WANs at 1 router (ie at Router A), the clients at the other site (which located at Router B) will only get 50Mbps out of 1Gbps.

I do not have a lab to setup a test to make a configuration for this, but som of what you need to do.
To both router make a bridge with vlan filter on.
Make three wlan.
1. Outside
2. Inside
3. Link
Setup Nat between Inside and Outside.
Set up a net with two different IP on the link net.
As long as all is connected the traffic will flow from inside trough the link to the other side as long as the two router are connected.

with Lan C do routing like that:

router a: ether1 IP: 10.30.1.1/29
router b: ether3 IP: 10.30.1.2/29