RB4011 VLAN + unifi

Misha404 · Sun Oct 04, 2020 5:29 pm

Hi all,

I'm fairly new to Mikrotik and Ubiquiti (been using the isp provided modem/router combo so far) so I'm guaranteed to be doing something wrong in the setup.

Last month I bought an RB 4011 and set up VLANs (no firewalls yet tough) on it and all worked well.
To replace a normal switch I bough a ubiquiti switrct, a cloud key and 2 access points and now I'm stuck scratching my head with getting it to work.
All was fine till I added the switch and tried to connect them via trunk port, so I'm fairly confident the fault lies there..

I have configured several vlans, but no firewall rules yet:
VLAN ID - name - network
10 - Corporate - 10.0.10.1/24
30 - Guest - 10.0.30.1/24
50 - IoT - 10.0.50.1/24
100 - Home - 192.168.100.1/24

I can't get rid of the ISP provided box (will be switching it to bridge mode later, when I get this to work) due to the phone and possibly IPTV.

When I plug my PC into any of the ports specified for a specific VLAN, I do get the appropriate IP, so that does work.
When I plug my PC into eth5 which is configured as a trunk port, I don't get an IP, I'm guessing it should work that way?

The Ubiquiti gear has been configured to use the 192.168.100.1/24 network.

The problem is that I have no access to the UniFi control panel and get no IP when I connect the RB4011 to the switch via the trunk port (eth5).
As far as I now, UniFi requires the base vlan to be untagged but am unsure if i configured it currently on the RB4011 side.

I did try connecting the router and switch via a dedicated vlan port tough and got the following results.
When I connect the RB4011 to the switch via a port 7 (Home vlan), and my PC is on RB4011 port 2 (Home vlan), I have access to the UniFi control panel.
If I switch my PC to a port on the switch which is configured for a vlan network 100, I lose access but if I connect it to a port designated to the default LAN network I get an IP in the 192.168.100.1/24 network.
I can't get any other vlan from the switch, obviously, as it't not connected via a trunc port.

The config for the router is attached.

router_home.rsc

Or for convenience, followed by a simple chart of the network:

# oct/04/2020 11:41:03 by RouterOS 6.47.3
# software id = 56W4-Z3DJ
#
# model = RB4011iGS+
# serial number = D4440C5AADA1
/interface bridge
add name=bridgeNET protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment=WAN

/interface vlan
add interface=bridgeNET name=Corporate_VLAN vlan-id=10
add interface=bridgeNET name=Guest_VLAN vlan-id=30
add interface=bridgeNET name=Home_VLAN vlan-id=100
add interface=bridgeNET name=IoT_VLAN vlan-id=50
add interface=IPTV_bridge name=MaxTV vlan-id=1023

/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0

/interface list
add name=WAN
add name=VLAN
add name=HOME
add name=IPTV

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik

/ip pool
add name=Corporate_POOL ranges=10.0.10.11-10.0.10.250
add name=Guest_POOL ranges=10.0.30.11-10.0.30.250
add name=IoT_POOL ranges=10.0.50.11-10.0.50.250
add name=Home_POOL ranges=192.168.100.31-192.168.100.

/ip dhcp-server
add address-pool=Corporate_POOL disabled=no interface=Corporate_VLAN name=\
    Corporate_DHCP
add address-pool=Guest_POOL disabled=no interface=Guest_VLAN name=Guest_DHCP
add address-pool=IoT_POOL disabled=no interface=IoT_VLAN name=IoT_DHCP
add address-pool=Home_POOL disabled=no interface=Home_VLAN name=Home_DHCP

/interface bridge port
add bridge=bridgeNET interface=ether2 pvid=100
add bridge=bridgeNET interface=ether3 pvid=10
add bridge=bridgeNET interface=ether4 pvid=30
add bridge=bridgeNET interface=ether5
add bridge=bridgeNET interface=ether6 pvid=100
add bridge=bridgeNET interface=ether7 pvid=100

/interface bridge vlan
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=10
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=30
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=50
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=Home_VLAN vlan-ids=100
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=1500
	
/interface list member
add interface=ether1 list=WAN
add interface=Home_VLAN list=VLAN
add interface=Corporate_VLAN list=VLAN
add interface=Guest_VLAN list=VLAN
add interface=IoT_VLAN list=VLAN
add interface=Home_VLAN list=HOME
add interface=ether9 list=IPTV
add interface=ether10 list=IPTV
add list=VLAN

/ip address
add address=192.168.100.1/24 comment=home interface=Home_VLAN network=\
    192.168.100.0
add address=10.0.10.1/24 comment=corp interface=Corporate_VLAN network=\
    10.0.10.0
add address=10.0.30.1/24 comment=guest interface=Guest_VLAN network=10.0.30.0
add address=10.0.50.1/24 comment=iot interface=IoT_VLAN network=10.0.50.0

/ip dhcp-client
add disabled=no interface=ether1
	
/ip dhcp-server network
add address=10.0.10.0/24 comment=corporate dns-server=10.0.10.1 gateway=\
    10.0.10.1
add address=10.0.30.0/24 comment=guest dns-server=10.0.30.1 gateway=10.0.30.1
add address=10.0.50.0/24 comment=iot dns-server=10.0.50.1 gateway=10.0.50.1
add address=192.168.100.0/24 comment=home dns-server=192.168.100.1 gateway=\
    192.168.100.1
	
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1,8.8.8.8

/ip firewall nat
add action=masquerade chain=srcnat comment="Default masquerade" \
    out-interface-list=WAN
	
/system clock
set time-zone-name=Europe/Zagreb

The Rb4011 is on 6.47.3 firmware
I would be very grateful for any help or hints provided ,

Misha

tdw · Mon Oct 05, 2020 7:50 pm

For Ubiquiti devices you need a hybrid rather than trunk port with your Home VLAN set as the PVID, it is worth turning on ingress filtering on all of the interfaces to prevent devices injecting any other tagged packets they like:
/interface bridge port
add bridge=bridgeNET ingress-filtering=yes interface=ether2 pvid=100
add bridge=bridgeNET ingress-filtering=yes interface=ether3 pvid=10
add bridge=bridgeNET ingress-filtering=yes interface=ether4 pvid=30
add bridge=bridgeNET ingress-filtering=yes interface=ether5 pvid=100
add bridge=bridgeNET ingress-filtering=yes interface=ether6 pvid=100
add bridge=bridgeNET ingress-filtering=yes interface=ether7 pvid=100

Then just set the tagged interface memberships, you could set the untagged ones manually but they will be dynamically added from the pvid= settings:
/interface bridge vlan
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=10
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=30
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=50
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=Home_VLAN vlan-ids=100
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=1500[/font]
I'm not sure what the last entry with VLAN ID 1500 is for, as you don't have any other references to it in your configuration, so likely not needed.
Note that the tagged memberships (and untagged if set manually) should only be the bridge itself and bridge ports, adding other random interfaces is incorrect.

anav · Tue Oct 06, 2020 5:50 pm

What? Why would ubiquiti need a hybrid port?

What is with the IPTV interface vlan of 1023 and a different bridge name??
The diagram shows the IPTV as being separate off the ISP Modem/Router!

What is with vlan id of 1500 on ether5?? not defined anywhere!!

All of the ether ports (besides eth1 WAN, ether5) are access ports (ingress with PVID assigned).
Would add--> only allow priority or untagged packets to each of those.
The exception is ether5 which is a trunk port to the ubiquiti and as noted would add
in this case --> ingress filtering AND only allow vlan tagged packets.

I know that its not mandatory in bridge vlans to denote the untagged ports but I like to do it for clarity
Your use of home-vlan in the bridge vlans rules is incorrect!!.

Suggesting the below................

/interface bridge vlan
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=ether2,ether6,ether7 vlan-ids=100 *****
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=ether3 vlan-ids=10
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=ether4 vlan-ids=30

************ The way you configured ether5 is akin to a hybrid port setting defined as an ACCESS port in the bridge port setting but like a TRUNK port in the bridge vlan settings. In this manner one can pass an untagged vlan to a device as well as a tagged vlan to a device.
However this is a very rare usage such as to a VOIP phone station, which is aware of vlan tags and uses the vlan for the phone itself while passing on the rest of the traffic to another etherport on the voip station phone, typically for a 'dumb' user PC. In this case, however you are passing a trunk port to a smart switch or smart device - the ubiquiti!.

It is on the ubiquiti/unifi16 where you define what vlans are identified on the ubiquit as being allowed to enter on its incoming etherport (other end of the trunk) and to define how those vlans are then transmitted forward out its ports or WLANS (if its an access point and switch). Typically access ports to dumb devices (be they wired or wireless) and trunk ports to other smart devices, such as another smart switch or a smart access point that can read vlan tags etc..

tdw · Tue Oct 06, 2020 6:04 pm

What? Why would ubiquiti need a hybrid port?

That's they way they work. Out of the box APs and switches will acquire an IP address with DHCP (untagged, obviously) and attempt to connect to a controller using a number of layer 2 and layer 3 discovery mechanisms.

If you have a setup with additional SSIDs connected to separate networks these are tagged. Whilst the newer versions of the controller and device firmware allow the management to be moved to a tagged VLAN (and use a purely tagged trunk) it would mean that if the device is factory reset it will not be contactable to be reprovisioned - you would have to reconnect it to an untagged network to do this.

So leave the management untagged and use a hybrid port.

anav · Tue Oct 06, 2020 6:39 pm

Interesting,
In that case I would do the following.

Okay if the goal is to pass VLAN 100 as untagged to the Ubiquiti so it gets an IP address on the VLAN100, you must realize that this prevents vlan 100 from being used at any other ports on the ubiquiti. The way to ensure vlan100 is available to be passed on to the other ports on the switch is to send it as a trunk port but I guess that is not the requirement here.
It sounds like a crazy implementation to make the assignment of an IP address easier for the user but its sounds more restrictive in the long run.

To do this bass ackwards setup is as follows.

/interface bridge port
add bridge=bridgeNET interface=ether2 pvid=100 frame-types=admit-only-untagged-and-priority-tagged
add bridge=bridgeNET interface=ether3 pvid=10 frame-types=admit-only-untagged-and-priority-tagged
add bridge=bridgeNET interface=ether4 pvid=30 frame-types=admit-only-untagged-and-priority-tagged
add bridge=bridgeNET interface=ether5 pvid=100
add bridge=bridgeNET interface=ether6 pvid=100 frame-types=admit-only-untagged-and-priority-tagged
add bridge=bridgeNET interface=ether7 pvid=100 frame-types=admit-only-untagged-and-priority-tagged

/interface bridge vlan
add bridge=bridgeNET tagged=bridgeNET, untagged=ether2,ether6,ether5,ether7 vlan-ids=100
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=ether3 vlan-ids=10
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=ether4 vlan-ids=30

If that doesnt work try
/interface bridge vlan
add bridge=bridgeNET tagged=bridgeNET, untagged=ether2,ether6,ether7 vlan-ids=100
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=ether3 vlan-ids=10
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=ether4 vlan-ids=30
add bridge=bridgeNET untagged=bridgeNET,ether5 vlan-ids=100

tdw · Tue Oct 06, 2020 7:24 pm

Okay if the goal is to pass VLAN 100 as untagged to the Ubiquiti so it gets an IP address on the VLAN100, you must realize that this prevents vlan 100 from being used at any other ports on the ubiquiti. The way to ensure vlan100 is available to be passed on to the other ports on the switch is to send it as a trunk port but I guess that is not the requirement here.
It sounds like a crazy implementation to make the assignment of an IP address easier for the user but its sounds more restrictive in the long run.

Erm, no. There is nothing preventing SSIDs or switch ports being assigned to the untagged network in UniFi, in fact you have to explicitly assign them to be tagged.

anav · Tue Oct 06, 2020 8:45 pm

Okay if the goal is to pass VLAN 100 as untagged to the Ubiquiti so it gets an IP address on the VLAN100, you must realize that this prevents vlan 100 from being used at any other ports on the ubiquiti. The way to ensure vlan100 is available to be passed on to the other ports on the switch is to send it as a trunk port but I guess that is not the requirement here.
It sounds like a crazy implementation to make the assignment of an IP address easier for the user but its sounds more restrictive in the long run.
Erm, no. There is nothing preventing SSIDs or switch ports being assigned to the untagged network in UniFi, in fact you have to explicitly assign them to be tagged.

Then its not a switch its an abomination following no standards.

Misha404 · Tue Oct 06, 2020 9:36 pm

For Ubiquiti devices you need a hybrid rather than trunk port with your Home VLAN set as the PVID, it is worth turning on ingress filtering on all of the interfaces to prevent devices injecting any other tagged packets they like:
/interface bridge port
add bridge=bridgeNET ingress-filtering=yes interface=ether2 pvid=100
add bridge=bridgeNET ingress-filtering=yes interface=ether3 pvid=10
add bridge=bridgeNET ingress-filtering=yes interface=ether4 pvid=30
add bridge=bridgeNET ingress-filtering=yes interface=ether5 pvid=100
add bridge=bridgeNET ingress-filtering=yes interface=ether6 pvid=100
add bridge=bridgeNET ingress-filtering=yes interface=ether7 pvid=100

Then just set the tagged interface memberships, you could set the untagged ones manually but they will be dynamically added from the pvid= settings:
/interface bridge vlan
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=10
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=30
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=50
add bridge=bridgeNET tagged=bridgeNET,ether5 untagged=Home_VLAN vlan-ids=100
add bridge=bridgeNET tagged=bridgeNET,ether5 vlan-ids=1500[/font]
I'm not sure what the last entry with VLAN ID 1500 is for, as you don't have any other references to it in your configuration, so likely not needed.
Note that the tagged memberships (and untagged if set manually) should only be the bridge itself and bridge ports, adding other random interfaces is incorrect.

Thanks!
This worked like a charm.

The VLAN IDs 1500, 1023 and the additional brige ware leftovers from when I tried to pass the iptv trough the mikrotik, I thought I cleaed them up obviously missed some.

Might I ask a follow up question?
For testing purposes, I connected a NAS to a port designated for the Corporate vlan (id =10). It properly received an IP from the appropriate pool (10.0.10.11) and I can ping it from my pc in the home vlan but am unable to access it.
Am I missing a firewall rule that allows intervlan communication or?

tdw · Tue Oct 06, 2020 9:47 pm

For testing purposes, I connected a NAS to a port designated for the Corporate vlan (id =10). It properly received an IP from the appropriate pool (10.0.10.11) and I can ping it from my pc in the home vlan but am unable to access it.
Am I missing a firewall rule that allows intervlan communication or?

Forwarding is permitted by default, you have to explicitly block traffic. There may be some default firewall rules on either your PC or NAS only permitting connections from the subnet the device is on.

tdw · Tue Oct 06, 2020 9:50 pm

Erm, no. There is nothing preventing SSIDs or switch ports being assigned to the untagged network in UniFi, in fact you have to explicitly assign them to be tagged.
Then its not a switch its an abomination following no standards.

Exactly which standards prohibit that behaviour?

mkx · Tue Oct 06, 2020 10:11 pm

Erm, no. There is nothing preventing SSIDs or switch ports being assigned to the untagged network in UniFi, in fact you have to explicitly assign them to be tagged.
Then its not a switch its an abomination following no standards.
Exactly which standards prohibit that behaviour?

Standards cast in stone by our MTUNA certified colleague.

anav · Tue Oct 06, 2020 10:28 pm

Like laws of gravity LOL.
How an untagged flow of traffic into a switch can then be turned into tagged traffic coming out other ports of the switch is PFM or MKX I guess LOL.
I suppose now thinking about it one could let this security mess continue and let the untagged traffic also flow out other ports as untagged traffic.
Like I said, its an abomination. ;-)

xvo · Tue Oct 06, 2020 10:49 pm

How an untagged flow of traffic into a switch can then be turned into tagged traffic coming out other ports of the switch

It will be tagged by a switch, I guess :)))
Isn't that what is switch for after all: tagging, untagging and tagging again, just to fulfil the darkest of admin's designs?!
You could do it on Mikrotik as well, if you want.
If you dare... ;)

tdw · Tue Oct 06, 2020 11:03 pm

To the OP - the forum is not always like this, don't be put off by it if you have other issues you need help with.

Misha404 · Wed Oct 07, 2020 1:42 am

To the OP - the forum is not always like this, don't be put off by it if you have other issues you need help with.

No worries, I found it amusing to read trough.

I've marked your answer as the solution as it indeed was, thank you very much once again.
Now I just have to figure on which end the firewall rules are causing my next issue

RB4011 VLAN + unifi [SOLVED]

RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi [SOLVED]

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Re: RB4011 VLAN + unifi

Who is online