Community discussions

MikroTik App
 
wilburt
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 86
Joined: Tue Aug 24, 2010 3:07 am

vlan setup basics

Thu Oct 28, 2010 4:13 am

I am trying to setup a basic VLAN without any success. I am following the basic setup as per the wiki manual

SO what i have is two RB devices 750 and 433

I setup RB750 with the following

/interface vlan add name=vlan20 vlan-id=20 interface=ether4 disabled=no
/ip address add address=192.168.88.20/24 interface=vlan20

RB433

/interface vlan add name=vlan20 vlan-id=20 interface=ether1 disabled=no
/ip address add address=192.168.88.21/24 interface=vlan20

When I try to ping from the RB750 to the RB433 on 192.168.88.21 I get no response.

Any ideas why this doesn't work?
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: vlan setup basics

Thu Oct 28, 2010 4:24 am

Stupid question, but you are connecting ether4 to ether1? Are there other interfaces with IP addresses in 192.168.88.0/24? Any firewall rules that might be blocking things? Any NAT getting in the way?
/ip address print detail
/ip route print detail
/ip firewall export
 
wilburt
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 86
Joined: Tue Aug 24, 2010 3:07 am

Re: vlan setup basics

Thu Oct 28, 2010 4:43 am

There are no firewall rules on the 192.168.88.0/24 network.

Ether 4 is on the RB750 device and Ether 1 is on the RB433 device. The following IP addresses are set on the interfaces

RB750

Ether2 - 192.168.88.1/24
Vlan20(ether4) - 192.168.88.20/24

RB433
Vlan20(ether1) - 192.168.88.21/24
 
wilburt
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 86
Joined: Tue Aug 24, 2010 3:07 am

Re: vlan setup basics

Thu Oct 28, 2010 4:46 am

Here are the export details

[admin@MikroTik] > /ip address print detail
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; default configuration
address=192.168.88.1/24 network=192.168.88.0 broadcast=192.168.88.255
interface=ether2-local-master actual-interface=ether2-local-master

1 address=192.168.5.1/24 network=192.168.5.0 broadcast=192.168.5.255
interface=ether5-local-slave actual-interface=bridgeHS

2 D address=10.1.1.2/16 network=10.1.0.0 broadcast=10.1.255.255
interface=ether1-gateway actual-interface=ether1-gateway

3 address=192.168.88.10/24 network=192.168.88.0 broadcast=192.168.88.255
interface=VLAN20 actual-interface=VLAN20
[admin@MikroTik] > /ip route print detail
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 ADS dst-address=0.0.0.0/0 gateway=10.1.1.1
gateway-status=10.1.1.1 reachable ether1-gateway distance=1 scope=30
target-scope=10

1 ADC dst-address=10.1.0.0/16 pref-src=10.1.1.2 gateway=ether1-gateway
gateway-status=ether1-gateway reachable distance=0 scope=10

2 ADC dst-address=192.168.5.0/24 pref-src=192.168.5.1 gateway=bridgeHS
gateway-status=bridgeHS reachable distance=0 scope=10

3 ADC dst-address=192.168.88.0/24 pref-src=192.168.88.1
gateway=ether2-local-master,VLAN20
gateway-status=ether2-local-master reachable,VLAN20 reachable
distance=0 scope=10
[admin@MikroTik] > /ip firewall export
# oct/28/2010 11:45:36 by RouterOS 4.9
# software id = WC5W-UVQQ
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s \
tcp-close-wait-timeout=10s tcp-established-timeout=1d \
tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s \
tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no \
tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=drop chain=hs-input comment="To deny DHCP request" disabled=no \
protocol=udp time=10h-10h59m59s,sun,mon,tue,wed,thu,fri,sat
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here" disabled=yes
add action=accept chain=input comment="default configuration" disabled=no \
protocol=icmp
add action=accept chain=input comment="default configuration" \
connection-state=established disabled=no in-interface=ether1-gateway
add action=accept chain=input comment="default configuration" \
connection-state=related disabled=no in-interface=ether1-gateway
add action=drop chain=input comment="default configuration" disabled=no \
in-interface=ether1-gateway
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="default configuration" disabled=\
no out-interface=ether1-gateway
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
disabled=no src-address=192.168.5.0/24
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
[admin@MikroTik] >
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: vlan setup basics

Thu Oct 28, 2010 5:23 am

You cannot have overlapping IP space like that. You cannot have 192.168.88.0/24 IP addresses on a physical interface as well as a VLAN interface on the same router. You need to choose unique IP space for both. Change your IP addresses on the VLAN interfaces to 192.168.89.20 and 192.168.89.21 and try to ping again.
 
wilburt
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 86
Joined: Tue Aug 24, 2010 3:07 am

Re: vlan setup basics

Thu Oct 28, 2010 5:46 am

I have changed the VLAN interface to 192.168.90.x/24

but still i am unable to ping either way.
 
wilburt
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 86
Joined: Tue Aug 24, 2010 3:07 am

Re: vlan setup basics

Thu Oct 28, 2010 5:57 am

Has it got anything to do with that physical interface being a slave? When i removed it from being a slave i was able to ping between the two vlans.

Sorry for all the newbie questions.

Thanks
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: vlan setup basics

Thu Oct 28, 2010 6:01 am

Oh, I missed that. Yes, you can only put VLAN interfaces on the master (or standalone) interfaces. Slave ports inherit master port settings and therefore all slaves to master port with a VLAN interface would be able to pass traffic on that VLAN, but you cannot have VLAN interfaces unique to slave ports.
 
wilburt
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 86
Joined: Tue Aug 24, 2010 3:07 am

Re: vlan setup basics

Thu Oct 28, 2010 6:09 am

Ok. That makes sense.

If I already have IP traffic on that interface that I have just created a new vlan on, do I have to have all traffic from the different subnet within their own vlan?

For example
I have a HS on 192.168.5.1/24 on ether5 and then I created a vlan20 on ether5 with the vlan having it's own subnet 192.168.89.1/24

Or do i have to make another vlan for the 192.168.5.1/24 subnet?

Thanks
 
tombee79
Member Candidate
Member Candidate
Posts: 246
Joined: Sun May 09, 2010 2:28 am

Re: vlan setup basics

Fri Nov 26, 2010 2:15 am

you don't have to. What i had done i created on one of the master MT RB 450g device eth5 four subnets ( 3 hotspots ) and one admin subnet = 4 subnets

1 unmanaged subnet on 192.68.2.x
3 vlans on eth5 192.168.3.x .4.x .5.x . Don not check option in vlan setting to "TAG" leave it unchecked.

I hooked up thin Access point with 3 vlans and 3 virtual radios.
Now i host 3 hotspots, at which clients can not get the Access point IP, cause it is bridged, i didn't configure the vlans with IP, I only configure the admin subnet with IP so there is no way for users to HACK hehehh.


hope it helps

Who is online

Users browsing this forum: No registered users and 48 guests