Hello all

I'm pretty new to the world of Mikrotik and RouterOS, and I would appreciate your help on this.

On a wireless network i've build up for my local community, I have 2 RB 750G.

One is at the internet source, with two ports used, one at the wan side, and one at wlan side.
I've already setup this one as a bridge, remotely, but it was before I finished the network, I was alone on it, and by trying, I've done it without problems.
I had only 2 active interfaces, so by giving different IPs to each interface, I finally found which one was attached to the wan and which was attached to the backhaul antenna. I got access back to it, and put everything in the bridge.

I'd like now to setup the second RB as a bridge. Up to now it works only as a switch, configured as defaut, with port 2 as master and port 3-5 as slaves. I know that port 1 and 5 are unused, as I can see it with winbox (those ones aren't synchronised at 100mbits FD)
Ports 2-3-4 are connected to :
- my BH antenna
- one 120 sector
- one 60 sector
But I don't know which one to what port exactly

What I'd like to do is to put these ports in the bridge. The problem is that it is now connected to Internet and used by my neighbors.

do you know a way to do this silently, transparently, with minimal downtime for users ?

What i thought to do was to give each port an IP address, then when I would put the port out of the bridge, if it is the port I'm connected to, i could use this IP address to connect back to the RB and continue my setup. Shouldn't take more than 5 minutes.

I first choose to give IPs in the same subnet (192.168.71.241/24 to 192.168.71.245) to each port. But not all IPs answer to my pings.
When I read the wiki manual, it says

Two IP addresses from the same network assigned to routers different interfaces are not valid unless VRF is used

So I believe it explains why only some of those IPs set on switch's ports answer my ping,and some others don't. Only 2 on 5. Strangely one of the IP that doesn't answer my ping is the IP i used to connect to this routerboard. It works with winbox or telnet, but not for ping.
Anyway, I can count on this, I want to be sure to connect back to the RB when the ports are get out of the switch configuration.

i don't want to use VRF for this. I read farther that

For example, the combination of IP address 10.0.0.1/24 on the ether1 interface and IP address 10.0.0.132/24 on the ether2 interface is invalid, because both addresses belong to the same network 10.0.0.0/24. Use addresses from different networks on different interfaces, or enable proxy-arp on ether1 or ether2.

Should I set proxy-arp on all ports ? just one ? which one ?
Would this solve my ping problem ? and enable me to connect to any of the IPs, especially to the port my AP is connected to ?

Otherwise i think I have another solution, that is simply to give 5 IPs belonging to 5 different subnets. I'll give 5 others to my own antenna, and maybe will it be OK ?
Is it the way to go to do that ? What do you think of it ?

For the rest, the bridge interface is already created but has no ports, it has a public IP, users/password are set, masquerade and DHCP deleted on port 1. I just need to put these 3 ports in the bridge

How would you do that ?

Regards

Fred

hello
Nobody has an opinion on that ?

Am I on the right way ? Or should I do that in a safer way ?

thanks in advance

Best regards

Fred

Your network appears very disorganised. My first suggestion would to work out what is where, what ip addresses are assigned to what port, what bridges you have and so on. I would then draw a diagram so that you can see what you are working on. Thats where I would start. I dont really understand your network layout/design.

hello

thanks for your answer

Not disorganized in my mind (I hope ), and you're right, I should have done a network map. That's not easy to show the picture only by writing about it.

Anyway, it's done.

I gave one IP to each physical interface in different subnets (192.168.71.x, 192.168.72.x,...). And I set 5 IPs in same subnets to my antenna

This way, I was able to release each interface from the port-2 master enslavement, and when i released the port my antenna was connected to (that was the first I released), I could get back with winbox to the RB750g using the appropriate alternative subnet IP.

Then I released the others ports, and put every ports in the bridge.
The change took me 2 minutes, i believe nobody noticed it

I want to be able to do some traffic shaping with this routerboard. That's why I wanted to put all ports in a bridge, in order to be able to use IP firewall features.
Maybe am I wrong on that ? but i thought it would be easier if each port is differentiated in the bridge

thinking about this now, I'm not so sure... But for me I believe it's not possible to use IP firewall on traffic passing through real L2 switch ports, that is the default RB750g setup

well, network is not my job, I'm voluntary on this project, and I'm learning everyday on networks