I'm trying to set up, what is seems, a fairly simple first setup of working with VLANs.
My router (RB850Gx2) have been happily serving untagged traffic on eth3,4,5 which have been upgraded to a bridge, created from the master port after upgrading to 6.41. Using the 192.168.48.0/24 range with DCHP, no problems at all.
Now I want to start 'migrating' pc's, servers, IoT, guests machines, wifi SSIDs to different VLANs with different subnets. Where the ip's third octet will correspond with the VLAN number to keep it simple.
There are several implementation examples to find with VLANs and bridges and wiki's are being rewritten to reflect the new bridge setup. Unfortunately I can not find a suitable example which will help me, the closest one seems to be https://wiki.mikrotik.com/wiki/Manual:I ... d_Ports.29 .
A friend of mine had his router (an RB3011) already setup with bridges before the 'switch-to-bridge' changes and it all seemed clear to me. After the 6.41 update his setup kept on working, but for me unfortunately something breaks when I try to set up something like he did. He has a bridge per vlan implementation, where vlan-sub-interfaces are added to the bridge. My idea was to implement this as well, but I'm not sure if this is the way to go now with the new 6.41 implementation of a 'single bridge' and vlan-filtering.
This in place now, which works fine. I don't have any switch settings (VLAN-Mode=disabled):
Now I want to use VLAN's and add this to my configuration and later more bridges for different VLANs:
Code: Select all
/interface bridge add name=br-untgd-48 comment="created from master port" /interface bridge port add bridge=br-untgd-48 interface=eth3 add bridge=br-untgd-48 interface=eth4 add bridge=br-untgd-48 interface=eth5 /ip address add address=192.168.48.1/24 network=192.168.48.0 interface=br-untgd-48 comment=studio48 /ip dhcp-server add add-arp=yes address-pool=dhcp-pool-48 interface=br-untgd-48 name=dhcp-48 /ip dhcp-server network add address=192.168.48.0/24 gateway=192.168.48.1 netmask=24 dns-server=192.168.48.1 comment=studio48
I hope it's clear what I'm trying to do. Now some might have noticed bridge port 'eth4-vlan76' is disabled, but that's because the issue starts there.
Code: Select all
/interface vlan add interface=eth4 name=eth4-vlan76 vlan-id=76 comment="tagged 76 from wifi" add interface=eth5 name=eth5-vlan76 vlan-id=76 comment="tagged 76 from vm's" /interface bridge add name=br-client-76 /interface bridge port add bridge=br-client-76 disabled=yes interface=eth4-vlan76 add bridge=br-client-76 interface=eth5-vlan76 /ip address add address=192.168.76.1/24 network=192.168.76.0 interface=br-client-76 comment=client /ip dhcp-server add add-arp=yes address-pool=dhcp-pool-76 interface=br-client-76 name=dhcp-76 /ip dhcp-server network add address=192.168.76.0/24 gateway=192.168.76.1 netmask=24 dns-server=192.168.76.1 comment=client
With this is disabled I'm able to send tagged traffic to the router, can torch it and see vlan 76 comming in on interface eth5 and it's handed over to 'eth5-vlan76'. The test machine gets an IP from DCHP (192.168.76.98), but also a static address will work. I can ping the gateway (192.168.76.1) and go online and without having setup vlan-filtering and/or firewall rules I can reach the machine from the 'untagged' 192.168.48.xxx network.
Now when I enable the bridge port 'eth4-vlan76' and I restart the network on the '.76.98' machine (systemctl restart network), 'everything' breaks. I does get an IP from the DCHP server (I can see the lease time being reset), but it can not ping the gateway any more and it's not reachable anymore from the machines on the '.48.xxx' network which all did work before adding bridge port 'eth4-vlan76'.
Not within a second when I disable bridge port 'eth4-vlan76' from the GUI, 'everything' start working again like before the network restart.
This scenario also works when eth4-vlan76 is enabled and eth5-vlan76 is disabled. A (WiFi) machine gets an IP from 'eth4-vlan76' (tagged on the AP) but stops working as soon bridge port 'eth5-vlan76' is enabled.
Is it not possible to have two VLAN sub-interfaces in a bridge in a setup like this? What am I doing wrong here or should there be a totally different approach?
Kind regards, Airell.