I believe you need to create a new bridge for the vlan and add IP and DHCP Server to the new bridge. Then change the bridge port for vlan1 to the new bridge.

Code: Select all

/interface bridge
add name=vlan1-bridge

/interface bridge port
add bridge=vlan1-bridge interface=vlan1

The rest of your config should remain the same.

• There are n (non-Mikrotik) wireless access points going to a switch that is fully bridged, then to the router.

• This is all on the 10.10.2.0/23 subnet. Router is 10.10.2.1, Switch is 10.10.2.2.

• DHCP setup on the Router serving addresses 10.10.3.17-10.10.3-254.

• All local interfaces are bridged on interface "bridge".

• ETH1 on the router is WAN, and there is an L2TP tunnel (L2TP_to_SMF) that is used as the outgoing interface for packets that have been mangled with routing-mark = to_smf.

• Note: Each of the wireless APs sends traffic tagged as VLAN 1, but there is nothing in the switch or router that does anything with this.

• I want to setup a new SSID (SSID_smf) in the wireless infrastructure that treats its clients as normal local clients (including broadcast), but uses L2TP_to_SMF as it's outgoing interface.

• The access points (non-Mikrotik) have the ability to tag packets with a VLAN ID per SSID, but no other feature to distinguish those.

• I have configured SSID_smf to tag packets as VLAN ID 99.

• I can see the packets arrive at the router at the L2TP_to_SMF VLAN interface.

• I thought I could just put L2TP_to_SMF interface into the router's bridge, but clearly that is not enough.

• I see Rx on the interface, but no Tx.

• Assuming we start with the current state diagram and setup, what steps would I take to have packets arriving at the router on VLAN ID = 99 act as if they were regular local clients on the same subnet, *BUT* get routing-mark=to_smf?

• I don't know if it is important that traffic go back to the originating access point tagged as VLAN 99 or not, so it would be nice to optionally know how to make sure they are tagged as VLAN 99 on egress (yeah, I got one word!).

add interface=L2TP_to_SMF list=VPNs

/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade for VPNs" ipsec-policy=out,none \
    out-interface-list=VPNs

/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list=!local new-routing-mark=to_SMF \
    passthrough=yes src-address-list=clients_SMF

/ip route
add check-gateway=ping distance=1 gateway=L2TP_to_SMF routing-mark=to_SMF
add distance=2 routing-mark=to_SMF type=prohibit

• any client that connect to a special wireless SSID (SSID_smf) to be routed to the internet via L2TP_to_SMF instead of the WAN port

• the local connectivity for these clients should remain unchanged, so they can still communicate with one another

• keep their local connectivity as if they were on the main network with all other clients 0 it would be nice if they used the same DHCP server as the other clients, but not required

• use L2TP_to_SMF as their internet gateway (instead of the default WAN interface) - it would be nice if it happened via a routing-mark=to_smf, but this is not required

• optionally have any packets related to those that come in on VLAN ID = 99 go out on VLAN ID = 99 as well - I don't know if the originating AP is going to care or not

Not sure if information missing, or maybe I don't fully understand requirements, but if you have an address list of source IPs, then these are already distinguished on the Mikrotik, why the need to complicate things with VLAN's?

All then needed is policy based routing on source address list to go via Vpn?

My suggestion will then be place that SSID on a separate vlan, issue a different subnet via DHCP to those clients on the vlan and config routing for that subnet

Thanks - and is there a simple way to "tie" the two subnets together so that everything (including broadcast) works across them both?

There is a way, however a terrible one.

On the bridge, the common subnet would live, with DHCP server etc. On the ethernet facing towards the non-Mikrotik AP (say, etherX), you'd set up an /interface vlan vlan-id=99 interface=etherX name=ssid-99 (i.e. having that ethernet as carrying interface). But to make this work you have to remove etherX from the bridge first, so the other SSID's VID on the AP has to be changed to something else than 1 - say, 33, and another /interface vlan vlan-id=33 interface=etherX name=ssid-33 has to be added as well. Next, you make these two /interface vlan member ports of the bridge. From this moment on, clients on both SSIDs will see each other transparently at L2 without any limitation, and both will be able to access the same L3 destinations.

To provide different L3 treatment to each SSID's clients, you have to let the bridge use the ip firewall - /interface bridge settings set use-ip-firewall=yes, which will allow you to refer to in-bridge-port (and, eventually, out-bridge-port) in the firewall rules, matching on ssid-33 or ssid-99.