with a lot help of two users here I got my wifi connected to my vlans.
Now I want to bring the management-services of my MikroTik in a VLAN.
Backgroud:
- Mikrotik is only wifi-AP (DNS, DHCP, etc are served by a separate opnsense-installation)
- Mikrotik is conntected with one ethernet-port (ether2) with a Trunk.
- vlan90 should be the management-vlan.
- PVID is defaulted to 1 (and should not be used after migration)
I don't find out how to bring webfig and ssh where I want...
What I tried:
- Adding a vlan-interface to the bridge with vlan-tag 90
- adding ether2 as tagged device for vlan90 to the bridge
- setting a correponding ip to the vlan (10.10.90.99)
But I can't even ping the ip set.
I could not find a way to set the listening interface/ip for the services www, ssh...
Searching the web and especially the Manual brought no help.
Here is my /export:
Code: Select all
# sep/19/2021 22:20:41 by RouterOS 6.48.4
# software id = P3XP-NN1L
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 673706DFA5C2
/interface bridge
add admin-mac=6C:3B:6B:12:03:89 auto-mac=no fast-forward=no name=bridge \
vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] name=ether2-master speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=sfp1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
country=germany disabled=no distance=indoors frequency=auto mode=\
ap-bridge ssid=Wandhydrant station-roaming=enabled vlan-id=10 vlan-mode=\
use-tag wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-Ceee country=germany default-forwarding=no distance=indoors \
frequency=auto mode=ap-bridge ssid=Wandhydrant station-roaming=enabled \
wireless-protocol=802.11
/interface vlan
add interface=bridge name=vlan10 vlan-id=10
add interface=bridge name=vlan60 vlan-id=60
add interface=bridge name=vlan90 vlan-id=90
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection=allowed mode=\
dynamic-keys name=Profil_Gast supplicant-identity=MikroTik
/interface wireless
add default-forwarding=no disabled=no mac-address=6E:3B:6B:12:03:8F \
master-interface=wlan1 name=GuestWLAN security-profile=Profil_Gast ssid=\
Forrest vlan-id=60 vlan-mode=use-tag wds-default-bridge=bridge wps-mode=\
disabled
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
sword,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf hw=no interface=sfp1
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=wlan1
add bridge=bridge interface=vlan10
add bridge=bridge interface=GuestWLAN
/ip neighbor discovery-settings
set discover-interface-list=discover
/interface bridge vlan
add bridge=bridge tagged=ether2-master,wlan1 vlan-ids=10
add bridge=bridge tagged=GuestWLAN,ether2-master vlan-ids=60
add bridge=bridge tagged=ether2-master vlan-ids=90
/interface list member
add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=sfp1 list=discover
add interface=wlan1 list=discover
add interface=wlan2 list=discover
add interface=bridge list=discover
add list=discover
add list=discover
add list=discover
add interface=bridge list=mac-winbox
add interface=wlan2 list=mactel
add interface=ether2-master list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=sfp1 list=LAN
add interface=wlan1 list=LAN
add interface=ether1
add interface=bridge list=LAN
/ip address
add address=192.168.2.99/16 interface=ether2-master network=192.168.0.0
add address=10.10.90.99 interface=bridge network=10.10.90.99
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=192.168.2.26
/ip dns static
add address=192.168.2.99 name=router
/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related" \
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input in-interface-list=!LAN
/ip route
add distance=1 gateway=192.168.2.1
/ip service
set www-ssl disabled=no
/ip smb shares
set [ find default=yes ] directory=/pub
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/system clock
set time-zone-name=Europe/Berlin
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add interval=1d name=Sched_WLAN_aus on-event=WLAN_Aus policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/23/2017 start-time=23:00:00
add interval=1d name=Sched_WLAN_an on-event=WLAN_An policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/24/2017 start-time=06:00:00
/system script
add dont-require-permissions=no name=WLAN_Aus owner=admin policy=read,write \
source="#2,4 GHz\
\n/interface wireless set wlan1 disabled=yes;\
\n\
\n#5GHz\
\n#/interface wireless set wlan2 disabled=yes;"
add dont-require-permissions=no name=WLAN_An owner=admin policy=read,write \
source="#2,4 GHz\
\n/interface wireless set wlan1 disabled=no;\
\n\
\n#5GHz\
\n#/interface wireless set wlan2 disabled=no;"
/tool mac-server
set allowed-interface-list=mactel
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox[code]