Good morning everyone.
@Anav:
1,2,3,4,5: I have adopted these changes in full. Thank you very much!
6: It´s currently not implemented, as the deployment is in the home. I hope for less effort with the administration of the firewall. I would probably do this differently in the company. I think this is acceptable?
7: Implemented and tested. Thanks for sharing this idea!
8: Oh, I didn't know that. Yes exactly, I just want to "provide" a trustful NTP time to the clients. Now it should be implemented, testing is pending.
@ConnyMercier
I found the error with the /24 on the IP address yesterday as well, was going to post this and then saw Anav's long post
. Sorry, I thought I would include this just now, but it dragged on a bit. Now everything should be fixed and ping is also working fine.
Outstanding are now two more points:
1) Integration of a Voip Dect station. To do this, I added ether5 to the provider's VOIP vlan. The provider specifies DHCP, so I guess I still have to set up a DHCP client on the Fritzbox. How does it look here actually with the firewall? We added the PPPoE to the WAN list, but the PPPoE client works in vlan 10 and voip is done over vlan 20. Does the firewall interfere at this point? Here is the mentioned location:
/interface list member
add comment=defconf interface=PPPoE_Out list=WAN
2) Currently I do not receive an IPv6 WAN address. In the future I would like to be reachable from outside via VPN. But I think this is beyond the scope of this post and is a separate topic.
The current state of the configuration is attached again. I have also adapted the overview image in the first post.
/interface bridge
add admin-mac=2C:C8:1B:B1:3A:82 auto-mac=no comment=defconf name=bridge \
vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1_WAN
set [ find default-name=ether2 ] name=ether2_intern
set [ find default-name=ether3 ] name=ether3_guests
set [ find default-name=ether4 ] name=ether4_AP
set [ find default-name=ether5 ] name=ether5_VOIP
set [ find default-name=ether10 ] name=ether10_emerg
/interface vlan
add interface=ether1_WAN name=vlan10_netcologne_data vlan-id=10
add interface=ether1_WAN name=vlan20_netcologne_voip vlan-id=20
add interface=bridge name=vlan100_intern vlan-id=100
add interface=bridge name=vlan200_guests vlan-id=200
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan10_netcologne_data name=\
PPPoE_Out use-peer-dns=yes user=nc-myusername@autoprov.netcologne.de
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp_intern ranges=192.168.1.100-192.168.1.200
add name=dhcp_guests ranges=192.168.2.100-192.168.2.200
/ip dhcp-server
add address-pool=dhcp_intern disabled=no interface=vlan100_intern lease-time=\
3d name=dhcp_intern
add address-pool=dhcp_guests disabled=no interface=vlan200_guests lease-time=\
3d name=dhcp_guests
/interface bridge port
add bridge=bridge comment=defconf interface=ether2_intern pvid=100
add bridge=bridge comment=defconf interface=ether3_guests pvid=200
add bridge=bridge comment=defconf interface=ether4_AP
add bridge=bridge comment=defconf interface=ether5_VOIP pvid=20
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge,sfp-sfpplus1,ether4_AP vlan-ids=100
add bridge=bridge tagged=bridge,sfp-sfpplus1,ether4_AP vlan-ids=200
/interface list member
add comment=defconf interface=PPPoE_Out list=WAN
add interface=vlan100_intern list=LAN
add interface=vlan200_guests list=LAN
add interface=bridge list=LAN
add interface=ether10_emerg list=LAN
/ip address
add address=192.168.1.1/24 interface=vlan100_intern network=192.168.1.0
add address=192.168.2.1/24 interface=vlan200_guests network=192.168.2.0
add address=192.168.10.1/24 interface=ether10_emerg network=192.168.10.0
/ip cloud
set update-time=no
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 domain=home.lan gateway=\
192.168.1.1
add address=192.168.2.0/24 dns-server=192.168.2.1 domain=home.guests gateway=\
192.168.2.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.1.1 name=lisa.home.lan
/ip firewall filter
add action=accept chain=input comment="accept established,related" \
connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment="allow ICMP" protocol=icmp
add action=drop chain=input comment="block everything else" \
in-interface-list=WAN
add action=drop chain=input comment="drop guests to intern" dst-address=\
192.168.1.0/24 src-address=192.168.2.0/24
add action=fasttrack-connection chain=forward comment=\
"fast-track for established,related" connection-state=established,related
add action=accept chain=forward comment="accept established,related" \
connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward comment=\
"drop access to clients behind NAT form WAN" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="drop guests to intern" dst-address=\
192.168.1.0/24 src-address=192.168.2.0/24
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=2200
set api disabled=yes
set winbox address=192.168.1.0/24
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=Europe/Berlin
/system ntp client
set enabled=yes primary-ntp=192.53.103.108 secondary-ntp=192.53.103.104
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
b9_no_sensitive.rsc
You do not have the required permissions to view the files attached to this post.
. The idea is to use a Fritzbox only as a DECT<->Ethernet "converter". Whereby this is actually too wasteful for me energetically. Unfortunately I have no other idea. In addition, I do not know how I would have to configure the router. According to the provider, VoIP should be done via VLAN 20, but how do I set this up?
