I've been having a problem with proper configuration of DHCP on different VLANs on RB3011. I apologize if the following has already been asked on this this forum, but I haven't found a post with similar configuration demands (or maybe the problem is, that i've been searching for a wrong solution).
What I'm trying to do is to configure separate VLANs on the same bridge:
- VLAN for management on port 2, which allows access to bridge port (Winbox/telnet/web...)
- VLAN for users on ports 3-5, which blocks access to bridge port, + DHCP
Here is the config that has been done according to wiki: https://wiki.mikrotik.com/wiki/Manual:Bridge_VLAN_Table
Code: Select all
/interface bridge
add frame-types=admit-only-vlan-tagged ingress-filtering=yes name=bridge \
vlan-filtering=yes
/interface vlan
add interface=bridge name=ACCESS vlan-id=35
add interface=bridge name=MANAGEMENT vlan-id=400
/ip pool
add name=access ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=access disabled=no interface=ACCESS name=server1
/interface bridge port
add bridge=bridge interface=ether2 pvid=400
add bridge=bridge interface=ether3 pvid=35
add bridge=bridge interface=ether4 pvid=35
add bridge=bridge interface=ether5 pvid=35
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
add bridge=bridge interface=ether10
/interface bridge vlan
add bridge=bridge tagged=bridge untagged=ether2 vlan-ids=400
add bridge=bridge untagged=ether3,ether4,ether5 vlan-ids=35
/ip address
add address=192.168.50.1/24 interface=MANAGEMENT network=192.168.50.0
/ip dhcp-server network
add dns-server=192.168.88.1 gateway=192.168.88.1 netmask=24
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
Now my understanding is that allowing access to bridge port (CPU) and management of the device is implemented with the part
/interface bridge vlan
add bridge=bridge tagged=bridge untagged=ether2 vlan-ids=400
allowing access only to packets that have tag 400. This actually works correctly. Access to management is only possible through port 2.
The part that doesn't work is the access VLAN, the devices do not get the IP from configured server, also on interface ACCESS there is no traffic detected. I've tried to switch the server to MANAGEMENT interface and added user device to port 2 and the IP is allocated immediately. I assumed that the problem is with missing tagged=bridge in the table for VLAN id 35. Fixed it, but even then on ACCESS interface DHCP does not work. It is practically the same as MANAGEMENT interface but it didn't work. So my question would be:
- is this the right way to allow access, with tagging bridge port in bridge VLAN table and block it without tagging bridge?
- where could be the problem of DHCP not working on ACCESS interface? (dhcp-server is also marked red)
Thank you in advance!