-
-
roxanaschram
just joined
- Posts: 18
- Joined:
- Location: PR
VLAN headache
So I have a site I manage and they recently decided to rent an office to another company and I need to setup a VLAN to isolate their traffic away from the rest of the client company. They have a hex s (RB760iGS) as the gateway. Internet comes in on ether1. There is a CRS305 connected to it, then fiber goes to the other side of the building where there is another hex s being used as a switch basically. I know, doesn't seem like a great device for a switch but this part of the building only has 3 offices. No need for a larger device. Anyways, all the ports on it are assigned to a bridge, no firewall or anything. It's connected to the CRS305 via the sfp1 port. The tenant comes off ether1 on it. I've created a VLAN on the gateway and tried tagging ether1 on the second switch for the VLAN I created but all traffic still goes across as normal. I tried search here and even resorted to asking Chat but no luck. Nothing has worked. Any one have any suggestions?
Re: VLAN headache
Config of hex, config of second hex please, the 305 I will assume has trunk port from HEX with internet and a trunk port going to hex switch.
Assuming there is management vlans where the 305 and hex switch get their IP address from.
/export file=anynameyouwish ( minus router serial number, public WANIP information, keys etc.)
Assuming there is management vlans where the 305 and hex switch get their IP address from.
/export file=anynameyouwish ( minus router serial number, public WANIP information, keys etc.)
-
-
roxanaschram
just joined
- Posts: 18
- Joined:
- Location: PR
Re: VLAN headache
This is from my last attempt. There have been various changes and settings attempted... I found most people want the switch port set to vlan, but these don't support that option...
Gateway:
Switch:
Gateway:
Code: Select all
# 2024-03-24 17:59:16 by RouterOS 7.14.1
# software id =
#
# model = RB760iGS
# serial number =
/interface bridge
add name=pnp_bridge port-cost-mode=short
add name=smr_bridge port-cost-mode=short
/interface vlan
add interface=smr_bridge name=vlan10 vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik-Gateway
/ip pool
add name=smr_dhcp ranges=192.168.1.100-192.168.1.245
add name=pnp_dhcp ranges=10.185.79.27-10.185.79.29
add name=vlan10_dhcp ranges=10.200.201.10-10.200.201.15
/ip dhcp-server
add address-pool=smr_dhcp interface=smr_bridge lease-time=1h name=defconf
add address-pool=pnp_dhcp interface=pnp_bridge lease-time=10m name=pnp_fiber
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
/ppp profile
set *FFFFFFFE bridge=smr_bridge local-address=192.168.1.1 remote-address=\
smr_dhcp use-ipv6=no
/queue simple
add max-limit=38M/38M name=pnp_queue target=pnp_bridge
add max-limit=10M/10M name=tjm_client target=vlan10
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/interface bridge port
add bridge=smr_bridge comment=defconf ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10
add bridge=pnp_bridge comment=defconf ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge=smr_bridge comment=defconf ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10
add bridge=pnp_bridge comment=defconf ingress-filtering=no interface=sfp1 \
internal-path-cost=10 path-cost=10
add bridge=smr_bridge interface=ether2 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface detect-internet
set detect-interface-list=all internet-interface-list=WAN lan-interface-list=\
LAN
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add comment=defconf interface=smr_bridge list=LAN
add comment="Spirit Communications" interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/ip address
add address=192.168.1.1/24 comment=defconf interface=smr_bridge network=\
192.168.1.0
add address=[redacted]/29 interface=ether1 network=[redacted]
add address=10.185.79.26/24 interface=pnp_bridge network=10.185.79.0
add address=10.200.201.1/24 interface=vlan10 network=10.200.201.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1 use-peer-dns=no
/ip dhcp-server lease
[removed]
/ip dhcp-server network
add address=10.185.79.0/24 dns-server=9.9.9.9 domain=149.112.112.112 gateway=\
10.185.79.26 netmask=22
add address=10.200.201.0/24 dns-server=9.9.9.9 domain=10.200.201.1 gateway=\
10.200.201.1
add address=192.168.1.0/24 comment=defconf dns-server=9.9.9.9,1.1.1.1 \
gateway=192.168.1.1 netmask=24
/ip dns
set servers=9.9.9.9,1.1.1.1
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=forward in-interface=pnp_bridge out-interface=\
smr_bridge
add action=drop chain=forward in-interface=smr_bridge out-interface=\
pnp_bridge
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input dst-port=8291 in-interface=ether1 protocol=tcp \
src-address=[redacted]
add action=drop chain=input dst-port=8291 in-interface=ether1 protocol=tcp \
src-address=![redacted]
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes in-interface=\
smr_bridge
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Temp Rule (delete when done)" \
dst-port=8292 protocol=tcp src-address=[redacted] to-addresses=\
192.168.1.2 to-ports=8291
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
/ip route
add check-gateway=ping comment="Spirit Communications" disabled=no \
dst-address=0.0.0.0/0 gateway=[redacted]
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.1.0/24,[redacted]/32
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/flash/pub
/ppp secret
add name=vpn profile=default-encryption
/system clock
set time-zone-name=America/New_York
/system identity
set name=MikroTik-Gateway
/system note
set show-at-login=no
/tool bandwidth-server
set authenticate=no enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Switch:
Code: Select all
# 2024-03-24 18:11:56 by RouterOS 7.14.1
# software id = [redacted]
#
# model = RB760iGS
# serial number = [redacted]
/interface bridge
add admin-mac=2C:C8:1B:E7:DD:0B auto-mac=no comment=defconf fast-forward=no \
ingress-filtering=no name=bridge1 port-cost-mode=short vlan-filtering=yes
/interface vlan
add interface=ether1 name=vlan10 vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge1 comment=defconf ingress-filtering=no interface=ether2 \
internal-path-cost=10 path-cost=10
add bridge=bridge1 comment=defconf ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10
add bridge=bridge1 comment=defconf ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge1 comment=defconf ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10
add bridge=bridge1 comment=defconf ingress-filtering=no interface=sfp1 \
internal-path-cost=10 path-cost=10
add auto-isolate=yes bridge=bridge1 ingress-filtering=no interface=ether1 \
internal-path-cost=10 path-cost=10 pvid=10
/interface bridge settings
set use-ip-firewall=yes
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set accept-redirects=no accept-router-advertisements=no disable-ipv6=yes \
forward=no max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge1 tagged=ether1 untagged=sfp1,ether2,ether3,ether4,ether5 \
vlan-ids=10
/interface list member
add comment=defconf interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=sfp1 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.1.2 interface=sfp1 network=192.168.1.0
/ip dhcp-client
add comment=defconf interface=bridge1
/ip dns
set allow-remote-requests=yes
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=0.0.0.0/0
set api-ssl disabled=yes
/system clock
set time-zone-name=America/New_York
/system identity
set name=Front-Building-Bridge
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=none
Re: VLAN headache
ONE BRIDGE - ROUTER
ONE BRIDGE - SWITCH
Code: Select all
# 2024-03-24 17:59:16 by RouterOS 7.14.1
# model = RB760iGS
/interface bridge
add name=bridge ingress-filtering=yes
/interface vlan
add interface=bridge name=vlan10-client vlan-id=10
add interface=bridge name=vlan2-homeoffice vlan-id=2
add interface=bridge name=vlan99-mngmt vlan-id=99 comment="smart devices control subnet"
/interface wireguard
add comment="A Proper VPN!" listen-port=13445 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment name=Trusted
/ip pool
add name=homeoffice-pool ranges=192.168.1.100-192.168.1.245
add name=client-pool ranges=10.200.201.10-10.200.201.15
add name=mngmt-pool ranges=192.168.99.10-192.168.99.50
/ip dhcp-server
add address-pool=homeoffice-pool interface=vlan2-homeoffice lease-time=1h name=office-dhcp
add address-pool=client-pool interface=vlan10-client lease-time=10m name=client-dhcp
add address-pool=client-pool interface=vlan99-mngmt lease-time=10m name=mngmt-dhcp
/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether2 pvid=2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether3 pvid=2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether4 pvid=2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether5 pvid=2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=sfp1 comment="Trunk to 305"
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=Trusted
/interface bridge vlan
add bridge=bridge tagged=bridge,sfp1 untagged=ether2,ether3,ether4,ether5 vlan-ids=2
add bridge=bridge tagged=bridge,sfp1 vlan-ids=10,99
/interface wireguard peers
add allowed-address=10.10.10.2/32 interface=wireguard1 comment=" remote admin desktop"
public-key= "---------------------="
add allowed-address=10.10.10.3/32 interface=wireguard1 comment=" remote admin laptop"
public-key= "--&&&&&&&&&---="
add allowed-address=10.10.10.4/32 interface=wireguard1 comment=" remote admin smartphone-ipad"
public-key= "----********------="
/ipv6 settings
set disable-ipv6=yes
/interface detect-internet
set detect-interface-list=NONE
/interface list member
add comment="Spirit Communications" interface=ether1 list=WAN
add interface=vlan2-homeoffice list=LAN
add interface=vlan10-client list=LAN
add interface=wireguard1 list=LAN
add interface=vlan99-mngmt list=LAN
add interface=vlan2-homeoffice list=Trusted
add interface=wireguard1 list=Trusted
add interface=vlan99-mngmt list=Trusted
/ip address
add address=[redacted]/29 interface=ether1 network=[redacted]
add address=192.168.1.1/24 interface=vlan2-homeoffice network=192.168.1.0
add address=10.200.201.1/24 interface=vlan10-client network=10.200.201.0
add address=10.10.10.1/24 interface=wireguard1 network=10.10.10.0
add address=192.168.99.1/24 interface=vlan99-mngmt network=192.168.99.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=10.200.201.0/24 dns-server=10.200.201.1 gateway=10.200.201.1
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
add address=192.168.99.0/24 dns-server=192.168.99.1 gateway=192.168.99.1
/ip dns
set servers=9.9.9.9,1.1.1.1
/ip firewall address-list
add address=192.168.1.X/32 list=Authorized comment="Local Router Admin IP"
add address=10.10.10.0/24 list=Authorized comment="Remote Admin Access"
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add acction=accept chain=input dst-port=13445 protocol=udp comment="wireguard handshake"
add action=accept chain=input comment="Admin access only " src-address-list=Authorized
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=udp comment="dns services"
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=tcp comment="dns services"
add action=drop chain=input comment="Drop all else" { put this as last rule }
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="admin access vlans" src-address-list=Authorized out-interface-list=LAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat disabled=yes { enable if required }
add action=drop chain=forward comment="Drop all else"
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add check-gateway=ping comment="Spirit Communications" disabled=no \
dst-address=0.0.0.0/0 gateway=[redacted]
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.1.0/24, 10.10.10.0/24,192.168.99.0/24 set port =NOT DEFAULT!!!!
set api-ssl disabled=yes
/system clock
set time-zone-name=America/New_York
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=TrustedCode: Select all
# 2024-03-24 18:11:56 by RouterOS 7.14.1
#
# model = RB760iGS
# serial number = [redacted]
/interface bridge
add ingress-filtering=no name=bridge1 vlan-filtering=yes
/interface vlan
add interface=bridge1 name=vlan99-management vlan-id=99
/interface list
add name=Manage
/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether1 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether2 pvid=2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether3 pvid=2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether4 pvid=2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether5 pvid=2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=sfp1 comment="Trunk from 305"
/ip neighbor discovery-settings
set discover-interface-list=Manage
/ipv6 settings
disable-ipv6=yes \
/interface bridge vlan
add bridge=bridge1 tagged=sfp1 untagged=ether2,ether3,ether4,ether5 vlan-ids=2
add bridge=bridge1 tagged=sfp1 untagged=ether1 vlan-ids=10
add bridge=bridge1 tagged=bridge1,sfp1 vlan-ids=99
/interface list member
add interface=vlan99-management list=Manage
/ip address
add address=192.168.99.3/24 interface=vlan99-management network=192.168.99.0
/ip dns
set allow-remote-requests=yes servers=192.168.99.1
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.99.1 routing-table=main
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=Manage-
-
roxanaschram
just joined
- Posts: 18
- Joined:
- Location: PR
Re: VLAN headache
Why the wireguard added? I've removed all the VPN related setting why I started to manage the site and set up zerotier for their systems... Also, there is equipment I am not allowed to modify settings as it is owned and managed by another company that provides it on a leasing/licensing scheme so I can't change the 2nd bridge without a huge ordeal from the equipment owner... It's a nightmare at this site.
edit:
the vpn because I have the winbox ports temporally open to my home ip?
edit:
the vpn because I have the winbox ports temporally open to my home ip?
Re: VLAN headache
Yup, I saw unsafe pptp and then winbox open on the internet............. The right way to handle that is for you to at least be able to wireguard into the First Router. From there you can reach the 305 switch and the second hex through the neighbours discovery etc.
-
-
roxanaschram
just joined
- Posts: 18
- Joined:
- Location: PR
Re: VLAN headache
So I gave the scripts a try but before I could test the vlans all the security cameras went down as did their machinery so I had to revert back... I knew the machinery would go down because they hardcoded their IP addresses to their device... I'll give another try after hours...
Re: VLAN headache
Ensure the subnet being used for the cameras fits what they are hardcoded too.
Then via the mac addresses of each camera fix the IP static to the mac address in DHCP leases for that subnet
Then via the mac addresses of each camera fix the IP static to the mac address in DHCP leases for that subnet
-
-
roxanaschram
just joined
- Posts: 18
- Joined:
- Location: PR
Re: VLAN headache
I have the exported dhcp lease data and copied it over and it showed up in the router with the new config but any attempt to ping the ip failed so I had to revert back. They were on the main network which is stupid but "I'm just here to keep things working"
-
-
roxanaschram
just joined
- Posts: 18
- Joined:
- Location: PR
Re: VLAN headache
So I've reapplied both configs to each device and still no vlan. I attempted to manually set the end device to the vlan id and no connection still. I then moved the fiber from the CRS305 to the HexS to remove any switches between, still no vlan... Using torch, I can see the device I set to the vlan id requesting dhcp, it was tagged... but it never made it to the router...
Re: VLAN headache
Post both configs again with latest settings
-
-
roxanaschram
just joined
- Posts: 18
- Joined:
- Location: PR
Re: VLAN headache
I've reverted back to the original. I can't have the cameras down that long. Also back home now and the winbox is closed to the internet. I only opened it for the weekend to try and do everything from home.
-
-
roxanaschram
just joined
- Posts: 18
- Joined:
- Location: PR
Re: VLAN headache
Please know I appreciate your help. I truly do. Just with this particular site, I don't have the freedom of taking things offline for any length of time.