The router we're replacing had 8 ethernet interfaces all with separate LANS on them and full access between all LAN's.
We can't rebuild the LANs so we needed to expand the Hex with a switch and therefore we needed to use VLAN.
All we had in stock was a 5 port Hex and a 5 port mikrotik switch.
It's a temporary solution but it will hold out until we can rebuild everything at the customer.
I have setup Vlans in a bridge following this guide:
viewtopic.php?t=143620
Works like a charm except that I have no connections between the different VLAN.
This rule should allow connections between VLAN: add action=accept chain=forward comment="VLAN inter-VLAN routing" \
connection-state="" in-interface-list=VLAN log=yes
It's added in the configuration (See below) but it doesn't work
.I have attached an image of the routes. I have not created any manually, these where all created by themselves
.I have also attached an image of what I'm trying to ping. Considering I don't have access to any of the clients on any of the VLAN's I can't ping between them in any way but this ping should work to right?
192.168.120.1 is on Passage_VLAN and I'm trying to ping it from BASE_VLAN and it doesn't work
.I'm truly aware I've missed something but what
. Can somebody give me some help?This is the result of /export compact file=name
/interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
/interface ovpn-client
add certificate=xxxxxxxxxxxxx cipher=xxxxx connect-to=xxxxxxx \
mac-address=02:A0:45:05:C8:CD name=xxxxxx port=xxxx user=xxxxx
/interface vlan
add interface=BR1 name=BASE_VLAN vlan-id=99
add interface=BR1 name=Brand_VLAN vlan-id=205
add interface=BR1 name=Elbil_VLAN vlan-id=203
add interface=BR1 name=Ljud_VLAN vlan-id=207
add interface=BR1 name=Passage_VLAN vlan-id=202
add interface=BR1 name=Pool_VLAN vlan-id=206
add interface=BR1 name=Solcell_VLAN vlan-id=204
/interface list
add name=WAN
add name=VLAN
add name=BASE
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=BASE_POOL ranges=192.168.110.150-192.168.110.200
add name=Elbil_POOL ranges=192.168.130.101-192.168.130.200
add name=Solcell_POOL ranges=192.168.140.101-192.168.140.200
add name=Ljud_POOL ranges=192.168.170.101-192.168.170.199
/ip dhcp-server
add address-pool=BASE_POOL interface=BASE_VLAN name=BASE_DHCP
add address-pool=Elbil_POOL interface=Elbil_VLAN name=Elbil_DHCP
add address-pool=Solcell_POOL interface=Solcell_VLAN name=Solcell_DHCP
add address-pool=Ljud_POOL interface=Ljud_VLAN name=Ljud_DHCP
/interface bridge port
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
ether2 pvid=99
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
ether3 pvid=202
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged interface=\
ether4 pvid=203
add bridge=BR1 frame-types=admit-only-vlan-tagged interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether5 vlan-ids=202
add bridge=BR1 tagged=BR1,ether5 vlan-ids=203
add bridge=BR1 tagged=BR1,ether5 vlan-ids=204
add bridge=BR1 tagged=BR1,ether5 vlan-ids=205
add bridge=BR1 tagged=BR1,ether5 vlan-ids=206
add bridge=BR1 tagged=BR1,ether5 vlan-ids=207
add bridge=BR1 tagged=BR1,ether5 vlan-ids=99
/interface list member
add interface=ether1 list=WAN
add interface=Passage_VLAN list=VLAN
add interface=Elbil_VLAN list=VLAN
add interface=BASE_VLAN list=BASE
add interface=Brand_VLAN list=VLAN
add interface=Pool_VLAN list=VLAN
add interface=Solcell_VLAN list=VLAN
add interface=Ljud_VLAN list=VLAN
add interface=lo list=VLAN
/ip address
add address=192.168.110.1/24 interface=BASE_VLAN network=192.168.110.0
add address=x.x.x.x/20 interface=ether1 network=x.x.x.x
add address=192.168.120.1/24 interface=Passage_VLAN network=192.168.120.0
add address=192.168.130.1/24 interface=Elbil_VLAN network=192.168.130.0
add address=192.168.140.1/24 interface=Solcell_VLAN network=192.168.140.0
add address=192.168.150.1/24 interface=Brand_VLAN network=192.168.150.0
add address=192.168.160.1/24 interface=Pool_VLAN network=192.168.160.0
add address=192.168.170.1/24 interface=Ljud_VLAN network=192.168.170.0
/ip dhcp-server network
add address=192.168.110.0/24 dns-server=192.168.110.1 gateway=192.168.110.1
add address=192.168.130.0/24 dns-server=192.168.130.1 gateway=192.168.130.1
add address=192.168.140.0/24 dns-server=192.168.140.1 gateway=192.168.140.1
add address=192.168.170.0/24 gateway=192.168.170.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall address-list
add address=x.x.x.x comment="xxxxxxxxxxxx" list=\
"Allowed to connect remotely"
add address=x.x.x.x comment="Kalle list=\
"Allowed to connect remotely"
add address=x.x.x.x list="Allowed to connect remotely"
add address=x.x.x.x comment="Tony" list=\
"Allowed to connect remotely"
/ip firewall filter
add action=accept chain=input comment="Allow Estab & Related" \
connection-state=established,related
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=accept chain=input comment="Allow Base_Vlan Full Access" \
in-interface=BASE_VLAN
add action=accept chain=input comment="Allowed to connect to ports remotely" \
in-interface-list=WAN src-address-list="Allowed to connect remotely"
add action=accept chain=input in-interface=xxxxxxx
add action=drop chain=input comment=Drop
add action=accept chain=forward comment="Allow Port forwarding to VLAN" \
connection-nat-state=dstnat
add action=accept chain=forward comment="Allow Estab & Related" \
connection-state=established,related
add action=accept chain=forward comment="VLAN inter-VLAN routing" \
connection-state="" in-interface-list=VLAN log=yes
add action=accept chain=input comment="VLAN inter-VLAN routing" \
connection-state="" disabled=yes in-interface-list=VLAN
add action=accept chain=forward comment="VLAN Internet Access only" \
connection-state=new disabled=yes in-interface-list=VLAN \
out-interface-list=WAN
add action=drop chain=forward comment=Drop
/ip firewall nat
add action=masquerade chain=srcnat comment="Default masquerade" \
out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=33333 in-interface-list=WAN log=yes \
protocol=tcp src-address-list="Allowed to connect remotely" to-addresses=\
192.168.110.101 to-ports=3389
add action=dst-nat chain=dstnat dst-port=8090 in-interface-list=WAN protocol=\
tcp src-address-list="Allowed to connect remotely" to-addresses=\
192.168.110.101 to-ports=8090
/ip route
add distance=1 gateway=x.x.x.x
/system clock
set time-zone-name=xxxxxxxxxxxxxx
/system identity
set name=xxxxxxxxx
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=BASE
/tool mac-server mac-winbox
set allowed-interface-list=BASE
