Mikrotik - vLANs, Firewall

Wieder mal so ein Mikrotik-Moment 😫

Habe mir am WE Zeit genommen, meinen CRS326 mit Hilfe von netinstall und der aktuellen RC (7.7.4) frisch zu betanken.

Im Anschluss habe ich den aktuell relevanten Teil der Einstellungen mit Hilfe eines "export-Files" wieder rekonstruiert. Im Prinzip sollte das einfach nur zum Training sein und ggfs. Fehler aus der Vergangenheit eliminieren. Gerade im Kontext zur offiziellen Mikrotik-Doku zu den vLANs sind mir da ein paar Fragen auf die Füße gefallen – die will ich aber noch gegenprüfen bevor ich die ggfs. hier einstelle.

Eine Sache "brennt" jedoch etwas:

Aktuell kann ich vom vLAN44 (10.98.44.0/26) zwar nicht auf den Mikrotik (10.98.44.1) jedoch auf alle Geräte im vLAN33 (10.98.33.0/26) zugreifen, anpingen, Homepage aufrufen, usw.

Eigentlich dachte ich, ich hätte das mit forward-Regeln in der Firewall ausgeschlossen. Ebenso habe ich in den Settings der (vlan)Bridge die Firewall aktiviert und auch testweise deaktivert?!

GELÖSCHT

Sieht man sich die FW-Regeln an, liegt ja eigentlich nur die (automatische) Fast forward-Regel darüber und bei den inter-vLAN-Regeln scheint auch kein Traffic aufzulaufen?!

Hat jemand eine Idee?

Bitte markiere auch die Kommentare, die zur Lösung des Beitrags beigetragen haben

Content-ID: 5265547280

Url: https://administrator.de/forum/mikrotik-vlans-firewall-5265547280.html

Ausgedruckt am: 23.12.2024 um 16:12 Uhr

7 Kommentare

Neuester Kommentar

Punkt 1: Tu uns einen Gefallen und pack das Webfig ganz weit weg, das ist oftmals Buggy und zeigt einem nicht immer die Wahrheit.

Punkt 2: Nimm Winbox oder das Terminal und poste einen "Export" damit kann man wenigstens mehr anfangen und hat ein komplettes Bild der Situation und nicht nur einen Ausschnitt!

Punkt 3: Aktivieren der Firewall auf dem Bridge-Interface ist nicht nötig braucht man nur wenn Layer-2 Traffic auch durch die FW gehen soll, schadet aber für solche Tests auch erst mal nicht.

Punkt 4: IPv6 auch berücksichtigen ...

Gruß Wurstel

Grummel, grummel, wenns der Wahrheitsfindung dient

# jan/09/2023 14:41:41 by RouterOS 7.7rc4
# software id = 5DQL-79U4
#
# model = CRS326-24G-2S+
# serial number = DA720D578C8E
/interface bridge
add frame-types=admit-only-vlan-tagged ingress-filtering=no name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=WAN1_Cable
set [ find default-name=ether2 ] name=WAN2_trunk
set [ find default-name=ether3 ] name=ether03_trunk
set [ find default-name=ether4 ] auto-negotiation=no name=ether04_mgmt
set [ find default-name=ether5 ] disabled=yes name=ether05_11
set [ find default-name=ether6 ] disabled=yes name=ether06_11
set [ find default-name=ether7 ] disabled=yes name=ether07_11
set [ find default-name=ether8 ] disabled=yes name=ether08_11
set [ find default-name=ether9 ] name=ether09_22
set [ find default-name=ether10 ] name=ether10_33
set [ find default-name=ether11 ] name=ether11_33
set [ find default-name=ether12 ] name=ether12_33
set [ find default-name=ether13 ] name=ether13_33
set [ find default-name=ether14 ] name=ether14_33
set [ find default-name=ether15 ] name=ether15_33
set [ find default-name=ether16 ] disabled=yes name=ether16_trunk
set [ find default-name=ether17 ] name=ether17_44
set [ find default-name=ether18 ] name=ether18_44
set [ find default-name=ether19 ] name=ether19_44
set [ find default-name=ether20 ] name=ether20_44
set [ find default-name=ether21 ] name=ether21_44
set [ find default-name=ether22 ] name=ether22_44
set [ find default-name=ether23 ] name=ether23_trunk
set [ find default-name=ether24 ] name=ether24_default
set [ find default-name=sfp-sfpplus2 ] disabled=yes name=sfp2.5_trunk
set [ find default-name=sfp-sfpplus1 ] disabled=yes name=sfp10_trunk
/interface wireguard
add listen-port=51888 mtu=1420 name=wg_7530
/interface vlan
add interface=bridge name=vlan11 vlan-id=11
add interface=bridge name=vlan22 vlan-id=22
add interface=bridge name=vlan33 vlan-id=33
add interface=bridge name=vlan44 vlan-id=44
add interface=bridge name=vlan_mgmt vlan-id=1
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface ethernet switch port
set 0 l3-hw-offloading=no
/interface list
add name=LAN
add name=WAN
add name=Mgmt
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp11 ranges=10.98.11.10-10.98.11.49
add name=dhcp22 ranges=10.98.22.10-10.98.22.49
add name=dhcp33 ranges=10.98.33.10-10.98.33.49
add name=dhcp44 ranges=10.98.44.10-10.98.44.49
/ip dhcp-server
add address-pool=dhcp11 interface=vlan11 name=dhcp11
add address-pool=dhcp22 interface=vlan22 name=dhcp22
add address-pool=dhcp33 interface=vlan33 name=dhcp33
add address-pool=dhcp44 interface=vlan44 name=dhcp44
/port
set 0 name=serial0
/routing table
add disabled=no fib name=to_WAN1
add disabled=yes fib name=to_WAN2
/interface bridge port
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether03_trunk
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether04_mgmt
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether05_11 pvid=11
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether06_11 pvid=11
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether07_11 pvid=11
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether08_11 pvid=11
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether09_22 pvid=22
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether10_33 pvid=33
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether11_33 pvid=33
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether12_33 pvid=33
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether13_33 pvid=33
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether14_33 pvid=33
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether15_33 pvid=33
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether16_trunk
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether17_44 pvid=44
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether18_44 pvid=44
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether19_44 pvid=44
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether20_44 pvid=44
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether21_44 pvid=44
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether22_44 pvid=44
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether23_trunk
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp2.5_trunk
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp10_trunk
add bridge=bridge frame-types=admit-only-vlan-tagged interface=WAN2_trunk
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/ip neighbor discovery-settings
set discover-interface-list=none
/interface bridge vlan
add bridge=bridge tagged=bridge,WAN2_trunk,ether03_trunk,ether16_trunk,ether23_trunk,sfp2.5_trunk,sfp10_trunk untagged=ether04_mgmt vlan-ids=1
add bridge=bridge tagged=WAN2_trunk,ether03_trunk,ether16_trunk,ether23_trunk,sfp2.5_trunk,sfp10_trunk,bridge vlan-ids=11
add bridge=bridge tagged=WAN2_trunk,ether03_trunk,ether16_trunk,ether23_trunk,sfp2.5_trunk,sfp10_trunk,bridge vlan-ids=22
add bridge=bridge tagged=WAN2_trunk,ether03_trunk,ether16_trunk,ether23_trunk,sfp10_trunk,sfp2.5_trunk,bridge vlan-ids=33
add bridge=bridge tagged=WAN2_trunk,ether03_trunk,ether16_trunk,ether23_trunk,sfp2.5_trunk,sfp10_trunk,bridge vlan-ids=44
/interface detect-internet
set detect-interface-list=WAN internet-interface-list=dynamic lan-interface-list=LAN wan-interface-list=WAN
/interface list member
add interface=bridge list=LAN
add interface=ether03_trunk list=LAN
add interface=ether04_mgmt list=LAN
add interface=ether05_11 list=LAN
add interface=ether06_11 list=LAN
add interface=ether07_11 list=LAN
add interface=ether08_11 list=LAN
add interface=ether09_22 list=LAN
add interface=ether10_33 list=LAN
add interface=ether11_33 list=LAN
add interface=ether12_33 list=LAN
add interface=ether13_33 list=LAN
add interface=ether14_33 list=LAN
add interface=ether15_33 list=LAN
add interface=ether16_trunk list=LAN
add interface=ether17_44 list=LAN
add interface=ether18_44 list=LAN
add interface=ether19_44 list=LAN
add interface=ether20_44 list=LAN
add interface=ether21_44 list=LAN
add interface=ether22_44 list=LAN
add interface=ether23_trunk list=LAN
add interface=sfp2.5_trunk list=LAN
add interface=sfp10_trunk list=LAN
add interface=vlan_mgmt list=LAN
add interface=vlan11 list=LAN
add interface=vlan22 list=LAN
add interface=vlan33 list=LAN
add interface=vlan44 list=LAN
add interface=WAN1_Cable list=WAN
add interface=WAN2_trunk list=WAN
add interface=vlan_mgmt list=Mgmt
add interface=ether24_default list=Mgmt
/ip address
add address=10.98.1.1/26 interface=vlan_mgmt network=10.98.1.0
add address=10.98.11.1/26 interface=vlan11 network=10.98.11.0
add address=10.98.22.1/26 interface=vlan22 network=10.98.22.0
add address=10.98.33.1/26 interface=vlan33 network=10.98.33.0
add address=10.98.44.1/26 interface=vlan44 network=10.98.44.0
add address=192.168.77.1/26 interface=wg_7530 network=192.168.77.0
/ip cloud
set ddns-enabled=yes
/ip cloud advanced
set use-local-address=yes
/ip dhcp-client
add interface=WAN1_Cable
/ip dhcp-server config
set accounting=no
/ip dhcp-server lease
add address=10.98.33.7 mac-address=52:54:00:D0:6C:14 server=dhcp33
add address=10.98.33.8 mac-address=52:54:00:8B:E7:27 server=dhcp33
add address=10.98.33.4 mac-address=B4:22:00:23:71:50 server=dhcp33
/ip dhcp-server network
add address=10.98.1.0/26 dns-server=9.9.9.9 gateway=10.98.1.1 netmask=26 ntp-server=129.70.132.34,178.215.228.24
add address=10.98.11.0/26 dns-server=10.98.11.1,9.9.9.9 gateway=10.98.11.1 netmask=26 ntp-server=178.215.228.24,129.70.132.34
add address=10.98.22.0/26 dns-server=10.98.22.1,9.9.9.9 gateway=10.98.22.1 netmask=26 ntp-server=129.70.132.34,178.215.228.24
add address=10.98.33.0/26 dns-server=10.98.33.2,9.9.9.9 gateway=10.98.33.1 netmask=26 ntp-server=129.70.132.34,178.215.228.24
add address=10.98.44.0/26 dns-server=10.98.44.1,9.9.9.9 gateway=10.98.44.1 netmask=26 ntp-server=129.70.132.34,178.215.228.24
/ip dns
set cache-size=4096KiB
/ip firewall address-list
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
/ip firewall filter
add action=drop chain=forward comment=vLAN-FW disabled=yes dst-address=10.98.0.0/16 log-prefix=vLAN-FW_Gaeste src-address=10.98.11.0/26
add action=drop chain=forward dst-address=10.98.1.0/26 src-address=10.98.44.0/26
add action=drop chain=forward dst-address=10.98.22.0/26 src-address=10.98.44.0/26
add action=drop chain=forward dst-address=10.98.33.0/26 log-prefix=vLAN44-FW src-address=10.98.44.0/26
add action=drop chain=input comment="drop invalid" connection-state=invalid  
add action=accept chain=input comment="accept established, related" connection-state=established,related  
add action=drop chain=input comment="block everything else" in-interface-list=!LAN log-prefix=drop_in_!LAN  
add action=fasttrack-connection chain=forward comment="FastTrack inkl. hw-offload, established, related" connection-state=established,related hw-offload=yes  
add action=accept chain=forward comment="FastTrack_Fallback, established, related, untracked" connection-state=established,related,untracked  
add action=drop chain=forward comment="drop all NEW from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN log-prefix="drop_forw_ !NAT"  
/ip firewall mangle
add action=mark-connection chain=output connection-mark=no-mark connection-state=new new-connection-mark=WAN1_conn out-interface=WAN1_Cable passthrough=yes
add action=mark-connection chain=output connection-mark=no-mark connection-state=new disabled=yes new-connection-mark=WAN2_conn out-interface=WAN2_trunk passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN1_Cable
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set sip disabled=yes sip-direct-media=no
set pptp disabled=yes
/ip route
add disabled=no distance=1 dst-address=192.168.66.0/26 gateway=wg_7530 pref-src="" routing-table=main suppress-hw-offload=no  
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=10.98.1.0/26,10.98.33.0/26
set ssh disabled=yes
set api disabled=yes
set winbox address=10.98.1.0/26,10.98.33.0/26
set api-ssl address=10.98.1.0/26,10.98.33.0/26
/ip ssh
set strong-crypto=yes
/ip traffic-flow
set interfaces=WAN1_Cable
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=CRS326-24G-2S+
/system logging
add topics=route
add topics=dhcp
add topics=manager
add topics=radius
add topics=wireguard
add topics=dot1x
/system ntp client
set enabled=yes
/system ntp server
set broadcast=yes broadcast-addresses=10.98.1.1 enabled=yes
/system ntp client servers
add address=0.de.pool.ntp.org
add address=3.de.pool.ntp.org
/system package update
set channel=testing
/system routerboard settings
set auto-upgrade=yes boot-os=router-os
/tool bandwidth-server
set authenticate=no enabled=no
/tool graphing interface
add interface=WAN2_trunk store-on-disk=no
add interface=WAN1_Cable store-on-disk=no
add interface=vlan11 store-on-disk=no
add interface=vlan22 store-on-disk=no
add interface=vlan33 store-on-disk=no
add interface=vlan44 store-on-disk=no
add interface=*23 store-on-disk=no
add interface=*2B store-on-disk=no
/tool graphing resource
add store-on-disk=no
/tool mac-server
set allowed-interface-list=Mgmt
/tool mac-server mac-winbox
set allowed-interface-list=Mgmt

/interface list member

Das ist schonmal falsch, hier gehören nur die einzelnen VLAN Interfaces rein nicht die Bridge an sich und auch nicht die Raw Interfaces!
Und das Hardwareoffloading für Tests auch erst deaktivieren.

Mein Gott, „falsch“ ist immer so ein hartes Wort! Für 2023 sollten wir das „wording“ überarbeiten

Ok, habs mal so geändert und hw-offload 3 auf dem Chip „global“ deaktiviert. Ich mache nachher sicherheitshalber ncoh nen Neustart und prüfe das Ergebnis. Das mit den Listen hatte ich auch in einem Anfall von Größenwahn gegenüber meinem alten Setup verschlimmbessert.