Networking
試圖讓 VLAN 在 Mikrotik HAP AC 和 RB4011iGS+ 之間工作
下面是網路圖:
我設置了3個vlan:
vlan1: 192.168.9.0/24 vlan11-lan: 192.168.11.0/24 vlan22-guest: 192.168.22.0/24
vlan1 工作正常。192.168.9.0/24 網路中的每個主機都在相互 ping 通。
vlan11-lan 和 vlan22-guest 無法正常工作:
- HAP AC可以ping通RB4011(192.168.11.1或192.168.22.1)
- RB4011可以ping HAP AC(192.168.11.2或192.168.22.2)
- PC5和PC2不能互相ping通,也不能ping通RB4011(192.168.11.1)或HAP AC(192.168.11.2)。他們甚至沒有在他們的 ARP 表中獲得彼此的 MAC 地址。
- PC3 無法 ping RB4011 (192.168.22.1) 或 HAP AC (192.168.22.2)。它也不會在其 ARP 表中獲取它們的 MAC 地址。
我完全禁用了防火牆,但還沒有成功。我從 Internet 介面(RB4011iGS+ 上的 eth1)出去了偽裝。
RB4011iGS+ 配置:
# nov/15/2018 22:53:31 by RouterOS 6.43.4 # software id = WP4U-Z565 # # model = RB4011iGS+ # serial number = 968A09187F4C /interface bridge add admin-mac=B8:69:F4:92:25:57 auto-mac=no comment=defconf name=bridge vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] l2mtu=1598 set [ find default-name=ether2 ] l2mtu=1598 set [ find default-name=ether3 ] l2mtu=1598 set [ find default-name=ether4 ] l2mtu=1598 set [ find default-name=ether5 ] l2mtu=1598 set [ find default-name=ether6 ] l2mtu=1598 set [ find default-name=ether7 ] l2mtu=1598 set [ find default-name=ether8 ] l2mtu=1598 set [ find default-name=ether9 ] l2mtu=1598 set [ find default-name=ether10 ] l2mtu=1598 /interface vlan add interface=ether10 name=vlan11-lan vlan-id=11 add interface=ether10 name=vlan22-guest vlan-id=22 /interface list add comment=defconf name=WAN add comment=defconf name=LAN /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip pool add name=dhcp ranges=192.168.9.50-192.168.9.254 /ip dhcp-server add address-pool=dhcp disabled=no interface=bridge name=defconf /interface bridge port add bridge=bridge interface=ether10 add bridge=bridge interface=ether5 pvid=11 add bridge=bridge interface=ether6 /ip neighbor discovery-settings set discover-interface-list=LAN /interface bridge vlan add bridge=bridge tagged=ether10 vlan-ids=11 add bridge=bridge tagged=ether10 vlan-ids=22 /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=ether1 list=WAN add list=LAN /ip address add address=192.168.100.2/24 interface=ether1 network=192.168.100.0 add address=192.168.22.1/24 interface=vlan22-guest network=192.168.22.0 add address=192.168.9.1/24 interface=bridge network=192.168.9.0 add address=192.168.11.1/24 interface=vlan11-lan network=192.168.11.0 /ip cloud set ddns-enabled=yes /ip dhcp-server network add address=192.168.9.0/24 gateway=192.168.9.1 netmask=24 /ip dns set allow-remote-requests=yes /ip dns static add address=192.168.9.1 name=router.lan /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN add action=netmap chain=dstnat dst-port=3484 in-interface=ether1 protocol=tcp to-addresses=192.168.9.4 to-ports=3306 add action=netmap chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.9.6 to-ports=3389 add action=masquerade chain=srcnat dst-port=80 protocol=tcp src-address=192.168.9.0/24 add action=netmap chain=dstnat dst-port=80 in-interface=ether1 protocol=tcp to-addresses=192.168.9.4 to-ports=80 /ip route add distance=1 gateway=192.168.100.1 /ip traffic-flow set cache-entries=32k interfaces=local /system clock set time-zone-name=Europe/Moscow /system identity set name=RB4011 /system routerboard settings set silent-boot=no /tool mac-server set allowed-interface-list=LAN /tool mac-server mac-winbox set allowed-interface-list=LAN /tool sniffer set filter-interface=ether10
HAP AC 配置:
# nov/15/2018 22:47:07 by RouterOS 6.43.2 # software id = R9TC-1I4K # # model = RouterBOARD 962UiGS-5HacT2HnT # serial number = 6737065A9A5D /interface bridge add admin-mac=6C:3B:6B:11:EB:C1 auto-mac=no name=bridge vlan-filtering=yes /interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=MikroTik-11EBC7 wireless-protocol=802.11 set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=MikroTik-11EBC6 wireless-protocol=802.11 /interface vlan add interface=ether1 name=vlan11-lan vlan-id=11 add interface=ether1 name=vlan22-guest vlan-id=22 /interface list add comment=defconf name=WAN add comment=defconf name=LAN /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=1620290162 wpa2-pre-shared-key=1620290162 /ip hotspot profile set [ find default=yes ] html-directory=flash/hotspot /interface bridge port add bridge=bridge interface=ether1 add bridge=bridge interface=ether3 add bridge=bridge interface=ether4 pvid=11 add bridge=bridge interface=ether5 pvid=22 /interface bridge vlan add bridge=bridge tagged=ether1 vlan-ids=11 add bridge=bridge tagged=ether1 vlan-ids=22 /interface list member add comment=defconf interface=bridge list=LAN add interface=sfp1 list=WAN /ip address add address=192.168.22.2/24 interface=vlan22-guest network=192.168.22.0 add address=192.168.9.2/24 interface=bridge network=192.168.9.0 add address=192.168.11.2/24 interface=vlan11-lan network=192.168.11.0 /ip dns set allow-remote-requests=yes /ip dns static add address=192.168.9.2 name=router.lan /ip route add distance=1 gateway=192.168.9.1 /system clock set time-zone-name=Europe/Moscow /system identity set name=HAP_AC /system routerboard settings set silent-boot=no /tool sniffer set filter-interface=ether1 filter-ip-address=!192.168.13.2/32
感謝您的想法!該問題的完整答案如下:
- 在兩個網橋上添加網橋作為 VLAN 成員(感謝 grawity):
/interface bridge vlan add bridge=bridge tagged=ether10,bridge untagged=ether5 vlan-ids=11 add bridge=bridge tagged=ether10,bridge vlan-ids=22 /interface bridge vlan add bridge=bridge tagged=ether1,bridge untagged=ether4 vlan-ids=11 add bridge=bridge tagged=ether1,bridge untagged=ether5 vlan-ids=22
- 將 vlan 介面從中繼介面移動到網橋:
/interface vlan add interface=bridge name=vlan11-lan vlan-id=11 add interface=bridge name=vlan22-guest vlan-id=22 /interface vlan add interface=bridge name=vlan11-lan vlan-id=11 add interface=bridge name=vlan22-guest vlan-id=22
修復了 RB4011iGS+ 配置:
# nov/16/2018 19:24:29 by RouterOS 6.43.4 # software id = WP4U-Z565 # # model = RB4011iGS+ # serial number = 968A09187F4C /interface bridge add admin-mac=B8:69:F4:92:25:57 auto-mac=no name=bridge vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] l2mtu=1598 set [ find default-name=ether2 ] l2mtu=1598 set [ find default-name=ether3 ] l2mtu=1598 set [ find default-name=ether4 ] l2mtu=1598 set [ find default-name=ether5 ] l2mtu=1598 set [ find default-name=ether6 ] l2mtu=1598 set [ find default-name=ether7 ] l2mtu=1598 set [ find default-name=ether8 ] l2mtu=1598 set [ find default-name=ether9 ] l2mtu=1598 set [ find default-name=ether10 ] l2mtu=1598 /interface vlan add interface=bridge name=vlan11-lan vlan-id=11 add interface=bridge name=vlan22-guest vlan-id=22 /interface list add comment=defconf name=WAN add comment=defconf name=LAN /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip pool add name=dhcp ranges=192.168.9.50-192.168.9.254 /ip dhcp-server add address-pool=dhcp disabled=no interface=bridge name=defconf /interface bridge port add bridge=bridge interface=ether10 add bridge=bridge interface=ether5 pvid=11 add bridge=bridge interface=ether6 /ip neighbor discovery-settings set discover-interface-list=LAN /interface bridge vlan add bridge=bridge tagged=ether10,bridge untagged=ether5 vlan-ids=11 add bridge=bridge tagged=ether10,bridge vlan-ids=22 /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=ether1 list=WAN add list=LAN /ip address add address=192.168.100.2/24 interface=ether1 network=192.168.100.0 add address=192.168.22.1/24 interface=vlan22-guest network=192.168.22.0 add address=192.168.9.1/24 interface=bridge network=192.168.9.0 add address=192.168.11.1/24 interface=vlan11-lan network=192.168.11.0 /ip cloud set ddns-enabled=yes /ip dhcp-server network add address=192.168.9.0/24 gateway=192.168.9.1 netmask=24 /ip dns set allow-remote-requests=yes servers=8.8.8.8 /ip dns static add address=192.168.9.1 name=router.lan /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN add action=netmap chain=dstnat dst-port=3484 in-interface=ether1 protocol=tcp to-addresses=192.168.9.4 to-ports=3306 add action=netmap chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.9.6 to-ports=3389 add action=masquerade chain=srcnat dst-port=80 protocol=tcp src-address=192.168.9.0/24 add action=netmap chain=dstnat dst-port=80 in-interface=ether1 protocol=tcp to-addresses=192.168.9.4 to-ports=80 /ip route add distance=1 gateway=192.168.100.1 /ip traffic-flow set cache-entries=32k interfaces=local /system clock set time-zone-name=Europe/Moscow /system identity set name=RB4011 /system routerboard settings set silent-boot=no /tool mac-server set allowed-interface-list=LAN /tool mac-server mac-winbox set allowed-interface-list=LAN /tool sniffer set filter-interface=vlan22-guest
固定 HAP AC 配置:
# nov/16/2018 19:20:06 by RouterOS 6.43.4 # software id = R9TC-1I4K # # model = RouterBOARD 962UiGS-5HacT2HnT # serial number = 6737065A9A5D /interface bridge add admin-mac=6C:3B:6B:11:EB:C1 auto-mac=no name=bridge vlan-filtering=yes /interface ethernet set [ find default-name=ether3 ] disabled=yes /interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=MikroTik-11EBC7 wireless-protocol=802.11 set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=MikroTik-11EBC6 wireless-protocol=802.11 /interface vlan add interface=bridge name=vlan11-lan vlan-id=11 add interface=bridge name=vlan22-guest vlan-id=22 /interface list add comment=defconf name=WAN add comment=defconf name=LAN /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=1234567123 wpa2-pre-shared-key=1234567123 /ip hotspot profile set [ find default=yes ] html-directory=flash/hotspot /interface bridge port add bridge=bridge interface=ether1 add bridge=bridge interface=ether3 add bridge=bridge interface=ether4 pvid=11 add bridge=bridge interface=ether5 pvid=22 /interface bridge vlan add bridge=bridge tagged=ether1,bridge untagged=ether4 vlan-ids=11 add bridge=bridge tagged=ether1,bridge untagged=ether5 vlan-ids=22 /interface list member add comment=defconf interface=bridge list=LAN add interface=sfp1 list=WAN /ip address add address=192.168.22.2/24 interface=vlan22-guest network=192.168.22.0 add address=192.168.9.2/24 interface=bridge network=192.168.9.0 add address=192.168.11.2/24 interface=vlan11-lan network=192.168.11.0 /ip dns set allow-remote-requests=yes servers=8.8.8.8 /ip dns static add address=192.168.9.2 name=router.lan /ip route add distance=1 gateway=192.168.9.1 add distance=1 gateway=192.168.22.1 /system clock set time-zone-name=Europe/Moscow /system identity set name=HAP_AC /system routerboard settings set silent-boot=no /tool sniffer set filter-interface=ether1 filter-ip-address=!192.168.13.2/32
創建一個禁用 vlan-filtering 的網橋,以避免在完全配置 VLAN 之前失去對路由器的訪問。
/interface bridge add name=bridge1 vlan-filtering=no
添加網橋埠並為 VLAN 訪問埠指定 pvid,以將其未標記的流量分配給預期的 VLAN。
/interface bridge port add bridge=bridge1 interface=ether10 add bridge=bridge1 interface=ether5 pvid=11 add bridge=bridge1 interface=ether6 pvid=12
添加網橋 VLAN 條目並在其中指定標記和未標記埠。
/interface bridge vlan add bridge=bridge1 tagged=ether10 untagged=ether5 vlan-ids=11 add bridge=bridge1 tagged=ether10 untagged=ether6 vlan-ids=12 add bridge=bridge1 tagged=ether10 vlan-ids=22
最後,當 VLAN 配置完成後,啟用 Bridge VLAN Filtering。
/interface bridge set bridge1 vlan-filtering=yes
這是第一個路由器,對另一個做同樣的事情(不要忘記相應地更改埠和 pvid、vlan 號)