Zdravim všechny
potrebuju radu, mam tri mikrotiky v siti, na jednom je udelana logika site. Celkem jsou konfigurovany 4 VLANy. Potrebuju vedet jak udelat, aby z vlanu kupříkladu 100, nebyl pristup do vlany 5, ale opacne ano. Prikladam konfiguraci ( není udelana zadna blokace mezi vlan )
Diky za rady
# jan/13/2018 18 by RouterOS 6.41
# software id = GTJK-084S
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number =
/interface bridge
add fast-forward=no name=VLAN
add comment=LAN fast-forward=no name=br-vlan5
add fast-forward=no name=br-vlan99
add fast-forward=no name=br-vlan100
/interface pppoe-client
add add-default-route=yes comment=WAN disabled=no interface=ether1 \
keepalive-timeout=60 max-mru=1480 max-mtu=1480 name=O2_VDSL password=o2 \
user=o2
/interface vlan
add interface=VLAN name=vlan5 vlan-id=5
add interface=VLAN name=vlan99 vlan-id=99
add interface=VLAN name=vlan100 vlan-id=100
/interface wireless security-profiles
set supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=xxxxx supplicant-identity="" \
wpa2-pre-shared-key=xxxxx
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=xxxxx supplicant-identity="" \
wpa2-pre-shared-key=xxxxx
/interface wireless
set band=2ghz-b/g/n bridge-mode=disabled \
channel-width=20/40mhz-eC country="czech republic" disabled=no frequency=\
auto hide-ssid=yes mode=ap-bridge security-profile=pomustr ssid=xxxxx \
wps-mode=disabled
set band=5ghz-onlyac bridge-mode=disabled \
channel-width=20/40/80mhz-Ceee country="czech republic" disabled=no \
hide-ssid=yes mode=ap-bridge security-profile=miras ssid=xxxxx \
wps-mode=disabled
/ip hotspot profile
set html-directory=flash/hotspot
/ip pool
add name=dhcp_pool1 ranges=192.168.5.101-192.168.5.119
add name=dhcp_pool2 ranges=192.168.11.2-192.168.11.254
add name=dhcp_pool3 ranges=192.168.100.2-192.168.100.254
/ip dhcp-server
add address-pool=dhcp_pool1 authoritative=after-2sec-delay disabled=no \
interface=br-vlan5 lease-time=1w name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface=VLAN lease-time=1w10m name=\
dhcp2
add address-pool=dhcp_pool3 disabled=no interface=br-vlan100 lease-time=1w10m \
name=dhcp3
/queue simple
add max-limit=512k/3M name=queue1 target=\
192.168.5.102/32,192.168.5.108/32,192.168.5.101/32,192.168.5.103/32
/queue tree
add disabled=yes limit-at=1024k max-limit=1024k name=queue1 packet-mark=\
Adelka parent=global
/interface bridge port
add bridge=br-vlan5 hw=no interface=ether2
add bridge=br-vlan5 hw=no interface=ether3
add bridge=br-vlan5 hw=no interface=ether4
add bridge=br-vlan5 hw=no interface=sfp1
add bridge=br-vlan5 hw=no interface=wlan1
add bridge=br-vlan5 hw=no interface=wlan2
add bridge=VLAN interface=ether5
add bridge=br-vlan5 interface=vlan5
add bridge=br-vlan99 interface=vlan99
add bridge=br-vlan100 interface=vlan100
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=192.168.5.138/24 interface=br-vlan5 network=192.168.5.0
add address=192.168.11.1/24 interface=VLAN network=192.168.11.0
add address=192.168.99.1/24 interface=vlan99 network=192.168.99.0
add address=192.168.100.1/24 interface=br-vlan100 network=192.168.100.0
/ip dhcp-server lease
add address=192.168.5.108 client-id=1 mac-address=\
XX server=dhcp1
add address=192.168.5.101 client-id=1 mac-address=\
XX server=dhcp1
add address=192.168.5.103 client-id=1 mac-address=\
XX server=dhcp1
add address=192.168.5.102 client-id=1 mac-address=\
XX server=dhcp1
/ip dhcp-server network
add address=192.168.5.0/24 dns-server=\
217.31.204.130,193.29.206.206,8.8.8.8,8.8.4.4 gateway=192.168.5.138 \
netmask=24
add address=192.168.11.0/24 gateway=192.168.11.1
add address=192.168.100.0/24 gateway=192.168.100.1
/ip dns
set allow-remote-requests=yes servers=\
217.31.204.130,193.29.206.206,8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.5.138 name=xxxxx
/ip firewall filter
add action=accept chain=input in-interface=O2_VDSL protocol=icmp
add action=accept chain=input connection-state=established in-interface=\
O2_VDSL
add action=accept chain=input connection-state=related in-interface=O2_VDSL
add action=accept chain=input in-interface=O2_VDSL port=8291 protocol=tcp
add action=drop chain=input in-interface=O2_VDSL
add action=accept chain=forward connection-state=established in-interface=\
O2_VDSL
add action=accept chain=forward connection-state=related in-interface=O2_VDSL
add action=drop chain=forward connection-state=invalid in-interface=O2_VDSL
add action=accept chain=forward
/ip firewall mangle
add action=mark-packet chain=prerouting disabled=yes new-packet-mark=xxxxx \
passthrough=yes src-mac-address=XX
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes out-interface=O2_VDSL \
src-address=192.168.5.101-192.168.5.119
add action=masquerade chain=srcnat disabled=yes src-address=192.168.11.0/24
add action=masquerade chain=srcnat
/ip smb shares
set directory=/pub
/system clock
set time-zone-name=Europe/Prague
/system identity
set name=xxxxx
/system leds
set 1 interface=wlan2
/system ntp client
set enabled=yes primary-ntp=217.31.202.100 secondary-ntp=195.113.144.201
