Question about Firewall Rules for Inter-VLAN Communication
Posted: Sat Jan 25, 2025 7:26 pm
Hello all, I am still very new to a lot of networking concepts. I am confused about using firewall rules for inter-VLAN communication between specific IPs.
I have been watching lots of videos on RouterOS configurations and have been reading documentation (the quality of the documentation is incredible, but things are still sinking in due to the learning curve).
I am trying to understand granting inter-VLAN access between specific IPs, and seem to be missing something. I want to allow my laptop (assigned 192.168.50.26) to access my switch configuration via WinBox (assigned 192.168.99.2)
Configuration Overview:
Router - CCR2004-1G-12S+2XS
Switch - CRS310-8G+2S+
The router is connected to the switch using a VLAN trunk port. The bridge VLANs in question here are:
- Infrastructure: PVID 99
- Trusted: PVID 50
Interface VLANs:
- Infrasstructure: PVID 99, DHCP Server assigns addresses in the range 192.168.99.1/24.
- Trusted: PVID 50, DHCP Server assigns addresses in the range 192.168.50.1/24.
The router is assigned the ip 192.168.99.1.
A bridge exists that has the VLANs above defined and they tag the bridge (IPs are given out to each interface-defined VLAN), and the port interface being used as an uplink to the switch. The bridge has 'vlan filtering' enabled.
Since the ports are all connected to the same bridge, my understanding is that they can communicate with each other by default since they are combined as a single 'bridge' interface.
The switch also has a bridge and bridge vlans defined. The vlans have the router uplink port interface tagged, as well as another vlan trunk port that connects to a wifi access point.
The switch is assigned the ip 192.168.99.2.
My router firewall is set up to have an input and forward drop catch-all at the bottom of the filter list.
I have a firewall rule to drop all inter-VLAN traffic:
But right before that inter-VLAN drop all rule, I have this rule to specifically allow traffic between my laptop:
When I try to connect to WinBox, I hang on the "Connecting to 192.168.99.2..." page, and it does not progress. When I look at the firewall filter rules tab in the router, I see that the ip-specific 'accept' rule defined above increases the Bytes/Packets numbers while this connection is trying to be made. The same thing happens when I run 'ping 192.168.99.2' from my laptop.
When I run 'tracepath 192.168.99.2' from my laptop, I get the following:
My confusion is why is it 'accepted' traffic, but the connection is not established.
If anyone can give pointers or correct my incorrect assumptions, that would be great!
Please let me know if I can provide any additional information.
I will include the output from 'export file=FILENAME' below for both the router and switch.
--------------------------------------------------------------------------------------------------
Router Configuration Export:
--------------------------------------------------------------------------------------------------
Switch Configuration Export:
I have been watching lots of videos on RouterOS configurations and have been reading documentation (the quality of the documentation is incredible, but things are still sinking in due to the learning curve).
I am trying to understand granting inter-VLAN access between specific IPs, and seem to be missing something. I want to allow my laptop (assigned 192.168.50.26) to access my switch configuration via WinBox (assigned 192.168.99.2)
Configuration Overview:
Router - CCR2004-1G-12S+2XS
Switch - CRS310-8G+2S+
The router is connected to the switch using a VLAN trunk port. The bridge VLANs in question here are:
- Infrastructure: PVID 99
- Trusted: PVID 50
Interface VLANs:
- Infrasstructure: PVID 99, DHCP Server assigns addresses in the range 192.168.99.1/24.
- Trusted: PVID 50, DHCP Server assigns addresses in the range 192.168.50.1/24.
The router is assigned the ip 192.168.99.1.
A bridge exists that has the VLANs above defined and they tag the bridge (IPs are given out to each interface-defined VLAN), and the port interface being used as an uplink to the switch. The bridge has 'vlan filtering' enabled.
Since the ports are all connected to the same bridge, my understanding is that they can communicate with each other by default since they are combined as a single 'bridge' interface.
The switch also has a bridge and bridge vlans defined. The vlans have the router uplink port interface tagged, as well as another vlan trunk port that connects to a wifi access point.
The switch is assigned the ip 192.168.99.2.
My router firewall is set up to have an input and forward drop catch-all at the bottom of the filter list.
I have a firewall rule to drop all inter-VLAN traffic:
Code: Select all
add action=drop chain=forward comment="Drop all inter-VLAN traffic" \
in-interface-list=ALL_VLANS log=yes log-prefix="Dropped by inter-vlan" \
out-interface-list=ALL_VLANSBut right before that inter-VLAN drop all rule, I have this rule to specifically allow traffic between my laptop:
Code: Select all
add action=accept chain=forward \
dst-address=192.168.99.2 \
src-address=192.168.50.26When I try to connect to WinBox, I hang on the "Connecting to 192.168.99.2..." page, and it does not progress. When I look at the firewall filter rules tab in the router, I see that the ip-specific 'accept' rule defined above increases the Bytes/Packets numbers while this connection is trying to be made. The same thing happens when I run 'ping 192.168.99.2' from my laptop.
When I run 'tracepath 192.168.99.2' from my laptop, I get the following:
Code: Select all
1?: [LOCALHOST] pmtu 1500
1: _gateway 8.447ms
1: _gateway 2.106ms
2: no reply
3: no replyMy confusion is why is it 'accepted' traffic, but the connection is not established.
If anyone can give pointers or correct my incorrect assumptions, that would be great!
Please let me know if I can provide any additional information.
I will include the output from 'export file=FILENAME' below for both the router and switch.
--------------------------------------------------------------------------------------------------
Router Configuration Export:
Code: Select all
# 2025-01-25 16:29:04 by RouterOS 7.17
# software id = SOFTWARE_ID
#
# model = CCR2004-1G-12S+2XS
# serial number = SERIAL_NUMBER
/interface bridge
add name="bridge[LAN]" vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name="ether1[INFRA]"
set [ find default-name=sfp-sfpplus1 ] name="sfp-sfpplus1[WAN]"
set [ find default-name=sfp-sfpplus11 ] name="sfp-sfpplus11[UPLINK_TRUENAS]"
set [ find default-name=sfp-sfpplus12 ] name=\
"sfp-sfpplus12[UPLINK_SWITCH_2.5G]"
/interface vlan
add interface="bridge[LAN]" name=Guest vlan-id=98
add interface="bridge[LAN]" name=Infrastructure vlan-id=99
add interface="bridge[LAN]" name=IoT vlan-id=30
add interface="bridge[LAN]" name=Security vlan-id=101
add interface="bridge[LAN]" name=Servers vlan-id=100
add interface="bridge[LAN]" name=Trusted vlan-id=50
add interface="bridge[LAN]" name=Work vlan-id=20
add interface="sfp-sfpplus1[WAN]" name=pppoe-vlan vlan-id=201
/interface pppoe-client
add add-default-route=yes disabled=no interface=pppoe-vlan name=\
"pppoe-out1[CL]" use-peer-dns=yes user=PPPOE_USERNAME_HERE
/interface list
add name=WAN
add name=ALL_VLANS
/ip pool
add name=dhcp_pool_infra ranges=192.168.99.100-192.168.99.254
add name=dhcp_pool_guest ranges=192.168.98.2-192.168.98.254
add name=dhcp_pool_trusted ranges=192.168.50.100-192.168.50.254
add name=dhcp_pool_servers ranges=192.168.100.100-192.168.100.254
add name=dhcp_pool_security ranges=192.168.101.100-192.168.101.254
/ip dhcp-server
add address-pool=dhcp_pool_infra interface=Infrastructure lease-time=8h name=\
"dhcp[INFRA]"
add address-pool=dhcp_pool_guest interface=Guest name="dhcp[GUEST]"
add address-pool=dhcp_pool_trusted interface=Trusted lease-time=1h name=\
"dhcp[TRUSTED]"
add address-pool=dhcp_pool_servers interface=Servers lease-time=8h name=\
"dhcp[SERVERS]"
add address-pool=dhcp_pool_security interface=Security lease-time=4h name=\
"dhcp[SECURITY]"
/port
set 0 name=serial0
/interface bridge port
add bridge="bridge[LAN]" interface="ether1[INFRA]" pvid=99
add bridge="bridge[LAN]" interface="sfp-sfpplus12[UPLINK_SWITCH_2.5G]"
add bridge="bridge[LAN]" interface="sfp-sfpplus11[UPLINK_TRUENAS]"
/ip settings
set rp-filter=strict
/interface bridge vlan
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" untagged="ether1[INFRA]" \
vlan-ids=99
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" vlan-ids=20
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" vlan-ids=30
add bridge="bridge[LAN]" tagged="bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]\
,sfp-sfpplus11[UPLINK_TRUENAS]" vlan-ids=50
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" vlan-ids=98
add bridge="bridge[LAN]" tagged="bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]\
,sfp-sfpplus11[UPLINK_TRUENAS]" vlan-ids=100
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus12[UPLINK_SWITCH_2.5G]" vlan-ids=101
/interface list member
add interface="pppoe-out1[CL]" list=WAN
add interface=Infrastructure list=ALL_VLANS
add interface=Trusted list=ALL_VLANS
add interface=Servers list=ALL_VLANS
add interface=Security list=ALL_VLANS
add interface=IoT list=ALL_VLANS
add interface=Work list=ALL_VLANS
add interface=Guest list=ALL_VLANS
/ip address
add address=192.168.99.1/24 interface=Infrastructure network=192.168.99.0
add address=192.168.20.1/24 interface=Work network=192.168.20.0
add address=192.168.30.1/24 interface=IoT network=192.168.30.0
add address=192.168.50.1/24 interface=Trusted network=192.168.50.0
add address=192.168.98.1/24 interface=Guest network=192.168.98.0
add address=192.168.100.1/24 interface=Servers network=192.168.100.0
add address=192.168.101.1/24 interface=Security network=192.168.101.0
/ip dhcp-server lease
add address=192.168.101.2 mac-address=MAC_ADDRESS server=\
"dhcp[SECURITY]"
add address=192.168.101.3 client-id=CLIENT_ID mac-address=\
MAC_ADDRESS server="dhcp[SECURITY]"
add address=192.168.99.50 client-id=CLIENT_ID mac-address=\
MAC_ADDRESS server="dhcp[INFRA]"
add address=192.168.50.2 client-id=CLIENT_ID mac-address=\
MAC_ADDRESS server="dhcp[TRUSTED]"
add address=192.168.50.26 client-id=CLIENT_ID mac-address=\
MAC_ADDRESS server="dhcp[TRUSTED]"
add address=192.168.50.4 client-id=CLIENT_ID mac-address=\
MAC_ADDRESS server="dhcp[TRUSTED]"
add address=192.168.99.26 client-id=CLIENT_ID mac-address=\
MAC_ADDRESS server="dhcp[INFRA]"
/ip dhcp-server network
add address=192.168.50.0/24 gateway=192.168.50.1
add address=192.168.98.0/24 gateway=192.168.98.1
add address=192.168.99.0/24 gateway=192.168.99.1
add address=192.168.100.0/24 gateway=192.168.100.1
add address=192.168.101.0/24 gateway=192.168.101.1
/ip firewall address-list
add address=192.168.100.99 list=MGMT_Servers
add address=192.168.50.2 list=MGMT_Trusted
add address=192.168.99.0/24 list=MGMT_IPs
add address=192.168.50.26 list=MGMT_IPs
add address=192.168.101.2 list=IPs_SimpliSafe
add address=192.168.101.3 list=IPs_Nest
add address=192.168.50.4 list=IPs_NordVPN
add address=192.168.50.3 list=IPs_NordVPN
add address=192.168.99.0/24 list=IPs_Infrastructure
add address=192.168.99.26 list=MGMT_IPs
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid log=yes log-prefix=\
"Invalid input:"
add action=accept chain=input in-interface="!pppoe-out1[CL]" protocol=icmp
add action=drop chain=input in-interface="pppoe-out1[CL]" log=yes log-prefix=\
"Dropped by input from WAN catch-all"
add action=fasttrack-connection chain=forward comment=Forward \
connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid log=yes log-prefix=\
"Invalid forward:"
add action=accept chain=forward dst-port=443,53,123 out-interface-list=WAN \
protocol=udp
add action=accept chain=forward dst-port=80,443,8080,53,853 \
out-interface-list=WAN protocol=tcp
add action=accept chain=forward dst-port=1723 out-interface-list=WAN \
protocol=tcp src-address-list=IPs_NordVPN
add action=accept chain=forward dst-port=500,1194,4500,51820 \
out-interface-list=WAN protocol=udp src-address-list=IPs_NordVPN
add action=accept chain=forward dst-port=8890,8899 out-interface-list=WAN \
protocol=tcp src-address-list=IPs_SimpliSafe
add action=accept chain=forward dst-port=11095 out-interface-list=WAN \
protocol=tcp src-address-list=IPs_Nest
add action=accept chain=forward connection-state="" out-interface-list=WAN \
protocol=icmp
add action=accept chain=forward dst-address=192.168.99.2 src-address=\
192.168.50.241
add action=accept chain=forward comment="Allow MGMT IPs to access everything" \
out-interface-list=ALL_VLANS src-address-list=MGMT_IPs
add action=drop chain=forward comment="Drop all inter-VLAN traffic" \
in-interface-list=ALL_VLANS log=yes log-prefix="Dropped by inter-vlan" \
out-interface-list=ALL_VLANS
add action=drop chain=forward connection-state=new in-interface=\
"pppoe-out1[CL]"
add action=drop chain=forward comment="Forward Drop Catch-All" log=yes \
log-prefix="Dropped by forward catch-all"
/ip firewall nat
add action=masquerade chain=srcnat out-interface="pppoe-out1[CL]"
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system identity
set name=WilderRouter
/system note
set show-at-login=no
/system routerboard settings
set enter-setup-on=delete-key--------------------------------------------------------------------------------------------------
Switch Configuration Export:
Code: Select all
# 1970-01-10 01:14:35 by RouterOS 7.17
# software id = SOFTWARE_ID
#
# model = CRS310-8G+2S+
# serial number = SERIAL_NUMBER
/interface bridge
add admin-mac=MAC_ADDRESS auto-mac=no comment=defconf name=\
"bridge[LAN]" vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name="ether1[INFRA]"
set [ find default-name=ether2 ] name="ether2[AP_BASEMENT]"
set [ find default-name=ether3 ] name="ether3[UPLINK_STUDY]"
set [ find default-name=ether5 ] name="ether5[TRUSTED_VLAN_TEMP]"
set [ find default-name=ether7 ] name="ether7[SERVER_VLAN_TEMP]"
set [ find default-name=ether8 ] name="ether8[TRUENAS_SERVER]"
set [ find default-name=sfp-sfpplus2 ] name="sfp-sfpplus2[UPLINK_ROUTER]"
/interface vlan
add interface="bridge[LAN]" name=Infrastructure vlan-id=99
/interface list
add name=LAN
/interface bridge port
add bridge="bridge[LAN]" comment=defconf interface="ether1[INFRA]" pvid=99
add bridge="bridge[LAN]" comment=defconf interface="ether2[AP_BASEMENT]"
add bridge="bridge[LAN]" comment=defconf interface="ether3[UPLINK_STUDY]" \
pvid=50
add bridge="bridge[LAN]" comment=defconf interface=ether4
add bridge="bridge[LAN]" comment=defconf interface=\
"ether5[TRUSTED_VLAN_TEMP]" pvid=50
add bridge="bridge[LAN]" comment=defconf interface=ether6
add bridge="bridge[LAN]" comment=defconf interface="ether7[SERVER_VLAN_TEMP]" \
pvid=100
add bridge="bridge[LAN]" comment=defconf interface="ether8[TRUENAS_SERVER]" \
pvid=100
add bridge="bridge[LAN]" comment=defconf interface=sfp-sfpplus1
add bridge="bridge[LAN]" comment=defconf interface=\
"sfp-sfpplus2[UPLINK_ROUTER]"
/ip firewall connection tracking
set udp-timeout=10s
/interface bridge vlan
add bridge="bridge[LAN]" tagged=\
"bridge[LAN],sfp-sfpplus2[UPLINK_ROUTER],ether2[AP_BASEMENT]" untagged=\
"ether1[INFRA]" vlan-ids=99
add bridge="bridge[LAN]" tagged=\
"sfp-sfpplus2[UPLINK_ROUTER],ether2[AP_BASEMENT]" vlan-ids=98
add bridge="bridge[LAN]" tagged="sfp-sfpplus2[UPLINK_ROUTER]" vlan-ids=20
add bridge="bridge[LAN]" tagged="sfp-sfpplus2[UPLINK_ROUTER]" vlan-ids=30
add bridge="bridge[LAN]" tagged=\
"sfp-sfpplus2[UPLINK_ROUTER],ether2[AP_BASEMENT]" untagged=\
"ether3[UPLINK_STUDY],ether5[TRUSTED_VLAN_TEMP]" vlan-ids=50
add bridge="bridge[LAN]" tagged="sfp-sfpplus2[UPLINK_ROUTER]" untagged=\
"ether8[TRUENAS_SERVER],ether7[SERVER_VLAN_TEMP]" vlan-ids=100
add bridge="bridge[LAN]" tagged=\
"sfp-sfpplus2[UPLINK_ROUTER],ether2[AP_BASEMENT]" vlan-ids=101
/interface list member
add interface="bridge[LAN]" list=LAN
add interface=Infrastructure list=LAN
/interface ovpn-server server
add mac-address=MAC_ADDRESS name=ovpn-server1
/ip address
add address=192.168.99.2/24 interface=Infrastructure network=192.168.99.0
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system identity
set name=WilderSwitch2.5G
/system note
set show-at-login=no