MikroTik

Community discussions
https://forum.mikrotik.com/

Need help setting DHCP server VLAN

https://forum.mikrotik.com/viewtopic.php?t=214581

Page 1 of 1

Need help setting DHCP server VLAN

Posted: Sat Feb 08, 2025 4:15 pm
by TxemacgMK
Hi all, i'm new to Mikrotik and need some help with my configuration, i need to setup a DHCP server on a VLAN 11 so my ISP router can get an IP for the VOIP (internet works perfect on VLAN 20), but when i create another DHCP server i get the error of "no IP address on interface"
Code: Select all
# 2025-02-08 14:03:49 by RouterOS 7.17.1
# software id = PLE9-LR9F
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = XXXXXXXXX
/interface bridge
add admin-mac=XXXXXXXXXXXXXX auto-mac=no comment=defconf name=bridge
add comment="Docker DNS AdGuard" name=contenedor-adguard
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac \
    configuration.mode=ap .ssid=MikroTik-2D2097 \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Spain .mode=ap .ssid=Mikrotik disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
/interface veth
add address=172.19.0.2/24 gateway=172.19.0.1 gateway6="" name=veth1
/interface vlan
add interface=ether1 name=vlan-internet vlan-id=20
add comment="VLAN 11 VOIP DIGI" interface=ether5 name=vlan_VOIP_DIGI vlan-id=\
    11
add interface=ether5 name=vlan_router_digi vlan-id=20
/disk
set usb1 media-interface=bridge media-sharing=yes smb-sharing=yes
set usb2 media-interface=bridge media-sharing=yes smb-sharing=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan-internet name=\
    pppoe-internet user=XXXXXXXXX
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add comment="Pool PPPoE DIGI" name=pool_pppoe_server ranges=\
    10.0.1.200-10.0.1.250
add comment="Pool de IPs para VOIP DIGI" name=pool-IPv4_RouterDIGIVoIP \
    ranges=100.111.120.10-100.111.120.15
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
# No IP address on interface
add address-pool=pool-IPv4_RouterDIGIVoIP authoritative=after-2sec-delay \
    comment="DHCP VOIP DIGI" interface=vlan_VOIP_DIGI lease-time=3d30m name=\
    dhcp_DIGIVoIP
/ppp profile
add local-address=10.0.1.1 name=pppoe_server_digi remote-address=\
    pool_pppoe_server
/container
add interface=veth1 logging=yes root-dir=usb2/etc start-on-boot=yes workdir=\
    /opt/adguardhome/work
/container config
set registry-url=https://registry-1.docker.io tmpdir=/adguard
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
add bridge=contenedor-adguard comment="AdGuard DNS" interface=veth1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-internet list=WAN
/interface pppoe-server server
add authentication=chap,mschap1,mschap2 default-profile=pppoe_server_digi \
    disabled=no interface=vlan_router_digi service-name=servicio_router_digi
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=172.19.0.1/24 comment="IP DNS AdGuard" interface=\
    contenedor-adguard network=172.19.0.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.254 client-id=XXXXXXXXXXXX mac-address=\
    00:11:32:80:9A:34 server=defconf
add address=192.168.88.251 client-id=XXXXXXXXXXXX mac-address=\
    FC:34:97:91:63:90 server=defconf
add address=192.168.88.241 client-id=XXXXXXXXXXXX mac-address=\
    FC:34:97:76:4B:40 server=defconf
add address=192.168.88.240 client-id=XXXXXXXXXXXX mac-address=\
    FC:34:97:B1:E2:D0 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment="Servidor DHCP con DNS AdGuard" \
    dns-server=172.19.0.2 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes cache-size=10048KiB servers=\
    1.1.1.1,8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment=Torrent dst-port=XXXXX \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.88.254 to-ports=\
    XXXXX
add action=dst-nat chain=dstnat comment=Torrent dst-port=XXXXX \
    in-interface-list=WAN protocol=udp to-addresses=192.168.88.254 to-ports=\
    XXXXX
add action=masquerade chain=srcnat comment="Masquerade VOIP DIGI" \
    src-address=100.111.120.0/24
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/ppp secret
add name=XXXXXXXXXXXX profile=pppoe_server_digi service=pppoe
/system clock
set time-zone-name=Europe/Madrid
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.es.pool.ntp.org
add address=1.es.pool.ntp.org
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :if ([system leds settings get all-leds-off] = \"never\") do={\r\
    \n     /system leds settings set all-leds-off=immediate \r\
    \n   } else={\r\
    \n     /system leds settings set all-leds-off=never \r\
    \n   }\r\
    \n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
    p\" && disabled=no)] do={\r\
    \n     /interface/wifi wps-push-button \$iface;}\r\
    \n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Thank you

Re: Need help setting DHCP server VLAN

Posted: Sat Feb 08, 2025 8:42 pm
by erlinden
Please have a very good look at this great topic, it describes the configuration of VLAN's in multiple situations:
viewtopic.php?t=143620

First things I notice on your config:
  • no VLAN filtering on bridge
  • multiple bridges

Re: Need help setting DHCP server VLAN

Posted: Sat Feb 08, 2025 9:27 pm
by anav
Single bridge for all data vlans as per viewtopic.php?t=143620

The single bridge will also be the interface for both ISP vlans.
These vlans however will not get any dhcp, Ip address etc..............
The WAN Vlan will get terminated at either the IP DHCP client settings or the PPPOE settings etc. and thus will not be seen on any /interface bridge vlan settings.
The VOIP Vlan will simple get passed, transparently, from incoming port to VOIP device on port X of router or possibly passed down a trunk port to a switch and then to VOIP device.
If the VOIP device cannot read tagged data, the traffic as last step is untagged to the VOIP device.

At least thats my limited understanding.
All times are UTC+02:00
Page 1 of 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/