Listing: Subinterfaces und IP-Adressen konfigurieren

# VLAN-Interfaces auf der Bridge
/interface vlan
add name=vlan10 vlan-id=10 interface=bridge-vlans
add name=vlan20 vlan-id=20 interface=bridge-vlans
add name=vlan30 vlan-id=30 interface=bridge-vlans
add name=vlan40 vlan-id=40 interface=bridge-vlans
# Gateways
/ip address
add address=192.168.10.1/24 interface=vlan10
add address=192.168.20.1/24 interface=vlan20
add address=192.168.30.1/24 interface=vlan30
add address=192.168.40.1/24 interface=vlan40
# DHCP-Server
/ip pool
add name=pool-mgmt ranges=192.168.10.100-192.168.10.200
add name=pool-server ranges=192.168.20.100-192.168.20.200
add name=pool-client ranges=192.168.30.100-192.168.30.200
add name=pool-iot ranges=192.168.40.100-192.168.40.200
/ip dhcp-server
add name=dhcp-mgmt interface=vlan10 address-pool=pool-mgmt disabled=no
add name=dhcp-vlan20 interface=vlan20 address-pool=pool-server disabled=no
add name=dhcp-client interface=vlan30 address-pool=pool-client disabled=no
add name=dhcp-iot interface=vlan40 address-pool=pool-iot disabled=no
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=192.168.10.1
add address=192.168.20.0/24 gateway=192.168.20.1 dns-server=192.168.20.1
add address=192.168.30.0/24 gateway=192.168.30.1 dns-server=192.168.30.1
add address=192.168.40.0/24 gateway=192.168.40.1 dns-server=192.168.40.1
RouterOS verwendet Filter-Chains (input, forward, output). Der Inter-VLAN-Traffic durchläuft
die Forward-Chain:
/ip firewall filter
# Management hat vollen Zugriff
add chain=forward in-interface=vlan10 action=accept
# Etablierte Verbindungen immer erlauben
add chain=forward connection-state=established,related action=accept
# Client -/ Server: nur definierte Ports
add chain=forward in-interface=vlan30 out-interface=vlan20 \
protocol=tcp dst-port=80,443,22,445,3389 action=accept
# Client -/ Management: gesperrt
add chain=forward in-interface=vlan30 out-interface=vlan10 action=drop
# Client -/ IoT: gesperrt
add chain=forward in-interface=vlan30 out-interface=vlan40 action=drop
# IoT -/ intern: kein Zugriff (Ausnahme: interner Update-Proxy – siehe Hinweis unten)
add chain=forward in-interface=vlan40 dst-address=192.168.0.0/16 action=drop
# Wird ein Update-Proxy intern betrieben (zum Beispiel 192.168.20.10), diese Zeile VOR dem Drop
einfügen:
# add chain=forward in-interface=vlan40 dst-address=192.168.20.10/32 protocol=tcp dst-port=80,443
action=accept
# Default Drop
add chain=forward action=drop