solero
May 03, 2021, updated at May 06, 2021 (UTC)
view3002
view6
0
Goto Top

Multicast über Mikrotik WLAN - LAN Bridge reichen

GermansolvedQuestionRouters, RoutingNetworks
Lösung: Ich hatte nur eine FW-Regel zu fest gezogen und damit jeglichen nicht-unicast traffic geblockt.
__________________________________

Hallo zusammen,

in meinem Setup versuche ich Multicast Traffic innerhalb desselben VLANs zwischen LAN und WLAN zu tauschen.

Ich habe seit mehreren Jahren ein Heimnetz auf Mikrotik-Basis mit einem Mikrotik Router und mehreren CAP, die ich per CAPsMAN steuere, der auf dem MT läuft. Das Netz ist in mehrere /24er VLANs segmentiert, die auf einer einzigen Bridge liegen. Mittels CatchAll Firewall-Regeln blocke ich alles und erlaube dann gezielt gewünschten Traffic zwischen den Netzen, bspw. vom User-VLAN in das NAS-VLAN.

Meine neue Yamaha Soundbar unterstützt Multicast für Multiroom über Kabel und WLAN. Aktuell habe ich als Gegenstück nur ein Handy zum Testen, ob Multicast Traffic wie gewünscht fließt. Ich möchte die Soundbar gerne per Kabel in das Heimnetz einbinden. Hierfür habe ich ein neues VLAN ID=41 geschaffen, das auf einem physischen untagged Port des MT liegt und auch ein eigenes WLAN im selben VLAN konfiguriert. Folgendes kann ich nun beobachten

  • Soundbar im WLAN des MT und Handy im WLAN des MT → Das Handy sieht die Soundbar → Multicast scheint zu klappen
  • Soundbar im LAN einer FritzBox und Handy im WLAN derselben FritzBox → Das Handy sieht die Soundbar → Multicast scheint zu klappen
  • Soundbar im LAN des MT und Handy im WLAN des MT → Das Handy sieht die Soundbar nicht, obwohl sie im selben Subnetz sind und ich die Soundbar anpingen kann.

Irgendwie scheint es das Multicast nicht über die Bridge zu schaffen. Auf der Bridge ist IGMP Snooping aktiviert. Multicast-Helper auf dem CAP Interface macht keinen Unterschied.

Kann mir jemand helfen, wo hier mein Denkfehler ist, bzw. was ich übersehe?

Viele Grüße
Solero
comment-contentCommentShareShare
Share on Facebook Share on Twitter Share on Reddit Share on Linkedin

Content-Key: 666361

Url: https://administrator.de/contentid/666361

Printed on: April 19, 2024 at 01:04 o'clock

6 Comments
Latest comment
Goto Top
Member: aqui
aqui May 04, 2021 at 07:25:25 (UTC)
Goto Top
Ohne dein spezifisches MT Setup zu kennen ist natürlich alles Raten im freien Fall. Leider hast du hier keinerlei Angaben dazu gemacht was eine zielführende Hilfe nicht gerade einfach macht wie du dir sicher auch selber denken kannst.
Bist du ganz sicher das du ein Bridging machst zwischen den beiden Segmenten ? Das sieht eher nach Routing aus und ggf. einer Fehlkonfiguration des MT.
Interessant wäre mal zu wissen ob eine normale IP Kommunikation zw. MT Kupfer und WLAN Segment problemlos möglich ist ?
Ein schneller Multicast_Test mit VLC rennt übrigens vollkommen fehlerlos auf einem cAP hier in einem Bridging Setup mit der 6.48.2 Firmware.
Member: Solero
Solero May 04, 2021 updated at 16:46:26 (UTC)
Goto Top
Danke für die super schnelle Rückmeldung. Ich hatte gedacht, dass evtl. jemand meinen Fehler schon kennt und direkt eine Antwort hat. Natürlich ist ein echtes Verständnis erst mit der Konfiguration möglich, die ich hier nachreiche.

Hier die Konfiguration des Routers:
# may/04/2021 18:16:41 by RouterOS 6.46.7
# software id = 4PGL-ML0T
#
# model = RB4011iGS+
# serial number = 968A09920509
/caps-man channel
add band=2ghz-onlyn frequency=2412 name=24_CH01
add band=2ghz-onlyn frequency=2417 name=24_CH02
add band=2ghz-onlyn frequency=2422 name=24_CH03
add band=2ghz-onlyn frequency=2427 name=24_CH04
add band=2ghz-onlyn frequency=2432 name=24_CH05
add band=2ghz-onlyn frequency=2437 name=24_CH06
add band=2ghz-onlyn frequency=2442 name=24_CH07
add band=2ghz-onlyn frequency=2447 name=24_CH08
add band=2ghz-onlyn frequency=2452 name=24_CH09
add band=2ghz-onlyn frequency=2457 name=24_CH10
add band=2ghz-onlyn frequency=2462 name=24_CH11
add band=2ghz-onlyn frequency=2467 name=24_CH12
add band=2ghz-onlyn frequency=2472 name=24_CH13
add band=5ghz-n/ac frequency=5160 name=5_CH032
add band=5ghz-n/ac frequency=5170 name=5_CH034
add band=5ghz-n/ac frequency=5180 name=5_CH036
add band=5ghz-n/ac frequency=5190 name=5_CH038
add band=5ghz-n/ac frequency=5200 name=5_CH040
add band=5ghz-n/ac frequency=5210 name=5_CH042
add band=5ghz-n/ac frequency=5220 name=5_CH044
add band=5ghz-n/ac frequency=5230 name=5_CH046
add band=5ghz-n/ac frequency=5240 name=5_CH048
add band=5ghz-n/ac frequency=5250 name=5_CH050
add band=5ghz-n/ac frequency=5260 name=5_CH052
add band=5ghz-n/ac frequency=5270 name=5_CH054
add band=5ghz-n/ac frequency=5280 name=5_CH056
add band=5ghz-n/ac frequency=5290 name=5_CH058
add band=5ghz-n/ac frequency=5300 name=5_CH060
add band=5ghz-n/ac frequency=5310 name=5_CH062
add band=5ghz-n/ac frequency=5320 name=5_CH064
add band=5ghz-n/ac frequency=5500 name=5_CH100
add band=5ghz-n/ac frequency=5510 name=5_CH102
add band=5ghz-n/ac frequency=5520 name=5_CH104
add band=5ghz-n/ac frequency=5530 name=5_CH106
add band=5ghz-n/ac frequency=5540 name=5_CH108
add band=5ghz-n/ac frequency=5550 name=5_CH110
add band=5ghz-n/ac frequency=5560 name=5_CH112
add band=5ghz-n/ac frequency=5570 name=5_CH114
add band=5ghz-n/ac frequency=5580 name=5_CH116
add band=5ghz-n/ac frequency=5590 name=5_CH118
add band=5ghz-n/ac frequency=5600 name=5_CH120
add band=5ghz-n/ac frequency=5610 name=5_CH122
add band=5ghz-n/ac frequency=5620 name=5_CH124
add band=5ghz-n/ac frequency=5630 name=5_CH126
add band=5ghz-n/ac frequency=5640 name=5_CH128
add band=5ghz-n/ac frequency=5660 name=5_CH132
add band=5ghz-n/ac frequency=5670 name=5_CH134
add band=5ghz-n/ac frequency=5680 name=5_CH136
add band=5ghz-n/ac frequency=5690 name=5_CH138
add band=5ghz-n/ac frequency=5700 name=5_CH140
add band=5ghz-n/ac frequency=5710 name=5_CH142
add band=5ghz-n/ac frequency=5720 name=5_CH144
add band=5ghz-n/ac frequency=5745 name=5_CH149
add band=5ghz-n/ac frequency=5755 name=5_CH151
add band=5ghz-n/ac frequency=5765 name=5_CH153
add band=5ghz-n/ac frequency=5775 name=5_CH155
add band=5ghz-n/ac frequency=5785 name=5_CH157
add band=5ghz-n/ac frequency=5795 name=5_CH159
add band=5ghz-n/ac frequency=5805 name=5_CH161
add band=5ghz-n/ac frequency=5825 name=5_CH165
add band=5ghz-n/ac frequency=5845 name=5_CH169
add band=5ghz-n/ac frequency=5865 name=5_CH173
add band=2ghz-onlyn frequency=2412,2437,2462 name=24_CH01-06-11 \
    reselect-interval=30m save-selected=yes
add frequency="5160,5170,5180,5190,5200,5210,5220,5230,5240,5250,5260,5270,528\  
    0,5290,5300,5310,5320,5500,5510,5520,5530,5540,5550,5560,5570,5580,5590,56\
    00,5610,5620,5630,5640,5660,5670,5680,5690,5700,5710,5720,5745,5755,5765,5\
    775,5785,5795,5805,5825,5845,5865" name=5_germany_A+B+C  
add frequency="5160,5170,5180,5190,5200,5210,5220,5230,5240,5745,5755,5765,577\  
    5,5785,5795,5805,5825,5845,5865" name=5_germany_I+III  
add frequency="5160,5170,5180,5190,5200,5210,5220,5230,5240,5260,5270,5280,529\  
    0,5300,5310,5320,5340,5480,5500,5520,5540,5560,5580,5600,5620,5640,5660,56\
    80,5700" name=5_germany_20MHz  
add frequency=5190,5230,5270,5310,5510,5550,5590,5630,5670 name=\
    5_germany_40MHz
/caps-man configuration
add country=germany datapath.client-to-client-forwarding=no \
    datapath.local-forwarding=no distance=indoors installation=indoor mode=ap \
    name=cfg_WLANSSID_PSK security.authentication-types=wpa2-psk \
    security.group-key-update=1h ssid=WLANSSID
add country=germany datapath.client-to-client-forwarding=no \
    datapath.local-forwarding=no datapath.vlan-mode=no-tag distance=indoors \
    installation=indoor mode=ap name=cfg_euterpe_tablets \
    security.authentication-types=wpa2-psk security.group-key-update=1h ssid=\
    saiRohw6
add comment="neato Staubsaugroboter" country=germany \  
    datapath.client-to-client-forwarding=no datapath.local-forwarding=no \
    datapath.vlan-mode=no-tag distance=indoors installation=indoor mode=ap \
    name=cfg_hausbot security.authentication-types=wpa2-psk \
    security.group-key-update=1h ssid=TePhah9e
add country=germany datapath.client-to-client-forwarding=no \
    datapath.local-forwarding=no datapath.vlan-mode=no-tag distance=indoors \
    installation=indoor mode=ap name=cfg_Quagga_Gast \
    security.authentication-types=wpa2-psk security.group-key-update=1h ssid=\
    Quagga
add country=germany distance=indoors hide-ssid=yes installation=indoor mode=\
    ap name=cfg_master
add country=germany datapath.client-to-client-forwarding=no \
    datapath.local-forwarding=no datapath.vlan-mode=no-tag distance=indoors \
    installation=indoor mode=ap name=cfg_WLANSSIDWork_Arbeitsnotebook \
    security.authentication-types=wpa2-psk security.group-key-update=1h ssid=\
    WLANSSIDWork
add channel=24_CH01-06-11 channel.band=2ghz-onlyn \
    channel.control-channel-width=20mhz channel.extension-channel=disabled \
    channel.reselect-interval=30m country=germany distance=indoors hide-ssid=\
    yes installation=indoor mode=ap name=cfg_master_24
add channel=5_germany_A+B+C channel.band=5ghz-n/ac \
    channel.control-channel-width=20mhz channel.extension-channel=Ce \
    channel.reselect-interval=30m channel.skip-dfs-channels=yes country=\
    germany distance=indoors hide-ssid=yes installation=indoor mode=ap name=\
    cfg_master_5 rates.basic="" rates.ht-basic-mcs="" rates.ht-supported-mcs=\  
    "" rates.supported="" rates.vht-basic-mcs="" rates.vht-supported-mcs=""  
add country=germany datapath.client-to-client-forwarding=yes \
    datapath.local-forwarding=no distance=indoors installation=indoor mode=ap \
    name=cfg_WLANSSIDAudio security.authentication-types=wpa2-psk \
    security.group-key-update=1h ssid=WLANSSIDAudio
/interface bridge
add igmp-snooping=yes name=bLAN protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=e1wan speed=100Mbps
set [ find default-name=ether2 ] name=ether2_ap1 speed=100Mbps
set [ find default-name=ether3 ] arp=local-proxy-arp name=\
    ether3_schlafzimmer_ap3 speed=100Mbps
set [ find default-name=ether4 ] name=ether4_FB speed=100Mbps
set [ find default-name=ether5 ] name=ether5_heimautomatisierung speed=100Mbps
set [ find default-name=ether6 ] name=ether6_HM-CFG-LAN
set [ find default-name=ether8 ] name=ether8_PowerlineKeller
set [ find default-name=ether9 ] name=ether9_wohnzimmer
set [ find default-name=ether10 ] arp=local-proxy-arp name=\
    ether10_switch3_Arbeit
/interface eoip
add allow-fast-path=no !keepalive local-address=192.168.12.1 mac-address=\
    00:00:5E:80:00:01 mtu=1500 name=eoip-keller remote-address=192.168.12.2 \
    tunnel-id=0
/caps-man interface
add channel=24_CH01 configuration=cfg_master_24 disabled=no l2mtu=1600 \
    mac-address=C4:AD:34:9E:84:D7 master-interface=none name=\
    ap1_wlan24_flur_master radio-mac=C4:AD:34:9E:84:D7 radio-name=\
    C4AD349E84D7
add configuration=cfg_euterpe_tablets disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B5 master-interface=ap1_wlan24_flur_master name=\
    ap1_wlan24_flur_tablet radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSID_PSK disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B8 master-interface=ap1_wlan24_flur_master name=\
    ap1_wlan24_flur_WLANSSID radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSIDAudio disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B8 master-interface=ap1_wlan24_flur_master name=\
    ap1_wlan24_flur_WLANSSIDaudio radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSIDWork_Arbeitsnotebook disabled=no l2mtu=1600 \
    mac-address=C6:AD:34:9E:F7:BA master-interface=ap1_wlan24_flur_master \
    name=ap1_wlan24_flur_WLANSSIDwork radio-mac=00:00:00:00:00:00 radio-name=""  
add channel=5_germany_20MHz configuration=cfg_master_5 disabled=no l2mtu=1600 \
    mac-address=C4:AD:34:9E:84:D8 master-interface=none name=\
    ap1_wlan5_flur_master radio-mac=C4:AD:34:9E:84:D8 radio-name=C4AD349E84D8
add configuration=cfg_euterpe_tablets disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B3 master-interface=ap1_wlan5_flur_master name=\
    ap1_wlan5_flur_tablet radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSID_PSK disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B9 master-interface=ap1_wlan5_flur_master name=\
    ap1_wlan5_flur_WLANSSID radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSIDWork_Arbeitsnotebook disabled=no l2mtu=1600 \
    mac-address=C6:AD:34:9E:F7:BA master-interface=ap1_wlan5_flur_master \
    name=ap1_wlan5_flur_WLANSSIDwork radio-mac=00:00:00:00:00:00 radio-name=""  
add channel=5_germany_20MHz configuration=cfg_master_5 disabled=no l2mtu=1600 \
    mac-address=74:4D:28:A9:BE:79 master-interface=none name=\
    ap2_wlan5_keller_master radio-mac=74:4D:28:A9:BE:79 radio-name=\
    744D28A9BE79
add configuration=cfg_WLANSSID_PSK disabled=no l2mtu=1600 mac-address=\
    76:4D:28:A9:BE:7B master-interface=ap2_wlan5_keller_master name=\
    ap2_wlan5_keller_WLANSSID radio-mac=00:00:00:00:00:00 radio-name=""  
add channel=24_CH11 configuration=cfg_master_24 disabled=no l2mtu=1600 \
    mac-address=C4:AD:34:9E:F7:B3 master-interface=none name=\
    ap3_wlan24_schlafzimmer_master radio-mac=C4:AD:34:9E:F7:B3 radio-name=\
    C4AD349EF7B3 rates.vht-supported-mcs=""  
add configuration=cfg_euterpe_tablets disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:84:D7 master-interface=ap3_wlan24_schlafzimmer_master name=\
    ap3_wlan24_schlafzimmer_tablet radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSID_PSK disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:84:DB master-interface=ap3_wlan24_schlafzimmer_master name=\
    ap3_wlan24_schlafzimmer_WLANSSID radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSIDWork_Arbeitsnotebook disabled=yes mac-address=\
    C6:AD:34:9E:F7:BA master-interface=ap3_wlan24_schlafzimmer_master name=\
    ap3_wlan24_schlafzimmer_WLANSSIDwork radio-mac=00:00:00:00:00:00 radio-name=\
    ""  
add channel=5_germany_20MHz configuration=cfg_master_5 disabled=no l2mtu=1600 \
    mac-address=C4:AD:34:9E:F7:B4 master-interface=none name=\
    ap3_wlan5_schlafzimmer_master radio-mac=C4:AD:34:9E:F7:B4 radio-name=\
    C4AD349EF7B4
add configuration=cfg_euterpe_tablets disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:84:D9 master-interface=ap3_wlan5_schlafzimmer_master name=\
    ap3_wlan5_schlafzimmer_tablet radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSID_PSK disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:84:DC master-interface=ap3_wlan5_schlafzimmer_master name=\
    ap3_wlan5_schlafzimmer_WLANSSID radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_WLANSSIDWork_Arbeitsnotebook disabled=yes mac-address=\
    C6:AD:34:9E:F7:BA master-interface=ap3_wlan5_schlafzimmer_master name=\
    ap3_wlan5_schlafzimmer_WLANSSIDwork radio-mac=00:00:00:00:00:00 radio-name=\
    ""  
/interface vlan
add interface=bLAN name=v10_mgmt vlan-id=10
add interface=bLAN name=v11_hausbot vlan-id=11
add interface=bLAN name=v12_eoip-keller vlan-id=12
add interface=bLAN name=v13_tasmota vlan-id=13
add interface=bLAN name=v14_printer vlan-id=14
add interface=bLAN name=v15_vss vlan-id=15
add interface=bLAN name=v20_user vlan-id=20
add interface=bLAN name=v30_gast vlan-id=30
add interface=bLAN name=v40_service vlan-id=40
add interface=bLAN name=v41_service-audio vlan-id=41
/caps-man interface
add configuration=cfg_Quagga_Gast disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B7 master-interface=ap1_wlan24_flur_master name=\
    ap1_wlan24_flur_gast radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_hausbot disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B6 master-interface=ap1_wlan24_flur_master name=\
    ap1_wlan24_flur_hausbot radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_Quagga_Gast disabled=no l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B3 master-interface=ap1_wlan5_flur_master name=\
    ap1_wlan5_flur_gast radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_Quagga_Gast disabled=yes mac-address=C6:AD:34:9E:84:D8 \
    master-interface=ap3_wlan24_schlafzimmer_master name=\
    ap3_wlan24_schlafzimmer_gast radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_hausbot disabled=yes l2mtu=1600 mac-address=\
    C6:AD:34:9E:F7:B4 master-interface=ap3_wlan24_schlafzimmer_master name=\
    ap3_wlan24_schlafzimmer_hausbot radio-mac=00:00:00:00:00:00 radio-name=""  
add configuration=cfg_Quagga_Gast disabled=yes mac-address=C6:AD:34:9E:84:DA \
    master-interface=ap3_wlan5_schlafzimmer_master name=\
    ap3_wlan5_schlafzimmer_gast radio-mac=00:00:00:00:00:00 radio-name=""  
/caps-man security
add name=sec_conf_PSK
add authentication-types=wpa2-psk name=wama-trockner-steckdosen
/caps-man configuration
add country=germany datapath.client-to-client-forwarding=no \
    datapath.local-forwarding=yes datapath.vlan-id=20 datapath.vlan-mode=\
    use-tag distance=indoors installation=indoor mode=ap name=\
    cfg_WLANSSIDKellerPSK security=sec_conf_PSK ssid=WLANSSIDK
add country=belize datapath.client-to-client-forwarding=no \
    datapath.local-forwarding=no datapath.vlan-mode=no-tag distance=indoors \
    installation=indoor mode=ap name=cfg_wama-trockner-steckdosen security=\
    wama-trockner-steckdosen security.group-key-update=1h ssid=Bi5eiyoh
/caps-man interface
add configuration=cfg_wama-trockner-steckdosen disabled=no l2mtu=1600 \
    mac-address=C6:AD:34:9E:84:DD master-interface=ap1_wlan24_flur_master \
    name=ap1_wlan24_flur_tasmota radio-mac=00:00:00:00:00:00 radio-name=""  
add channel=24_CH01-06-11 configuration=cfg_WLANSSIDKellerPSK disabled=no l2mtu=\
    1600 mac-address=74:4D:28:A9:BE:78 master-interface=none name=\
    ap2_wlan24_keller_WLANSSIDk radio-mac=74:4D:28:A9:BE:78 radio-name=\
    744D28A9BE78
add configuration=cfg_wama-trockner-steckdosen disabled=no l2mtu=1600 \
    mac-address=76:4D:28:A9:BE:78 master-interface=ap2_wlan24_keller_WLANSSIDk \
    name=ap2_wlan24_keller_tasmota radio-mac=74:4D:28:A9:BE:78 radio-name=""  
add configuration=cfg_WLANSSID_PSK disabled=no l2mtu=1600 mac-address=\
    76:4D:28:A9:BE:7A master-interface=ap2_wlan24_keller_WLANSSIDk name=\
    ap2_wlan24_keller_WLANSSID radio-mac=00:00:00:00:00:00 radio-name=""  
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-eap group-ciphers=tkip,aes-ccm \
    management-protection=allowed mode=dynamic-keys name=\
    eap_tls_profile_capsman supplicant-identity="" unicast-ciphers=\  
    tkip,aes-ccm
/ip firewall layer7-protocol
add comment="Block Bit Torrent" name=layer7-bittorrent-exp regexp="^(\\x13bitt\  
    orrent protocol|azver\\x01\$|get /scrape\\\?info_hash=get /announce\\\?inf\
    o_hash=|get /client/bitcomet/|GET /data\\\?fid=)|d1:ad2:id20:|\\x08'7P\\)[\  
    RP]"  
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot login-by=http-chap \
    name=Hotspot-Profile-User use-radius=yes
/ip pool
add name=dhcp_pool_mgmt ranges=192.168.10.100-192.168.10.200
add name=dhcp_pool_user ranges=192.168.20.100-192.168.20.200
add name=dhcp_pool_gast ranges=192.168.30.100-192.168.30.200
add name=dhcp_pool_service ranges=192.168.40.100-192.168.40.200
add name=dhcp_pool_hausbot ranges=192.168.11.100-192.168.11.200
add name=dhcp_pool_openvpn5 ranges=192.168.51.17-192.168.51.18
add name=dhcp_pool_openvpn4 next-pool=dhcp_pool_openvpn5 ranges=\
    192.168.51.13-192.168.51.14
add name=dhcp_pool_openvpn3 next-pool=dhcp_pool_openvpn4 ranges=\
    192.168.51.9-192.168.51.10
add name=dhcp_pool_openvpn2 next-pool=dhcp_pool_openvpn3 ranges=\
    192.168.51.5-192.168.51.6
add name=dhcp_pool_openvpn1 next-pool=dhcp_pool_openvpn2 ranges=\
    192.168.51.1-192.168.51.2
add name=dhcp_pool_keller_eoip ranges=192.168.12.100-192.168.12.200
add name=dhcp_pool_service-audio ranges=192.168.41.100-192.168.41.200
add name=dhcp_pool_tasmota ranges=192.168.13.100-192.168.13.200
add name=dhcp_pool_printer ranges=192.168.14.100-192.168.14.200
add name=dhcp_pool_vss ranges=192.168.15.100-192.168.15.200
/ip dhcp-server
add address-pool=dhcp_pool_mgmt disabled=no interface=v10_mgmt name=dhcp_mgmt
add address-pool=dhcp_pool_user disabled=no interface=v20_user name=dhcp_user
add address-pool=dhcp_pool_gast disabled=no interface=v30_gast name=dhcp_gast
add address-pool=dhcp_pool_service disabled=no interface=v40_service name=\
    dhcp_service
add address-pool=dhcp_pool_hausbot disabled=no interface=v11_hausbot name=\
    dhcp_hausbot
add address-pool=dhcp_pool_keller_eoip disabled=no interface=v12_eoip-keller \
    name=dhcp_keller_eoip
add address-pool=dhcp_pool_service-audio disabled=no interface=\
    v41_service-audio name=dhcp_service-audio
add address-pool=dhcp_pool_tasmota disabled=no interface=v13_tasmota name=\
    dhcp_tasmota
add address-pool=dhcp_pool_printer disabled=no interface=v14_printer name=\
    dhcp_printer
add address-pool=dhcp_pool_vss disabled=no interface=v15_vss name=dhcp_vss
/ip hotspot
add address-pool=dhcp_pool_user idle-timeout=none interface=v20_user name=\
    Hotspot-User
/ppp profile
add dns-server=192.168.20.1 local-address=dhcp_pool_openvpn1 name=openvpn \
    remote-address=dhcp_pool_openvpn1
/system logging action
set 3 remote=192.168.10.13
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\  
    sword,web,sniff,sensitive,api,romon,dude,tikapp"  
add name=backup policy="ssh,ftp,read,write,policy,test,sensitive,!local,!telne\  
    t,!reboot,!winbox,!password,!web,!sniff,!api,!romon,!dude,!tikapp"  
add name=read_write_for-wifi-pw-change policy="ssh,read,write,sensitive,!local\  
    ,!telnet,!ftp,!reboot,!policy,!test,!winbox,!password,!web,!sniff,!api,!ro\
    mon,!dude,!tikapp"  
/caps-man manager
set ca-certificate=CAPsMAN-CA-703AFC41CFBA certificate=CAPsMAN-703AFC41CFBA \
    enabled=yes require-peer-certificate=yes upgrade-policy=\
    suggest-same-version
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=v10_mgmt
/interface bridge port
add bridge=bLAN frame-types=admit-only-vlan-tagged interface=ether2_ap1
add bridge=bLAN interface=ether4_FB pvid=10
add bridge=bLAN interface=eoip-keller
add bridge=bLAN interface=ether9_wohnzimmer pvid=40
add bridge=bLAN interface=ether10_switch3_Arbeit pvid=20
add bridge=bLAN interface=ether5_heimautomatisierung pvid=10
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ether6_HM-CFG-LAN pvid=10
add bridge=bLAN interface=ether8_PowerlineKeller pvid=12
add bridge=bLAN interface=ap2_wlan24_keller_tasmota pvid=13
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan5_flur_tablet pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan24_flur_hausbot pvid=11
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan24_flur_gast pvid=30
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan5_flur_gast pvid=30
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan24_schlafzimmer_tablet pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan5_schlafzimmer_tablet pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan24_schlafzimmer_hausbot pvid=11
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan5_schlafzimmer_gast pvid=30
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan24_schlafzimmer_gast pvid=30
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan24_flur_tablet pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan24_flur_WLANSSID pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan5_flur_WLANSSID pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan24_flur_WLANSSIDwork pvid=30
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan5_flur_WLANSSIDwork pvid=30
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan24_schlafzimmer_WLANSSIDwork pvid=30
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan5_schlafzimmer_WLANSSIDwork pvid=30
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap2_wlan24_keller_WLANSSID pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap2_wlan5_keller_WLANSSID pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan24_schlafzimmer_WLANSSID pvid=20
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap3_wlan5_schlafzimmer_WLANSSID pvid=20
add bridge=bLAN frame-types=admit-only-vlan-tagged interface=\
    ether3_schlafzimmer_ap3
add bridge=bLAN interface=ap1_wlan24_flur_tasmota pvid=13
add bridge=bLAN interface=ether7 pvid=41
add bridge=bLAN frame-types=admit-only-untagged-and-priority-tagged \
    interface=ap1_wlan24_flur_WLANSSIDaudio pvid=41
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-pppoe=yes \
    use-ip-firewall-for-vlan=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bLAN comment=User tagged=bLAN,eoip-keller untagged="ether10_switch3\  
    _Arbeit,ap1_wlan24_flur_tablet,ap1_wlan5_flur_tablet,ap3_wlan24_schlafzimm\
    er_tablet,ap3_wlan5_schlafzimmer_tablet,ap1_wlan24_flur_WLANSSID,ap1_wlan5_fl\
    ur_WLANSSID,ap2_wlan24_keller_WLANSSID,ap2_wlan5_keller_WLANSSID,ap3_wlan24_schlafz\
    immer_WLANSSID,ap3_wlan5_schlafzimmer_WLANSSID" vlan-ids=20  
add bridge=bLAN comment=management tagged="bLAN,ether10_switch3_Arbeit,ether3_\  
    schlafzimmer_ap3,ether2_ap1,eoip-keller,ether9_wohnzimmer,ether7" \  
    untagged=ether4_FB,ether5_heimautomatisierung,ether6_HM-CFG-LAN vlan-ids=10
add bridge=bLAN comment="User (guest)" tagged=bLAN untagged="ap1_wlan5_flur_ga\  
    st,ap1_wlan24_flur_gast,ap3_wlan24_schlafzimmer_gast,ap3_wlan5_schlafzimme\
    r_gast,ap1_wlan24_flur_WLANSSIDwork,ap1_wlan5_flur_WLANSSIDwork,ap3_wlan24_schla\
    fzimmer_WLANSSIDwork,ap3_wlan5_schlafzimmer_WLANSSIDwork" vlan-ids=30  
add bridge=bLAN comment=service tagged=\
    bLAN,ether10_switch3_Arbeit,ether5_heimautomatisierung,eoip-keller,ether9_wohnzimmer \
    vlan-ids=40
add bridge=bLAN comment=hausbot tagged=bLAN untagged=\
    ap1_wlan24_flur_hausbot,ap3_wlan24_schlafzimmer_hausbot vlan-ids=11
add bridge=bLAN comment=eoip-keller tagged=bLAN untagged=\
    ether8_PowerlineKeller vlan-ids=12
add bridge=bLAN comment=service-audio tagged=bLAN,ether9_wohnzimmer untagged=\
    ap1_wlan24_flur_WLANSSIDaudio,ether7 vlan-ids=41
add bridge=bLAN comment=tasmota tagged=bLAN,eoip-keller untagged=\
    ap2_wlan24_keller_tasmota,ap1_wlan24_flur_tasmota vlan-ids=13
add bridge=bLAN comment=printer tagged=bLAN,ether10_switch3_Arbeit vlan-ids=\
    14
add bridge=bLAN comment="video surveillance system" tagged=\  
    bLAN,eoip-keller,ether2_ap1,ether10_switch3_Arbeit,ether7 vlan-ids=15
/interface list member
add interface=e1wan list=WAN
add disabled=yes interface=bLAN list=LAN
add interface=v10_mgmt list=LAN
add interface=v20_user list=LAN
add interface=v30_gast list=LAN
add interface=v40_service list=LAN
add interface=v11_hausbot list=LAN
add interface=v41_service-audio list=LAN
add interface=v13_tasmota list=LAN
add interface=v14_printer list=LAN
add interface=v15_vss list=LAN
/interface ovpn-server server
set auth=sha1 certificate=openvpn-server.crt_0 cipher=aes256 default-profile=\
    openvpn enabled=yes require-client-certificate=yes
/ip address
add address=192.168.10.1/24 interface=v10_mgmt network=192.168.10.0
add address=192.168.20.1/24 interface=v20_user network=192.168.20.0
add address=192.168.30.1/24 interface=v30_gast network=192.168.30.0
add address=192.168.40.1/24 interface=v40_service network=192.168.40.0
add address=192.168.11.1/24 interface=v11_hausbot network=192.168.11.0
add address=192.168.12.1/24 interface=v12_eoip-keller network=192.168.12.0
add address=192.168.41.1/24 interface=v41_service-audio network=192.168.41.0
add address=192.168.13.1/24 interface=v13_tasmota network=192.168.13.0
add address=192.168.14.1/24 interface=v14_printer network=192.168.14.0
add address=192.168.15.1/24 interface=v15_vss network=192.168.15.0
/ip dhcp-client
add disabled=no interface=e1wan use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=192.168.40.11 client-id=1:d0:bf:9c:45:bb:d9 comment=nas \
    mac-address=D0:BF:9C:45:BB:D9 server=dhcp_service
add address=192.168.40.120 client-id=1:d6:d3:bf:9e:c1:ec comment=transmission \
    disabled=yes mac-address=D6:D3:BF:9E:C1:EC server=dhcp_service
add address=192.168.10.11 client-id=1:70:4f:57:ac:25:e0 disabled=yes \
    mac-address=70:4F:57:AC:25:E0 server=dhcp_mgmt
add address=192.168.10.22 client-id=1:d0:bf:9c:45:bb:da comment=nas-iLO \
    mac-address=D0:BF:9C:45:BB:DA server=dhcp_mgmt
add address=192.168.10.31 client-id=ff:6:85:a5:15:0:3:0:1:c0:25:6:85:a5:15 \
    comment="Fritz.Box 7360" disabled=yes mac-address=C0:25:06:85:A5:15 \  
    server=dhcp_mgmt
add address=192.168.10.41 client-id=1:0:1a:22:4:b9:41 comment=HM-CFG-LAN \
    mac-address=00:1A:22:04:B9:41 server=dhcp_mgmt
add address=192.168.20.10 disabled=yes mac-address=80:FA:5B:43:9D:04 server=\
    dhcp_user
add address=192.168.10.5 client-id=1:74:da:38:63:1f:e6 comment=ap1 \
    mac-address=74:DA:38:63:1F:E6 server=dhcp_mgmt
add address=192.168.10.13 client-id=1:b8:27:eb:ab:5a:e3 disabled=yes \
    mac-address=B8:27:EB:AB:5A:E3 server=dhcp_mgmt
add address=192.168.20.11 client-id=1:f0:d7:aa:86:ef:29 comment=melpomene \
    mac-address=F0:D7:AA:86:EF:29 server=dhcp_user
add address=192.168.40.21 client-id=1:b8:27:eb:10:38:a7 comment=apollon \
    disabled=yes mac-address=B8:27:EB:10:38:A7 server=dhcp_service
add address=192.168.20.12 client-id=1:9c:5c:f9:e8:87:86 comment=eurydike \
    mac-address=9C:5C:F9:E8:87:86 server=dhcp_user
add address=192.168.12.2 client-id=1:b8:69:f4:1:e5:6a disabled=yes \
    mac-address=B8:69:F4:01:E5:6A server=dhcp_keller_eoip
add address=192.168.12.100 mac-address=B8:BE:F4:00:1A:F3 server=\
    dhcp_keller_eoip
add address=192.168.12.101 mac-address=B8:BE:F4:00:19:24 server=\
    dhcp_keller_eoip
add address=192.168.10.32 comment=S675IP mac-address=00:21:04:10:02:7F \
    server=dhcp_mgmt
add address=192.168.10.51 client-id=1:b8:27:eb:6b:6a:6a comment=snips1 \
    disabled=yes mac-address=B8:27:EB:6B:6A:6A server=dhcp_mgmt
add address=192.168.10.61 client-id=1:d0:bf:9c:40:ed:c3 comment=zoneminder \
    disabled=yes mac-address=D0:BF:9C:40:ED:C3 server=dhcp_mgmt
add address=192.168.40.21 client-id=1:dc:a6:32:65:b0:b3 comment=apollon \
    mac-address=DC:A6:32:65:B0:B3 server=dhcp_service
add address=192.168.20.170 comment="euterpe - entsorgt" disabled=yes \  
    mac-address=88:70:8C:46:AF:B1 server=dhcp_user
add address=192.168.20.159 client-id=1:d0:f8:8c:7a:f5:db comment=euterpe2 \
    mac-address=D0:F8:8C:7A:F5:DB server=dhcp_user
add address=192.168.13.2 comment=PowerWaMa mac-address=D8:F1:5B:AB:44:18 \
    server=dhcp_tasmota
add address=192.168.13.3 comment=PowerTrockner mac-address=24:62:AB:30:A2:B7 \
    server=dhcp_tasmota
add address=192.168.20.149 client-id=1:48:2c:a0:66:c2:c7 comment=melpomene2 \
    mac-address=48:2C:A0:66:C2:C7 server=dhcp_user
add address=192.168.40.12 client-id=1:d0:bf:9c:3:aa:47 disabled=yes \
    mac-address=D0:BF:9C:03:AA:47 server=dhcp_service
add address=192.168.10.21 client-id=1:d0:bf:9c:45:bb:d9 comment=nas \
    disabled=yes mac-address=D0:BF:9C:45:BB:D9 server=dhcp_mgmt
add address=192.168.40.12 client-id=1:d0:bf:9c:3:aa:47 disabled=yes \
    mac-address=D0:BF:9C:03:AA:47 server=dhcp_service
add address=192.168.20.154 mac-address=D8:D0:90:5A:1D:4B server=dhcp_user
add address=192.168.10.31 client-id=ff:1e:a:f7:56:0:3:0:1:cc:ce:1e:a:f7:56 \
    comment="FritzBox 7412" mac-address=CC:CE:1E:0A:F7:56 server=dhcp_mgmt  
add address=192.168.20.155 client-id=1:0:e:c6:d6:e6:28 mac-address=\
    00:0E:C6:D6:E6:28 server=dhcp_user
add address=192.168.20.145 client-id=1:22:26:fb:77:90:8c comment=melpomene2 \
    disabled=yes mac-address=22:26:FB:77:90:8C server=dhcp_user
add address=192.168.20.148 comment="google Home Renate" disabled=yes \  
    mac-address=00:F6:20:B3:62:1C server=dhcp_user
add address=192.168.40.17 client-id=1:d0:bf:9c:ac:89:b3 mac-address=\
    D0:BF:9C:AC:89:B3 server=dhcp_service
add address=192.168.14.10 client-id=1:0:1b:a9:33:30:9e comment=\
    "printer brother MFC-5890CN" disabled=yes mac-address=00:1B:A9:33:30:9E \  
    server=dhcp_printer
add address=192.168.40.14 client-id=1:d0:bf:9c:eb:cd:2f mac-address=\
    D0:BF:9C:EB:CD:2F server=dhcp_service
add address=192.168.14.11 client-id=1:74:bf:c0:c4:f4:8d comment=\
    "printer canon MB2750" mac-address=74:BF:C0:C4:F4:8D server=dhcp_printer  
add address=192.168.30.192 client-id=1:fc:87:43:75:14:92 comment=\
    "Tablet Christina Bomholt" mac-address=FC:87:43:75:14:92 server=dhcp_gast  
add address=192.168.40.15 client-id=1:d0:bf:9c:95:6c:f0 mac-address=\
    D0:BF:9C:95:6C:F0 server=dhcp_service
add address=192.168.20.146 client-id=1:d4:38:9c:2:5b:55 comment=\
    "Handy Christina Bomholt" mac-address=D4:38:9C:02:5B:55 server=dhcp_user  
add address=192.168.10.13 client-id=1:dc:a6:32:51:c2:51 mac-address=\
    DC:A6:32:51:C2:51 server=dhcp_mgmt
add address=192.168.40.13 client-id=\
    ff:32:51:c2:51:0:1:0:1:26:d4:43:ff:dc:a6:32:51:c2:51 mac-address=\
    DC:A6:32:51:C2:51 server=dhcp_service
add address=192.168.20.161 client-id=1:84:b8:b8:bc:50:96 comment=wandtablet1 \
    mac-address=84:B8:B8:BC:50:96 server=dhcp_user
add address=192.168.13.4 mac-address=BC:DD:C2:91:4C:6F server=dhcp_tasmota
add address=192.168.30.182 client-id=1:34:d2:62:90:fc:d9 comment=\
    "DJI mavic enterprise" mac-address=34:D2:62:90:FC:D9 server=dhcp_gast  
add address=192.168.10.15 client-id=1:b8:27:eb:ab:5a:e3 mac-address=\
    B8:27:EB:AB:5A:E3 server=dhcp_mgmt
add address=192.168.40.18 client-id=1:d0:bf:9c:40:ed:c3 comment=zoneminder \
    mac-address=D0:BF:9C:40:ED:C3 server=dhcp_service
add address=192.168.30.201 client-id=1:b8:27:eb:ed:c:b6 comment=\
    "gateway pi fuer webcam" mac-address=B8:27:EB:ED:0C:B6 server=dhcp_gast  
add address=192.168.40.12 client-id=1:d2:bf:9c:3:aa:47 mac-address=\
    D2:BF:9C:03:AA:47 server=dhcp_service
add address=192.168.15.10 client-id=1:3c:8c:f8:a2:fa:a8 comment=\
    "kamera keller trendnet" mac-address=3C:8C:F8:A2:FA:A8 server=dhcp_vss  
add address=192.168.10.12 mac-address=58:D5:6E:22:4F:44 server=dhcp_mgmt
add address=192.168.41.100 client-id=1:88:c2:55:29:d2:13 comment=\
    "YAS-306 Soundbar (WLAN)" mac-address=88:C2:55:29:D2:13 server=\  
    dhcp_service-audio
add address=192.168.41.101 client-id=1:76:7f:ea:7b:45:da comment=melpomene2 \
    mac-address=76:7F:EA:7B:45:DA server=dhcp_service-audio
add address=192.168.41.102 client-id=1:0:a0:de:db:54:5b comment=\
    "YAS-306 Soundbar (LAN)" mac-address=00:A0:DE:DB:54:5B server=\  
    dhcp_service-audio
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=192.168.10.1 domain=some-name.de gateway=\
    192.168.10.1
add address=192.168.11.0/24 dns-server=192.168.11.1 gateway=192.168.11.1
add address=192.168.12.0/24 dns-none=yes gateway=192.168.12.1
add address=192.168.13.0/24 dns-server=192.168.13.1 gateway=192.168.13.1
add address=192.168.14.0/24 dns-server=192.168.14.1 gateway=192.168.14.1
add address=192.168.15.0/24 dns-server=192.168.15.1 gateway=192.168.15.1
add address=192.168.20.0/24 dns-server=192.168.20.1 domain=some-name.de gateway=\
    192.168.20.1
add address=192.168.30.0/24 dns-server=192.168.30.1 domain=some-name.de gateway=\
    192.168.30.1
add address=192.168.40.0/24 dns-server=192.168.40.1 domain=some-name.de gateway=\
    192.168.40.1
add address=192.168.41.0/24 dns-server=192.168.41.1 domain=some-name.de gateway=\
    192.168.41.1
/ip dns
set allow-remote-requests=yes cache-max-ttl=1d servers="2620:fe::fe,9.9.9.9,20\  
    8.67.222.222,2620:0:ccc::2,2001:4860:4860::8888,1.1.1.1,8.8.8.8"  
/ip dns static
add address=192.168.10.21 name=nas-mgmt.some-name.de ttl=10m
add address=192.168.40.18 name=zoneminder.some-name.de ttl=10m
add address=192.168.10.21 name=nas-mgmt ttl=10m
add address=192.168.40.12 name=transmission ttl=10m
add address=192.168.40.12 name=transmission.some-name.de ttl=10m
add address=192.168.40.11 name=nas ttl=10m
add address=192.168.40.11 disabled=yes regexp="^nas\?(\\.some-name\\.de)" \  
    ttl=10m
add address=192.168.10.11 name=switch1 ttl=10m
add address=192.168.10.11 name=switch1.some-name.de ttl=10m
add address=192.168.10.12 name=switch2 ttl=10m
add address=192.168.10.12 name=switch2.some-name.de ttl=10m
add address=192.168.10.31 disabled=yes name=fritz.box ttl=10m
add address=192.168.10.3 name=ap2 ttl=10m
add address=192.168.10.3 name=ap2.some-name.de ttl=10m
add address=192.168.40.11 name=nas.some-name.de ttl=10m
add address=192.168.10.22 name=nas-ilo.some-name.de ttl=10m
add address=192.168.10.22 name=nas-ilo ttl=10m
add address=127.0.0.1 disabled=yes name=googleads.g.doubleclick.net ttl=10m
add address=127.0.0.1 disabled=yes name=l.doubleclick.net ttl=10m
add address=192.168.0.1 name=connectbox ttl=10m
add address=192.168.10.41 name=hmlan1 ttl=10m
add address=192.168.10.41 name=hmlan1.some-name.de ttl=10m
add address=192.168.20.179 name=heimautomatisierung.some-name.de ttl=10m
add address=192.168.20.179 name=heimautomatisierung ttl=10m
add address=192.168.40.13 regexp="^heimautomatisierung\?(\\.some-name\\.de)" ttl=10m  
add address=192.168.10.13 name=heimautomatisierung-mgmt ttl=10m
add address=192.168.10.13 name=syslog ttl=10m
add address=192.168.10.13 name=syslog.some-name.de ttl=10m
add address=192.168.40.21 regexp="^apollon\?(\\.some-name\\.de)" ttl=10m  
add address=192.168.40.21 name=apollon.some-name.de ttl=10m
add address=192.168.40.21 name=apollon ttl=10m
add address=192.168.10.2 name=router2 ttl=10m
add address=192.168.10.2 name=router2.some-name.de ttl=10m
add address=192.168.111.111 regexp="^moep\?(\\.some-name\\.de)" ttl=10m  
add address=192.168.10.32 name=voipkeller ttl=10m
add address=192.168.10.32 name=voipkeller.some-name.de ttl=10m
add address=192.168.10.51 disabled=yes name=snips1 ttl=10m
add address=192.168.10.61 disabled=yes name=zoneminder ttl=10m
add address=192.168.10.13 name=heimautomatisierung-mgmt.some-name.de ttl=10m
add address=192.168.10.1 name=router1 ttl=10m
add address=192.168.10.1 name=router1.some-name.de ttl=10m
add address=192.168.10.14 name=switch3 ttl=10m
add address=192.168.10.14 name=switch3.some-name.de ttl=10m
add address=192.168.13.2 name=powerwama ttl=10m
add address=192.168.13.2 name=powerwama.some-name.de ttl=10m
add address=192.168.13.3 name=powertrockner ttl=10m
add address=192.168.13.3 name=powertrockner.some-name.de ttl=10m
add address=192.168.20.154 name=notebook1.some-name.de ttl=20m
add address=192.168.20.154 name=notebook1 ttl=20m
add address=192.168.10.31 name=voipgateway ttl=10m
add address=192.168.10.31 name=voipgateway.some-name.de ttl=10m
add address=62.53.165.195 comment="bis 2021-03 213.20.127.17" name=\  
    sip.alice-voip.de ttl=1m
add address=192.168.10.4 name=ap3 ttl=10m
add address=192.168.10.4 name=ap3.some-name.de ttl=10m
add address=192.168.178.1 name=inetgateway.some-name.de ttl=10m
add address=192.168.178.1 name=inetgateway ttl=10m
add address=192.168.10.5 name=ap1 ttl=10m
add address=192.168.10.5 name=ap1.some-name.de ttl=10m
add address=192.168.40.14 name=scan ttl=10m
add address=192.168.40.14 name=scan.some-name.de ttl=10m
add address=192.168.14.11 name=printer-mb2750.some-name.de ttl=10m
add address=192.168.14.11 name=printer-mb2750 ttl=10m
add address=192.168.40.15 name=dms-aaron ttl=10m
add address=192.168.40.15 name=dms-aaron.some-name.de ttl=10m
add address=192.168.13.4 name=irbridge1 ttl=10m
add address=192.168.13.4 name=irbridge1.some-name.de ttl=10m
add address=192.168.10.15 name=kellerpi1 ttl=10m
add address=192.168.10.15 name=kellerpi1.some-name.de ttl=10m
add address=192.168.40.18 name=zoneminder ttl=10m
add address=192.168.15.10 name=cam-keller1 ttl=10m
add address=192.168.15.10 name=cam-keller1.some-name.de ttl=10m
add address=192.168.41.100 name=yas306 ttl=10m
add address=192.168.41.100 name=yas306.some-name.de ttl=10m
/ip firewall address-list
add address=192.168.0.0/24 list=unitymedia_subnet
add address=192.168.10.0/24 list=mgmt_subnet
add address=192.168.51.0/24 list=openvpn_subnet
add address=192.168.40.0/24 list=service_subnet
add address=192.168.12.0/24 list=eoip-keller-mgmt
add address=192.168.20.0/24 list=user_subnet
add comment="Ransomware tracker RW_IPBL" list=addressListMalware  
add address=103.224.182.250 comment="Ransomware tracker RW_IPBL" list=\  
    addressListMalware
/ip firewall filter
add action=drop chain=input comment="test - ping verbieten" disabled=yes \  
    protocol=icmp
add action=drop chain=forward comment="test - ping verbieten" disabled=yes \  
    dst-address=192.168.10.2 protocol=icmp
add action=drop chain=forward comment="test - subnetisolation" disabled=yes \  
    dst-address-list=user_subnet log=yes log-prefix=TESTFW
add action=accept chain=forward comment="# gedacht, damit ich das handy anping\  
    en kann, damit ist aber JEDER intravlan traffic erlaubt" disabled=yes \  
    in-interface=bLAN out-interface=bLAN
add action=accept chain=forward comment=\
    "pi test - loeschen wenn fertig 2020-05-30" disabled=yes dst-address=\  
    192.168.14.102
add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes  
add action=accept chain=forward comment="zoneminder test" disabled=yes \  
    dst-address=192.168.40.102
add action=accept chain=forward comment="ipcam auf gateway-aaron" disabled=\  
    yes dst-address=192.168.30.201
add action=accept chain=forward comment="ipcam auf notebook1" disabled=yes \  
    dst-address=192.168.20.154
add action=accept chain=forward comment=\
    "tmp regel f\FCr ip webcam auf euterpe" disabled=yes dst-address=\  
    192.168.20.170
add action=accept chain=forward comment=\
    "dji qgroundcontrol test - ip von remote darf complett auf notebook1" \  
    disabled=yes dst-address=192.168.10.106 log=yes log-prefix=dji \
    src-address=192.168.30.182
add action=accept chain=forward comment=\
    "dji qgroundcontrol test - ip von remote darf complett auf notebook1" \  
    disabled=yes dst-address=192.168.30.182 src-address=192.168.10.106
add action=accept chain=forward comment=\
    "dji qgroundcontrol test - ip von remote darf complett auf notebook1" \  
    disabled=yes dst-address=192.168.20.173 src-address=192.168.30.182
add action=accept chain=forward comment=\
    "dji qgroundcontrol test - ip von remote darf complett auf notebook1" \  
    disabled=yes dst-address=192.168.30.182 src-address=192.168.20.173
add action=accept chain=forward comment=openVPN src-address-list=\
    openvpn_subnet
add action=fasttrack-connection chain=forward comment=fasttrack \
    connection-state=established,related
add action=accept chain=forward connection-state=\
    established,related,untracked
add action=accept chain=forward in-interface=v10_mgmt out-interface=v10_mgmt
add action=accept chain=forward in-interface=v41_service-audio out-interface=\
    v41_service-audio
add action=accept chain=forward comment="Bridging Regel" dst-address-list=\  
    mgmt_subnet in-interface=bLAN out-interface=bLAN src-address-list=\
    mgmt_subnet
add action=accept chain=forward disabled=yes in-interface=v20_user \
    out-interface=v40_service
add action=accept chain=forward comment="ssh & samba - nas" dst-address=\  
    192.168.40.11 dst-port=22,139,445,22043,12345 in-interface=v20_user \
    out-interface=v40_service protocol=tcp
add action=accept chain=forward comment="tmp- alles auf nas erlaubt" \  
    disabled=yes out-interface=v40_service
add action=accept chain=forward comment=\
    "samba - von gast auf nas - nur fuer public share" dst-address=\  
    192.168.40.11 dst-port=139,445 in-interface=v30_gast out-interface=\
    v40_service protocol=tcp
add action=accept chain=forward comment=\
    "WINS - in NAS-SMB.conf fehlt noch die ip des WINS servers" disabled=yes \  
    dst-port=139 in-interface=v20_user out-interface=v40_service protocol=tcp
add action=accept chain=forward comment=\
    "WINS - in NAS-SMB.conf fehlt noch die ip des WINS servers" disabled=yes \  
    dst-port=137,138 in-interface=v40_service out-interface=v20_user \
    protocol=udp src-address=192.168.40.11
add action=accept chain=forward comment=nas-admin dst-address=\
    192.168.40.11 dst-port=22,80,443,22043,12345 in-interface=v10_mgmt \
    out-interface=v40_service protocol=tcp
add action=accept chain=forward comment=transmission dst-address=\
    192.168.40.12 dst-port=9091 in-interface=v20_user out-interface=\
    v40_service protocol=tcp
add action=accept chain=forward comment=\
    "transmission port forwarding erlauben" dst-address=192.168.40.12 \  
    dst-port=51413 protocol=tcp
add action=accept chain=forward comment="smb1forscan ablage fuer scanner - ip \  
    einschraenkungen direkt in smb config in /usr/local/etc/smb4.conf" \  
    dst-port=139,445 in-interface=v14_printer out-interface=v40_service \
    protocol=tcp
add action=accept chain=forward comment="dms aaron" dst-address=192.168.40.15 \  
    dst-port=80,443 in-interface=v20_user protocol=tcp
add action=accept chain=forward comment="dms aaron" dst-address=192.168.40.15 \  
    dst-port=80,443 in-interface=v10_mgmt protocol=tcp
add action=accept chain=forward comment=zoneminder dst-address=192.168.40.18 \
    dst-port=80,443 in-interface=v20_user protocol=tcp
add action=accept chain=forward comment=zoneminder dst-address=192.168.40.18 \
    dst-port=80,443 in-interface=v10_mgmt protocol=tcp
add action=accept chain=forward comment="printer-mb2750 - zugriff von heimnetz\  
    \_auf drucker - raspi kann nicht den drucker ansteuern (treiber will nicht\
    )" dst-address=192.168.14.11 dst-port=80,515,8611,9100 in-interface-list=\  
    LAN out-interface=v14_printer protocol=tcp
add action=accept chain=forward comment=\
    "printer-mb2750 - zugriff von heimnetz auf heimautomatisierung" disabled=yes \  
    dst-address=192.168.10.13 dst-port=80,515,8611,9100 protocol=tcp
add action=accept chain=forward comment="printer-mb2750 - zugriff von heimnetz\  
    \_auf drucker - raspi kann nicht den drucker ansteuern (treiber will nicht\
    )" dst-address=192.168.14.11 dst-port=161,427,8609,8611 \  
    in-interface-list=LAN out-interface=v14_printer protocol=udp
add action=accept chain=forward comment=\
    "printer-mb2750 - zugriff von heimnetz auf heimautomatisierung" disabled=yes \  
    dst-address=192.168.10.13 dst-port=161,427,8609,8611 protocol=udp
add action=drop chain=forward comment=\
    "nur zum ports finden, die der drucker braucht" disabled=yes dst-address=\  
    192.168.14.11 log=yes log-prefix=PRINTER
add action=accept chain=forward comment="apollon (kodi)" dst-address=\  
    192.168.40.21 dst-port=80 in-interface=v20_user out-interface=v40_service \
    protocol=tcp
add action=accept chain=forward comment="apollon (kodi) aus vpn" dst-address=\  
    192.168.40.21 dst-port=80 out-interface=v40_service protocol=tcp \
    src-address-list=openvpn_subnet
add action=accept chain=forward comment="apollon (kodi) - ssh" dst-address=\  
    192.168.40.21 dst-port=22,80,5900 in-interface=v10_mgmt out-interface=\
    v40_service protocol=tcp
add action=accept chain=forward comment=\
    "apollon (kodi) - ssh -sollte unnoetig sein - loeschen!" disabled=yes \  
    dst-address=192.168.40.101 dst-port=22,80,5900 in-interface=v20_user \
    out-interface=v40_service protocol=tcp
add action=accept chain=forward comment="rsyslog von apollon an heimautomatisierung" \  
    dst-address=192.168.10.13 dst-port=514 in-interface=v40_service \
    out-interface=v10_mgmt protocol=udp src-address=192.168.40.21
add action=accept chain=forward comment="any regel von mgmt auf service -  UNS\  
    CHOEN - ich wei\DF nicht mehr wofuer die sein soll. deaktiviert am 2018-11\
    -25" disabled=yes in-interface=v10_mgmt log=yes log-prefix=mgmt2service \  
    out-interface=v40_service
add action=accept chain=forward comment="nas - ssh & samba" dst-address=\  
    192.168.40.11 dst-port=137,138 in-interface=v20_user out-interface=\
    v40_service protocol=udp
add action=accept chain=forward comment=\
    "nas - zugriff auf notebook1 fuer backup" dst-address=192.168.20.154 \  
    dst-port=22 out-interface=v20_user protocol=tcp
add action=accept chain=forward comment=\
    "nas - zugriff auf notebook1 fuer backup" dst-address=192.168.20.154 \  
    out-interface=v20_user protocol=icmp
add action=accept chain=forward comment="fhem auf heimautomatisierung" dst-address=\  
    192.168.40.13 dst-port=80,443,8090 in-interface=v20_user out-interface=\
    v40_service protocol=tcp
add action=accept chain=forward comment="fhem auf heimautomatisierung aus mgmt vlan" \  
    dst-address=192.168.40.13 dst-port=80,443,1883,8090 in-interface=v10_mgmt \
    out-interface=v40_service protocol=tcp
add action=accept chain=forward comment="tor auf heimautomatisierung" dst-address=\  
    192.168.40.13 dst-port=9050 in-interface=v20_user out-interface=\
    v40_service protocol=tcp
add action=accept chain=forward comment="dconz fuer zigbee auf heimautomatisierung" \  
    dst-address=192.168.40.13 dst-port=8088 in-interface=v10_mgmt \
    out-interface=v40_service protocol=tcp
add action=accept chain=forward comment=\
    "f\FCr zugriff von fhem auf musiccast" dst-port=\  
    1900,5353,51100,51200,61100 in-interface=v10_mgmt out-interface=\
    v41_service-audio protocol=udp
add action=accept chain=forward comment=\
    "f\FCr zugriff von fhem auf musiccast" dst-port=80,49154,51000 \  
    in-interface=v10_mgmt out-interface=v41_service-audio protocol=tcp
add action=accept chain=forward comment="2020-10-19 - mgmt auf gast - fuer web\  
    cam pi im gast vlan - deaktivieren wenn nicht mehr benoetigt" \  
    in-interface=v10_mgmt out-interface=v30_gast protocol=tcp
add action=accept chain=forward comment="2020-10-19 - fuer webcam pi im gast v\  
    lan - deaktivieren wenn nicht mehr benoetigt" dst-port=40001 \  
    in-interface=v30_gast protocol=udp
add action=accept chain=forward comment="cups auf heimautomatisierung - habe ich auch mit akt\  
    uellem raspbian 2020-05 nicht zum laufen bekommen" disabled=yes \  
    dst-address=192.168.40.13 dst-port=515,631 protocol=tcp
add action=accept chain=forward comment="heimautomatisierung - apollon" dst-address-list=\  
    service_subnet src-address-list=service_subnet
add action=accept chain=forward comment="fhem auf heimautomatisierung (aus vpn)" \  
    dst-address=192.168.40.13 src-address-list=openvpn_subnet
add action=accept chain=forward comment="com von fhem zu mobile" \  
    in-interface=v40_service out-interface=v20_user protocol=tcp src-address=\
    192.168.40.13
add action=accept chain=forward comment="Zugriff in tasmota vlan" \  
    in-interface=v10_mgmt log-prefix=tasmota out-interface=v13_tasmota
add action=accept chain=forward comment=\
    "tasmota devices syslogging auf heimautomatisierung erlauben" dst-address=192.168.10.13 \  
    dst-port=514 in-interface=v13_tasmota out-interface=v10_mgmt protocol=udp
add action=accept chain=forward comment=\
    "tasmota devices mqtt auf heimautomatisierung f\FCr mqtt" dst-address=192.168.10.13 \  
    dst-port=1883 in-interface=v13_tasmota out-interface=v10_mgmt protocol=\
    tcp
add action=accept chain=forward comment="tasmota devices mqtt auf notebook1" \  
    disabled=yes dst-address=192.168.10.106 dst-port=1883 in-interface=\
    v13_tasmota out-interface=v10_mgmt protocol=tcp
add action=accept chain=forward comment=\
    "zugriff von mgmt auf powerline devices" dst-port=80 in-interface=\  
    v10_mgmt out-interface=v12_eoip-keller protocol=tcp
add action=accept chain=forward comment=\
    "zugriff von mgmt auf soundtest vlan 41" disabled=yes in-interface=\  
    v10_mgmt out-interface=v41_service-audio
add action=accept chain=forward comment=\
    "zugriff von mgmt auf videosurveilance vss vlan 15" in-interface=v10_mgmt \  
    out-interface=v15_vss
add action=accept chain=forward comment="rtsp zugriff auf die kameras" \  
    dst-port=554 in-interface=v20_user out-interface=v15_vss protocol=tcp
add action=accept chain=forward dst-address=!192.168.178.1 log-prefix=\
    traffic2Audio out-interface=v41_service-audio
add action=accept chain=forward comment="accept in ipsec policy" disabled=yes \  
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" disabled=\  
    yes ipsec-policy=out,ipsec
add action=drop chain=forward comment="Block von Malware IPs" \  
    dst-address-list=addressListMalware log=yes log-prefix=MalwareAccess \
    src-address=!192.168.40.12 tcp-flags=""  
add action=accept chain=forward in-interface=v10_mgmt out-interface-list=WAN
add action=accept chain=forward comment=\
    "rule evtl. nicht noetig und auf fehler in router begruendet" disabled=\  
    yes in-interface=v10_mgmt log-prefix=traffic2WAN
add action=accept chain=forward dst-address=!192.168.178.1 in-interface=\
    v11_hausbot log=yes log-prefix=traffic2WAN-Hausbot out-interface-list=WAN
add action=accept chain=forward disabled=yes dst-address=!192.168.178.1 \
    in-interface=v13_tasmota out-interface-list=WAN
add action=accept chain=forward disabled=yes dst-address=!192.168.178.1 \
    in-interface=v14_printer log=yes log-prefix=traffic2WAN-Hausbot \
    out-interface-list=WAN
add action=accept chain=forward dst-address=!192.168.178.1 in-interface=\
    v20_user log-prefix=traffic2WAN out-interface-list=WAN
add action=accept chain=forward dst-address=!192.168.178.1 dst-port=\
    22,25,80,110,143,443,465,587,993,995,5222,5223,5280,5298 in-interface=\
    v30_gast layer7-protocol=!layer7-bittorrent-exp log-prefix=traffic2WAN \
    out-interface-list=WAN protocol=tcp
add action=accept chain=forward comment="skype for business https://kb.circuit\  
    id.com/knowledge-base/skype-for-business-firewall-ports/" dst-address=\  
    !192.168.178.1 dst-port=443,444,5061,5223,50000-59999 in-interface=\
    v30_gast layer7-protocol=!layer7-bittorrent-exp log-prefix=traffic2WAN \
    out-interface-list=WAN protocol=tcp
add action=accept chain=forward comment="skype for business https://kb.circuit\  
    id.com/knowledge-base/skype-for-business-firewall-ports/" dst-address=\  
    !192.168.178.1 dst-port=3478,50000-59999 in-interface=v30_gast \
    layer7-protocol=!layer7-bittorrent-exp log-prefix=traffic2WAN \
    out-interface-list=WAN protocol=udp
add action=accept chain=forward dst-address=!192.168.178.1 in-interface=\
    v30_gast layer7-protocol=!layer7-bittorrent-exp log-prefix=traffic2WAN \
    out-interface-list=WAN protocol=icmp
add action=accept chain=forward dst-address=!192.168.178.1 dst-port=123 \
    in-interface=v30_gast layer7-protocol=!layer7-bittorrent-exp log-prefix=\
    traffic2WAN out-interface-list=WAN protocol=udp
add action=accept chain=forward comment="Zoom aus Gastnetz" dst-address=\  
    !192.168.178.1 dst-port=8801,8802 in-interface=v30_gast layer7-protocol=\
    !layer7-bittorrent-exp log-prefix=traffic2WAN out-interface-list=WAN \
    protocol=tcp
add action=accept chain=forward comment="Zoom aus Gastnetz" dst-address=\  
    !192.168.178.1 dst-port=\
    3478,3479,8801,8802,8803,8804,8805,8806,8807,8808,8809,8810 in-interface=\
    v30_gast layer7-protocol=!layer7-bittorrent-exp log-prefix=traffic2WAN \
    out-interface-list=WAN protocol=udp
add action=accept chain=forward dst-address=!192.168.178.1 in-interface=\
    v40_service log-prefix=traffic2WAN out-interface-list=WAN
add action=accept chain=forward dst-address=!192.168.178.1 in-interface=\
    v41_service-audio log-prefix=traffic2WAN out-interface-list=WAN
add action=reject chain=forward comment="dedizierte input regel f\FCr powerlin\  
    e adapter, damit das firewall log nicht vollgespammt wird" dst-port=53 \  
    in-interface=v12_eoip-keller out-interface=e1wan protocol=udp \
    reject-with=icmp-net-prohibited
add action=reject chain=forward log=yes log-prefix=reject reject-with=\
    icmp-net-prohibited
add action=accept chain=input connection-state=established,related
add action=accept chain=input comment=\
    "ping aus dem heimnetz auf router erlauben" in-interface-list=LAN \  
    protocol=icmp
add action=accept chain=input comment=NTP dst-port=123 in-interface-list=LAN \
    protocol=udp
add action=accept chain=input comment="DNS f\FCr LAN erlauben" dst-port=53 \  
    in-interface-list=LAN protocol=udp
add action=accept chain=input comment="DHCP f\FCr LAN erlauben" dst-port=67 \  
    in-interface-list=LAN protocol=udp
add action=accept chain=input comment="DNS f\FCr openVPN erlauben" dst-port=\  
    53 protocol=udp src-address-list=openvpn_subnet
add action=accept chain=input dst-port=21,22,23,80,443,1812,8291,8728 \
    in-interface=v10_mgmt protocol=tcp
add action=accept chain=input comment="das zoneminder jail im freenas scheint \  
    das netzwerk irgendwie durcheinander zubringen. u.a. scheint nas \FCb\
    er die mgmt ip ausgehende verbindungen z.b. auf den router \FCber das serv\
    ice vlan statt das mgmt vlan zu initiieren, ka warum. diese regel ist ein \
    workaround, dass explizit die ip des nas sich mit dem router verbinden kan\
    n, auch wenn es nicht aus dem servide vlan kommt EDIT1: die regel scheint \
    nichts zu bringen. hilf wohl wirklich nur ein restart des nas" disabled=\  
    yes dst-port=22 in-interface=v40_service protocol=tcp src-address=\
    192.168.10.21
add action=accept chain=input comment="Zugriff auf router aus openVPN" \  
    dst-port=22,23,80,443,8291 protocol=tcp src-address-list=openvpn_subnet
add action=accept chain=input comment="OpenVPN Port" dst-port=1194 protocol=\  
    tcp
add action=accept chain=input comment="Radius server" disabled=yes \  
    dst-address=192.168.10.2 in-interface=v10_mgmt
add action=reject chain=input comment="dedizierte input regel f\FCr powerline \  
    adapter, damit das firewall log nicht vollgespammt wird" dst-port=53 \  
    in-interface=v12_eoip-keller log-prefix=reject protocol=udp reject-with=\
    icmp-net-prohibited
add action=reject chain=input log=yes log-prefix=reject reject-with=\
    icmp-net-prohibited
add action=accept chain=output
/ip firewall nat
add action=dst-nat chain=dstnat comment=\
    "Port forwarding fuer transmission bittorrent client" dst-port=51413 \  
    in-interface=e1wan protocol=tcp to-addresses=192.168.40.12 to-ports=51413
add action=masquerade chain=srcnat out-interface=e1wan
add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes  
add action=masquerade chain=srcnat comment="masquerade hotspot network" \  
    disabled=yes src-address=192.168.20.0/24
/ip hotspot user
add name=admin
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ipv6 address
add address=::20 from-pool=Poolv6 interface=v20_user
add address=::30 from-pool=Poolv6 interface=v30_gast
add address=::40 from-pool=Poolv6 interface=v40_service
add address=::10 from-pool=Poolv6 interface=v10_mgmt
/ipv6 dhcp-client
add add-default-route=yes interface=e1wan pool-name=Poolv6 prefix-hint=::/57 \
    request=prefix use-peer-dns=no
/ipv6 firewall address-list
add address=2a0d:e500::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0e:fa00::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a07:6800::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a09:ac80::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0d:e7c7:ffff::/48 comment="Spamhaus DROPv6" list=\  
    addressListMalware
add address=2a0b:4ec0::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0a:ed80::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2607:d100::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2401:c580::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2803:5380:ffff::/48 comment="Spamhaus DROPv6" list=\  
    addressListMalware
add address=2a0a:a840::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2602:ffa0::/36 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a07:5780::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a06:d240::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a06:e480::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2607:f2d0::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2405:e880::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0a:c00::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a06:4740::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a06:57c0::/30 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0a:36c0::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0b:ae80::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0b:3e80::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0a:6240::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a07:9b80::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a07:7700::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0b:f500::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0c:c600::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a0b:d900::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a00:4c80::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a07:b300::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2803:8700::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2402:6680::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a07:4180::/29 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2a00:55a0::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2405:b480::/32 comment="Spamhaus DROPv6" list=addressListMalware  
add address=2405:b180::/32 comment="Spamhaus DROPv6" list=addressListMalware  
/ipv6 firewall filter
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward comment="Block von Malware IPs" \  
    dst-address-list=addressListMalware log=yes log-prefix=MalwareAccess
add action=accept chain=forward in-interface=v10_mgmt out-interface-list=WAN
add action=accept chain=forward in-interface=v20_user out-interface-list=WAN
add action=accept chain=forward dst-port=\
    22,25,80,110,143,443,465,587,993,995,5222,5223,5280,5298 in-interface=\
    v30_gast out-interface-list=WAN protocol=tcp
add action=accept chain=forward in-interface=v30_gast out-interface-list=WAN \
    protocol=igmp
add action=accept chain=forward dst-port=123 in-interface=v30_gast \
    out-interface-list=WAN protocol=udp
add action=accept chain=forward comment="2020-10-19 - fuer webcam pi im gast v\  
    lan - deaktivieren wenn nicht mehr benoetigt" dst-port=40001 \  
    in-interface=v30_gast out-interface-list=WAN protocol=udp
add action=accept chain=forward in-interface=v40_service out-interface-list=\
    WAN
add action=accept chain=forward disabled=yes in-interface=v20_user \
    out-interface=v20_user
add action=accept chain=forward dst-port=137,139,445,22043,12345 \
    in-interface=v20_user out-interface=v40_service protocol=tcp
add action=reject chain=forward reject-with=icmp-admin-prohibited
add action=accept chain=input protocol=icmpv6
add action=accept chain=input comment=\
    "noetig, um prefix von FritzBox zu erhalten" dst-port=546 in-interface=\  
    e1wan protocol=udp src-port=547
add action=reject chain=input reject-with=icmp-admin-prohibited
/ipv6 nd
set [ find default=yes ] advertise-dns=no
/ppp secret
add name=openvpn profile=openvpn service=ovpn
/radius
add address=192.168.10.13 service=wireless
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Berlin
/system identity
set name=router1
/system logging
add action=remote disabled=yes topics=info
add action=remote topics=warning
add action=remote topics=error
add action=remote topics=critical
add action=remote topics=dhcp
add action=remote topics=firewall
add action=remote topics=system
add action=remote topics=dns
add disabled=yes prefix=MULTICAST topics=pim
/system ntp client
set enabled=yes primary-ntp=78.46.53.8 secondary-ntp=132.163.96.1
/system ntp server
set enabled=yes
/system package update
set channel=long-term
/system scheduler
add interval=30s name=refresh-ipv6 on-event=\
    "/ipv6 dhcp-client renew [find interface=vlan50]" policy=read,write \  
    start-date=nov/28/2016 start-time=18:26:35
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN


Hier die Konfiguration des APs:
# may/04/2021 18:17:35 by RouterOS 6.46.7
# software id = 2PDP-86RF
#
# model = RBcAPGi-5acD2nD
# serial number = BECD0BC0BB3A
/interface bridge
add igmp-snooping=yes ingress-filtering=yes name=bridge_LAN vlan-filtering=\
    yes
/interface wireless
# managed by CAPsMAN
# channel: 2412/20/gn(20dBm), SSID: , CAPsMAN forwarding
set [ find default-name=wlan1 ] antenna-gain=0 country=no_country_set \
    frequency-mode=manual-txpower ssid=MikroTik station-roaming=enabled
# managed by CAPsMAN
# channel: 5560/20-Ce/ac/DP(27dBm), SSID: , CAPsMAN forwarding
set [ find default-name=wlan2 ] antenna-gain=0 country=no_country_set \
    frequency-mode=manual-txpower ssid=MikroTik station-roaming=enabled
/interface vlan
add interface=bridge_LAN name=v10_mgmt vlan-id=10
/interface list
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/system logging action
set 3 remote=192.168.10.13
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\  
    sword,web,sniff,sensitive,api,romon,dude,tikapp"  
add name=backup policy="ssh,ftp,read,write,policy,test,sensitive,!local,!telne\  
    t,!reboot,!winbox,!password,!web,!sniff,!api,!romon,!dude,!tikapp"  
/interface bridge port
add bridge=bridge_LAN frame-types=admit-only-vlan-tagged ingress-filtering=\
    yes interface=ether1 trusted=yes
add bridge=bridge_LAN frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether2 pvid=15
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=bridge_LAN tagged=bridge_LAN,ether1 vlan-ids=10
add bridge=bridge_LAN tagged=bridge_LAN untagged=ether2 vlan-ids=15
/interface list member
add interface=v10_mgmt list=LAN
/interface wireless cap
# 
set bridge=bridge_LAN caps-man-addresses=192.168.10.1 caps-man-names=router1 \
    certificate=CAP-75AF60EA6B4D discovery-interfaces=v10_mgmt enabled=yes \
    interfaces=wlan1,wlan2 lock-to-caps-man=yes
/ip address
add address=192.168.10.5/24 interface=v10_mgmt network=192.168.10.0
/ip dns
set servers=192.168.10.1
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=accept chain=input dst-port=21,22,23,80,443,1812,8291,8728 \
    in-interface=v10_mgmt protocol=tcp
add action=reject chain=input log=yes log-prefix=reject reject-with=\
    icmp-admin-prohibited
/ip route
add distance=1 gateway=192.168.10.1
/ipv6 firewall filter
add action=accept chain=input connection-state=established,related
add action=accept chain=input dst-port=21,22,23,80,443,1812,8291,8728 \
    in-interface=v10_mgmt protocol=tcp
add action=reject chain=input log=yes log-prefix=reject reject-with=\
    icmp-admin-prohibited
/ipv6 nd
set [ find default=yes ] advertise-dns=no
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=AP1
/system leds settings
set all-leds-off=after-1h
/system logging
add action=remote disabled=yes topics=critical
add action=remote disabled=yes topics=error
add action=remote disabled=yes topics=firewall
add action=remote disabled=yes topics=system
add action=remote disabled=yes topics=warning
/system ntp client
set enabled=yes primary-ntp=192.168.10.1 secondary-ntp=192.168.10.1 \
    server-dns-names=de.pool.ntp.org,time.nist.gov
/system package update
set channel=long-term

Nach meinem Verständnis habe ich wirklich alles gebridged. Ich habe keine Routen händisch angelegt und alles auf der von mir bLAN getauften Bridge liegen. Da es viel inter-VLAN Traffic gibt (und mir die Konfiguration etwas einfacher erscheint) habe ich dieses Setup gewählt. Das User-VLAN greift bspw. auf das service-VLAN mit dem NAS und die Oberfläche mit der Heimautomatisierung zu. Der Druckscanner im printer-VLAN darf dediziert auf einen Port einer IP im service-VLAN zugreifen, um Scans dort abzulegen, etc.
Die im CAPsMAN sichtbaren SSIDs des APs habe ich auf dieselbe Bridge gelegt, weswegen ich davon ausgehe, dass es sich wirklich um Bridging handelt.
Normaler unicast Traffic fliegt wie gewünscht durch das Netz. So kann ich bspw. vom Handy im audio-WLAN, dass im audio-VLAN liegt die Soundbar, die per Ethernet auch im audio-VLAN liegt zugreifen. Ich komme auch auf den Webserver der Soundbar vom Handy aus. Nur die Yamaha App, die auf den Multicast Traffic angewiesen ist, findet sie nicht.

Momentan bin ich leider an einer Stelle angekommen, an der ich nicht so richtig weiter weiß.
Member: aqui
aqui May 04, 2021 updated at 17:35:24 (UTC)
Goto Top
Hier die Konfiguration des APs:
Wieso Konfig der APs wenn du mit CapsMan arbeitest. Da haben die APs keinerlei Konfig und ziehen alles vom CapsMan Manager. Die APs werden alle im Caps Mode gebootet !! Ggf. ist das der grundsätzliche Fehler den du machst ?! Siehe dazu auch hier.
Die Bridge ist nur bedingt Bridge im Sinne einer L2 Bridge sondern ein VLAN Switch. Dein Router agiert ja als VLAN Router.
Befürchtung ist also das die beiden WLAN Clients in unterschiedlichen IP Netzen liegen. Gut, das kannst du ja aber kinderleicht checken wenn die in der gleichen SSID eingebucht sind und auch IP Adressen aus dem gleichen IP Netz bekommen haben.
Dann sind sie auch wirklich Layer 2 technisch in der gleichen Broadcast Domain und sollten auch problemlos mit Multicast kommunizieren können.

Wie bereits gesagt. Zum Test wurde hier ein klassisches CapsMan WLAN verwendet identisch zu dieser Konfig:
Dynamische VLAN Zuweisung für WLAN (u. LAN) Clients mit Mikrotik
Der o.a. Multicast Test über 15 Minuten gefahren ohne jegliche Aussetzer und auch mit schnellem Roaming.
Es liegt also de facto nicht an der Hardware an sich sondern sehr wahrscheinlich an einem Fehler in deinem Setup.
Grundlagen zum VLAN Setup auch hier:
Mikrotik VLAN Konfiguration ab RouterOS Version 6.41
Member: Solero
Solero May 04, 2021 at 20:04:39 (UTC)
Goto Top
Ich bin der Sache ein deutliches Stück näher gekommen. Ich kann jetzt den Multicast Traffic zulassen, aber damit erlaube ich mehr als mir lieb ist und deshalb wieder eine Frage.

Hintergrund
Ich habe alle VLAN und CAP Interfaces auf einer einzigen Bridge bLAN auf dem Router. Die Bridge hat alle Firewalls aktiviert (IP, IP for VLAN, IP for PPPOE (ja, unnötig, ich weiß)) und Allow Fast Path). In der Firewall gibt es nun zwei Catch all Regeln reject input und reject forward. Damit lege ich alles tot und erlaube dann selektiv wieder Traffic. Das klappt auch problemlos für inter-vlan Traffic und sieht als FW-Regel bspw. so aus: 
In.Interface=user-vlan Out.Interface=service-vlan Dst.Port=22 Protocol=tcp allow forward
Das ganz klappt jedoch nicht für Traffic, der zwar durch den Router läuft, aber innerhalb desselben VLANS bleibt. In diesem Fall ist sowohl In als auch Out Interface meine Bridge. Im Log sieht das so aus: 
reject forward: In:bLAN(ethernet7) out:bLAN(ap1_audioSSID), src-mac: MA:CA:DD:RE:SS, proto UDP, IP: ->MulticastIP
ethernet7 ist hierbei ein physischer Port am Router in dem die Soundbar steckt und ap1_audioSSID das CAP Interface in dem mein Handy eingebucht ist.

Setzte ich nun eine FW-Regel auf wie 
In.Interface=bLAN Out.Interface=bLAN allow forward
so kommt der Multicast durch, gleichzeitig hätte ich aber auch den gesamten intra-vlan Traffic der durch den Router läuft erlaubt, was ich nicht möchte.

Gibt es hier nun eine Möglichkeit, wie ich selektiv Bridge Traffic nur innerhalb eines VLANS erlauben kann?
Member: aqui
Solution aqui May 05, 2021 at 09:19:04 (UTC)
Goto Top
Die Bridge IST doch das VLAN ! In sofern ist deine Frage etwas verwirrend. Innerhalb einer Layer 2 Boradcast Domain, sprich also eines VLANs, gibt es doch keinerlei Traffic Beschränkungen oder Filter. Die Kommunikation basiert dort immer rein auf Mac Adress Basis ohne irgendwelche Limits.
Die o.a. Frage ist also leider etwas irreführend. WAS genau meinst du damit ?
Member: Solero
Solero May 06, 2021 at 19:25:48 (UTC)
Goto Top
Der Gedanke war es eine Art small-mans-port-isolation aka private vlan einzurichten. Das wäre aber wohl ein separater Thread.

Ich bin jetzt gerade froh, dass der Multicast Traffic wie gewünscht läuft und es nur an einer unüberlegten Firewall-Regel lag.
Danke für das Hinterfragen meiner Gedanken.

Solero
GermansolvedQuestionRouters, RoutingNetworks
Hotly discussed
AlexWishaHow to set up and configure a Linux GRE tunnelAlexWisha - 3 CommentsjstrickerWIREGUARD VPN ON UDM PRO BEHIND FRITZBOX - HANDSHAKE DID NOT COMPLETEjstricker - 1 CommentDaniEnd of Support dates for Office 2016, 2019 Apps und Productivity ServersDani - 1 Comment