Маршрутизация между vlan и vpn

[pro1oo]

Добрый день! Прошу помощи, не могу разобраться, в чем проблема! Сразу оговорюсь, я не СУПЕРАДМИН, и не СУПЕРСЕТЕВИК, но есть определенные знания и понимание! Я так думаю))))))
Суть проблемы! Нет доступа между хостами разных vlan, vpn хосты не видят локалку!
По IP:
На RB создана сеть 172.16.0.0/16
На RB на bridge поднят DHCP-server 172.16.0.50-172.16.0.254/24 это сетка для всех, кого нельзя выделить в отдельную! (native)
в Ether 1-2 воткнуты DGS-1024 неуправляемые 172.16.0.0/24
в Ether 3 воткнут CRS326-SW1, на нем три группы вланов: port 2-8, 9-16, 17-24, в ether1 приходит trunk с RB c Vlan10(172.16.10.0/24),11(172.16.11.0/24),12(172.16.12.0/24),99(172.16.99.0/24), поднят клиент в 99 vlan (Управляющий)
в Ether 4 воткнут CRS326-SW2, на нем три группы вланов: port 2-8, 9-16, 17-24, в ether1 приходит trunk с RB c Vlan13,14,15,99, поднят клиент в 99 vlan (Управляющий)
Настроен L2tp ipsec сервер! Пул 172.16.100.2-172.16.100.254
Что то я не нашел, как скрыть под кат! (((
Конфиги:
RB
[pro1oo@RB2011iL_R-01] > interface vlan pr
Flags: X - disabled, R - running
# NAME MTU ARP VLAN-ID INTERFACE
0 R vlan10 1500 enabled 10 bridge1
1 R vlan11 1500 enabled 11 bridge1
2 R vlan12 1500 enabled 12 bridge1
3 R vlan13 1500 enabled 13 bridge1
4 R vlan14 1500 enabled 14 bridge1
5 R vlan15 1500 enabled 15 bridge1
6 R vlan99 1500 enabled 99 bridge1
__________________________________________________________________________________________________________________________________________________________
[pro1oo@RB2011iL_R-01] > interface bridge print
Flags: X - disabled, R - running
0 R name="bridge1" mtu=auto actual-mtu=1500 l2mtu=1598 arp=enabled arp-timeout=auto mac-address=46:7B:AD:5D:70:9E protocol-mode=rstp fast-forward=yes
igmp-snooping=no auto-mac=no admin-mac=46:7B:AD:5D:70:9E ageing-time=5m priority=0 max-message-age=20s forward-delay=15s transmit-hold-count=6
vlan-filtering=yes ether-type=0x8100 pvid=1 frame-types=admit-all ingress-filtering=no dhcp-snooping=no
__________________________________________________________________________________________________________________________________________________________
[pro1oo@RB2011iL_R-01] >> interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic, H - hw-offload
# INTERFACE BRIDGE HW PVID PRIORITY PATH-COST INTERNAL-PATH-COST HORIZON
0 ether1 bridge1 yes 1 0x80 10 10 none
1 ether2 bridge1 yes 1 0x80 10 10 none
2 ether3 bridge1 yes 1 0x80 10 10 none
3 ether4 bridge1 yes 1 0x80 10 10 none
4 I ether5 bridge1 yes 99 0x80 10 10 none
__________________________________________________________________________________________________________________________________________________________
[pro1oo@RB2011iL_R-01] >> interface bridge vlan print
Flags: X - disabled, D - dynamic
# BRIDGE VLAN-IDS CURRENT-TAGGED CURRENT-UNTAGGED
0 D bridge1 1 bridge1
ether1
ether2
ether3
ether4
1 bridge1 10 bridge1
ether3
2 bridge1 11 bridge1
ether3
3 bridge1 12 bridge1
ether3
4 bridge1 13 bridge1
ether4
5 bridge1 14 bridge1
ether4
6 bridge1 15 bridge1
ether4
7 bridge1 99 bridge1
ether3
ether4
__________________________________________________________________________________________________________________________________________________________
[pro1oo@RB2011iL_R-01] >> ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 172.16.0.1/16 172.16.0.0 bridge1
1 172.16.10.1/24 172.16.10.0 vlan10
2 172.16.99.1/24 172.16.99.0 vlan99
3 D xxx.xx.xx.xxx/32 xxx.xx.xx.xxx HomeNet
4 172.16.11.1/24 172.16.11.0 vlan11
5 172.16.12.1/24 172.16.12.0 vlan12
6 172.16.13.1/24 172.16.13.0 vlan13
7 172.16.14.1/24 172.16.14.0 vlan14
8 172.16.15.1/24 172.16.15.0 vlan15
__________________________________________________________________________________________________________________________________________________________
[pro1oo@RB2011iL_R-01] >> ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; WAN masquarade
chain=srcnat action=masquerade src-address=172.16.0.0/16 out-interface=HomeNet log=no log-prefix=""

1 X ;;; 1c_web_auditor
chain=dstnat action=dst-nat to-addresses=172.16.0.10 to-ports=80 protocol=tcp dst-port=XXXX log=no log-prefix="Audit"

2 X ;;; RDP
chain=dstnat action=dst-nat to-addresses=172.16.0.11 to-ports=3389 protocol=tcp src-address-list=ip_access dst-port=XXXX log=yes log-prefix="rdp_s"

3 X ;;; RDP
chain=dstnat action=dst-nat to-addresses=172.16.0.10 to-ports=3389 protocol=tcp src-address-list=ip_access dst-port=XXXX log=yes log-prefix="rdp_a"
__________________________________________________________________________________________________________________________________________________________
[pro1oo@RB2011iL_R-01] >> ip route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 HomeNet 1
1 ADC xxx.xx.xx.xxx/32 xxx.xx.xx.xxx HomeNet 0
2 ADC 172.16.0.0/16 172.16.0.1 bridge1 0
3 ADC 172.16.10.0/24 172.16.10.1 vlan10 0
4 ADC 172.16.11.0/24 172.16.11.1 vlan11 0
5 ADC 172.16.12.0/24 172.16.12.1 vlan12 0
6 ADC 172.16.13.0/24 172.16.13.1 vlan13 0
7 ADC 172.16.14.0/24 172.16.14.1 vlan14 0
8 ADC 172.16.15.0/24 172.16.15.1 vlan15 0
9 ADC 172.16.99.0/24 172.16.99.1 vlan99 0
__________________________________________________________________________________________________________________________________________________________
[pro1oo@RB2011iL_R-01] >> ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked log=no log-prefix=""

1 ;;; Accept to local loopback
chain=input action=accept dst-address=127.0.0.1 log=no log-prefix=""

2 ;;; accept limit icmp
chain=input action=accept protocol=icmp limit=50/5s,2:packet log=no log-prefix=""

3 ;;; Accept vpn
chain=input action=accept protocol=udp in-interface=HomeNet dst-port=1701,500,4500 log=no log-prefix=""

4 ;;; Accept ipsec-esp
chain=input action=accept protocol=ipsec-esp log=no log-prefix=""

5 ;;; WinBox_podbor
chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=WBX_podbor_3 address-list=blacklist
address-list-timeout=none-static in-interface-list=WAN dst-port=9600 log=no log-prefix=""

6 chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=WBX_podbor_2 address-list=WBX_podbor_3
address-list-timeout=1h in-interface-list=WAN dst-port=XXXX log=no log-prefix=""

7 chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=WBX_podbor_1 address-list=WBX_podbor_2
address-list-timeout=1h in-interface-list=WAN dst-port=XXXX log=no log-prefix=""

8 chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=!ip_access address-list=WBX_podbor_1
address-list-timeout=1h in-interface-list=WAN dst-port=XXXX log=no log-prefix=""

9 ;;; Accept WinBox
chain=input action=accept connection-state="" protocol=tcp src-address-list=ip_access dst-port=9600 log=no log-prefix=""

10 chain=input action=drop connection-state="" protocol=tcp dst-port=XXXX log=no log-prefix=""

11 ;;; RDP_podbor
chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=RDP_podbor_3 address-list=blacklist
address-list-timeout=none-static in-interface-list=WAN dst-port=3389 log=no log-prefix=""

12 chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=RDP_podbor_2 address-list=RDP_podbor_3
address-list-timeout=1h in-interface-list=WAN dst-port=3389 log=no log-prefix=""

13 chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=RDP_podbor_1 address-list=RDP_podbor_2
address-list-timeout=1h in-interface-list=WAN dst-port=3389 log=no log-prefix=""

14 chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=!ip_access address-list=RDP_podbor_1
address-list-timeout=1h in-interface-list=WAN dst-port=3389 log=no log-prefix=""

15 ;;; Accept RDP
chain=input action=accept connection-state="" protocol=tcp src-address-list=ip_access dst-port=3389 log=no log-prefix=""

16 chain=input action=drop connection-state="" protocol=tcp dst-port=3389 log=no log-prefix=""

17 ;;; DNS Flood from WAN
chain=input action=drop protocol=udp in-interface-list=WAN dst-port=53 log=no log-prefix=""

18 chain=input action=drop protocol=tcp in-interface-list=WAN dst-port=53 log=no log-prefix=""

19 chain=input action=drop protocol=udp in-interface-list=WAN dst-port=123 log=no log-prefix=""

20 ;;; Drop invalid
chain=input action=drop connection-state=invalid log=no log-prefix=""

21 ;;; Drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN log=no log-prefix=""

22 ;;; Accept established,related,untracked
chain=forward action=accept connection-state=established,related,untracked log=no log-prefix=""

23 ;;; accept in ipsec policy
chain=forward action=accept log=no log-prefix="" ipsec-policy=in,ipsec

24 ;;; accept out ipsec policy
chain=forward action=accept log=no log-prefix="" ipsec-policy=out,ipsec

25 ;;; drop invalid
chain=forward action=drop connection-state=invalid log=no log-prefix=""

26 ;;; drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=no log-prefix=""

CRS

[pro1oo@CRS326-24G-SW-01] > export
# feb/16/2021 13:35:18 by RouterOS 6.48.1
# software id = IWE6-C07M
#
# model = CRS326-24G-2S+
# serial number = DA720C98137F
/interface bridge
add admin-mac=BE:4A:5B:31:DC:27 auto-mac=no name=bridge1 vlan-filtering=yes
/interface vlan
add interface=bridge1 name=vlan99 vlan-id=99
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/interface bridge port
add bridge=bridge1 comment="TRUNK to R-01 ether3" interface=ether1
add bridge=bridge1 comment="Vlan 10" interface=ether2 pvid=10
add bridge=bridge1 interface=ether3 pvid=10
add bridge=bridge1 interface=ether4 pvid=10
add bridge=bridge1 interface=ether5 pvid=10
add bridge=bridge1 interface=ether6 pvid=10
add bridge=bridge1 interface=ether7 pvid=10
add bridge=bridge1 interface=ether8 pvid=10
add bridge=bridge1 comment="Vlan 11" interface=ether9 pvid=11
add bridge=bridge1 interface=ether10 pvid=11
add bridge=bridge1 interface=ether11 pvid=11
add bridge=bridge1 interface=ether12 pvid=11
add bridge=bridge1 interface=ether13 pvid=11
add bridge=bridge1 interface=ether14 pvid=11
add bridge=bridge1 interface=ether15 pvid=11
add bridge=bridge1 interface=ether16 pvid=11
add bridge=bridge1 comment="Vlan 12" interface=ether17 pvid=12
add bridge=bridge1 interface=ether18 pvid=12
add bridge=bridge1 interface=ether19 pvid=12
add bridge=bridge1 interface=ether20 pvid=12
add bridge=bridge1 interface=ether21 pvid=12
add bridge=bridge1 interface=ether22 pvid=12
add bridge=bridge1 interface=ether23 pvid=12
add bridge=bridge1 interface=ether24 pvid=12
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether1,sfp-sfpplus1 vlan-ids=99
add bridge=bridge1 tagged=bridge1,ether1,sfp-sfpplus1 untagged=\
ether2,ether3,ether4,ether5,ether6,ether7,ether8 vlan-ids=10
add bridge=bridge1 tagged=bridge1,ether1,sfp-sfpplus1 untagged=\
ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16 vlan-ids=11
add bridge=bridge1 tagged=bridge1,ether1,sfp-sfpplus1 untagged=\
ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24 vlan-ids=12
/interface detect-internet
set detect-interface-list=WAN
/interface list member
add interface=vlan99 list=WAN
/ip dhcp-client
add disabled=no interface=vlan99
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=xx.xx.xx.xx/32 port=xxxx
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=CRS326-24G-SW-01
/system routerboard settings
set boot-os=router-os
/tool romon
set enabled=yes secrets=************
/tool romon port
set [ find default=yes ] forbid=yes
add disabled=no interface=ether1

[Chupaka]

Здравствуйте.

Суть проблемы! Нет доступа между хостами разных vlan, vpn хосты не видят локалку!

Трассировку хотя бы покажите, для начала

Вроде ничего в конфиге (смотрел по диагонали) не мешает. Причина точно не в файрволах на устройствах (например, Брандмауэр Windows по умолчанию пускает к себе только из своей подсети)?

[pro1oo]

Добрый вечер! По трассировке отвечает шлюз влана и дальше превышен интервал...

[Chupaka]

Тогда я всё ещё подозреваю файрвол на трассируемой машине

Для проверки можете сделать правило SRC-NAT Masquerade для Out-Interface=вилан_назначения - тогда пакеты на машину назначения будут прилетать с адреса роутера в этом вилане.

[pro1oo]

Большое спасибо! Действительно, дело оказалось в штатном брандмауэре! (( Будь он не ладен)