@probzx, ton serveur sait il gérer des vlans ? Tu utilises un système de virtualisation, genre VMware, proxmox ? Car sinon en règle générale un port « access » ne doit être que dans un Vlan et donc en untag chez MikroTik.

@probzx, ok. Peux tu alors exporter la conf complète de ton bridge et de un des ports access et d’un des trunk ?

Je pense que ton bridge a un souci dans la conf des vlans

@probzx, ok. Peux tu alors exporter la conf complète de ton bridge et de un des ports access et d’un des trunk ?

Je pense que ton bridge a un souci dans la conf des vlans

Je reviens avec un peu d'absence, entre les fêtes et le boulot j'avais mis mon projet en pause.

Voici donc la configuration de mon bridge :
/interface bridge
add frame-types=admit-only-vlan-tagged name=br-lan vlan-filtering=yes
add admin-mac=98:42:65:15:93:60 auto-mac=no name=br-wan


Mes VLAN :
/interface vlan
add interface=br-lan name=VLAN10 vlan-id=10
add interface=br-lan name=VLAN20 vlan-id=20
add interface=br-lan name=VLAN100 vlan-id=100
add comment="Internet ONT" interface=ether1 loop-protect-disable-time=0s \
    loop-protect-send-interval=1s name=vlan832-internet vlan-id=832

Les ports du bridge :
/interface bridge port
add bridge=br-lan interface=sfp-sfpplus1
add bridge=br-wan comment=WAN interface=vlan832-internet
add bridge=br-lan interface=ether2
add bridge=br-lan interface=ether3
add bridge=br-lan interface=ether4
add bridge=br-lan interface=ether5
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether6
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether7

Les vlans du bridge :
/interface bridge vlan
add bridge=br-lan tagged=br-lan,ether6,ether7 vlan-ids=20
add bridge=br-lan tagged=br-lan,ether4,ether5 vlan-ids=10

@probzx, en effet ton bridge me semble mal configuré par rapport a ton schema de la page précedente.

Voila quelques modifs à tester:

Code: [Sélectionner]

/interface bridge
add frame-types=admit-only-vlan-tagged name=br-lan vlan-filtering=yes
add admin-mac=98:42:65:15:93:60 auto-mac=no name=br-wan

/interface vlan
add interface=br-lan name=VLAN10 vlan-id=10
add interface=br-lan name=VLAN20 vlan-id=20
add interface=br-lan name=VLAN100 vlan-id=100
add comment="Internet ONT" interface=ether1 loop-protect-disable-time=0s \
    loop-protect-send-interval=1s name=vlan832-internet vlan-id=832

/interface bridge port
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1
add bridge=br-wan comment=WAN interface=vlan832-internet
add bridge=br-lan frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=br-lan frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=br-lan frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=10
add bridge=br-lan frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether6
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether7

/interface bridge vlan
add bridge=br-lan tagged=br-lan,ether6,ether7,sfp-sfpplus1 vlan-ids=20
add bridge=br-lan tagged=br-lan,sfp-sfpplus1 vlan-ids=10
add bridge=br-lan tagged=br-lan,ether6,ether7,sfp-sfpplus1 vlan-ids=100
add bridge=br-lan tagged=br-lan,ether6,ether7,sfp-sfpplus1 vlan-ids=200

Ca correspond plus a ton schema pour la partie routeur, je te laisse configurer ton switch.

De plus il te manques la partie COS6 sur le vlan 832:

Code: [Sélectionner]

/interface bridge filter
add action=set-priority chain=output dst-port=67 ip-protocol=udp mac-protocol=ip new-priority=6 out-interface=vlan832-internet passthrough=yes
add action=set-priority chain=output dst-port=547 ip-protocol=udp mac-protocol=ipv6 new-priority=6 out-interface=vlan832-internet
add action=set-priority chain=output mac-protocol=arp new-priority=6 out-interface=vlan832-internet passthrough=yes
Voila qui devrait t'aider, je pense.

Merci pour ton aide.
J'avais volontairement retiré la partie "WAN", mais effectivement j'ai déjà en place la partie COS6 avec ipv6 fonctionnelle

J'ai suivi des conseils en modifiant ma configuration, malheureusement je ne parviens pas à la faire fonctionner.
Je partage ici ma configuration si ça peut aider à pointer une erreur de configuration.

Voici ce que ça donne :

/interface bridge
add frame-types=admit-only-vlan-tagged name=br-lan port-cost-mode=short \
    vlan-filtering=yes
add admin-mac=98:42:65:15:93:60 auto-mac=no name=br-wan port-cost-mode=short

/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=sfp-sfpplus1 ] comment=LAN-SFP

/interface vlan
add interface=br-lan name=vlan10 vlan-id=10
add interface=br-lan name=vlan20 vlan-id=20
add interface=br-lan name=vlan100 vlan-id=100
add interface=br-lan name=vlan200 vlan-id=200
add comment="Internet ONT" interface=ether1 loop-protect-disable-time=0s \
    loop-protect-send-interval=1s name=vlan832-internet vlan-id=832

/interface list
add name=LAN

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik

/interface bridge filter
add action=set-priority chain=output dst-port=67 ip-protocol=udp log=yes \
    log-prefix="Set CoS6 on DHCP request" mac-protocol=ip new-priority=6 \
    out-interface=vlan832-internet passthrough=yes
add action=set-priority chain=output dst-port=547 ip-protocol=udp \
    mac-protocol=ipv6 new-priority=6 out-interface=vlan832-internet

/interface bridge port
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 \
    internal-path-cost=10 path-cost=10
add bridge=br-wan comment=WAN interface=vlan832-internet internal-path-cost=\
    10 path-cost=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether2 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether3 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether4 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether5 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether6 pvid=20
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=ether7 pvid=20

/interface list member
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=sfp-sfpplus1 list=LAN
add interface=ether8 list=LAN
add interface=br-lan list=LAN
add interface=vlan10 list=LAN
add interface=vlan20 list=LAN
add interface=vlan100 list=LAN
add interface=vlan200 list=LAN

/ip address
add address=192.168.1.254/24 comment=LAN-DEFAULT disabled=yes interface=\
    br-lan network=192.168.1.0
add address=192.168.88.1/24 interface=ether8 network=192.168.88.0
add address=192.168.10.254/24 comment=LAN interface=vlan10 network=\
    192.168.10.0
add address=192.168.20.254/24 comment=SERVEUR interface=vlan20 network=\
    192.168.20.0
add address=192.168.100.254/24 comment=DMZ interface=vlan100 network=\
    192.168.100.0
add address=192.168.200.254/24 comment=MGMT interface=vlan200 network=\
    192.168.200.0

/ip firewall address-list
add address=192.168.1.0/24 list=support
add address=192.168.88.0/24 list=support
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A" disabled=yes \
    list=bogons
add address=127.0.0.0/16 comment="Loopback [RFC 3330]" list=bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B" disabled=yes \
    list=bogons
add address=192.168.0.0/16 comment="Private[RFC 1918] - CLASS C" disabled=yes \
    list=bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=\
    bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons
add address=224.0.0.0/4 comment="MC, Class D, IANA" disabled=yes list=bogons
add address=192.168.20.0/24 list=support
add address=192.168.30.0/24 list=support
add address=192.168.200.0/24 list=support
add address=192.168.100.0/24 list=support
/ip firewall filter
add action=add-src-to-address-list address-list=Syn_Flooder \
    address-list-timeout=30m chain=input comment=\
    "Add Syn Flood IP to the list" connection-limit=30,32 protocol=tcp \
    tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" \
    src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
    address-list-timeout=1w chain=input comment="Port Scanner Detect" \
    protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" \
    src-address-list=Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=\
    ICMP protocol=icmp
add action=drop chain=input comment="Block all access to the winbox - except t\
    o support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUP\
    PORT ADDRESS LIST" dst-port=8291 protocol=tcp src-address-list=!support
add action=jump chain=forward comment="Jump for icmp forward flow" \
    jump-target=ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
    bogons
add action=add-src-to-address-list address-list=spammers \
    address-list-timeout=3h chain=forward comment=\
    "Add Spammers to the list for 3 hours" connection-limit=30,32 dst-port=\
    25,587 limit=30/1m,0:packet protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
    protocol=tcp src-address-list=spammers
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input comment="Accept to established connections" \
    connection-state=established
add action=accept chain=input comment="Accept to related connections" \
    connection-state=related
add action=accept chain=input comment="Full access to SUPPORT address list" \
    src-address-list=support
add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE THIS \
    RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED"
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" \
    icmp-options=8:0 limit=1,5:packet protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
    icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
    protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
    3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
    protocol=icmp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \
    protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist \
    address-list-timeout=1w3d chain=input connection-state=new dst-port=22 \
    protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 \
    address-list-timeout=1m chain=input connection-state=new dst-port=22 \
    protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 \
    address-list-timeout=1m chain=input connection-state=new dst-port=22 \
    protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 \
    address-list-timeout=1m chain=input connection-state=new dst-port=22 \
    protocol=tcp
add action=drop chain=forward comment="drop ssh brute downstream" dst-port=22 \
    protocol=tcp src-address-list=ssh_blacklist
/ip firewall nat
add action=masquerade chain=srcnat out-interface=br-wan to-addresses=0.0.0.0
/ip service
set telnet disabled=yes
set ftp disabled=yes

@Probzx, alors plusieurs remarques:
- les ports access eth2 à 5 doivent être en frame-types=admit-only-untagged-and-priority-tagged  et surtout pas en admit-only-vlan-tagged.
- Ou sont définis tes vlan sur le bridge ? Je parle de cette partie qui ne figure pas dans ton export, sans cela ne marchera pas…

Code: [Sélectionner]

/interface bridge vlan
add bridge=br-lan tagged=br-lan,ether6,ether7,sfp-sfpplus1 vlan-ids=20
add bridge=br-lan tagged=br-lan,sfp-sfpplus1 vlan-ids=10
add bridge=br-lan tagged=br-lan,ether6,ether7,sfp-sfpplus1 vlan-ids=100
add bridge=br-lan tagged=br-lan,ether6,ether7,sfp-sfpplus1 vlan-ids=200- ensuite je dirais que tu as repris le firewall de quelqu’un d’autre sans probablement le comprendre…. ;-), tu as des blacklist ssh qui ne semble pas définies. Alors si j’étais toi je repartirai de zéro, de ce coté, car je ne suis pas sur que cela soit adapté a ton besoin. https://help.mikrotik.com/docs/display/ROS/Building+Your+First+Firewall

Après tout ca cela si cela ne marche toujours pas exporte complètement ta conf et pas seulement une partie.

Merci pour ton aide, j'ai réussi à faire fonctionner correctement mon bridge et mes vlans

Je vais reprendre la configuration du firewall au début en me basant sur doc que tu m'a envoyé. Effectivement, j'ai chopé la configuration du firewall sur le guide : https://lafibre.info/remplacer-livebox/guide-de-connexion-fibre-directement-sur-un-routeur-voire-meme-en-2gbps/

Les lignes de codes sont à entrer une par une dans le terminal c'est bien ça (je découvre RouterOS) ?