Neo TV Box in mikrotik router

Neo TV Box ima težavo s povezljivostjo ko ga priklopim čez Mikrotik router. Omrežje je sledeče:

Innbox modem LAN1 (trunk) -> LAN1 Mikrotik LAN3 -> Unmanaged Switch -> Unmanaged Switch -> Neo Tv Box

Iz routerja mi gre v mansardo samo en kabel tako da ne vidim druge opcije kot tak priklop.

Na zadnjih dveh switchih že imam priklopljen PC, rpi, AP.. vse zadeve delajo. Samo Box se ne poveže.

Na Mikrotik DHCP Serverju vidim lease za MAC od Neota, ima LAN IP, vendar Neo trdi da nima povezave, niti lokalnega IPja.

Na torchu vidim tudi neke pakete ki letijo iz Neo leased IPja na 10.253.47.X.

Sem iz ITja ampak bolj švoh na omrežnem področju, na googlu sem naletel na več let stare poste glede VLAN 3999 ipd ampak ne vem kaj še drži v 2023. Če se me kdo usmili in mal vodi čez proces delovanja bi bilo dobrodošlo.

lp

Nov Bridge IPTV
Ustvariš VLAN 3999 na ETH1 in ETH3 vmesniku in oba VLANa daš v ta bridge. To je osnova, se pa da potem zadevo še malo obdelati po potrebi.

Da se nastaviti IP na vmesnik, nato IGMP proxy po potrebi oz. še bolj uporabna zadeva je poganjanje UDPXY v Container funkciji, potem lahko unicast playlisto poženeš v VLC na računalniku, dela BP.

V VLC sicer ni ogleda nazaj in teh reči.

Pa tudi nastavljanje tega, ti bo vzelo nekaj časa. Odvisno koliko si "podkovan" v teh zadevah.

Čisto odvisno od switcha. Popolnoma dumb switch ti spušča multicast na vse porte in boš imel multicast promet na LAN portih računalnikov.
Potem so neki switchi, ki so križanci, ima nekaj pametnih fukncij okrog igmp, nima pa vmesnika, taki ponavadi povzročajo največ težav.
In potem so še switchi, ki so managed, tisti bi načeloma z vklopljenim igmp snoopingom morali delati ok, ampak garancije za to vseeno ni.

Na tisti port, kjer je switch dodaj VLAN3999 in dodaj ta VLAN v bridge z ostalima dvema portoma kjer je modem in NEO.

jao jao, tole z vec bridgi ze zelo dolgo ni optimalna konfiguracija, ker cisto po nepotrebnem obremenjuje cpu :)

to se da zelo elegantno resit z enim bridgem in switch configom

moj mikrotik hap ac2 config:
ether1 wan
ether 2-5 vlan 10 access porti, ether5 tagged vlan 3999 za iptv
wifi - vlan 10

/interface bridge add name=bridge1
/interface pppoe-client add add-default-route=yes disabled=no interface=bridge1 name=pppoe-out1 password=PASSWORD user=USERNAME
/interface wireless set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX country=slovenia disabled=no distance=indoors frequency=5200 installation=indoor mode=ap-bridge name=wlan0 ssid=SSID station-roaming=enabled vlan-id=10 vlan-mode=use-tag wmm-support=enabled wps-mode=disabled
/interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n country=slovenia disabled=no distance=indoors frequency=2437 installation=indoor mode=ap-bridge ssid=SSID station-roaming=enabled vlan-id=10 vlan-mode=use-tag wmm-support=enabled wps-mode=disabled
/interface vlan add interface=bridge1 name=vlan10 vlan-id=10
/interface ethernet switch port set ether1 default-vlan-id=1 vlan-header=always-strip vlan-mode=secure
/interface ethernet switch port set ether2 default-vlan-id=10 vlan-header=always-strip vlan-mode=secure
/interface ethernet switch port set ether3 default-vlan-id=10 vlan-header=always-strip vlan-mode=secure
/interface ethernet switch port set ether4 default-vlan-id=10 vlan-header=always-strip vlan-mode=secure
/interface ethernet switch port set ether5 default-vlan-id=10 vlan-header=add-if-missing vlan-mode=secure
/interface ethernet switch port set switch1-cpu vlan-mode=secure
/interface list add name=LAN
/interface list add name=WAN
/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=SSID wpa2-pre-shared-key=PASSWORD
/ip pool add name=dhcp_pool ranges=192.168.10.100-192.168.10.150
/ip dhcp-server add add-dns-entries=yes address-pool=dhcp_pool interface=vlan10 lease-time=12h name=dhcp1
/interface bridge port add bridge=bridge1 interface=ether1 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=ether2 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=ether3 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=ether4 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 interface=ether5
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=wlan1 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=wlan0 internal-path-cost=10 path-cost=10
/ip firewall connection tracking set udp-timeout=10s
/ip neighbor discovery-settings set discover-interface-list=none lldp-med-net-policy-vlan=1
/interface ethernet switch vlan add independent-learning=yes ports=ether2,ether3,ether4,ether5,switch1-cpu switch=switch1 vlan-id=10
/interface ethernet switch vlan add independent-learning=yes ports=ether1,switch1-cpu switch=switch1 vlan-id=1
/interface ethernet switch vlan add independent-learning=yes ports=ether1,ether5 switch=switch1 vlan-id=3999
/interface list member add interface=vlan10 list=LAN
/interface list member add interface=pppoe-out1 list=WAN
/ip address add address=192.168.10.1/24 interface=vlan10 network=192.168.10.0
/ip dhcp-server network add address=192.168.10.0/24 dns-server=192.168.10.1 domain=lan gateway=192.168.10.1
/ip dns set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8,2001:4860:4860::8888,2606:4700:4700::1111 use-doh-server=https://dns.adguard-dns.com/dns-query
/ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
/ip firewall filter add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=reject chain=forward disabled=yes in-interface=ether1 out-interface=ether1 reject-with=icmp-network-unreachable
/ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
/ip firewall filter add action=accept chain=input comment="IPSec VPN" disabled=yes in-interface=*A port=500,4500 protocol=udp
/ip firewall filter add action=accept chain=input comment="IPSec VPN" disabled=yes in-interface=*A protocol=ipsec-esp
/ip firewall filter add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
/ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
/ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
/ip firewall filter add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
/ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
/ip firewall filter add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
/ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip service set ftp disabled=yes
/ip service set telnet disabled=yes
/ip service set api disabled=yes
/ip ssh set forwarding-enabled=both
/ipv6 address add address=2001:db8::1/64 interface=vlan10
/ipv6 dhcp-client add add-default-route=yes custom-iana-id=0 custom-iapd-id=0 default-route-tables=main interface=pppoe-out1 pool-name=dhcpv6 pool-prefix-length=64 request=prefix use-peer-dns=no
/ipv6 firewall address-list add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
/ipv6 firewall address-list add address=::1/128 comment="defconf: lo" list=bad_ipv6
/ipv6 firewall address-list add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
/ipv6 firewall address-list add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
/ipv6 firewall address-list add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
/ipv6 firewall address-list add address=100::/64 comment="defconf: discard only " list=bad_ipv6
/ipv6 firewall address-list add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
/ipv6 firewall address-list add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
/ipv6 firewall address-list add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
/ipv6 firewall filter add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
/ipv6 firewall filter add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/ipv6 firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" connection-state=established,related
/ipv6 firewall filter add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
/ipv6 firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
/ipv6 firewall filter add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
/ipv6 firewall filter add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
/ipv6 firewall filter add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
/ipv6 firewall filter add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
/ipv6 firewall filter add action=accept chain=forward comment="defconf: accept HIP" protocol=139
/ipv6 firewall filter add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
/ipv6 firewall filter add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
/ipv6 firewall filter add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
/ipv6 firewall filter add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
/ipv6 firewall filter add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/ipv6 nd
set [ find default=yes ] advertise-dns=yes dns=2001:db8::1 mtu=1492
/system clock set time-zone-name=Europe/Ljubljana
/system identity set name=MikroTik
/system note set show-at-login=no
/system ntp client set enabled=yes
/system ntp client servers add address=2001:1470:8000::117
/system ntp client servers add address=2001:1470:8000::92
/system ntp client servers add address=ntp1.arnes.si
/system ntp client servers add address=ntp2.arnes.si
/tool bandwidth-server set enabled=no
/tool graphing interface add store-on-disk=no
/tool graphing resource add store-on-disk=no
/tool mac-server set allowed-interface-list=none
/tool mac-server mac-winbox set allowed-interface-list=LAN
/tool mac-server ping set enabled=no