Configuring Qiniq NNU VLAN ISP Carrier on RouterOS

Step-by-step guide to set up your VLAN interface for Qiniq NNU

Highlights

VLAN Interface Creation: Learn to set up VLANs using the RouterOS interface or terminal commands, ensuring your physical interface is properly designated.
WAN Client Configuration: Detailed instructions for setting up either DHCP or PPPoE clients on the VLAN interface based on your ISP requirements.
Q-in-Q Considerations: Guidance on whether you require double tagging (Q-in-Q) and how to adjust settings like l2mtu, bridge configurations, and firewall rules to maintain connectivity and security.

Understanding the Qiniq NNU VLAN Setup

The Qiniq NNU VLAN ISP carrier uses a dedicated VLAN configuration that segregates your traffic from other traffic on shared networks. This method isolates your Internet data flow while ensuring secure and reliable connectivity by enforcing Network VLAN tagging. In many instances, the service may leverage additional protocols like DHCP or PPPoE for WAN client configuration as well as Q-in-Q (IEEE 802.1ad) tagging – which encapsulates one VLAN inside another – when required. This guide will outline all the necessary steps and considerations to set up and optimize your RouterOS device for a Qiniq NNU VLAN ISP environment.

Step 1: Verifying Physical Connectivity

Check the Interface

First, ensure that your RouterOS device’s WAN port (typically labeled as "ether1" or similar depending on your hardware configuration) is physically connected to the Qiniq NNU Customer Premises Equipment (CPE) or designated port provided by your ISP. Incorrect physical connections can stop VLAN configurations from working or lead to unexpected connectivity issues.

Verify your connection using the RouterOS interface to monitor port lights (if available) and by pinging common network addresses once configuration is applied.

Step 2: Creating the VLAN Interface

Via Graphical User Interface (Winbox/WebFig)

Access your RouterOS administration interface. In the VLAN section:

Create a new VLAN interface by clicking on “Add New”.
Assign the VLAN a recognizable name in the Comment field (e.g., "vlan-qiniq").
Enter the VLAN ID provided by your ISP. For instance, if your ISP specifies VLAN 160, then that is the value you need.
Select the physical interface (typically "ether1") to which this VLAN is attached.
Decide if the interface should be a part of a bridge. In many cases for WAN connectivity, a direct assignment is sufficient, unless your network setup requires bridging.

Via Terminal Commands

Alternately, you can create and configure your VLAN interface using RouterOS terminal commands. In the terminal, type:


  /interface vlan
  add name="vlan-qiniq" interface=ether1 vlan-id=160  <!-- Replace 160 with your specific VLAN ID -->

This command creates a VLAN sub-interface attached to the physical interface, specifying the VLAN ID as provided by Qiniq NNU. The naming convention makes it easier to identify the interface connection.

Step 3: Configuring the WAN Client on the VLAN Interface

Option A: DHCP Client

In many cases, the ISP uses DHCP to allocate IP settings to the VLAN interface. This means the RouterOS device will automatically acquire an IP address along with appropriate DNS servers and a default route.

To enable the DHCP client interface via the RouterOS terminal, type:


  /ip dhcp-client
  add interface=vlan-qiniq disabled=no use-peer-dns=yes add-default-route=yes

This setup will request an IP address from the ISP’s DHCP server, set the default route based on the received gateway, and apply ISP-assigned DNS information.

Option B: PPPoE Client

Some Qiniq NNU services require PPPoE client configuration which involves authentication. If your ISP provided credentials, follow these steps:


  /interface pppoe-client
  add interface=vlan-qiniq name=pppoe-qiniq user=YOUR_USERNAME password=YOUR_PASSWORD add-default-route=yes use-peer-dns=yes disabled=no

Replace YOUR_USERNAME and YOUR_PASSWORD with the actual credentials provided by the Qiniq NNU service. This command will establish a PPPoE session over your previously defined VLAN interface, and configure the default routing and DNS settings as dictated by your PPPoE session.

Advanced Concepts: Q-in-Q (802.1ad) Tagging

In more complex setups, especially in cases where the ISP handles multiple levels of VLAN tagging, you may need to implement Q-in-Q, also known as double VLAN tagging. Q-in-Q enables networks to encapsulate one VLAN tag within another, a practice that is particularly common in carrier-level networks to differentiate between various clients.

Understanding Q-in-Q

Q-in-Q encapsulation allows an additional layer of VLAN tagging. The outer tag (often called the Service VLAN or S-VLAN) encapsulates the customer VLAN (C-VLAN), which permits the ISP to manage hundreds or thousands of customers using a limited set of VLAN IDs while ensuring isolation and QoS.

Configuration Steps of Q-in-Q

To set up Q-in-Q you will need to:

Create the outer VLAN (e.g., "vlan-outer") attached to your physical interface.
Create the inner VLAN on top of the outer VLAN interface, specifying the customer VLAN ID.

An example configuration is shown below:


  /interface vlan
  add interface=ether1 name="vlan-outer" vlan-id=2705   <!-- Outer VLAN provided by ISP -->
  add interface=vlan-outer name="vlan-customer" vlan-id=100 <!-- Customer VLAN -->

After creating the Q-in-Q setup, it might be necessary to ensure that the full frame size is supported. This may include adjusting the Layer 2 MTU on the outer VLAN interface:


  /interface vlan
  set [find name="vlan-outer"] l2mtu=1586

When to Use Q-in-Q

Depending on the Qiniq service setup or ISP guidance, you may either need a single VLAN configuration or opt for Q-in-Q if the ISP instructs you to encapsulate one VLAN within another. Always confirm the VLAN IDs (both outer and inner) with your ISP prior to completing your configuration.

Setting Up Firewall and NAT Rules

For scenarios in which your RouterOS device functions as a NAT router behind your Qiniq connection, implementing proper firewall and NAT rules is critical. This ensures that all outgoing connections are correctly masqueraded through the configured VLAN interface.

NAT Configuration

Add a masquerade rule to handle outbound traffic, using commands such as:


  /ip firewall nat
  add chain=srcnat out-interface=vlan-qiniq action=masquerade

This will allow proper translation of your internal IP addresses to the IP address provided by your Qiniq connection, ensuring that outbound traffic is routed appropriately.

Firewall Considerations

In addition to NAT, configuring firewall filters to secure your network is advised. Some common practices include:

Blocking unwanted incoming connections on the WAN side.
Allowing only necessary traffic for remote management.
Logging dropped packets to monitor any unauthorized access attempts.

Example of a basic firewall input rule for your WAN interface:


  /ip firewall filter
  add chain=input in-interface=vlan-qiniq protocol=tcp dst-port=22 action=accept comment="Allow SSH"
  add chain=input in-interface=vlan-qiniq action=drop comment="Drop other WAN traffic"

Practical Configuration Table

The table below summarizes a sample configuration for a typical Qiniq NNU VLAN setup using RouterOS:

Configuration Step	Command / Description
Physical Interface Verification	Ensure ether1 is connected to Qiniq CPE
Create VLAN	`/interface vlan add name="vlan-qiniq" interface=ether1 vlan-id=160`
Configure WAN via DHCP	`/ip dhcp-client add interface=vlan-qiniq disabled=no use-peer-dns=yes add-default-route=yes`
Alternatively, PPPoE Setup	`/interface pppoe-client add interface=vlan-qiniq name=pppoe-qiniq user=YOUR_USERNAME password=YOUR_PASSWORD add-default-route=yes use-peer-dns=yes disabled=no`
NAT Rule	`/ip firewall nat add chain=srcnat out-interface=vlan-qiniq action=masquerade`
Optional Q-in-Q Setup	`/interface vlan add interface=ether1 name="vlan-outer" vlan-id=2705 /interface vlan add interface=vlan-outer name="vlan-customer" vlan-id=100`

Troubleshooting and Verification

Ping and Log Checks

Once you’ve applied your configuration changes, it’s essential to verify connectivity and troubleshoot any problems. Here are key verification steps:

Ping Tests: Use the RouterOS terminal command /ping to test connectivity to external IP addresses (e.g., 8.8.8.8). Successful responses indicate that your WAN configuration is working correctly.
Log Review: Use /log print to inspect system logs for any error messages or warning alerts that might indicate misconfigurations or connectivity issues.
Interface Status: Check the status of your configured interfaces by executing /ip address print and /interface print to ensure that the correct IP addresses have been allocated and that the physical interfaces are operational.

Common Pitfalls

VLAN ID Mismatch

Ensure that you are using the correct VLAN ID as specified by your ISP. A mismatch will interrupt traffic flow. Confirm the specific VLAN details from the Qiniq NNU documentation or via direct ISP communication.

Incorrect Physical Interface Assignment

Double-check that the chosen physical interface (ether1, ether2, etc.) is correctly associated with your VLAN sub-interface. This ensures the actual data path is maintained accurately.

Bridge and Port Tagging Issues

If you are using bridge configurations, ensure that both tagged and untagged ports are appropriately assigned. Some advanced setups may require the link between your RouterOS and ISP hardware to be a trunk port carrying VLAN tags.

Additional Considerations in Your Configuration

Security and Maintenance

In any network configuration, especially one interfacing directly with an ISP, ensuring that your device is secure is essential. Employ strong firewall rules to block unauthorized access, monitor logs regularly, and update RouterOS firmware to protect against vulnerabilities.

Consider segmenting your network by creating separate bridges or VLAN configurations for your private networks versus the public, so that troubleshooting and performance enhancement measures are more manageable.

Monitoring and Performance

Once operational, continuous monitoring of your VLAN connection is critical. Tools integrated within RouterOS, like Torch, can help you analyze network bandwidth and troubleshoot intermittent connectivity issues. Additionally, reviewing SNMP or external monitoring systems will provide deeper insight into network performance and help in early detection of potential issues.

Periodic Review and Updates

As environments change, updates to VLAN configurations may be necessary. Always check with your ISP for firmware announcements or configuration changes that might influence your setup. Regularly review your firewall, NAT rules, and any secondary settings like Q-in-Q configurations.

Conclusion

Configuring a Qiniq NNU VLAN ISP carrier on RouterOS demands careful planning, precise execution, and ongoing maintenance. By setting up the appropriate VLAN interface on your designated physical port, and configuring the correct WAN client (either DHCP or PPPoE) alongside optional Q-in-Q configurations if necessary, you ensure that your network traffic is correctly segregated and delivered. Detailed firewall and NAT rules further secure outbound traffic, while regular monitoring and troubleshooting confirm that the configuration is both effective and resilient.

This comprehensive guide walks through verifying physical connectivity, creating and configuring VLAN interfaces, establishing LAN-to-WAN communication via DHCP or PPPoE, setting up Q-in-Q for advanced network routing, and implementing firewall and NAT rules for security. By adhering to these steps and confirming each parameter with your ISP, you create a robust and secure network environment suited for the Qiniq NNU VLAN ISP carrier. Regular maintenance and monitoring further contribute to stable long-term operations.