+7 495 320-55-52
- Назад
- Телефоны
- +7 495 320-55-52
- Заказать звонок
info@mikrotik.moscow
г. Москва, ул. Бакунинская, 84
Пн-Пт: 09-00 до 18-00
Сб-Вс: выходной

Struggling with additional WiFI Subnets

Struggling with additional WiFI Subnets, RouterOS

jdub88

Guest

18.01.2024 11:18:00

Hey Folks, So one thing that has perplexed me for a while now with Mikrotik is being able to easily segment the network. All I want to achieve is to add a couple of extra SSIDs, with their own subnets and their own DHCP scopes, where I can filter traffic with the Firewall. I have reviewed the following examples, and while they are useful, they tend to cover more than I need: https://help.mikrotik.com/docs/display/ROS/VLANs+on+Wireless http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 I have just a single AX3 for the entire house so I don’t really need to worry about trunking. Ideally, I would like to add a new VLAN for the new SSID without messing with the existing config. I assume that defconf is in VLAN1, even though not explicitly stated. I know VLAN1 isn’t best practice, but this is just my house, I’m not too concerned. I have tried using the Guest Wireless option within Quick Set, but this adds bridge filters and shares IP space, and I’d rather control this with firewall rules and have each SSID associated with it’s own /24 with DHCP. Here is the key config I have now, exluding stuff like firewalls: /interface ethernet set [ find default-name=ether1 ] comment=WAN
/interface ethernet set [ find default-name=ether2 ] comment=Switch
/interface ethernet set [ find default-name=ether3 ] comment=Base
/interface wifi set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac configuration.mode=ap .ssid=HOME disabled=no security.authentication-types=wpa2-psk,wpa3-psk
/interface wifi set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac configuration.mode=ap .ssid=HOME disabled=no security.authentication-types=wpa2-psk,wpa3-psk
/interface list add comment=defconf name=WAN
/interface list add comment=defconf name=LAN
/ip pool add name=dhcp ranges=192.168.1.30-192.168.1.200
/ip dhcp-server add address-pool=dhcp interface=bridge lease-time=23h59m59s name=defconf
/interface bridge port add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge comment=defconf interface=wifi1 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge comment=defconf interface=wifi2 internal-path-cost=10 path-cost=10
/interface list member add comment=defconf interface=bridge list=LAN
/interface list member add comment=defconf interface=ether1 list=WAN
/interface list member add interface=pppoe-out1 list=WAN
/ip address add address=192.168.1.254/24 comment=defconf interface=bridge network=192.168.1.0
/ip dhcp-server network add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.2 gateway=192.168.1.254 netmask=24 What is the least disruptive way to add the extra config? The access/physical ports can stay as they are in the native VLAN. I’ve done this many times with Cisco, HP Enterprise and also Ubiquiti but it’s a bit more of a challenge on Mikrotik..but I am determined to solve it My knowledge in the area is a little rusty though, and Mikrotik isn’t so forgiving. Losing WiFi access would be a PITA to then resolve so I will be sure to use safe mode.. Thank you!

jdub88

Guest

10.04.2024 10:23:00

Coming back to this (as I do from time to time) and I am still struggling since there seems to be so many different suggestions. If there is one thing that I dearly miss about Ubiquiti, is that I can do exactly what I want here with just a couple of clicks and no risk of downtime. It would be great to have something in the Mikrotik wiki that strips this use case to its most simple parts for a single device config (ie no trunking off to other switches etc, just a simple SoHo/single wireless router config), with step by step config on creating the VLAN, creating DHCP scope, and a set of firewall rules, and slotting that on top of an existing config (or, guiding how to change the default config to make everything VLANed, or just making the guest wifi quickset option a Layer 3 solution vs simple layer 2 filtering with isolation. There are lots of tutorials out there but they are often really old and not for ROSv7.x, or exclusively use winbox. BTW, is it possible to have DoH server per VLAN?

jdub88

Guest

05.08.2024 10:37:00

Can anyone tell me if there is any major drawback or problem with using a multi-bridge approach, with SSID/Wifi interface associated with that bridge, along with DHCP, etc? ChatGPT gave me this: /interface wifi add configuration.mode=ap .ssid=GUEST master-interface=wifi1 name=wifi3 security.authentication-types=wpa2-psk,wpa3-psk .passphrase=xxxxx disabled=no
/interface wifi add configuration.mode=ap .ssid=GUEST master-interface=wifi2 name=wifi4 security.authentication-types=wpa2-psk,wpa3-psk .passphrase=xxxxx disabled=no
/interface bridge add name=bridge-guest
/interface bridge port add bridge=bridge-guest interface=wifi3
/interface bridge port add bridge=bridge-guest interface=wifi4
/ip pool add name=dhcp-guest ranges=192.168.2.30-192.168.2.200
/ip dhcp-server add address-pool=dhcp-guest interface=bridge-guest lease-time=23h59m59s name=dhcp-guest
/ip dhcp-server network add address=192.168.2.0/24 gateway=192.168.2.1 dns-server=1.1.1.1,8.8.8.8
/ip address add address=192.168.2.1/24 interface=bridge-guest network=192.168.2.0
/ip firewall filter add action=accept chain=forward in-interface=bridge-guest out-interface-list=WAN
/ip firewall filter add action=accept chain=forward in-interface-list=WAN out-interface=bridge-guest connection-state=established,related
/ip firewall filter add action=drop chain=forward in-interface=bridge-guest out-interface=bridge
/ip firewall filter add action=drop chain=forward in-interface=bridge out-interface=bridge-guest
/ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN src-address=192.168.2.0/24 In safe mode, the config applied just fine..it works and seems to do what I need, with appropriate firewalling preventing access to other subnets while allowing internet, and it seems I can just add more configs for more SSID… The above was based on me providing my existing configuration, hence referencing the WAN list etc. But this seems too simple - whats the drawback? This is just home use, so I am not worried about bigger implications, I am simply looking for the most straightforward way to have other SSIDs that do not use the built in layer 2 guest option from quickset. Thanks

gigabyte091

Guest

05.08.2024 12:19:00

I can suggest you to check TheNetworkBerg videos on topic of VLANs. He covered that area, and his explanations are great. Don’t follow multi bridge advice, one bridge is enough. Try with his videos and come back here then. Few advices, when messing with VLANs, create one off bridge port for configuration, so you don’t lock yourself out. Use single bridge only, and if you go VLANs, you go VLANs all the way, so no default vlan 1.

jaclaz Guest	#5 0 05.08.2024 15:09:00 Sometimes they come back: https://web.archive.org/web/20231216022654/https://forum.mikrotik.com/viewtopic.php?t=182373

jdub88

Guest

05.08.2024 16:49:00

Thanks for the extra tips, I will review. I totally get the trend of multi vlan; however I’ve yet to understand why I should not use multi bridge. It seems to work and is very simple to implement. If the function exists to do it, I assume it must be for a reason (of course my Cisco experience tells me you can also do things really wrong on that logic!) - I am just interested to understand why I cannot solve this with multi bridge and a few lines of config that ultimately gets me the same outcome, ie separate L3 subnets with firewall rules and their own SSID. Indeed, the very first paragraph of ‘bridge in a nutshell’ from the linked web archive post doesn’t suggest to me that there is anything wrong with this.. I hate to labour the point but, as I noted before, this seems far too esoteric on Mikrotik vs $anyoneelse, and one of the first comments on the linked thread was along the lines of ‘why are there so many ways to do the same thing’ Tik team - I really do think you need to make this easier

gigabyte091 Guest	#7 0 06.08.2024 04:10:00 Because it’s not efficient, you lose HW offloading and you are adding complexity to your configuration. Why would you like to do that. There are probably very specific areas where multiple bridges are recommend but I highly doubt that’s the case with you. VLANs are easy to implement on single bridge also… Give it a try

jdub88

Guest

08.08.2024 09:19:00

Thanks, noted. I guess it’s easy when you know how! But trying to sift through mountains of information for all manner of use cases is tricky, especially given how much Wifi has changed on Mikrotik, even within v7 versions. Alot of the tutorials use Winbox which I don’t have easy access to, and I also need to configure everything over Wifi (safe mode is great, though). I am running 7.15.3 I set up this (for now I just want to add a VLAN, not modify the existing setup…though maybe that in itself is the problem?) /interface wifi add configuration.mode=ap .ssid=GUEST master-interface=wifi1 name=wifi3 security.authentication-types=wpa2-psk,wpa3-psk .passphrase=12345678 disabled=no
/interface wifi add configuration.mode=ap .ssid=GUEST master-interface=wifi2 name=wifi4 security.authentication-types=wpa2-psk,wpa3-psk .passphrase=12345678 disabled=no

/interface vlan add name=GUEST vlan-id=10 interface=bridge
/interface bridge port add bridge=bridge interface=GUEST

/ip address add address=192.168.100.1/24 interface=GUEST
/ip pool add name=DHCP-POOL-GUEST ranges=192.168.100.10-192.168.100.100
/ip dhcp-server add name=DHCP-GUEST interface=GUEST address-pool=DHCP-POOL-GUEST lease-time=10m
/ip dhcp-server network add address=192.168.100.0/24 gateway=192.168.100.1 dns-server=1.1.1.1

/ip firewall filter
add chain=forward in-interface=GUEST action=accept
add chain=forward out-interface=GUEST action=accept
add chain=input protocol=udp port=67,68 action=accept

/interface bridge set [find name=bridge] vlan-filtering=yes I see the GUEST SSID broadcast and I can connect, but that’s where things stop - I don’t get a DHCP lease, and no traffic passes when I set a manual IP. I did wonder how the GUEST SSID was being associated with VLAN10. I have seen some command examples where you can specify vlan-id in the /interface wifi command but I can’t do that on my router, presumably as I am on a later version of ROS7. After some digging, I understand that you now do that via the interface bridge vlan, so then I found I should do this: /interface bridge vlan
add bridge=bridge vlan-ids=10 tagged=bridge However this still doesn’t work. I am using ChatGPT to try and help, but I think it’s blending different flavours every time I ask. I feel like I am nearly there. I literally want the most basic virtual access point configuration, and I don’t mind if I still have VLAN1!

jdub88

Guest

08.08.2024 11:42:00

OK so it seems I forgot to add wifi3 and wifi4 to the bridge port When I reapply as follows, it works /interface vlan add name=GUEST vlan-id=10 interface=bridge
/interface bridge port add bridge=bridge interface=GUEST pvid=10
/interface bridge port add bridge=bridge interface=wifi3 pvid=10
/interface bridge port add bridge=bridge interface=wifi4 pvid=10 So, now I will wait to be told why this is a bad idea

anav

Guest

#10

08.08.2024 15:52:00

Not bad but better /interface vlan add name=GUEST vlan-id=10 interface=bridge
/interface bridge port add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=GUEST pvid=10
/interface bridge port add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=wifi3 pvid=10
/interface bridge port add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-untagged interface=wifi4 pvid=10

jdub88

Guest

#11

08.08.2024 16:22:00

Thanks for that, I had seen that as part of the VLAN doc, however I wonder if it’s down to the later version but that option for frame-types is not available: [me@MikroTik] <SAFE> /interface bridge port add bridge=bridge ingress-filtering=yes frame-types=admit-
admit-all admit-only-untagged-and-priority-tagged admit-only-vlan-tagged In the linked VLAN doc for a single device, the suggested action which appears the equivalent is: /interface bridge port
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether2]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether3]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether4]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether5]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan1]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan2] I note the following adaption of your suggestion was accepted by the CLI: /interface bridge port add bridge=bridge ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=wifi4 pvid=10

jdub88 Guest	#12 0 08.08.2024 16:36:00 Is there anything about such a config as above that would create wireless instability on the network running on wifi1 and wifi2? I’ve been able to repeatedly get the same result… Add the config as above It’s OK for a few minutes Connectivity starts to stutter My connection drops and safe mode backs out the changes I reconnect, all is well

anav Guest	#13 0 08.08.2024 17:01:00 Yeah my wording may not be 100 accurate as I do it from the top of my head but its close enough to get you there. I dont comment on issues unless I see the whole config /export file=anynameyouwish (minus router serial number, any public WANIP information, keys, long lease lists etc.)

jdub88 Guest	#14 0 08.08.2024 17:09:00 Ah, my apologies, I have been battling with subtle syntax differences between versions today Thanks for your assitance. I think the above was just coincidence, I will monitor. I seem to have boiled down the basic extra VLAN/SSID quite well now. So, I will come back with questions because I am determined to get to the happy state you suggested; ie converting the existing base config to be VLANned.

Читают тему

Главная Каталог 0 Корзина 0 Избранные Кабинет 0 Сравнение Акции Контакты Услуги Бренды Отзывы Компания Лицензии Документы Реквизиты Поиск Блог Обзоры