Virtual AP With Different Network Not Getting Internet

rawon · Fri Mar 18, 2016 1:18 pm

I recently got this mikrotik Metal 2SHPn in which will function as access point for internal use (192.168.88.0/24) and virtual access point for public use (192.168.33.0/24.)

This Metal is connecting through the main router on port 5 (main router network is all 192.168.88.0.24.) Currently the Metal is setup as bridge mode with the following configuration:

# mar/18/2016 18:02:11 by RouterOS 6.30.4
# software id = UCC1-CYM5
#
/interface bridge
add name=bridge-gue
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=indonesia disabled=no frequency=auto l2mtu=1600 mode=ap-bridge ssid=money wireless-protocol=802.11
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=youbetgot wpa2-pre-shared-key=youbetgot
add authentication-types=wpa-psk,wpa2-psk eap-methods="" management-protection=allowed name=guest-profile supplicant-identity=""
/interface wireless
add disabled=no l2mtu=1600 mac-address=E6:8D:8C:F8:03:83 master-interface=wlan1 name=guest-wlan security-profile=guest-profile ssid=money-guest wds-cost-range=0 \
    wds-default-cost=0
/ip pool
add name=guest-pool ranges=192.168.33.11-192.168.33.254
/ip dhcp-server
add address-pool=guest-pool disabled=no interface=guest-wlan name=guest-dhcp
/interface bridge port
add bridge=bridge-gue interface=wlan1
add bridge=bridge-gue interface=ether1
/ip address
add address=192.168.88.3/24 interface=ether1 network=192.168.88.0
add address=192.168.33.1 interface=guest-wlan network=192.168.33.0
/ip dhcp-client
add dhcp-options=hostname,clientid interface=bridge-gue
/ip dhcp-server network
add address=192.168.33.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.33.1
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.33.0/24
/ip route
add distance=1 gateway=192.168.88.1
/system clock
set time-zone-name=Asia/Jakarta
/system identity
set name="Anak Metal"
/system routerboard settings
set protected-routerboot=disabled
/tool romon port
add

Now the if I connect to the "money" (internal,) I can access internet just fine. However if I connect through the "money-guest" it's cannot even though it's getting ip address. Is there anything I can do on either the Metal or the main router? Thank you so much!

pukkita · Sat Mar 19, 2016 12:17 pm

You should make the guest SSID to make tag its traffic to a VLAN, then run an specific DHCP or hotspot over that vlan interface.

You'll need also to adjust masquerading to cover also that subnet.

If you have a router, I'd setup the metal just as an AP + VirtualAP with vlan, then set up everything else on the router.

rawon · Mon Mar 21, 2016 1:51 pm

Thanks for the suggestion. After some reading about virtual AP and VLAN I think this is what should I do:

Router:
1. create vlan connected to port 5 (vlan 100)
2. create a dhcp server for that vlan interface

Metal:
1. create vlan interface attached to the ethernet interface (vlan 100)
2. create bridge with ports: vlan and virtual ap

However when I attached the vlan interface to the ethernet interface my network seems to cease to work (I can't even login.) Should I make my router port 5 to be not a slave of the master interface (port2)? Thanks

pukkita · Mon Mar 21, 2016 7:58 pm

Thanks for the suggestion. After some reading about virtual AP and VLAN I think this is what should I do:

Router:
1. create vlan connected to port 5 (vlan 100)
2. create a dhcp server for that vlan interface

Metal:
1. create vlan interface attached to the ethernet interface (vlan 100)
2. create bridge with ports: vlan and virtual ap

However when I attached the vlan interface to the ethernet interface my network seems to cease to work (I can't even login.) Should I make my router port 5 to be not a slave of the master interface (port2)? Thanks

Router: leave ether5 without master port. follow step 1, then assign an IP to vlan interface. Then follow step 2.

Metal: On Interface > wireless VirtualAP wireless tab, set VLAN ID = 100 and VLAN Mode = use service tag

You should have already a bridge with wlan1 and ether, add VirtualAP to it, thats all.

hgonzale · Fri Mar 25, 2016 12:37 pm

You can also create a new bridge for the virtual AP (just the virtual AP in the bridge) and masquerade the network to your gateway and voila.....

You need to setup a DHCP server for the new bridge and assign ips, etc etc

Virtual AP With Different Network Not Getting Internet

Virtual AP With Different Network Not Getting Internet

Re: Virtual AP With Different Network Not Getting Internet

Re: Virtual AP With Different Network Not Getting Internet

Re: Virtual AP With Different Network Not Getting Internet

Re: Virtual AP With Different Network Not Getting Internet

Who is online