Hi all,
i read many posts about this network configuration but still can’t find a solution to my problem…maybe i’m wrong, but after 4 hours i still don’t have an idea on how get this thing to work.
Let’s explain: i have to develop a network with about ten Metal-2Shpn, controlled by an RB750.
Every Metal has an access to the main company network (only protected by WPA2) and a VirtualAP for Guest connections. Customer wants to run an hotspot over the Guest network with no access to the main company LAN.
I’m trying to develop this project using VLANs. I connected the RB750 to a switch WITH 2 ETHERNETS. My idea is to run the HotSpot on one ethernet and to accept connections for the main network on the other.
eth1-MainNet has a VLAN ID=1 on it, and eth2-GUESTWIFI has VLAN ID=2.
Then i took the access point (i’m using an RB433 as test bed, faking like it’s a Metal), created 2 Virtual APs (i saw this in another post).
VirtualAP1 - MainWIFI
VirtualAP2 - GuestWIFI
Bridged VLAN1 with VirtualAP1 and VLAN2 with VirtualAP2. BOTH WLAN WHERE CREATED WITH ETHER1 AS INTERFACE. Then, as i saw in the other post, bridged the ethernet interface with the wlan1 master interface.
It doesn’t work…obviously.
Do i have to bridge anything on the RB750? (maybe ethernets with their related vlans)
Configuration on the Access Point is correct?
Three posts this month, more than 160 views and no answers…
By the way, since i didn’t find a proper solution to the problem i made a work-around that someone could find useful.
Before everything an hint: don’t try to replace VLANs with eoip-tunnels. DHCP in the common switch will fly around and you can’t stop clients to get the wrong IP. I thought that creating an eoip-tunnel between one ethernet of the RB750 and the GUEST virtualAP would result in a real tunnel between the interaces. Wrong. DHCP packets leaving the Ethernet don’t pass ONLY through the tunnel…they are broadcasted also in the switch creating a mess and an unpredictable scenario.
And the work around for the problem? I simply configured an HotSpot server on every Guest VirtualAP and created a RADIUS server with the Mikrotik User Manager in the RB750. HotSpots used RADIUS for authentication. Then I created a DHCP server on every MainNet VirtualAP to make clients navigate with normal routing and no hotspot.
I also created a forward filter rule to avoid visibility between the hotspot subnet and the main office subnet (hotspot clients can’t see shared resources and internal servers).
The eoip is like a cable. It works where you plug in on both sides. According to your findings it looks to me that you joined the second end to the too much wide bridge…
Yes, i thought the same but verifying the bridges it seems they were pretty correct…
HOTSPOT CONTROLLER ACCESS POINT
Bridge1 between eoip1 and ether1 Bridge1 between virtualAP1 end eoip1
Bridge2 between eoip2 and ether2 Bridge2 between virtualAP2 and eoip2
