Hii there,
Yesterday, I have received my new CRS326-24G-2S+ (I will refer to it as “router”) along with two hAP AC Lite (will be “AP1” and “AP2” respectively).
I also have a Dell PE2748 (will be “switch”) in “unmanaged”-mode that has most of my “stationary” stuff (like my virtualization server, my NAS, my gamepc/workstation etc. etc.).
First MikroTik devices I have done more with than just physically setting it up, so I’m new to WinBox and ROS… please be patient with me, I’m doing my best!
I have spent most of yesterday and today to set up the router in a barebones “it works” config and, am now trying to get everything to work the way I want it to.
I’ll do my best to have my goal make any sense in the next (whether it makes sense from a “network topology” aspect is a different story).
First, let’s define my pools (on the router):
- cabled: 10.0.3.1-10.255.255.254
- wireless: 10.0.1.1-10.0.1.254
- wireless-guests: 10.0.2.1-10.0.2.254
- parents: 192.168.0.3-192.168.254.254
- parents-guests: 192.168.255.1-192.168.255.254
Ok, now here’s the setup I want when it comes to physical ports:
- The router will be connected to the WAN (via ether1).
- Switched is hooked up to router’s ether2.
- AP1 will be connected to ether3 and will be my wifi (along with a guest network for my guests).
- AP2 will be connected to ether4 and will be the wifi of my parents (along with a guest network for their guests).
Next, we have the setup I want when it comes to the DHCP leases:
- The switch should get the addresses from the pool “cabled”.
- Leftover ports (including the SFP+ ports) on the router should also get addresses from the pool “cabled”.
- AP1’s main network should get the addresses from the pool “wireless”.
- AP1’s guest network should get the addresses from the pool “wireless-guests”
- AP2’s main network should get the addresses from the pool “parents”.
- AP2’s guest network should get the addresses from the pool “parents-guests”.
And now comes the most tricky(?) bit of it all… the network isolation:
- AP1’s main network should have access to every other part of the network.
- AP1’s guest network should have access to nearly every other part of the network except the stuff on AP2 (and it’s associated guest network).
- AP2’s main network should only have access to itself on AP2’s main network.
- AP2’s guest network should have no access to other parts of the network (also not being able to see other clients on AP2’s guest network).
- Everything has access to the internet (duh).
I hope you guys can help me out getting this setup 
I prefer to work in WinBox instead of the command line.
Again, I’m fairly new to this and would like to learn how to do it (I have a “basic” understanding of networking).
Cheers!