Hey there.
Not sure if this is the correct forum. Let me know if not.
I have a wired network setup that consists of a router in the basement and a switch in the attic. Both are directly connected via 10G copper. My AP works fine as long as it’s connected to the router; once it’s connected to the switch it does not work (clients can’t authenticate). I am quite stumped by this - maybe you guys have an idea what I am doing wrong.
Setup details:
- vlans
- mac-based vlan assignment with freeradius
- dot1x on lan ports
- single ssid, vlans get assigned by radius
Router config:
# model = CCR2004-16G-2S+
/interface bridge
add ingress-filtering=no name=bridge-vlan vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment=Modem name=ether1-modem
set [ find default-name=ether2 ] comment=A4.1 name=ether2-a4-ap
set [ find default-name=ether3 ] comment=EGUV.1 name=ether3-eguv
set [ find default-name=ether4 ] comment=EGUV.2 name=ether4-eguv
set [ find default-name=ether5 ] comment=OG2.1.1 name=ether5-og2
set [ find default-name=ether6 ] comment=OG2.1.2 name=ether6-og2-ap
set [ find default-name=ether7 ] comment=OG4.1.1 name=ether7-og4
set [ find default-name=ether8 ] comment=OG4.1.2 name=ether8-og4
set [ find default-name=ether9 ] comment=OG4.2.1 name=ether9-og4
set [ find default-name=ether10 ] comment=OG4.2.2 name=ether10-og4
set [ find default-name=ether11 ] comment=OG5.1.1 name=ether11-og5
set [ find default-name=ether12 ] comment=OG5.1.2 name=ether12-og5
set [ find default-name=ether13 ] comment="EG1 server" name=ether13-server-ipmi
set [ find default-name=ether14 ] comment=EG2 name=ether14-modem-admin
set [ find default-name=ether15 ] disabled=yes
set [ find default-name=ether16 ] comment=EG2 name=ether16-eg2
set [ find default-name=sfp-sfpplus1 ] comment="DGNV.1 Uplink" name=sfpplus1-uplink-dg
set [ find default-name=sfp-sfpplus2 ] comment="EG1 server" name=sfpplus2-server-main
/interface vlan
add interface=ether1-modem name=ether1-modem-vlan7 vlan-id=7
add interface=bridge-vlan name=vlan1-mgmt vlan-id=1
add interface=bridge-vlan name=vlan10-main vlan-id=10
add interface=bridge-vlan name=vlan20-iot vlan-id=20
add interface=bridge-vlan name=vlan30-guest vlan-id=30
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1-modem-vlan7 name=pppoe-out1 use-peer-dns=yes user=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
/interface list
add name=LAN
/interface wifi aaa
add disabled=no name=aaa-default password-format=aa:aa:aa:aa:aa:aa username-format=aa:aa:aa:aa:aa:aa
/interface wifi datapath
add bridge=bridge-vlan disabled=no name=datapath-default
/interface wifi security
add authentication-types=wpa2-psk connect-priority=0 disable-pmkid=yes disabled=no encryption=ccmp ft=yes ft-over-ds=yes group-encryption=ccmp group-key-update=1h name=security-default wps=disable
/interface wifi configuration
add aaa=aaa-default country=Germany datapath=datapath-default disabled=no mode=ap multicast-enhance=enabled name=config-default security=security-default security.connect-priority=0 .ft=yes .ft-over-ds=yes ssid="XXXXXXXXXXXXXXXXX"
/ip dhcp-server option
add code=121 name=option10_121_route_192.168.0.0/16_via_192.168.10.1 value=0x10c0a8c0a80a01
add code=249 name=option10_249_route_192.168.0.0/16_via_192.168.10.1 value=0x10c0a8c0a80a01
add code=121 name=option1_121_route_192.168.0.0/16_via_192.168.1.1 value=0x10c0a8c0a80101
add code=249 name=option1_249_route_192.168.0.0/16_via_192.168.1.1 value=0x10c0a8c0a80101
add code=121 name=option20_121_route_192.168.0.0/16_via_192.168.20.1 value=0x10c0a8c0a81401
add code=249 name=option20_249_route_192.168.0.0/16_via_192.168.20.1 value=0x10c0a8c0a81401
add code=249 name=option30_249_route_192.168.0.0/16_via_192.168.30.1 value=0x10c0a8c0a81e01
add code=121 name=option30_121_route_192.168.0.0/16_via_192.168.30.1 value=0x10c0a8c0a81e01
/ip dhcp-server option sets
add name=set1 options="option1_121_route_192.168.0.0/16_via_192.168.1.1,option1_249_route_192.168.0.0/16_via_192.168.1.1"
add name=set10 options="option10_121_route_192.168.0.0/16_via_192.168.10.1,option10_249_route_192.168.0.0/16_via_192.168.10.1"
add name=set20 options="option20_121_route_192.168.0.0/16_via_192.168.20.1,option20_249_route_192.168.0.0/16_via_192.168.20.1"
add name=set30 options="option30_121_route_192.168.0.0/16_via_192.168.30.1,option30_249_route_192.168.0.0/16_via_192.168.30.1"
/ip pool
add name=dhcp-pool1 ranges=192.168.1.100-192.168.1.200
add name=dhcp-pool10 ranges=192.168.10.100-192.168.10.200
add name=dhcp-pool20 ranges=192.168.20.100-192.168.20.200
add name=dhcp-pool30 ranges=192.168.30.100-192.168.30.200
/ip dhcp-server
add address-pool=dhcp-pool1 interface=vlan1-mgmt lease-time=10m name=dhcp-server1
add address-pool=dhcp-pool10 dhcp-option-set=set10 interface=vlan10-main lease-time=10m name=dhcp-server10
add address-pool=dhcp-pool20 interface=vlan20-iot lease-time=10m name=dhcp-server20
add address-pool=dhcp-pool30 interface=vlan30-guest lease-time=10m name=dhcp-server30
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
set 1 name=serial1
/interface bridge port
add bridge=bridge-vlan interface=ether2-a4-ap
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether3-eguv pvid=20
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether4-eguv pvid=20
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether5-og2 pvid=10
add bridge=bridge-vlan interface=ether6-og2-ap
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether7-og4 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether8-og4 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether9-og4 pvid=30
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether10-og4 pvid=30
add bridge=bridge-vlan interface=ether11-og5 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether12-og5 pvid=10
add bridge=bridge-vlan interface=sfpplus1-uplink-dg
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether16-eg2 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether13-server-ipmi
add bridge=bridge-vlan interface=sfpplus2-server-main
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge-vlan tagged=bridge-vlan untagged=ether2-a4-ap,ether6-og2-ap vlan-ids=1
add bridge=bridge-vlan tagged="bridge-vlan,ether2-a4-ap,ether6-og2-ap,sfpplus1-uplink-dg,sfpplus2-server-main" vlan-ids=10
add bridge=bridge-vlan tagged="bridge-vlan,ether2-a4-ap,ether6-og2-ap,sfpplus1-uplink-dg,sfpplus2-server-main" vlan-ids=20
add bridge=bridge-vlan tagged="bridge-vlan,ether2-a4-ap,ether6-og2-ap,sfpplus1-uplink-dg,sfpplus2-server-main" vlan-ids=30
/interface dot1x server
add auth-types=mac-auth interface=ether7-og4 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether8-og4 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether9-og4 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether10-og4 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether11-og5 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether12-og5 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether5-og2 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether16-eg2 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
/interface list member
add interface=bridge-vlan list=LAN
/interface wifi access-list
add action=query-radius allow-signal-out-of-range=10s disabled=no
/interface wifi cap
set certificate=request
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=all package-path=/packages require-peer-certificate=no upgrade-policy=suggest-same-version
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=config-default
/ip address
add address=192.168.1.1/24 interface=vlan1-mgmt network=192.168.1.0
add address=192.168.10.1/24 interface=vlan10-main network=192.168.10.0
add address=192.168.20.1/24 interface=vlan20-iot network=192.168.20.0
add address=192.168.30.1/24 interface=vlan30-guest network=192.168.30.0
/ip cloud
set update-time=no
/ip dhcp-client
add add-default-route=no comment="Used to access VDSL modem on 192.168.100.1" interface=ether14-modem-admin use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
add address=192.168.10.0/24 dns-server=192.168.10.1 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=192.168.20.1 gateway=192.168.20.1
add address=192.168.30.0/24 dns-server=192.168.30.1 gateway=192.168.30.1
/ip dns
/ip dns
set allow-remote-requests=yes verify-doh-cert=yes
/ip dns static
add address=94.140.14.49 disabled=yes name=https://d.adguard-dns.com/dns-query/XXXXXXXXX
/ip firewall address-list
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet
add address=192.168.10.0/24 list=allowed_to_router
add address=192.168.1.0/24 list=allowed_to_router
add address=192.168.1.0/24 list=lan_clients
add address=192.168.10.0/24 list=lan_clients
add address=192.168.20.0/24 list=lan_clients
add address=192.168.30.0/24 list=lan_clients
/ip firewall filter
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="Established, Related" connection-state=established,related
add action=drop chain=forward comment="Drop invalid" connection-state=invalid log=yes log-prefix=invalid
add action=drop chain=forward comment="Drop tries to reach not public addresses from LAN" dst-address-list=not_in_internet in-interface=bridge-vlan log=yes log-prefix=!public_from_LAN out-interface=!bridge-vlan
add action=drop chain=forward comment="Drop incoming packets that are not NAT`ted" connection-nat-state=!dstnat connection-state=new in-interface=pppoe-out1 log=yes log-prefix=!NAT
add action=jump chain=forward comment="jump to ICMP filters" jump-target=icmp protocol=icmp
add action=drop chain=forward comment="Drop incoming from internet which is not public IP" in-interface=pppoe-out1 log=yes log-prefix=!public src-address-list=not_in_internet
add action=drop chain=forward comment="Drop packets from LAN that do not have LAN IP" in-interface=bridge-vlan log=yes log-prefix=LAN_!LAN src-address=!192.168.0.0/16
add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp
add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 protocol=icmp
add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 protocol=icmp
add action=accept chain=icmp comment="host unreachable fragmentation required" icmp-options=3:4 protocol=icmp
add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 protocol=icmp
add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 protocol=icmp
add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 protocol=icmp
add action=drop chain=icmp comment="deny all other types"
add action=accept chain=input comment="Established, Related" connection-state=established,related
add action=accept chain=input comment="Internal clients that are allowed to access the router" src-address-list=allowed_to_router
add action=accept chain=input comment="DNS access for all lan clients" dst-port=53 protocol=udp src-address-list=lan_clients
add action=accept chain=input comment="Allow ICMP - TODO - restrict" protocol=icmp
add action=accept chain=input comment="Allow internal RADIUS" dst-port=1700,1812,1813 log=yes log-prefix="Radius UDP" protocol=udp src-address-list=lan_clients
add action=accept chain=input disabled=yes dst-port=1700,1812,1813 protocol=udp src-address=192.168.1.0/24
add action=drop chain=input
/ip firewall mangle
add action=change-mss chain=forward disabled=yes new-mss=1452 out-interface=pppoe-out1 protocol=tcp tcp-flags=syn tcp-mss=1301-65535
add action=change-mss chain=forward new-mss=1452 out-interface=pppoe-out1 passthrough=no protocol=tcp tcp-flags=syn tcp-mss=1453-65535
/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade all internal traffic when accessing the internet" out-interface=pppoe-out1 src-address=192.168.0.0/16
add action=masquerade chain=srcnat comment="Allow access to modem admin interface from internal lan" dst-address=192.168.100.1 out-interface=ether14-modem-admin src-address-list=allowed_to_router
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/ip ssh
set always-allow-password-login=yes strong-crypto=yes
/ipv6 firewall address-list
add address=fd12:672e:6f65:8899::/64 list=allowed
add address=fe80::/16 list=allowed
add address=ff02::/16 comment=multicast list=allowed
/ipv6 firewall filter
add action=accept chain=input comment="allow established and related" connection-state=established,related
add action=accept chain=input comment="accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=drop chain=input in-interface=pppoe-out1 log=yes log-prefix=dropLL_from_public src-address=fe80::/10
add action=accept chain=input comment="allow allowed addresses" src-address-list=allowed
add action=drop chain=input
add action=accept chain=forward comment=established,related connection-state=established,related
add action=drop chain=forward comment=invalid connection-state=invalid log=yes log-prefix=ipv6,invalid
add action=accept chain=forward comment=icmpv6 in-interface=!pppoe-out1 protocol=icmpv6
add action=accept chain=forward comment="local network" in-interface=!pppoe-out1 src-address-list=allowed
add action=drop chain=forward log-prefix=IPV6
/ipv6 firewall mangle
add action=change-mss chain=forward disabled=yes new-mss=1432 out-interface=pppoe-out1 protocol=tcp tcp-flags=syn
add action=change-mss chain=forward new-mss=1432 out-interface=pppoe-out1 passthrough=no protocol=tcp tcp-flags=syn tcp-mss=1433-65535
/ipv6 nd
add interface=pppoe-out1 mtu=1492
/radius
add address=192.168.1.12 require-message-auth=no service=wireless,dot1x src-address=192.168.1.1
/radius incoming
set accept=yes
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=router
/system logging
add topics=route,!debug
add topics=caps
add topics=radius
add topics=dhcp
add topics=manager
add topics=caps
add topics=wireless
add topics=ppp
add topics=pppoe
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=ptbtime1.ptb.de
add address=ntp1.t-online.de
add address=de.pool.ntp.org
/system routerboard settings
set enter-setup-on=delete-key
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Switch config:
# model = RB4011iGS+5HacQ2HnD
/interface bridge
add ingress-filtering=no name=bridge-vlan vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment="Philips Hue bridge" name=ether1-hue
set [ find default-name=ether2 ] comment=DG2.1.1 name=ether2-dg2
set [ find default-name=ether3 ] comment=DG2.1.2 name=ether3-dg2
set [ find default-name=ether4 ] comment=DG6.1.1 name=ether4-dg6
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=ether6 ] comment=DG5.1.1 name=ether6-dg5
set [ find default-name=ether7 ] comment=DG1.1.1 name=ether7-dg1
set [ find default-name=ether8 ] comment=DG1.1.2 name=ether8-dg1
set [ find default-name=ether9 ] comment="Velux bridge" name=ether9-velux
set [ find default-name=ether10 ] comment="DG1.2.1 - AP Dachgeschoss - POE" name=ether10-dg1-ap
set [ find default-name=sfp-sfpplus1 ] comment=EGNV.1 name=sfpplus1-uplink-eg
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
/interface vlan
add interface=bridge-vlan name=vlan1-mgmt vlan-id=1
add interface=bridge-vlan name=vlan10-main vlan-id=10
add interface=bridge-vlan name=vlan20-iot vlan-id=20
add interface=bridge-vlan name=vlan30-guest vlan-id=30
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/port
set 0 name=serial0
set 1 name=serial1
/interface bridge port
add bridge=bridge-vlan interface=sfpplus1-uplink-eg
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether1-hue pvid=20
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether2-dg2 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether3-dg2 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether4-dg6 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether6-dg5 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether7-dg1 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether8-dg1 pvid=10
add bridge=bridge-vlan frame-types=admit-only-untagged-and-priority-tagged interface=ether9-velux pvid=20
add bridge=bridge-vlan interface=ether10-dg1-ap
/interface bridge vlan
add bridge=bridge-vlan tagged=bridge-vlan untagged=ether10-dg1-ap vlan-ids=1
add bridge=bridge-vlan tagged=bridge-vlan,sfpplus1-uplink-eg vlan-ids=10
add bridge=bridge-vlan tagged=bridge-vlan,sfpplus1-uplink-eg vlan-ids=20
add bridge=bridge-vlan tagged=bridge-vlan,sfpplus1-uplink-eg vlan-ids=30
/interface dot1x server
add auth-types=mac-auth interface=ether2-dg2 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether3-dg2 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether4-dg6 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether6-dg5 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether7-dg1 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
add auth-types=mac-auth interface=ether8-dg1 mac-auth-mode=mac-as-username-and-password radius-mac-format=xx:xx:xx:xx:xx:xx reject-vlan-id=30 server-fail-vlan-id=30
/ip address
add address=192.168.1.2/24 interface=vlan1-mgmt network=192.168.1.0
add address=192.168.10.2/24 interface=vlan10-main network=192.168.10.0
add address=192.168.20.2/24 interface=vlan20-iot network=192.168.20.0
add address=192.168.30.2/24 interface=vlan30-guest network=192.168.30.0
/ip cloud
set update-time=no
/ip dns
set servers=192.168.1.1
/ip firewall address-list
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet
add address=192.168.10.0/24 list=allowed_to_router
add address=192.168.1.0/24 list=allowed_to_router
add address=192.168.1.0/24 list=lan_clients
add address=192.168.10.0/24 list=lan_clients
add address=192.168.20.0/24 list=lan_clients
add address=192.168.30.0/24 list=lan_clients
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set always-allow-password-login=yes strong-crypto=yes
/radius
add address=192.168.1.12 service=wireless,dot1x src-address=192.168.1.2
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=switch-dg
/system logging
add topics=route,!debug
add topics=radius
add topics=dhcp
add topics=wireless
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=ptbtime1.ptb.de
add address=ntp1.t-online.de
add address=de.pool.ntp.org
/system routerboard settings
set enter-setup-on=delete-key
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
AP config:
# model = cAPGi-5HaxD2HaxD
/interface bridge
add admin-mac=78:9A:18:96:CF:B1 auto-mac=no comment=defconf name=bridgeLocal
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
# managed by CAPsMAN
# mode: AP, SSID: XXXXXXXX, channel: 5640/ax/eeeC
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp disabled=no
# managed by CAPsMAN
# mode: AP, SSID: XXXXXXXX, channel: 2412/ax/Ce
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp disabled=no
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifi cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=ap-dg1
/system logging
add topics=route,!debug
add topics=caps
add topics=radius
add topics=dhcp
add topics=wireless
/system note
set show-at-login=no