Hello MikroTik Experts.
I have a hAP ax2 (LAN Ports, WLAN, Guest WLAN) connected to a RB5009UGSIN (WAN, LAN) via dedicated Trunk (hAP ax2 ether5 -to- RB5009UGSIN ether6).
The RB5009UGSIN is the main router for the site and handles the NAT and Firewall Rules for the site.
The hAP ax2 is used to connect some LAN devices, but is primarily used for the WLAN and Guest WLAN. There is no WAN connection and only a few Firewall Rules setup to deal with VLAN.
I have tried a number of methods to get the Guest WLAN setup on a VLAN and functioning properly. All of the tutorials are years old and only worked on older versions of RouterOS that I have in another hAP ax2 with Guest WLAN setup on VLAN (working). The only thing that I can conclude is that there is something that has been changed in the newer version of RouterOS that is not allowing my setup to work.
I am trying to setup the Guest WLAN to use VLAN 52, but I cannot get the DHCP Server to assign/issue an IP Address from the Pool.
Last night and this morning I read over the “Using RouterOS to VLAN your network” tutorial from pcunite, which is an AWESOME post. I have also been scouring over ther RouterOS Docs on DHCP, VLAN, IP Routing, and WLAN. I have zero success. At this point, I am at a complete loss.
What is working…
- Internet Access on LAN and WLAN
- DHCP assignment on LAN
- DHCP assignment on WLAN
Here is an export of my Config…
[admin@4306io_hAPax2] > export
# 2025-02-11 21:50:07 by RouterOS 7.14.1
# software id = QX75-F9BV
#
# model = C52iG-5HaxD2HaxD
# serial number = [****REDACTED****]
/interface bridge
add name=bridge1-primary vlan-filtering=yes
/interface ethernet
set [ find default-name=ether5 ] comment="[router-uplink] mikrotik rb5009ugs" name=ether5-rb5009ugs-uplnk
/interface vlan
add comment="[guest-vlan52] **TDF**" interface=bridge1-primary name=vlan52-guest vlan-id=52
/interface list
add name=WAN
add name=LAN
add name=VLAN
add name=ROUTER-TRUNK
/interface wifi channel
add band=5ghz-ax disabled=no frequency=5180-5885 name=channel1-5g-ax width=20/40/80mhz
add band=5ghz-ac disabled=no frequency=5180-5885 name=channel2-5g-ac width=20/40/80mhz
add band=2ghz-ax disabled=no frequency=2412-2462 name=channel3-2g-ax width=20/40mhz
add band=2ghz-n disabled=no frequency=2412-2462 name=channel4-2g-n width=20/40mhz
/interface wifi datapath
add comment="[guest-wifi] **TDF**" disabled=no name=datapath1-guest-vlan52 vlan-id=52
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk comment="[primary] **HK**" disabled=no name=sec1-primary
add authentication-types=wpa2-psk,wpa3-psk comment="[legacy] **THJJJ**" disabled=no name=sec2-legacy
add authentication-types=wpa2-psk,wpa3-psk comment="[guest] **TDF**" disabled=no name=sec3-guest
/interface wifi
set [ find default-name=wifi1 ] channel=channel1-5g-ax channel.band=5ghz-ax .width=20/40/80mhz comment=**HK**_5g \
configuration.country="United States" .mode=ap .ssid=**HK**_5g disabled=no name=wifi1-primary-5g security=\
sec1-primary security.authentication-types=wpa2-psk,wpa3-psk
set [ find default-name=wifi2 ] channel=channel3-2g-ax comment=**HK**_2g configuration.country="United States" \
.mode=ap .ssid=**HK**_2g disabled=no name=wifi2-primary-2g security=sec1-primary \
security.authentication-types=wpa2-psk,wpa3-psk
add comment="[guest] **TDF**_5g" configuration.mode=ap .ssid=**TDF**_5g datapath.client-isolation=no \
disabled=no mac-address=D6:01:C3:C1:4B:6D master-interface=wifi1-primary-5g name=wifi3-guest-5g security=\
sec3-guest security.authentication-types=wpa2-psk,wpa3-psk
add comment="[guest] **TDF**_2g" configuration.mode=ap .ssid=**TDF**_2g datapath.client-isolation=yes \
disabled=no mac-address=D6:01:C3:C1:4B:6D master-interface=wifi2-primary-2g name=wifi4-guest-2g security=\
sec3-guest
/ip pool
add name=pool1-default ranges=192.168.1.100-192.168.1.124
add name=pool3-guest-vlan52 ranges=192.168.52.100-192.168.52.150
add name=pool2-guest ranges=192.168.1.125-192.168.1.150
/ip dhcp-server
add address-pool=pool1-default interface=bridge1-primary lease-time=1d name=dhcp1-primary
add address-pool=pool3-guest-vlan52 comment="[guest-vlan52] **TDF**" interface=vlan52-guest lease-time=3h name=\
dhcp2-vlan52-guest
/interface bridge port
add bridge=bridge1-primary interface=ether2
add bridge=bridge1-primary interface=ether3
add bridge=bridge1-primary interface=ether4
add bridge=bridge1-primary interface=ether5-rb5009ugs-uplnk
add bridge=bridge1-primary interface=wifi1-primary-5g
add bridge=bridge1-primary interface=wifi2-primary-2g
add bridge=bridge1-primary interface=ether1
add bridge=bridge1-primary comment="[guest] **TDF**_5g" frame-types=admit-only-untagged-and-priority-tagged \
interface=wifi3-guest-5g pvid=52
add bridge=bridge1-primary comment="[guest] **TDF**_2g" frame-types=admit-only-untagged-and-priority-tagged \
interface=wifi4-guest-2g pvid=52
add bridge=bridge1-primary comment="[guest-vlan52] **TDF**" frame-types=admit-only-untagged-and-priority-tagged \
interface=vlan52-guest pvid=52
/interface bridge vlan
add bridge=bridge1-primary comment="[guest-vlan52] **TDF**" tagged=wifi3-guest-5g,wifi4-guest-2g,vlan52-guest \
vlan-ids=52
/interface list member
add disabled=yes interface=ether1 list=WAN
add interface=bridge1-primary list=LAN
add interface=vlan52-guest list=VLAN
add interface=ether5-rb5009ugs-uplnk list=ROUTER-TRUNK
add interface=wifi3-guest-5g list=VLAN
add interface=wifi4-guest-2g list=VLAN
/interface wifi capsman
set interfaces="" package-path="" require-peer-certificate=no upgrade-policy=none
/ip address
add address=192.168.1.2/24 interface=bridge1-primary network=192.168.1.0
add address=192.168.10.2/24 comment="[router-uplink] mikrotik rb5009ugs" interface=ether5-rb5009ugs-uplnk network=\
192.168.10.0
add address=192.168.52.1/24 comment="[vlan52-guest] **TDF**" interface=vlan52-guest network=192.168.52.0
/ip dhcp-client
add disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=1.1.1.1,208.67.222.222,1.0.0.1,208.67.220.220 gateway=192.168.1.2 netmask=24
add address=192.168.52.0/24 dns-server=192.168.1.1 gateway=192.168.52.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,208.67.222.222,1.0.0.1,208.67.220.220
/ip firewall filter
add action=accept chain=input comment="[ronin] Allow & Establish Related" connection-state=established,related
add action=accept chain=input comment="[ronin] Allow VLAN" in-interface-list=VLAN
add action=accept chain=forward comment="[ronin] Allow & Establish Related" connection-state=established,related
add action=accept chain=forward comment="[ronin-vlan52-guest] **TDF** - Internet Access Only" connection-state=\
new in-interface-list=VLAN out-interface-list=ROUTER-TRUNK
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes out-interface=bridge1-primary
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main scope=30 suppress-hw-offload=\
no target-scope=10 vrf-interface=bridge1-primary
add comment="[router-uplink]" disabled=no dst-address=0.0.0.0/0 gateway=192.168.10.1 routing-table=main \
suppress-hw-offload=no
/system identity
set name=4306io_hAPax2
/system note
set show-at-login=no
[admin@4306io_hAPax2] >
Any assistance would be very much appreciated.
