Hi,
I have an RB4011 and a Caps (ax capable) attached to it.
The problem is that what I provision to the Caps does get any clients on 5GHz and the 2.4GHz wifi complains that it can't find channels.
I work with vlans and only vlan 200 is to be provided to the caps.
Thanks in advance!
# 2025-09-15 19:45:16 by RouterOS 7.19.6
# software id = RI0F-4S4Q
#
# model = RB4011iGS+5HacQ2HnD
# serial number = *sanitized*
/interface bridge
add admin-mac=*sanitized* auto-mac=no comment=defconf name=bridge \
vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no speed=\
1G-baseT-full
/interface vlan
add interface=bridge name=Clients vlan-id=200
add interface=bridge name=Guests vlan-id=400
add interface=bridge name=Management vlan-id=10
add interface=bridge name=Servers vlan-id=100
/interface bonding
add mode=802.3ad name=bonding1 slaves=ether8,ether9
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=5ghz-ac disabled=no name=channel_5ac skip-dfs-channels=10min-cac \
width=20/40/80/160mhz
add band=5ghz-ax disabled=no name=channel_5ax skip-dfs-channels=10min-cac width=\
20/40/80mhz
add band=2ghz-ax disabled=no name=channel_2ax skip-dfs-channels=10min-cac \
width=20/40mhz
/interface wifi datapath
add bridge=bridge disabled=no name=datapath1 vlan-id=200
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption=\
ccmp,gcmp,ccmp-256,gcmp-256 name=sec_mywifi wps=disable
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption=\
ccmp,gcmp,ccmp-256,gcmp-256 name=sec_guests wps=disable
/interface wifi configuration
add channel=channel_5ac country=*sanitized* disabled=no name=cfg_mywifi \
security=sec_mywifi ssid=mywifi
add channel=channel_5ac country=*sanitized* disabled=no name=cfg_guest security=\
sec_guests ssid="guestwifi"
add channel=channel_5ax channel.skip-dfs-channels=10min-cac country=*sanitized* \
datapath=datapath1 disabled=no name=cfg_CAP_mywifi_5 security=\
sec_mywifi ssid=mywifi
add channel=channel_2ax country=*sanitized* datapath=datapath1 disabled=no name=\
cfg_CAP_mywifi_2 security=sec_mywifi ssid=mywifi
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac \
configuration=cfg_mywifi configuration.mode=ap disabled=no name=\
wifi1-mywifi
add configuration=cfg_guest configuration.mode=ap disabled=no mac-address=\
0A:55:31:AF:05:0D master-interface=wifi1-mywifi name=wifi2-guests \
security=sec_guests
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool1 ranges=10.0.0.2-10.0.0.254
add name=dhcp_pool2 ranges=10.0.1.2-10.0.1.254
add name=dhcp_pool3 ranges=10.0.2.100-10.0.2.254
add name=dhcp_pool4 ranges=192.168.100.100-192.168.100.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_pool1 interface=Management name=dhcp1
add address-pool=dhcp_pool2 interface=Servers name=dhcp2
add address-pool=dhcp_pool3 interface=Clients name=dhcp3
add address-pool=dhcp_pool4 interface=Guests name=dhcp4
/port
set 0 name=serial0
set 1 name=serial1
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge interface=ether2 pvid=10
add bridge=bridge interface=ether3 pvid=100
add bridge=bridge interface=ether4 pvid=100
add bridge=bridge interface=ether5 pvid=100
add bridge=bridge interface=ether6 pvid=100
add bridge=bridge interface=ether7
add bridge=bridge interface=sfp-sfpplus1 pvid=200
add bridge=bridge interface=wifi1-mywifi pvid=200
add bridge=bridge interface=ether10
add bridge=bridge interface=bonding1 pvid=100
add bridge=bridge interface=wifi2-guests pvid=400
/ip firewall connection tracking
set enabled=yes
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge untagged=ether2 vlan-ids=10
add bridge=bridge tagged=ether7,bridge vlan-ids=100
add bridge=bridge tagged=ether7,bridge,ether10 vlan-ids=200
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=Management list=LAN
/interface wifi capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=\
none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=\
cfg_CAP_mywifi_5
add action=create-dynamic-enabled disabled=no master-configuration=\
cfg_CAP_mywifi_2
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
add address=10.0.0.1/24 interface=Management network=10.0.0.0
add address=10.0.1.1/24 interface=Servers network=10.0.1.0
add address=10.0.2.1/24 interface=Clients network=10.0.2.0
add address=192.168.100.1/24 interface=Guests network=192.168.100.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.1.5,9.9.9.9,149.112.112.112 gateway=\
10.0.0.1
add address=10.0.1.0/24 dns-server=10.0.1.5,9.9.9.9,149.112.112.112 gateway=\
10.0.1.1
add address=10.0.2.0/24 dns-server=10.0.1.5,9.9.9.9,149.112.112.112 gateway=\
10.0.2.1
add address=192.168.88.0/24 dns-server=10.0.1.5,9.9.9.9 gateway=192.168.88.1
add address=192.168.100.0/24 dns-server=9.9.9.9,149.112.112.112 gateway=\
192.168.100.1
/ip dns
set servers=10.0.1.5,9.9.9.9,149.112.112.112
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="Allow HTTP and HTTPS to 10.0.1.2" \
connection-state=new disabled=yes dst-address=10.0.1.2 dst-port=80,443 \
protocol=tcp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=drop chain=forward comment="Block 192.168.100.0/24 -> 10.0.0.0/24" \
dst-address=10.0.0.0/24 src-address=192.168.100.0/24
add action=drop chain=forward comment="Block 192.168.100.0/24 -> 10.0.2.0/24" \
dst-address=10.0.2.0/24 src-address=192.168.100.0/24
add action=drop chain=forward comment=\
"Block 192.168.100.0/24 -> 192.168.88.0/24" dst-address=192.168.88.0/24 \
src-address=192.168.100.0/24
add action=drop chain=forward comment="Block 192.168.100.0/24 -> 10.0.1.0/24" \
dst-address=10.0.1.0/24 src-address=192.168.100.0/24
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=forward dst-address=10.0.1.8 dst-port=1939 \
in-interface=ether1 protocol=tcp
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Forward HTTP to 10.0.1.2" dst-port=\
80 in-interface=ether1 protocol=tcp to-addresses=10.0.1.2 to-ports=80
add action=dst-nat chain=dstnat comment="Forward HTTP to 10.0.1.2" dst-port=\
443 in-interface=ether1 protocol=tcp to-addresses=10.0.1.2 to-ports=443
add action=dst-nat chain=dstnat comment="Redirect UDP DNS to Pi-hole" \
disabled=yes dst-port=53 protocol=udp to-addresses=10.0.1.5 to-ports=53
add action=dst-nat chain=dstnat comment="Redirect TCP DNS to Pi-hole" \
disabled=yes dst-port=53 protocol=tcp to-addresses=10.0.1.5 to-ports=53
add action=dst-nat chain=dstnat comment="SSH Forward" dst-port=22 \
in-interface=ether1 log=yes log-prefix=SSH protocol=tcp \
to-addresses=10.0.1.8 to-ports=22
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www-ssl disabled=no
/ip ssh
set host-key-type=ed25519
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system clock
set time-zone-name=Europe/Helsinki
/system identity
set name=Thawra
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool romon
set enabled=yes