Configure Wi-Fi on my RB2011

RouterOS Wireless Networking
1

Hello,

I’ve just become owner of a RB2011, being my first MikroTik with Wi-Fi I don’t have too much knowledge configuring it.
I want a simple AP to share my internet…

My current config is a PCC load balancing having 2 providers, now I need to:

  1. Enable Wi-Fi interface, select ap-bridge mode ?!
  2. In security profile select dynamic-keys mode ?! WPA2-EAP!
  3. IP → Addresses → I will give a a network in my case will be 192.168.3.1/24 ?!
  4. Add New Pool, for example 192.168.3.2-192.168.3.100 ?!
  5. Add New DHCP Server for WiFi interface and use the pool created above ?!

Is everything above correct ? What next should I do ?

Do I need the masquerade rule ? (/ip firewall nat add action=masquerade chain=srcnat out-interface=WiFi)

The pool above should only be able to use internet without having access to may LAN 192.168.0.1/24

Thank you.

2

Post your current export so we can see what you have done.

Then yes… looks reasonable. Basically add a masq rule, then add firewall rules to block cross talk. Either that block by default and then allow what you want.

-Eric

3

Thank you for posting.
Here are my current rules:

[admin@MikroTik] > ip firewall nat export
# feb/11/2014 19:49:05 by RouterOS 6.9
#
/ip firewall nat
add action=masquerade chain=srcnat out-interface=Provider_1
add action=masquerade chain=srcnat out-interface=Provider_2
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=\
    192.168.0.1 to-ports=8080
add action=redirect chain=dstnat dst-address-type=!local dst-port=53 \
    protocol=udp to-addresses=0.0.0.0 to-ports=53
[admin@MikroTik] >




[admin@MikroTik] > ip firewall mangle export
# feb/11/2014 19:45:00 by RouterOS 6.9
#
/ip firewall mangle
add chain=prerouting dst-address=192.168.0.0/24
add chain=prerouting dst-address=188.XX.XX.0/24 in-interface=LAN1
add chain=prerouting dst-address=77.89.XXX.XXX/30 in-interface=LAN1
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Provider_2 new-connection-mark=Provider_2
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Provider_1 new-connection-mark=Provider_1
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=LAN1 new-connection-mark=Provider_2 \
    per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=LAN1 new-connection-mark=Provider_1 \
    per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting connection-mark=Provider_2 in-interface=LAN1 new-routing-mark=Provider_2 passthrough=no
add action=mark-routing chain=prerouting connection-mark=Provider_1 in-interface=LAN1 new-routing-mark=Provider_1 passthrough=no
add action=mark-routing chain=output connection-mark=Provider_2 new-routing-mark=Provider_2 passthrough=no
add action=mark-routing chain=output connection-mark=Provider_1 new-routing-mark=Provider_1 passthrough=no
add chain=output dst-address=192.168.0.0/24
add action=mark-connection chain=output connection-mark=no-mark dst-address-type=!local new-connection-mark=Provider_2 per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=output connection-mark=no-mark dst-address-type=!local new-connection-mark=Provider_1 per-connection-classifier=\
    both-addresses:2/1
add action=mark-routing chain=output connection-mark=Provider_2 new-routing-mark=Provider_2 passthrough=no
add action=mark-routing chain=output connection-mark=Provider_1 new-routing-mark=Provider_1 passthrough=no
[admin@MikroTik] >
4

You have nothing in filter?

5

I have, but I didn’t think it is important…

[admin@MikroTik] > ip firewall filter export
# feb/12/2014 08:58:43 by RouterOS 6.9
#
/ip firewall filter
add chain=input comment="Allow Ping" icmp-options=0:0 protocol=icmp
add chain=input comment="Allow Ping" icmp-options=8:0 protocol=icmp
add chain=input comment="Allow Traceroute" icmp-options=11:0 protocol=icmp
add chain=input comment="Allow Traceroute" icmp-options=3:3 protocol=icmp
add chain=input comment="Allow Path MTU Discovery" icmp-options=3:4 protocol=\
    icmp
add action=drop chain=input comment="Drop all other ICMP" protocol=icmp
add action=drop chain=input dst-port=8080 in-interface=Provider_1 protocol=tcp \
    src-address=0.0.0.0/0
add action=drop chain=input dst-port=8080 in-interface=Provider_2 protocol=tcp \
    src-address=0.0.0.0/0
add chain=input comment="Added by webbox" connection-state=established \
    in-interface=Provider_1
add chain=input comment="Added by webbox" connection-state=established \
    in-interface=Provider_2
add chain=input comment="Added by webbox" connection-state=related \
    in-interface=Provider_1
add chain=input comment="Added by webbox" connection-state=related \
    in-interface=Provider_2
add action=drop chain=input comment="Added by webbox" in-interface=Provider_1
add action=drop chain=input comment="Added by webbox" in-interface=Provider_2
add action=jump chain=forward disabled=yes jump-target=icmp protocol=icmp
add action=jump chain=forward comment="Added by webbox" in-interface=Provider_1 \
    jump-target=customer
add action=jump chain=forward comment="Added by webbox" in-interface=Provider_2 \
    jump-target=customer
add chain=customer comment="Added by webbox" connection-state=established
add chain=customer comment="Added by webbox" connection-state=related
[admin@MikroTik] >
6

Alright. Looking at that you don’t need to add a Masq rule since you masq all outbound traffic. What you do need to add is some rules to filter to block traffic between your two networks.

7

I will make that rule, is not a problem, the problem is that I get no internet the connection is only “Limited”.
Maybe I need to add some rule to mangle ?
Here is my config for wireless…

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no l2mtu=2290 mode=ap-bridge
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk,wpa2-eap mode=dynamic-keys wpa2-pre-shared-key=test@test
[admin@MikroTik] >




/ip pool
add name=WiFi ranges=192.168.3.2-192.168.3.100
[admin@MikroTik] >




/ip address
add address=192.168.3.1/24 interface=wlan1 network=192.168.3.0
[admin@MikroTik] >




/ip dhcp-server
add add-arp=yes address-pool=WiFi disabled=no interface=wlan1 lease-time=1d name=WiFi
/ip dhcp-server network
add address=192.168.3.0/24 gateway=192.168.0.1
[admin@MikroTik] >
8

Post your entire export

Sent from my SCH-I545 using Tapatalk

9

You posted only some parts from your router configuration. Please make a support output file and send that to support@mikotik.com.

Check if you get an IP address on the client and you are able to ping the gateway and check if you can resolve DNS names by pinging some www site. Then check
how far you can traceroute to check if your routing is working correctly.

10



All the config is above, what else to show ?

I get an IP from DHCP…but no ping reply.

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 192.168.3.98
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1




C:\Users\Admin>ping 192.168.3.1

Pinging 192.168.3.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.3.1:
    Packets: Sent = 3, Received = 0, Lost = 3 (100% loss),
Control-C
^C
C:\Users\Admin>




C:\Users\Admin>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:
Request timed out.
Request timed out.

Ping statistics for 192.168.0.1:
    Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),
Control-C
11

I’ve read a few tutorials about how to setup an AP on MikroTik and I’ve noticed that almost in all of them LAN and WLAN need to be bridged and in this case it will work, but I don’t want to bridge them because it will have same network, but I want WLAN to have different network and different DHCP Server. Is there another way?

I saw normis post where he says:

How to accomplish this ?

Thank you.

12

I receive IP from DHCP, I cannot ping gateway 192.168.3.1 but I can ping external IP’s for example 8.8.8.8 but websites won’t open, it’s a DNS issue?

In IP → DNS my dns servers are 8.8.8.8 and 8.8.4.4
In IP → DHCP Server → Networks I’ve added DNS server 8.8.8.8 to 192.168.3.0/24 network but still websites won’t open.

13

Try to run “ipconfig /all”
To see all ip config including dns settings.

14

http://i.imgur.com/yX8Znfk.jpg

15

Issue solved, had to add this rule:

/ip firewall mangle add chain=output dst-address=192.168.3.0/24