Connect Internet LAN and Smart Home LAN

Florian85 · September 29, 2023, 4:44pm

Hi,

i ve got to admit that I assumed being able to configure my MikroTik RB750R2 on my own … but I cannot

I have the following situation: I have a LAN/Wifi router, providing internet and LAN connectivity for my computer, TV, mobiles, etc.
The router is mine, I can configure it and do everything i want.

On the other hand there is a second LAN in my flat, that is used for all smart home features. I have limited control on these devices. There is a device providing DHCP and I figured out the IP Mask of this network using wireshark etc.

The problem is, that there is no way to control anything with my mobile phone, since my phone is in “my” wifi but has no connection to the smart home LAN. The smart home LAN has no internet connection, so there is no connection between both.

My obvious solution was, to get a device inbetween those 2 networks to provide a connection between both. Is that generally correct?

I ve tried some things in router and bridge mode, but didnt get it working at all. Is there any hint you can give me?

Best Regards
Florian

BrateloSlava · October 1, 2023, 9:24am

As for me, the first option that comes to mind is to try to organize, for example, a separate Wi-Fi network for access to smart home devices. You buy a device that can be a Wi-Fi access point, connect it with a cable to the smart home network. Set up a Wi-Fi network on this device. Clients of this wireless network will receive an address via DHCP from the “master” device. Connect your phone to this new network and everything should be fine.

There are other options, but they seem more complicated to me to set up for you.

bpwl · October 1, 2023, 10:39am

I see 3 network controlling devices

Owned Wifi router with WAN access, and ethernet, wifi LAN
Owned RB750R2 non-wifi router
Smart home controller (as black box, no management access) , but is a DHCP server. Network features here are unclear (ethernet , wifi?)

There should be no problem to connect those networks.
Depending on what that WAN/wifi router can do, there is a need for the RB750 or not

The MT RB750 can do many things, but has no wifi.

Connect one ethernet port (ether1) of the RB750 to the Smart hone controller network.
Set it as the by default WAN port of the RB750 (not a port connected to the bridge, DHCP client, SRCnat (masquerade) for what goes out there.)
The RB750 should get an IP address on that “WAN” interface in the Home Network, or you use the one, as you already discovered the DHCP addresses, as fixed address.
Do not use this connection as default gateway (do not allow DHCP client to add default route here)
Connect another port of RB750 to your WAN/wifi/LAN router.
This is a (by default) a LAN (!) port, connected to the bridge (bridge is member of the LAN-list), but stop the default DHCP server on the bridge, as this would conflict the WAN/wifi/LAN routers DHCP server. Add a client DHCP on the bridge instead, to get an IP address from your WAN/wifi/LAN network. Use the WAN/wifi/LAN router as default gateway.(use Peer DNS, use peer NTP, add Default Route=yes). Make sure this IP address on the bridge is static as needed for point 3.
Set a route entry in the WAN/wifi/LAN router for the IP-range of the Smart Home LAN, with the RB750R2 as gateway with it’s static IP address.

Clients on the wifi or that first WAN/wifi/LAN network will connect to internet, except for the Smart Home network addresses, those will be routed to the RB750
Clients (or clients of new acces Point) connected to the other ports of the RB750) can connect to the Smart Home network and also to internet.
Due to the WAN connection (with default setup doing srcNAT or masquerade) on the RB750 the Smart Home devices and controller have the proper return path as all wifi connections seem to come from the local RB750. (ether1 WAN IP address)

EDIT: If point 3 is not possible (happens with other brand home gateways that are not as flexible as MT, as they refuse LAN direction routing), then the setup should be changed, with the RB750 connected to internet and Smart home network (2 WAN connections), and the wifi router on the LAN port of the RB750.

Florian85 · October 1, 2023, 12:43pm

Thank you both for your answer.
What you wrote bpwl does make a lot of sense to me. Thank you very much.

In the meantime I fiddled around myself a bit with some success. I basically added a new bridge between eth4 and 5 and connected the 2 LANs there, setting the correct ip networks for both. This gave me a connection from one network to the other and I thought everything is fine. But today I noticed that the IP address of my computer changed, since the DHCP server on my LAN and the one on the smart home network were both reachable from my computer… So i scrapped this one and went through your steps, bpwl:

I got this working as well, and my computer “stayed” in my network. So this already looks better than my approach.
I started from the default config and followed the mentioned steps and had only minor questions:

SRCnat (masquerade): what do you mean with that? Where do I need to set this?

Make sure this IP address on the bridge is static as needed for point 3.: Kinda clear, but isnt DHCP client and static IP a contradiction?

Set a route entry in the WAN/wifi/LAN router for the IP-range of the Smart Home LAN: I didnt do that and its working. Maybe just from inside the LAN and not from the internet side or whats the reason to do that?

EDIT its kinda strange, since some apps are working with that setup and some dont. I notices that i couldnt ping the smart home devices from my LAN. So i added the static route on my wifi router and pinging those devices work fine now.

Heres my config:

# oct/01/2023 14:28:19 by RouterOS 6.48.6
# software id = Y4Y7-6PSX
#
# model = RB750r2
# serial number = HE908Z1S5M8
/interface bridge
add admin-mac=48:A9:8A:93:96:F7 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.0.254/24 interface=bridge network=192.168.0.0
/ip dhcp-client
add add-default-route=no comment=defconf disabled=no interface=ether1
add disabled=no interface=bridge
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name="MikroTik Router"
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN