Hi all!
I have new setup, but still have some issues, that I can not figure out. I would also appreciate the comments about the configuration, if there are some suggestions on improving it.
My Setup:
CHR (QUEMU on Proxmox) RouterOS 7.20.6
WAN-IF connected to DSL modem using PPPoE
LAN-IF connected to cAP ac
cAP ac RouterOS 7.20.6
Proxmox-LAN connected to CHR
Game-LAN connected to hAP ac^2
I use 4 VLANS (later I will set the correct insolation, but by now I want all of them to access internet and be able to communicate with each other).
Admin VLAN (With DHCP) - All Mikrotiks get an address in this VLAN
Home VLAN (With DHCP) - address reservation, DNS forced to use DNS server on CHR with adlists.
IOT VLAN (With DHCP) - address reservation
Guest VLAN (With DHCP) - only DHCP addresses for guests
cAP ac - have virtual AP for each VLAN except Admin. Managed from CAPsMAN on CHR.
With the setup I have following issues
ISSUES
- on CHR I can not enable IP/Cloud DDNS - it stuck in Updating. Upgrading RouterOS is possible, ping to 8.8.8.8 succesfull.
- on cAP ac I can not access admin interface on Admin VLAN (from Home VLAN using Winbox). I can access, if connecting to MAC address. And I can connect to Admin IP of CHR and hAP ac^2.
- on cAP ac I can not access Mikrotik upgrade, (error, Address not available). Ping to 8.8.8.8 succesful.
Things done:
cAP ac & CHR restarted. cAP ac - config backup, reset and deleted config, backup loaded.
CONFIGS
CHR
# 2025-12-10 13:43:01 by RouterOS 7.20.6
# system id = REMOVED
#
/caps-man channel
add band=2ghz-b/g/n comment=2412 control-channel-width=20mhz frequency=2412 \
name=CH1 reselect-interval=3h15m save-selected=yes
add band=2ghz-b/g/n comment=2437 control-channel-width=20mhz frequency=2437 \
name=CH6 reselect-interval=4h30m save-selected=yes
add band=2ghz-g/n comment=2462 control-channel-width=20mhz frequency=2462 \
name=CH11 reselect-interval=2h45m save-selected=yes
/interface bridge
add comment="Common bridge" frame-types=admit-only-vlan-tagged name=\
DATA-BRIDGE vlan-filtering=yes
/interface ethernet
set [ find default-name=ether3 ] comment="Configuration interface" \
disable-running-check=no name=CONFIG-IF
set [ find default-name=ether1 ] comment="ETH to MAIN AP" \
disable-running-check=no name=LAN-IF
set [ find default-name=ether2 ] comment="ETH to Telekom Modem" \
disable-running-check=no name=WAN-IF
/interface vlan
add comment="55 Admin VLAN" interface=DATA-BRIDGE name=ADMIN-55 vlan-id=55
add comment="99 Guest VLAN" interface=DATA-BRIDGE name=GUEST-99 vlan-id=99
add comment="77 Home VLAN" interface=DATA-BRIDGE name=HOME-77 vlan-id=77
add comment="88 IOT VLAN" interface=DATA-BRIDGE name=IOT-88 vlan-id=88
add comment="7 Telekom VLAN" interface=WAN-IF name=WAN-7 vlan-id=7
/caps-man datapath
add bridge=DATA-BRIDGE comment="Home Network data" name=HOME-DATA vlan-id=77 \
vlan-mode=use-tag
add bridge=DATA-BRIDGE client-to-client-forwarding=yes comment=\
"IOT Network Data" name=IOT-DATA vlan-id=88 vlan-mode=use-tag
add bridge=DATA-BRIDGE comment="Guest Network Data" name=GUEST-DATA vlan-id=\
99 vlan-mode=use-tag
/interface pppoe-client
add add-default-route=yes comment="Telekom PPPoE" disabled=no interface=WAN-7 \
max-mru=1492 max-mtu=1492 name=TELEKOM-PPPoE use-peer-dns=yes user=\
REMOVED
/caps-man security
add authentication-types=wpa-psk,wpa2-psk comment=GUEST-NET encryption=\
aes-ccm name=GUEST-SEC
add authentication-types=wpa-psk,wpa2-psk comment=HOME-NET encryption=aes-ccm \
name=HOME-SEC
add authentication-types=wpa-psk,wpa2-psk comment=IOT-NET encryption=aes-ccm \
name=IOT-SEC
/caps-man configuration
add country=germany datapath=GUEST-DATA installation=indoor mode=ap name=\
GUEST-CONFIG security=GUEST-SEC ssid=GUEST-NET
add channel=CH6 country=germany datapath=HOME-DATA installation=indoor mode=\
ap name=HOME-CONFIG security=HOME-SEC ssid=HOME-NET
add country=germany datapath=HOME-DATA installation=indoor mode=ap name=\
HOME-CONFIG-5G security=HOME-SEC ssid=HOME-NET
add channel=CH11 country=germany datapath=IOT-DATA installation=indoor mode=\
ap name=IOT-IN-CONFIG security=IOT-SEC ssid=IOT-NET
add channel=CH6 country=germany datapath=IOT-DATA installation=outdoor mode=\
ap name=IOT-OUT-CONFIG security=IOT-SEC ssid=IOT-NET
/interface list
add comment="LAN List" name=LAN
add comment="WAN List" name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add comment="Admin DHCP Pool" name=ADMIN-POOL ranges=\
192.168.55.10-192.168.55.20
add comment="Home DHCP Pool" name=HOME-POOL ranges=\
192.168.77.200-192.168.77.254
add comment="IOT DHCP Pool" name=IOT-POOL ranges=\
192.168.88.200-192.168.88.254
add comment="Guest DHCP Pool" name=GUEST-POOL ranges=\
192.168.99.2-192.168.99.20
/ip dhcp-server
add address-pool=ADMIN-POOL comment="Admin DHCP server" interface=ADMIN-55 \
lease-time=1w name=ADMIN-DHCP
add address-pool=HOME-POOL comment="Homenet DHCP server" interface=HOME-77 \
lease-time=1w name=HOME-DHCP
add address-pool=IOT-POOL comment="IOTnetwork DHCP server" interface=IOT-88 \
lease-time=1w name=IOT-DHCP
add address-pool=GUEST-POOL comment="GuestNet GHCP server" interface=GUEST-99 \
name=GUEST-DHCP
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man manager interface
set [ find default=yes ] comment="Ignore other" forbid=yes
add comment="Admin Interface to connect" disabled=no interface=ADMIN-55
/caps-man provisioning
add action=create-dynamic-enabled comment="Main 2.4Ghz" master-configuration=\
HOME-CONFIG name-format=prefix-identity name-prefix=2G radio-mac=\
REMOVED slave-configurations=IOT-IN-CONFIG,GUEST-CONFIG
add action=create-dynamic-enabled comment="Main 5Ghz" master-configuration=\
HOME-CONFIG-5G name-format=prefix-identity name-prefix=5G radio-mac=\
REMOVED
add action=create-dynamic-enabled comment="Out 2.4Ghz" master-configuration=\
IOT-OUT-CONFIG name-format=prefix-identity name-prefix=2G radio-mac=\
REMOVED slave-configurations=HOME-CONFIG,GUEST-CONFIG
add action=create-dynamic-enabled comment="Game 2.4 Ghz" \
master-configuration=IOT-IN-CONFIG name-format=prefix-identity \
name-prefix=2G radio-mac=REMOVED slave-configurations=\
HOME-CONFIG,GUEST-CONFIG
add action=create-dynamic-enabled comment="Game 5Ghz" master-configuration=\
HOME-CONFIG-5G name-format=prefix-identity name-prefix=5G radio-mac=\
REMOVED
/certificate settings
set builtin-trust-anchors=not-trusted
/dude
set enabled=yes
/interface bridge port
add bridge=DATA-BRIDGE frame-types=admit-only-vlan-tagged interface=LAN-IF
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=DATA-BRIDGE comment="VLANs on LAN ETH" tagged=DATA-BRIDGE,LAN-IF \
vlan-ids=77,88,99
add bridge=DATA-BRIDGE comment="Admin VLAN" tagged=DATA-BRIDGE,LAN-IF \
vlan-ids=55
/interface detect-internet
set detect-interface-list=WAN internet-interface-list=WAN lan-interface-list=\
LAN wan-interface-list=WAN
/interface list member
add interface=ADMIN-55 list=LAN
add interface=HOME-77 list=LAN
add interface=IOT-88 list=LAN
add comment="LAN interfaces" interface=GUEST-99 list=LAN
add comment="WAN interface" interface=TELEKOM-PPPoE list=WAN
add comment="ETH port for config" interface=CONFIG-IF list=LAN
add interface=DATA-BRIDGE list=LAN
/ip address
add address=192.168.55.55/24 comment="Static config IP" interface=CONFIG-IF \
network=192.168.55.0
add address=192.168.55.1/24 comment="Admin IP" interface=ADMIN-55 network=\
192.168.55.0
add address=192.168.77.1/24 comment="Homenet IP" interface=HOME-77 network=\
192.168.77.0
add address=192.168.88.1/24 comment="IOTnet IP" interface=IOT-88 network=\
192.168.88.0
add address=192.168.99.1/24 comment="Guestnet IP" interface=GUEST-99 network=\
192.168.99.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add interface=CONFIG-IF
/ip dhcp-server lease
REMOVED
/ip dhcp-server network
add address=192.168.55.0/24 comment="Admin Net" dns-server=\
1.1.1.1,8.8.8.8,8.8.4.4 gateway=192.168.55.1 netmask=24
add address=192.168.77.0/24 comment="Home Net" dns-server=192.168.77.1 \
gateway=192.168.77.1 netmask=24
add address=192.168.88.0/24 comment="IOT Net" dns-server=\
1.1.1.1,8.8.8.8,8.8.4.4 gateway=192.168.88.1 netmask=24
add address=192.168.99.0/24 comment="Guest Net" dns-server=\
1.1.1.1,8.8.8.8,8.8.4.4 gateway=192.168.99.1 netmask=24
/ip dns
set allow-remote-requests=yes cache-max-ttl=6h cache-size=40960KiB \
doh-max-concurrent-queries=200 doh-max-server-connections=20 \
max-concurrent-queries=1000 max-concurrent-tcp-sessions=40 \
mdns-repeat-ifaces=GUEST-99,HOME-77,IOT-88 servers=\
8.8.8.8,8.8.4.4,1.1.1.1 use-doh-server=\
https://cloudflare-dns.com/dns-query verify-doh-cert=yes
/ip dns adlist
add url=https://v.firebog.net/hosts/static/w3kbl.txt
add url=\
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt
add url=https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
add url=https://v.firebog.net/hosts/AdguardDNS.txt
add url=https://v.firebog.net/hosts/Easylist.txt
add url=https://v.firebog.net/hosts/Prigent-Crypto.txt
/ip firewall address-list
add address=192.168.55.0/24 comment="Admin network" list=Admin_IP
add address=192.168.77.0/24 comment="Home network" list=Home_IP
add address=192.168.88.0/24 comment="IOT network" list=IOT_IP
add address=192.168.99.0/24 comment="Guest network" list=Guest_IP
/ip firewall filter
add action=accept chain=input comment=\
"Defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="Defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="Defconf: accept ICMP" disabled=yes \
protocol=icmp
add action=accept chain=input comment=\
"Defconf: accept to local loopback (for CAPsMAN)" disabled=yes \
dst-address=127.0.0.1
add action=drop chain=input comment="Defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="Defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="Defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="Defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"Defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="Defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"Defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="Defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="DNS ADblocker" dst-address=\
!192.168.77.1 dst-port=53 in-interface=HOME-77 protocol=udp src-address=\
!192.168.77.1 to-addresses=192.168.77.1
add action=dst-nat chain=dstnat comment="DNS ADblocker" dst-address=\
!192.168.77.1 dst-port=53 in-interface=HOME-77 protocol=tcp src-address=\
!192.168.77.1 to-addresses=192.168.77.1
add action=masquerade chain=srcnat comment="DNS ADblocker" dst-address=\
192.168.77.1 dst-port=53 protocol=udp src-address-list=Home_IP
add action=masquerade chain=srcnat comment="DNS ADblocker" dst-address=\
192.168.77.1 dst-port=53 protocol=udp src-address-list=Home_IP
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=Proxmox-MT
/system scheduler
add comment="Automatic weekly update" interval=1w name=Weekly-Update \
on-event="/system/script/ run Auto-Update" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2025-12-06 start-time=03:33:33
/system script
add comment="Automatic weekly upgrade" dont-require-permissions=no name=\
Auto-Update owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/\
system package update\
\ncheck-for-updates once\
\n:delay 3s;\
\n:if ( [get status] = \"New version is available\") do={ install }"
cAP ac
# 2025-12-10 11:33:58 by RouterOS 7.20.6
# software id = REMOVED
#
# model = RBcAPGi-5acD2nD
# serial number = REMOVED
/interface bridge
add frame-types=admit-only-vlan-tagged name=DATA-BRIDGE vlan-filtering=yes
/interface wireless
# managed by CAPsMAN
# channel: 2437/20-Ce/gn(18dBm), SSID: HOME-NET, CAPsMAN forwarding
set [ find default-name=wlan1 ] name=wlan-2G ssid=MikroTik
# managed by CAPsMAN
# channel: 5180/20-Ceee/ac/P(20dBm), SSID: HOME-NET, CAPsMAN forwarding
set [ find default-name=wlan2 ] name=wlan-5G ssid=MikroTik
/interface ethernet
set [ find default-name=ether2 ] name=GAME-LAN
set [ find default-name=ether1 ] name=PROXMOX-LAN
/interface vlan
add interface=DATA-BRIDGE name=ADMIN-55 vlan-id=55
add interface=DATA-BRIDGE name=GUEST-99 vlan-id=99
add interface=DATA-BRIDGE name=HOME-77 vlan-id=77
add interface=DATA-BRIDGE name=IOT-88 vlan-id=88
/interface list
add comment="Admin interface" name=Admin
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/certificate settings
set builtin-trust-anchors=not-trusted
/interface bridge port
add bridge=DATA-BRIDGE frame-types=admit-only-vlan-tagged interface=\
PROXMOX-LAN
add bridge=DATA-BRIDGE frame-types=admit-only-vlan-tagged interface=GAME-LAN
/ipv6 settings
set allow-fast-path=no disable-ipv6=yes forward=no
/interface bridge vlan
add bridge=DATA-BRIDGE tagged=DATA-BRIDGE,PROXMOX-LAN,GAME-LAN vlan-ids=\
77,88,99
add bridge=DATA-BRIDGE tagged=PROXMOX-LAN,DATA-BRIDGE,GAME-LAN vlan-ids=55
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=\
all
/interface list member
add interface=ADMIN-55 list=Admin
/interface wireless cap
#
set bridge=DATA-BRIDGE caps-man-addresses=192.168.55.1 certificate=request \
discovery-interfaces=ADMIN-55 enabled=yes interfaces=wlan-2G,wlan-5G
/ip dhcp-client
add interface=ADMIN-55
/system identity
set name=HALL-MT
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add interval=1w name="Auto Upgrade" on-event=\
"/system/script/ run Auto_Update " policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2025-12-13 start-time=04:30:00
/system script
add dont-require-permissions=no name=Auto_Update owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/\
system package update\
\ncheck-for-updates once\
\n:delay 3s;\
\n:if ( [get status] = \"New version is available\") do={ install }"
Any comments and improvement suggestions welcome!