Hello, I have MikroTik hap ac2. I am trying to create my sub-network in my studio from a shared apartment router. My aim is to have separate subnetwork within my house, where I can connect to Wifi and have Ethernet connections. I have added a diagram for my clarity on what I am trying to achieve.
I am not knowledgeable on RouterOS, so I read the documentation of MikroTik and tried to follow some tutorials and ended up setting up Home AP Dual. But currently I am not receiving any connection, I tried pinging within the terminal of WinBox, and it fails as well.
edit1: Thanks jaclaz for heads up, here is my full configuration
# jan/02/1970 00:02:32 by RouterOS 6.46.8
# software id = ABCD-123
#
# model = RBD52G-5HacD2HnD
# serial number = ABCDEF12345
/interface bridge
add admin-mac=AA:AA:AA:AA:AA:AA auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto installation=indoor mode=\
ap-bridge ssid=MikroTik-08337B wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto \
installation=indoor mode=ap-bridge ssid=MikroTik-08337C \
wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
No, we need your full configuration, instructions here:
And some details on your physical/logical setup.
Which LAN/IP address(es) has the "Shared Apartment Router" (SAR)?
Does it run a DHCP server?
From what you write you want to have a different subnet for your devices, right?
If this is the case, then the AC2 will need to be configured with a LAN (a bridge with ports ether2-5 and wlan1 and wlan2) and a WAN (ether1 connected to the SAR).
Thank you for the reply. I have updated my post with full configuration. Regarding my physical setup:
SAR is in the hallway managed by the building, ethernet cable comes from SAR to MikroTik ether1. Ether2 and Ether3 are connected to my devices and phone will connect to Wifi.
SAR has LAN IP 192.168.1.1, it has DHCP server running. When MikroTik ether1 connects, it gets 192.168.1.26 via DHCP. When PC connects directly to SAR, it gets 192.168.1.14 and internet works fine.
Yes, I want a separate subnet (192.168.88.0/24) for my devices behind the MikroTik.
So far what I’ve identified is, MikroTik successfully gets IP from SAR (192.168.1.26). MikroTik can ping SAR gateway (192.168.1.1) from terminal inside. MikroTik CANNOT ping 8.8.8.8 or any internet IP and traceroute stops immediately after gateway.
It is with Use Peer DNS. I have updated my post by editing and adding full configuration. If that doesn’t work, please let me know and I can comment it. Here is my DNS configuration:
after reboot, go to system/routerboard and Upgrade the firmware, then, without reboot,
go to system/reset configuration and select only "keep user configuration" and "Reset Configuration"...
After reboot the routerboard is exactly configured as your need, do not touch nothing,
except go on wireless and set on 2 wlans the SSID
and on security profiles / default profile set the password.
What the OP needs to know that even if he puts his own network behind the router, all this traffic eventually has to come out his WAN which is then on the LAN of the shared router. Its not like if he has a direct private line to the internet.
Thanks for the detailed explanation. I followed the steps to upgrade and reset. Unfortunately, I still can’t connect to the internet on Wifi or any Ethernet. Also, I can’t ping the 8.8.8.8 within the terminal still (Not entirely sure if this is relavant).
I am re-posting my full configuration after doing the steps you mentioned. I haven’t touched the QuickSet.
# jan/02/1970 00:10:54 by RouterOS 6.49.18
# software id = AAAA-AAAAA
#
# model = RBD52G-5HacD2HnD
# serial number = ABCDEF12345
/interface bridge
add admin-mac=AA:AA:AA:AA:AA:AA auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto installation=indoor mode=\
ap-bridge ssid=MikroTik wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto \
installation=indoor mode=ap-bridge ssid=MikroTikA wireless-protocol=\
802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik wpa2-pre-shared-key=123asdqwess
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
I double checked the connection. ether1 is connected via cable to SAR. I also checked if cable is working properly, but when I directly connect cable to my PC’s ethernet port, I can access the internet.
No I haven’t logged in. Previously someone else came to set this up for my studio and I had this working for years. Recently, I changed where my MikroTik and PC are located within my room. After setting everything up, I think MikroTik went to default mode or something, as nothing was able to re-connect. I also don’t have any login credentials for the login to SAR.
