At my home, main router is Mikrotik CRS326-24G-2S+. On interface eth24 I have Ubiquiti UAP-AC-HD access point connected with cable and everything works fine. IP address of router is 192.168.100.1. On access point, I have added WiFi network named fermi and it works fine. Its network settings are shown here:
All clients are connected to this wifi (in the range 192.168.100.1-192.168.100.50, and they work fine. However, I would like to introduce guest wifi network on its own subnet (in the range 192.168.101.1-192.168.100.50) so the clients, connected to guest network, do not “see” clients on primary network (i.e. fermi). Therefore I’ve added second WiFi network to access point:
Now, the problem is an arbitrary device “sees” network fermiGuests, but it does not receive network address (IP number) from DHCP server from Mikrotik. How do I spawn two DHCP servers in Mikrotik on interface eth24?
It’s easy IF the access point is VLAN aware. However I don’t see any indication on the AP config pages of VLANs. IF the AP is VLAN capable, configure it for two different VLANs - one for each SSID. Configure a separate DHCP server for the guest WiFi SSID.
If you are using a Mikrotik, or any other non-Ubiquiti gateway, the UniFi controller network settings have absolutely no effect. You can’t remove the inbuilt base/untagged LAN network and replace it with a VLAN-only network, but there is little point in using anything other than VLAN-only networks for additional VLANs. These are used by the UniFi controller solely to associate UniFi AP SSIDs and UniFi switch port profiles with particular VLAN IDs.
The Mikrotik will need a hybrid trunk port with a matching VLAN to the one chosen for the guest network, IP gateway address & DHCP server adding to provide the guest network, and firewall rules to limit access.
UniFi APs do have features not present on many other manufacturers - you can indicate an SSID is for guest devices which will prevent access to other devices on the same subnet, i.e. you can use the same subnet for main and guest devices but the guest devices are isolated avoiding the need for a separate subnet.
Ok, guys, thank you very much for your hints - I’ve manage to get it done after two quarter sleepy nights. Wired clients now work ok, however, I still have these problems:
I’ve introduced “fermiServiceWIFI” wifi network for devices, which are part of skeleton, which my smart apartment resides on. I have also created new VLAN “fermiServiceVLAN” and
fermiServiceVLAN has ip range 192.168.100.100 - 192.168.100.170
fermiServiceWIFI has ip range 192.168.100.190-192.168.100.240
1st Problem) Now, on Mikrotik side, I’ve put “fermiServiceVLAN” ip range into IP->Address table and if I enable it, WAN stops working across apratment on all wired devices, Why?
2nd Problem) WiFi devices can connect to all three WiFi networks, but they cannor reach WAN. How do I fix that?
Post you configuration, it is the output of /export hide-sensitive in a terminal window. Redact additional information such as the serial number, public IP addresses, credentials in scripts, etc. and post in a code block (the icon in the menu above the text box when posting a reply).
192.168.100.1/24 and 192.168.100.160/24 are the same subnet, you cannot use the same subnet on different networks.
The family and guest networks should work, do clients obtain IP addresses when they connect?
Hopefully you have some other firewall between the CRS and internet as with no firewall filer rules you are providing an open DNS proxy and exposing all of the Mikrotik services to the world.
Here is situation:
192.168.100.0 network is backbone for devices, which gives functionality of smart home. And some devices are wifi based (like 2 Amazon Echo dots I have) and some device, like Fibaro Home Center 3, which is central unit for smart based home. These devices must reside on same network, so they can “see” each other. Therefore, I gave wifi devices one ip range and wired devices other ip range, but on same network (192.168.100.0).
Regarding firewall: I will set it up, as soon I correct mentioned two problems.
You can’t assign several ranges from one subnet to different layer 2 interfaces, it has to be the same network. Get rid of vlanFermiService (and the unused vlanHomeLANWiredClients), move/merge services to the base bridgeHomeLANWiredClients interface (maybe give it a better name), configure the WiFi SSID to use no VLAN ID (untagged).
The /ip dhcp-server network settings are incorrect, the gateway has to be within the subnet assigned unless you have manually configured static routes on each client.
Wired clients now work ok, however, I still have these problems: