Hi people, just wanted to run an idea past you regarding a network I’m building for our farm.
The network consists of several bases and CPE’s as per the drawing.
Now what I want to achieve at the end is the following.
The first network that is available everywhere for guests with low CoS and speed and data volume restrictions going out to the internet. (in red)
The second network that is available at one of the CPE’s. (in green)
The third network that is available everywhere else. (in yellow)
A forth network for management would be an obvious requirement.
From then end users perspective it need to be a flat layer 2 network.
Each network will have it’s own address space 192.168.X.0 and needs to be isolated from the other networks.
Each address space will be have a static section probably 1-100 and DHCP section 100-200
The question I was wanting to ask, was how should I build this network. Three vlans? or build an OSPF network with VPN’s?
I consider myself capable of the layer three configuration but do I need the complexity?
Layer 2 seems a lot easier until one reads about the vlan isolation. http://forum.mikrotik.com/t/how-to-isolate-vlan/55848/1
Is that really the best solution for isolating vlans?
Looks like a star network without any redundancy so no reason for ospf. Keep it as much simple as you can, so bridges with vlans is what I would use.
Manage everything in main router and let all other devices just to carry vlans and at the ends to extract them. Nothing more.
I also had the first thought to go for simple solution with VLAN’s. @jarda: But how to solve the wireless links in combination with these VLAN’s. I have come across some possible solution with WDS, but it is not that stable after-all.
@Jarda, regarding extracting them vlans at the main router. Is that other thread the way to keep them isolated? Or is there another way it can be done.
@Rudios, are you talking about getting the vlans across the radio links?
I am running two of similar networks too. With vlans over the wlans without any problems. You just need to use mikrotik native radio modes “bridge AP” and “station bridge” on the radios to get the link into “ethernet” mode. Afther that the vlans are passed fine like over any other ethernet connection. No need for wds at all.
(as reply to the question of Rudios)
Make one address range (separate network) for physical interconnection between the devices and for management purposes. Then run all the “data” networks over it in form of vlans. On “inner” network part the vlan headers will be still kept untouched, on the edges just make for each vlan separate bridge and join the vlan with the virtual ap or whatever port it should go out untagged. None of the devices (just only the main router) needs the ip address of the vlans. Then there will not be any unwanted forwarding between the vlans on those inner devices.
On the main router use the vlans like any other interface, put the dhcp server on it and make all the firewalling you need there. All clients will get ip settings from dhcp server and one default gateway - the main router. So everything what is not from the range of its vlan will be passed to the main router and it will decide what to do. Nothing complicated.
Maybe you can take two or three devices and make a small test on your desk to get more familiar with the configuration. Do not use quickset at all, start with blank config and set everything manually from scratch to be sure what is set and how it works…