DualWAN-DualLAN-seperated

Hello Community,

im new in mikrotik, i just did the basic curse and now i would like to build something i dont know how to, that why i aks for help from you guys/girls!

I have an RB201UiAS-RM with firmware v6.41(mipsbe). Just upgraded, so i saw that master/slave port got removed, insted of that we have to use bridging.

I would like to configure our mikrotik at our workplace like this: 2 WAN and 2 LAN. Sound easy, but: the 2 LAN-s should be seperated (basically LAN1 network can/could/should[or not, its not so important, only the seperation] see LAN2 network but LAN2 shouldnt have any access to LAN1 network[just internet], like chain-input action-drop or something like this) AND the second WAN should not just be the second LAN-s “internet provider” but the second (failover) WAN for LAN1 (in case the internet goes away on WAN1 - because ISP is not so stable).

I hope i could write this down so, that u guys/girls will understand it and can help me!
Happy new year everyone and thx in advance!

So if I understand right:

Wan1 is primary, but fails over to Wan2
=> ensure that Wan1 distance is lower than Wan2
ex: /ip route add … distance=10 & =20 …
=> define route for Wan1 with ping check so it will be disabled when unavailable
/ip route add … check-gateway=ping …

Lan1 is “internal”, with access to internet and optinally to Lan2
Lan2 is “dmz”, with access to internet only
=> filter access in forwarding rules of the firewall
/ip firewall filter add … chain=forward… in-interface=Lan2 out-interface=Lan1 action=drop

Hi Sebastia,


thank you for your help.

But i was stupid, i didnt wrote my whole problem down, bc this is not so hard to configure, but where i got stuck is this:

LAN1 will get IP address from a windows dhcp server, but LAN2 shouldn’t → LAN2 client should get IP address from mikrotik router and not windows server.
So basically for me this sound like i would have to bridge a port two times or i dont know :slight_smile:

Thank you guys/girls in advance!

I should have mentioned that all 4 ports, Wan1, Wan2, Lan1 & Lan2 should be separated from each other. So NO switching or bridging. Only routing for these.

With port isolation it doesn’t matter who’s serving ip’s on Lan1, from the point of view of Lan2. Lan2 is independent, and can be served by Mikrotik.

Thank you for your answer!

And if i wanted to spicy up things with dual wan bonding? Or i dont know what it is called, basically i would like to achive something like adding the two wans bandwith together.. :slight_smile: Thank you guys/girls in advance!

The two wans would still be separate from each other: no switching / bridging.

Loadbalancing is in routing.https://wiki.mikrotik.com/wiki/Manual:PCC