I need build a guest wifi in our company. We have one main router 951G-2HnD with DNS, DHCP server and FW. Now we bought 3x AP RBcAPGi-5acD2nD (they are connected using non manageable switches)
I created a virtual WLAN with guest configuration on each AP (on physical WLAN I have a private wifi). I can connect with laptop, but I am getting default IP from LAN subnet on guest wifi.
It’s because a DHCP requests from APs are sends over LAN to main router on port 3 and there is a LAN DHCP. I tried to create a VLAN on port3, but without a success.
Is it possible to use VLAN on our three APs and a main router with ordinary network switches (no VLAN support) ?
I don’t want to have a multiple DHCPs (I mean on each APs), I want to have just one centralized DHCP server on our main router.
I succesfully created a guest wifi on our main router. I created a virtual WLAN for guests and put a DHCP server with its IP pool on wlan2 interface and it’s works like a charm. But the range of wifi is poor. So I need to connect another APs to extend the wifi range. But now I stock and I have no idea howto do it.
A private wifi is working as I expected. I have troubles with guest wifi only.
It is possible if those switches support MTU of 1508 bytes (plain ordinary ethernet is 1500 bytes).
You’ll have to configure all devices (main router as well as APs) with the VLAN of choice. I suggest you to post configuration of main router as well as of one of APs and we’ll suggest necessary changes. You can get full config using command “/export hide-sensitive” … redact public addresses and post it here inside [ code ] environment for better visibility.
Hi there I have very much the same setup in my house.
I have my main mikrotik router (previously a hex router and now the RB450Gx4).
It is connected to a managed 24 port switch from one port which connects to one capac and another managed switch in an entertainment area.
The Router is also connected on another port to a managed switch in the basement which then connects to another capAC.
Since the capAC is capable of recognizing and tagging frames, I don’t think it will be an issue to have unmanaged switches between the main router and your cap acs.
The problem is that the vlans will be sent out every port on the unmanaged switch but if physical security is not a concern then there is no risk.
As per MKXs comments, there may be limitations on the unmanaged switch but that is beyond my scope of knowledge.
As for setup my capacs have three networks
a. smartdevices on 2.4ghz chain
b. private wifi on 5ghz chain
c. guest wifi virtual on 5ghz chain
I have vlan11 for private wifi
I have vlan 10 for guest wifi
I have vlan20 for smart devices
(all my traffic is on vlans).
Setting up your network and router for all vlans using bridge vlans is the easiest method to setting up your network and highly recommend using this resource as your primary go to source!! Basically any port on the router or the capac going to your unmanaged switches would be a trunk port. http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Especially if you do not want to use a vlan for your main network and therefore you will have to pay close attention to diagram #4 which shows ether3 as a hybrid port (which would be required to send to your unmanaged switches).
Lastly, suggest you provide a diagram which helps clarify the intent of your network.
When you do have your router config and capac config advanced to the point of being useful for us to analyze please do so!
/export hide-sensitive file=yourconfigjun26
I tried to make my scenario so simple as possible, without CAPSMan, VPN, FW, etc. So I started over with a plain config.
So I have main router 951G-2HnD connected to the internet (public static ip) on ether1, ether3 is connected to my LAN (192.168.10.0/24), ether5 si connected to RBcAPGi-5acD2nD, on ether5 are two VLAN (7 is guest, 10 is staff). On AP I have connection to Router on ether1 (with VLAN7 and VLAN10 on it), also I have there wlan2(GHz) and wlan5(GHz) with wlan2g(guest) and wlan5g(guest).
I created two bridges on AP: bridge-staff with ports vlan10, wlan2 and wlan5 & bridge-guest with ports vlan7, wlan2g and wlan5g.
On router I created dhcp-staff on vlan10 with pool 192.168.12.100-150 and dhcp-guest.on vlan7 with pool 192.168.7.100-150.
Everything looks good on first sight, when someone connected to guest wifi gets subnet from guest and internet works, when someone connected to wlan2 or wlan5 gets subnet from staff dhcp.
The first weird thing is: I tried to connect from guest vlan to lan or staff subnet and it WORKS. I am able to connect everywhere from guest. It is not OK.
The second weird thing is: when I tried to torch any interfaces and search for VLAN ID, I don’t see any ID at all. Is it OK ?
So basicaly I am able to separate guest wifi on its own subnet and then I can drop packets from that subnets to everywhere except the internet GW. But I thought that VLAN works in better way. Maybe it did and I made some terrible misunderstanding or something else.
I made it with this howto https://www.youtube.com/watch?v=fc61fkQnoW4
If the published config for your router is complete, then your router is probably already hacked because you don’t have any firewall protection. I suggest you to start from default firewall filter list, it is a decent starting point.
Anyhow, MT routers perform two (very) distinct tasks: routing and firewalling. Your router right now does the routing between all of its interfaces which have IP addresses set, VLANs included. What your device is not doing right now is firewalling - essentially that’s blocking unwanted (forbidden) connections which might include all connections between e.g. VLAN 7 and VLAN 10. So you’ll have to construct some appropriate chain=forward action=drop rules.
After you grt that sorted out, you can go back to configuring VLANs on your AP … the way you have it now is overly complicated. I suggest you to study this thread, it makes a very nice tutorial.
You could convert config of router as well, but this one is not that ugly
Well, my config is missing a FW rules, cos I don’t have any FW issues to deal with. I am dealing with VLAN only.
As I wrote I am able to create some FW drop rules to manage “my VLANs”, but I thought that VLAN is working independently to FW.
So You have absolutely right that my router right now does the routing between all of its interfaces which have IP addresses set, VLANs included and that’s the core of my problem.
I don’t have a modem, I have an ehternet cable, but it doesn’t matter. On ether1 is connected internet with public static IP on it.
It is temporary connected to another internet connection for testing only, it’s not a permanent solution.
I don’t want to mess up with our main router, so I made a second independent network for testing VLAN for guests and staff. When all VLANs will be working I will put necessary configs to our main router.
Of course you have a modem, in this case a Cable modem. A router does not work independent of a modem either by landline or wisp.
But understand your test router is really just being used for testing setup planning.
