Help Setting Up Guest WIFI

RouterOS Beginner Basics
1

Hi!
I’m new to mikrotik. I got the MikroTik RB4011iGS+5HacQ2HnD-INon the suggestion of my ISP but had no idea what I was getting into
I want to set up a guest wifi network. This is pretty much every tutorial I’ve seen on the subject on YT https://www.youtube.com/watch?v=gcwbhncwPug&list=PLYnftX296vo9vu4k_SwHhdtHFkJNf_KeD&index=3
I have done a hard reset of the router and did a soft reset with no default configuration.
But there are some odd things about my set up that don’t quite work when I try to do basic setup stuff. Here is what’s different:

  • My ISP provides microwave internet. Not sure if that makes any difference. Not satellite, not cable, its passed around via microwave repeaters
  • The cable providing the internet only seems to work when it is plugged into the number 10 port I have. I have followed the quick start guide and plugged the ISP cable into port 1 and tried to do set up but was unable to obtain an IP and the light for the port does not light up
  • Using the Quick Set option The internet only seems to obtain an IP using the CPE option and the configuration is set to: BRIDGE. Then WinBox can acquire an IP automatically

When setup using the CPE option in Bridge mode, I can set up wifi networks in AP bridge configuration
However when I try to set up a virtual network using the same method as in the tutorial above, The devices see the network but there is no internet flowing through them
Even when I don’t use a separate bridge or DHCP or anything, it still doesn’t work

I would appreciate any help that can be offered and please remember, I’m really new to this stuff. I am using WinBox.

Here is my config file

# dec/26/2021 15:35:53 by RouterOS 6.49.2
# software id = HLWE-KMIM
#
# model = RB4011iGS+5HacQ2HnD
# serial number = D4400C5050E1
/interface bridge
add name=Bridge-Guest
add name=bridge1
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityPrivate supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityGuest supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=guest \
    supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] disabled=no frequency=auto mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS 5GHZ"
set [ find default-name=wlan2 ] band=2ghz-b/g/n disabled=no mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS"
add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:76:D6:A4 \
    master-interface=wlan1 multicast-buffering=disabled name=GuestWIFI \
    security-profile=SecurityGuest ssid=WIFI-Guest wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/ip pool
add name=dhcp_pool0 ranges=10.10.10.2-10.10.10.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=Bridge-Guest name=\
    dhcp-guest
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=wlan2
add bridge=Bridge-Guest interface=GuestWIFI
/interface list member
add interface=wlan1 list=WAN
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=ether10 list=LAN
add interface=sfp-sfpplus1 list=LAN
add interface=wlan2 list=LAN
/ip address
add address=10.10.10.1/24 interface=Bridge-Guest network=10.10.10.0
/ip dhcp-client
add disabled=no interface=bridge1
/ip dhcp-server network
add address=10.10.10.0/24 gateway=10.10.10.1
/system clock
set time-zone-name=America/Los_Angeles
/system identity
set name=RouterSwitchAP
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-le\
    d,wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive

MyConfigDec26.rsc (3.29 KB)

2

To recap,
You do not have a wired internet connection?
Your internet comes in on wlan1 ?
/interface list member
add interface=wlan1 list=WAN

IF SO,
suggesting
ip dhcp client should be set to WLAN1 and not the bridge.

suggesting you have two bridges
bridge1 = normal LAN (trusted)
bridge-guest= guest LAN or guest WIFI

This means you need two sets of
IP address, ip pool, dhcp server, dhcp server networks (one for bridge1 and one for bridge-guest)

The main issue I have with your config is that it should NOT BE ATTACHED to the internet as you have NO FIREWALL RULES..…
and some other missing items such as NAT rules, ip routes etc…

3

I do have a wired connection. There is a small dish on my roof that receives signal and then there is a cable from the dish to my mikrotik router



Does my config not show that? I do have Bridge-Guest connected to guest Wifi



Correct! The youtube video I showed does show how to set up a firewall rule between the guest and private wifi but I’m not really sure what firewall rules I should set up beyond that

4

So please make it clear which port does the internet come into the router on?

5

Thank you for your help. The Internet comes into the router on port 10.

I tried putting it in Port 1 and doing the normal setup as described in the quick start guide but that never worked. When we had the installer come and set everything up he got everything up and running and marked port 10 as the port to use for the internet cable.

6

(1) Fix pools settings
/ip pool
add name=dhcp_guest ranges=10.10.10.2-10.10.10.254
add name=dhcp_main ranges=10.10.5.2-10.10.5.100

(2) Fix dhcp server settings
/ip dhcp-server
add address-pool=dhcp_main disabled=no interface=bridge1 name=
dhcp-main
add address-pool=dhcp_guest disabled=no interface=Bridge-Guest name=
dhcp-guest

(3) Fix IP address settings
/ip address
add address=10.10.10.1/24 interface=Bridge-Guest network=10.10.10.0
add address=10.10.5.1/24 interface=bridge1 network=10.10.5.0

(4) Fix dhcp server-network settings
/ip dhcp-server network
add address=10.10.10.0/24 gateway=10.10.10.1 dns-server=10.10.10.1
add address=10.10.5.0/24 gateway=10.10.5.1 dns-server=10.10.5.1

(5) REMOVE PORT 10 From any bridge as it is the WAN port.
/interface bridge port
…
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1 interface=sfp-sfpplus1
…

(6) Fix the Interface LIST MEMBERS.
/interface list member
add interface=wlan1 list=WAN {should be LAN}
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=ether10 list=LAN {should be WAN}
add interface=sfp-sfpplus1 list=LAN
add interface=wlan2 list=LAN

(6) WHERE ARE THE FIREWALL RULES ???

ADD These rules immediately…

Go to windows terminal and paste below into it and hit enter…

/ip firewall filter
add chain=input action=accept comment=“default configuration” connection-state=
established,related,untracked
add action=drop chain=forward comment=“default configuration”
connection-state=invalid
add chain=input action=accept comment=“default configuration” protocol=icmp
add action=accept chain=input comment=“default configuration” in-interface-list=LAN
add action=drop chain=input comment=“drop all else”
add action=fasttrack-connection chain=forward comment=“default configuration”
connection-state=established,related
add chain=forward comment=“default configuration” connection-state=
established,related,untracked
add action=drop chain=forward comment=“default configuration”
connection-state=invalid
add action=accept chain=forward comment=“allow port forwarding”
connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment=“drop all else”

(7) Missing NAT RULES.
please go to terminal and paste this in.. and hit enter.

/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN

(8) IP DHCP CLIENT set this to ether10 (and ensure you select USE default route and USE peer DNS for now).

Then report back what happens!! and post your new config…

7

Thank you, Anav for this incredibly helpful list of things to do. I tried my best to implement the changes you mentioned but I probably bungled something. After implementing the changes it didn’t work. I had neither wifi nor internet on the pc with my lan cable in ether2.

I will post my config with the changes. But also maybe I can just replace the sections in my config with your sections and then import that to the router? But I don’t know how to import a config to the router.

# dec/29/2021 16:09:47 by RouterOS 6.49.2
# software id = HLWE-KMIM
#
# model = RB4011iGS+5HacQ2HnD
# serial number = D4400C5050E1
/interface bridge
add name=Bridge-Guest
add name=bridge1
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityPrivate supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityGuest supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=guest \
    supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] disabled=no frequency=auto mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS 5GHZ"
set [ find default-name=wlan2 ] band=2ghz-b/g/n disabled=no mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS"
add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:76:D6:A4 \
    master-interface=wlan1 multicast-buffering=disabled name=GuestWIFI \
    security-profile=SecurityGuest ssid=WIFI-Guest wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/ip pool
add name=dhcp_guest ranges=10.10.10.2-10.10.10.254
add name=dhcp_main ranges=10.10.5.2-10.10.5.100
/ip dhcp-server
add address-pool=dhcp_guest disabled=no interface=Bridge-Guest name=\
    dhcp-guest
add address-pool=dhcp_main disabled=no interface=bridge1 name=dhcp-main
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=wlan2
add bridge=Bridge-Guest interface=GuestWIFI
/interface list member
add interface=wlan1 list=LAN
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=ether10 list=WAN
add interface=sfp-sfpplus1 list=LAN
add interface=wlan2 list=LAN
/ip address
add address=10.10.10.1/24 interface=Bridge-Guest network=10.10.10.0
add address=10.10.5.1/24 interface=bridge1 network=10.10.5.0
/ip dhcp-client
add disabled=no interface=ether10
/ip dhcp-server network
add address=10.10.5.0/24 dns-server=10.10.5.1 gateway=10.10.5.1
add address=10.10.10.0/24 dns-server=10.10.10.1 gateway=10.10.10.1
/ip firewall filter
add action=accept chain=input comment="default configuration" \
    connection-state=established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input comment="default configuration" \
    in-interface-list=LAN
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="default configuration" \
    connection-state=established,related
add chain=forward comment="default configuration" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=forward comment="allow port forwarding" \
    connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=America/Los_Angeles
/system identity
set name=RouterSwitchAP
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-le\
    d,wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive

myConfigDec29.rsc (4.62 KB)

8

Hi there, I did tell you how to insert the firewall rules and it seems you did it correctly !!!
Go to winbox and find terminal and at the prompt simply paste the text and hit enter on the keyboard!!

(1) Missing interface list member
/interface list member
…
add interface=GuestWIFI list=LAN
…

(2) Clearly we do not want to give the guestwifi full access to the router so suggesting we change this rule to 3 rules…
add action=accept chain=input comment=“default configuration” in-interface-list=LAN
TO
add action=accept chain=input in-interface-list=bridge1
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp

So basically we changed full access to the router for all users (for config purposes mostly) to now only allowing users on bridge1 full access to the router .
We add the DNS service (as all users need access to that router service)… we could just use GuestWIFI (vice LAN) for interface but its best to keep it to LAN.
The reason is that not all bridge1 users need full access, for the most part they also only need DNS services.
So we keep that to LAN for DNS and modify the first new rule.

First create a firewall address list called “authorized” and ensure we set the following IPs to static leases (via IP → DHCP Server → Leases
How? Find the IP, highlight it, and then select “Make Static” A dynamic lease will have that option available plus the capital letter “D” in the far left column.
add ip=IP of Admin desktop list=authorized
add ip=IP of admin laptop list=authorized
add ip=IP of admin smartphone list=authorized
add ip=IP of admins IPAD list=authorized

The rule then becomes.
add action=accept chain=input in-interface-list=bridge1 src-address-list=authorized
Which basically states allow full access to the list of identified IP addresses coming from bridge1.

+++++++++++++++++++++++++++++++++++++++++++++++++++++
Clean that up and the config is looking good!.
THe next major issue to look at is the results of what you see from ip dhcp client.
Highlight the entery of ether10 and double click to pull up its details and check out the tab of STATUS.
Do you see any entries for WANIP or WAN Gateway??

Dont post them but are they there?

9

Hello,

Thank you again for your help Anav. I have made the changes as you instructed but I am still not getting internet to my devices. Please see my updated config at the bottom of the page.


Yes, when I click on the ether10 entry I see that the IP Address and Gateway fields do have addresses in them.


# dec/31/2021 14:06:37 by RouterOS 6.49.2
# software id = HLWE-KMIM
#
# model = RB4011iGS+5HacQ2HnD
# serial number = D4400C5050E1
/interface bridge
add name=Bridge-Guest
add name=bridge1
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityPrivate supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityGuest supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=guest \
    supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] disabled=no frequency=auto mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS 5GHZ"
set [ find default-name=wlan2 ] band=2ghz-b/g/n disabled=no mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS"
add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:76:D6:A4 \
    master-interface=wlan1 multicast-buffering=disabled name=GuestWIFI \
    security-profile=SecurityGuest ssid=WIFI-Guest wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/ip pool
add name=dhcp_guest ranges=10.10.10.2-10.10.10.254
add name=dhcp_main ranges=10.10.5.2-10.10.5.100
/ip dhcp-server
add address-pool=dhcp_guest disabled=no interface=Bridge-Guest name=\
    dhcp-guest
add address-pool=dhcp_main disabled=no interface=bridge1 name=dhcp-main
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=wlan2
add bridge=Bridge-Guest interface=GuestWIFI
/interface list member
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=sfp-sfpplus1 list=LAN
add interface=wlan2 list=LAN
add interface=wlan1 list=LAN
add interface=ether10 list=WAN
add interface=GuestWIFI list=LAN
/ip address
add address=10.10.10.1/24 interface=Bridge-Guest network=10.10.10.0
add address=10.10.5.1/24 interface=bridge1 network=10.10.5.0
/ip dhcp-client
add disabled=no interface=ether10
/ip dhcp-server lease
add address=10.10.5.87 client-id=1:e6:ac:ca:2f:e4:81 mac-address=\
    E6:AC:CA:2F:E4:81 server=dhcp-main
add address=10.10.5.91 client-id=1:18:60:24:95:5c:3a mac-address=\
    18:60:24:95:5C:3A server=dhcp-main
add address=10.10.5.88 client-id=1:a4:5e:60:bd:96:ed mac-address=\
    A4:5E:60:BD:96:ED server=dhcp-main
/ip dhcp-server network
add address=10.10.5.0/24 dns-server=10.10.5.1 gateway=10.10.5.1
add address=10.10.10.0/24 dns-server=10.10.10.1 gateway=10.10.10.1
/ip firewall address-list
add address=10.10.5.91 list=authorized
add address=10.10.5.88 list=authorized
add address=10.10.5.87 list=authorized
/ip firewall filter
add action=accept chain=input comment="default configuration" \
    connection-state=established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input in-interface=bridge1 src-address-list=\
    authorized
add action=accept chain=input comment="Allow LAN DNS queries-UDP" \
    connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries - TCP" \
    connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="default configuration" \
    connection-state=established,related
add chain=forward comment="default configuration" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=forward comment="allow port forwarding" \
    connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=America/Los_Angeles
/system identity
set name=RouterSwitchAP
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-le\
    d,wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive

MyConfigDec31.rsc (5.41 KB)

10

As I said in my above post, no devices were getting internet using the Dec31 config. But here are the changes I made so I can get internet on my devices again. I think it mostly had to do with setting the dhcp client back to bridge1?

# dec/31/2021 15:46:33 by RouterOS 6.49.2
# software id = HLWE-KMIM
#
# model = RB4011iGS+5HacQ2HnD
# serial number = D4400C5050E1
/interface bridge
add name=Bridge-Guest
add name=bridge1
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityPrivate supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityGuest supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=guest \
    supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] disabled=no frequency=auto mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS 5GHZ"
set [ find default-name=wlan2 ] band=2ghz-b/g/n disabled=no mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS"
add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:76:D6:A4 \
    master-interface=wlan1 multicast-buffering=disabled name=GuestWIFI \
    security-profile=SecurityGuest ssid=WIFI-Guest wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/ip pool
add name=dhcp_guest ranges=10.10.10.2-10.10.10.254
add name=dhcp_main ranges=10.10.5.2-10.10.5.100
/ip dhcp-server
add address-pool=dhcp_guest disabled=no interface=Bridge-Guest name=\
    dhcp-guest
add address-pool=dhcp_main interface=bridge1 name=dhcp-main
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=wlan2
add bridge=Bridge-Guest interface=GuestWIFI
add bridge=bridge1 interface=ether10
/interface list member
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=sfp-sfpplus1 list=LAN
add interface=wlan2 list=LAN
add interface=wlan1 list=LAN
add interface=ether10 list=WAN
add interface=GuestWIFI list=LAN
/ip address
add address=10.10.10.1/24 interface=Bridge-Guest network=10.10.10.0
add address=10.10.5.1/24 disabled=yes interface=bridge1 network=10.10.5.0
/ip dhcp-client
# DHCP client can not run on slave interface!
add disabled=no interface=ether10
add disabled=no interface=bridge1
/ip dhcp-server lease
add address=10.10.5.87 client-id=1:e6:ac:ca:2f:e4:81 mac-address=\
    E6:AC:CA:2F:E4:81 server=dhcp-main
add address=10.10.5.91 client-id=1:18:60:24:95:5c:3a mac-address=\
    18:60:24:95:5C:3A server=dhcp-main
add address=10.10.5.88 client-id=1:a4:5e:60:bd:96:ed mac-address=\
    A4:5E:60:BD:96:ED server=dhcp-main
/ip dhcp-server network
add address=10.10.5.0/24 dns-server=10.10.5.1 gateway=10.10.5.1
add address=10.10.10.0/24 dns-server=10.10.10.1 gateway=10.10.10.1
/ip firewall address-list
add address=10.10.5.91 list=authorized
add address=10.10.5.88 list=authorized
add address=10.10.5.87 list=authorized
/ip firewall filter
add action=accept chain=input comment="default configuration" \
    connection-state=established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input in-interface=bridge1 src-address-list=\
    authorized
add action=accept chain=input comment="Allow LAN DNS queries-UDP" \
    connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries - TCP" \
    connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="default configuration" \
    connection-state=established,related
add chain=forward comment="default configuration" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=forward comment="allow port forwarding" \
    connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=America/Los_Angeles
/system identity
set name=RouterSwitchAP
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-le\
    d,wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive
11

Not that it should make any difference
but only vlans need to be individually identified on interface list members so you can remove
all the port to LAN and just
have the two bridges identified as LAN interface members.

Here is s problem
/ip dhcp-client

DHCP client can not run on slave interface!

add disabled=no interface=ether10
add disabled=no interface=bridge1

REmOVE the bridge1 under dhcp client it has no business being there.............

Other than that looks good.
See what happens when you make those changes.
The other thing to do is go to IP cloud and enable it and see if the IP address it returns is the same on your IP DHCP Client settings.
Also check your IP routes, to see if the IP address shows in any routes....

12

I’m a little confused about the above. Please specify what I should do with Interface and Interface-list. I get confused about the difference between these two


When I remove bridge1 under dhcp client and keep ether10, it breaks and internet does not work. Unless in bridge - port I make interface=ether10 Bridge=bridge1. Then ether10 in dhcp client becomes invalid.

if I have ether10 in dhcp client and ether10 is not on bridge1 then it does not work.

Here is a working config:

# dec/31/2021 16:37:02 by RouterOS 6.49.2
# software id = HLWE-KMIM
#
# model = RB4011iGS+5HacQ2HnD
# serial number = D4400C5050E1
/interface bridge
add name=Bridge-Guest
add name=bridge1
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityPrivate supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityGuest supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=guest \
    supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] disabled=no frequency=auto mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS 5GHZ"
set [ find default-name=wlan2 ] band=2ghz-b/g/n disabled=no mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS"
add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:76:D6:A4 \
    master-interface=wlan1 multicast-buffering=disabled name=GuestWIFI \
    security-profile=SecurityGuest ssid=WIFI-Guest wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/ip pool
add name=dhcp_guest ranges=10.10.10.2-10.10.10.254
add name=dhcp_main ranges=10.10.5.2-10.10.5.100
/ip dhcp-server
add address-pool=dhcp_guest disabled=no interface=Bridge-Guest name=\
    dhcp-guest
add address-pool=dhcp_main disabled=no interface=bridge1 name=dhcp-main
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=wlan2
add bridge=Bridge-Guest interface=GuestWIFI
add bridge=bridge1 disabled=yes interface=ether10
/interface list member
add interface=sfp-sfpplus1 list=LAN
add interface=wlan2 list=LAN
add interface=wlan1 list=LAN
add interface=ether10 list=WAN
add interface=GuestWIFI list=LAN
/ip address
add address=10.10.10.1/24 interface=Bridge-Guest network=10.10.10.0
add address=10.10.5.1/24 interface=bridge1 network=10.10.5.0
/ip dhcp-client
add disabled=no interface=ether10
/ip dhcp-server lease
add address=10.10.5.87 client-id=1:e6:ac:ca:2f:e4:81 mac-address=\
    E6:AC:CA:2F:E4:81 server=dhcp-main
add address=10.10.5.91 client-id=1:18:60:24:95:5c:3a mac-address=\
    18:60:24:95:5C:3A server=dhcp-main
add address=10.10.5.88 client-id=1:a4:5e:60:bd:96:ed mac-address=\
    A4:5E:60:BD:96:ED server=dhcp-main
/ip dhcp-server network
add address=10.10.5.0/24 dns-server=10.10.5.1 gateway=10.10.5.1
add address=10.10.10.0/24 dns-server=10.10.10.1 gateway=10.10.10.1
/ip firewall address-list
add address=10.10.5.91 list=authorized
add address=10.10.5.88 list=authorized
add address=10.10.5.87 list=authorized
/ip firewall filter
add action=accept chain=input comment="default configuration" \
    connection-state=established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input in-interface=bridge1 src-address-list=\
    authorized
add action=accept chain=input comment="Allow LAN DNS queries-UDP" \
    connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries - TCP" \
    connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="default configuration" \
    connection-state=established,related
add chain=forward comment="default configuration" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=forward comment="allow port forwarding" \
    connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=America/Los_Angeles
/system identity
set name=RouterSwitchAP
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-le\
    d,wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive

This config Doesn’t work:

# dec/31/2021 16:43:30 by RouterOS 6.49.2
# software id = HLWE-KMIM
#
# model = RB4011iGS+5HacQ2HnD
# serial number = D4400C5050E1
/interface bridge
add name=Bridge-Guest
add name=bridge1
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityPrivate supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    SecurityGuest supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=guest \
    supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] disabled=no frequency=auto mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS 5GHZ"
set [ find default-name=wlan2 ] band=2ghz-b/g/n disabled=no mode=ap-bridge \
    security-profile=SecurityPrivate ssid="FREE BELARUS"
add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:76:D6:A4 \
    master-interface=wlan1 multicast-buffering=disabled name=GuestWIFI \
    security-profile=SecurityGuest ssid=WIFI-Guest wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/ip pool
add name=dhcp_guest ranges=10.10.10.2-10.10.10.254
add name=dhcp_main ranges=10.10.5.2-10.10.5.100
/ip dhcp-server
add address-pool=dhcp_guest disabled=no interface=Bridge-Guest name=\
    dhcp-guest
add address-pool=dhcp_main disabled=no interface=bridge1 name=dhcp-main
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=wlan2
add bridge=Bridge-Guest interface=GuestWIFI
/interface list member
add interface=sfp-sfpplus1 list=LAN
add interface=wlan2 list=LAN
add interface=wlan1 list=LAN
add interface=ether10 list=WAN
add interface=GuestWIFI list=LAN
/ip address
add address=10.10.10.1/24 interface=Bridge-Guest network=10.10.10.0
add address=10.10.5.1/24 interface=bridge1 network=10.10.5.0
/ip dhcp-client
add disabled=no interface=ether10
/ip dhcp-server lease
add address=10.10.5.87 client-id=1:e6:ac:ca:2f:e4:81 mac-address=\
    E6:AC:CA:2F:E4:81 server=dhcp-main
add address=10.10.5.91 client-id=1:18:60:24:95:5c:3a mac-address=\
    18:60:24:95:5C:3A server=dhcp-main
add address=10.10.5.88 client-id=1:a4:5e:60:bd:96:ed mac-address=\
    A4:5E:60:BD:96:ED server=dhcp-main
/ip dhcp-server network
add address=10.10.5.0/24 dns-server=10.10.5.1 gateway=10.10.5.1
add address=10.10.10.0/24 dns-server=10.10.10.1 gateway=10.10.10.1
/ip firewall address-list
add address=10.10.5.91 list=authorized
add address=10.10.5.88 list=authorized
add address=10.10.5.87 list=authorized
/ip firewall filter
add action=accept chain=input comment="default configuration" \
    connection-state=established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input in-interface=bridge1 src-address-list=\
    authorized
add action=accept chain=input comment="Allow LAN DNS queries-UDP" \
    connection-state=new dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries - TCP" \
    connection-state=new dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="default configuration" \
    connection-state=established,related
add chain=forward comment="default configuration" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="default configuration" \
    connection-state=invalid
add action=accept chain=forward comment="allow port forwarding" \
    connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=America/Los_Angeles
/system identity
set name=RouterSwitchAP
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-le\
    d,wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive
13

The INTERFACE LIST ENTRIES (WAN, LAN) can be thought of as the name of the folder containing various subnets, could be one but is usually multiple ones.
We put them in folders because interface list members are handy to use in firewall rules and because they are used in other locations on the config.

Interface list members are the actual interfaces contained within any one interface list.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

What I was saying is that you need to remove all the interface list members that are the etherports for LAN.
Just need the two bridge entries so should look like.
/interface list member
add interface=ether10 list=WAN
add interface=Bridge-Guest list=LAN
add interface=bridge1 list=LAN

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

14

As I stated the bridge has nothing to do with the IP DHCP client.
If ether10 is connected to your ISP provider, the ether10 is the correct entry there and for the WAN interface list.

15

Dont understand what is going on,
but you could take one of your etheports not used
and create an access to your router, separate and OFF the bridge…
That way now or later if something gets screwed up on the bridge part of the config you have a separate way of accessing the router.

https://forum.mikrotik.com/viewtopic.php?t=181718 ( use wired connection )

16

Alright. I have a wired connection already on ether2 which is connected to my PC. Thank you for all of your help.

17

I have two wired connections on my router that I can connect my laptop to. One is on the bridge and one is OFF the bridge and thus if I screw up on the bridge config and any wired port or WLAN on the bridge that isnt working , is not a problem in that I have another way to access the router (same can be done with a virtual wlan).

18

So this may be relevant. I took apart my setup yesterday and realized something I had forgotten about. ISP brings internet to ether10, a hard wire is connected to ether2 and connected to a switch, which then distributed internet via a hard line to my pc. I was wondering why I was getting a seemingly random IP address for the dhcp client or to communicate with the router. Maybe that was why?

19

Can you draw a diagram with labels, what you said makes little sense to me… what the heck is a hard wire (ethernet)?

20

Apologies for the confusion. Here was my setup before, when we were working through the problems and you were helping me get things setup.
RouterSetup01.png
Here is my setup now
Routersetup02b.png