Hi everyone,
I have a 1Gbps FTTH connection at home and a HAP AC3 + a “stupid” AP connected to one ethernet interface (mikrotik’s wifi is slow, not reaching 100 mbps). All the clients are connecting to the AP, the mikrotik’s wifi is not in use. I have one pc that connects to a wireguard vpn server and access the internet through this vpn connection.
To make the FTTH work, my ISP requires the Vlan id 835.
The fiber arrives to a converter that is connected to an ethernet interface on the mikrotik.
I want to modify the configuration to accomplish the following:
- have the mikrotik connect to the wireguard vpn server
- every client that connects to the mikrotik wifi should be routed through the vpn connection
- the clients using the vpn must use a different dns server than the other ones
I have managed to connect to the vpn server, but i am not sure how to do everything else.
With my limited understanding, I think the mikrotik’s wifi should be on a different vlan with its own dhcp and dns, but I cannot figure this out.
I have basic networking knowledge, but not enough to do the configuration by myself.
I saw the Router-Switch-AP example configuration here on the forum http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 but I cannot understand how to apply that to my situation.
Could anyone help me, please?
I’ve managed to connect to the vpn server with this piece of config
# Create WireGuard Interface
/interface wireguard add name=wg0 private-key="<MY_PRIVATE_KEY>" listen-port=51820
# configure wireguard interface
/ip address add address=10.49.0.6/32 interface=wg0
# Add Peer Information
/interface wireguard peers
add allowed-address=0.0.0.0/0,::/0 endpoint-address=*.*.*.* endpoint-port=51820 public-key="<MY_PUBLIC_KEY>" preshared-key="<MY_PRESHARED_KEY>" interface=wg0 persistent-keepalive=30m
# Create a new bridge
/interface bridge add name=vpn_bridge
# Add WireGuard interface and wlan2 to the bridge
/interface bridge port add bridge=vpn_bridge interface=wg0
/interface bridge port add bridge=vpn_bridge interface=wlan2
# Set up NAT for VPN bridge
/ip firewall nat add chain=srcnat out-interface=wg0 action=masquerade
I have tried the vlan way for the wifi, but the clients cannot connect to it (without this config, the clients can connect to mikrotik’s wifi just fine)
/interface vlan
add interface=bridge name=wifi-vlan1 vlan-id=101
add interface=bridge name=wifi-vlan2 vlan-id=102
/ip address
add address=192.168.3.1/24 interface=wifi-vlan1 network=192.168.3.0
add address=192.168.4.1/24 interface=wifi-vlan2 network=192.168.4.0
/ip pool
add name=wifi-dhcp-pool1 ranges=192.168.3.50-192.168.3.200
add name=wifi-dhcp-pool2 ranges=192.168.4.50-192.168.4.200
/ip dhcp-server
add address-pool=wifi-dhcp-pool1 interface=wifi-vlan1 name=wifi-dhcp1
add address-pool=wifi-dhcp-pool2 interface=wifi-vlan2 name=wifi-dhcp2
/ip dhcp-server network
add address=192.168.3.0/24 gateway=192.168.3.1
add address=192.168.4.0/24 gateway=192.168.4.1
/interface bridge port
add bridge=bridge interface=wifi-vlan1
add bridge=bridge interface=wifi-vlan2
/interface wireless
set [ find default-name=wlan1 ] vlan-mode=use-tag vlan-id=101
set [ find default-name=wlan2 ] vlan-mode=use-tag vlan-id=102
My currently working config is
# oct/31/2023 23:41:28 by RouterOS 7.2.3
#
# model = RBD53iG-5HacD2HnD
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge
/interface vlan
add interface=ether1 name=vlan835 vlan-id=835
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk,wpa-eap,wpa2-eap mode=dynamic-keys name=profile1 supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=wifi-profile5 supplicant-identity=""
add authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm mode=dynamic-keys name=wifi-profile2 supplicant-identity="" unicast-ciphers=tkip,aes-ccm
/interface wireless
set [ find default-name=wlan1 ] country=italy ssid=MikroTik2 security-profile=wifi-profile2 mode=ap-bridge wireless-protocol=802.11 distance=indoors frequency=auto installation=indoor disabled=no
set [ find default-name=wlan2 ] country=italy ssid=MikroTik5 security-profile=wifi-profile5 mode=ap-bridge wireless-protocol=802.11 distance=indoors frequency=auto installation=indoor band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX
/ip pool
add name=dhcp ranges=192.168.2.50-192.168.2.200
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add comment=customconf interface=vlan835 list=WAN
/ip address
add address=192.168.2.1/24 comment=defconf interface=bridge network=192.168.2.0
/ip dhcp-client
add comment=confv2 interface=vlan835
/ip dhcp-server network
add address=192.168.2.0/24 comment=defconf dns-server=1.1.1.1 gateway=192.168.2.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.2.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="confv2: accept from LAN" in-interface-list=LAN
add action=drop chain=input comment="confv2: drop everything not permitted"
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="confv2: allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="confv2: allow dst-nat from both WAN and LAN (including port forwarding)" connection-nat-state=dstnat
add action=reject chain=forward comment="confv2: useful for tracking LAN issues" in-interface-list=LAN reject-with=icmp-admin-prohibited
add action=drop chain=forward comment="confv2: drop everything else"
/ip firewall mangle
add action=set-priority chain=forward new-priority=0 out-interface=vlan835 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="configv2: masquerade" out-interface=vlan835
/ip firewall service-port
set ftp disabled=yes
set irc disabled=yes
set sip disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Rome
/tool mac-server
set allowed-interface-list=LAN
The four vlans solution is really a great upgrade.