I’m using a hEX as my main router and FW instance (FW for futuer use).
I configured different VLANs for different devices. After configuring all the VLANs successfully I will start to limit communication between the VLANs. At the moment I try to implement an hAP ac as WLAN AP.
I tried different ays to implement the hAP usng the VLAN 40 for all wireless traffic butnit doesn’t works. I want to implement on special feature: The DHCP server for the wireless clients is located in the hEX and should servenall IPs for wireless clients. After tue first hAP I’m going do add another 2 hAPs the same way without their own DHCP server.
Do you have any ideas how this implementation can be realized?
Wireless interfaces have their own vlan option (vlan-mode=use-tag vlan-id=40). Set it, then add wlan interface as bridge port, and it will serve as untagged access port for vlan 40. Packets sent to other ports will be tagged. At least it worked like this before the new bridge implementation. It’s probably the same, but I didn’t test it yet.
I tried to configure as I understood your post.
I didn’t get an IP address for the WLAN device. Did I configure the hAP correctly?
# jan/02/1970 00:40:38 by RouterOS 6.42.3
# software id = N8B5-9W0L
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 830608EA823A
/interface bridge
add admin-mac=CC:2D:E0:1D:5D:B5 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-Ceee disabled=no distance=indoors frequency=auto mode=\
ap-bridge ssid=MikroTik-1D5DBA vlan-id=40 vlan-mode=use-tag \
wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection=allowed mode=\
dynamic-keys name=Woodroot supplicant-identity=MikroTik \
wpa2-pre-shared-key=********
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n channel-width=20/40mhz-Ce \
country=germany disabled=no distance=indoors frequency=2422 mode=\
ap-bridge name=WLAN1_2GHz security-profile=Woodroot ssid=Woodroot2 \
vlan-id=40 vlan-mode=use-tag wireless-protocol=802.11
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 pvid=40
add bridge=bridge comment=defconf interface=ether3 pvid=40
add bridge=bridge comment=defconf interface=ether4 pvid=40
add bridge=bridge comment=defconf disabled=yes interface=ether5 pvid=5
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=WLAN1_2GHz pvid=40
add bridge=bridge comment=defconf interface=wlan2 pvid=40
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether5 list=LAN
/ip address
add address=192.168.40.20/24 comment="Bridge Address MGMT-VLAN" interface=\
bridge network=192.168.40.0
add address=192.168.15.20/24 interface=ether5 network=192.168.15.0
/ip dhcp-relay
add dhcp-server=192.168.40.1 disabled=no interface=bridge local-address=\
192.168.40.20 name=DhcpRelayBridge
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add distance=1 gateway=192.168.40.1
/system routerboard settings
set silent-boot=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
The hAP is connected with its “ether1” to the hEX. On the hEX “ether5” is configured as tagged port of VLAN40 and the hAP is connected to this port.
I have been testing the hEX configuration: Set the ether5 as an untagged port of VLAN40 and connected the pc. It got an IP address and has been connected to the internet. Looks good … I think …
Why do you have a DHCP relay and why do you have DNS server (remote requests + cache) enabled on the AP?
On the AP, try adding a DHCP Client with interface set to the bridge and add ether1 as a bridge port too since there is no routing. Remember to change the list member of ether1 from WAN to LAN too.
I added the relay to get IP addresses from the hex. But I have thought about the DHCP client. Maybe I misunderstood the relay function. I think this needs to be checked by me. I will try the DHCP client later on!
I thought the hAP would also route if ether1 is WAN port. That seems to be a fault of mine. I will test this too.
Thank you very much for your help!
So far I have done what you mentioned, squeeze. And after this everything was fine. But now the hAP has no access to the internet again and I did nothing. The WLAN ports didn’t have access to the hEX and the LAN ports also. I tried to find out what is wrong but I need your help again.
This is my config of the hAP:
# jun/30/2018 17:35:48 by RouterOS 6.42.3
# software id = N8B5-9W0L
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 830608EA823A
/interface bridge
add admin-mac=CC:2D:E0:1D:5D:B5 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-Ceee distance=indoors frequency=auto mode=ap-bridge ssid=\
MikroTik-1D5DBA vlan-id=40 vlan-mode=use-tag wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection=allowed mode=\
dynamic-keys name=Woodroot supplicant-identity=MikroTik \
wpa2-pre-shared-key=***********
/interface wireless
# managed by CAPsMAN
set [ find default-name=wlan1 ] band=2ghz-g/n channel-width=20/40mhz-Ce \
country=germany distance=indoors frequency=2422 mode=ap-bridge \
security-profile=Woodroot ssid=Woodroot2 vlan-id=40 vlan-mode=use-tag \
wireless-protocol=802.11
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 pvid=40
add bridge=bridge comment=defconf interface=ether3 pvid=40
add bridge=bridge comment=defconf interface=ether4 pvid=40
add bridge=bridge comment=defconf disabled=yes interface=ether5 pvid=5
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1 pvid=40
add bridge=bridge comment=defconf interface=wlan2 pvid=40
add bridge=bridge interface=ether1 pvid=40
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=LAN
add interface=ether5 list=LAN
/interface wireless cap
#
set bridge=bridge discovery-interfaces=bridge enabled=yes interfaces=wlan1
/ip address
add address=192.168.40.20/24 comment="Bridge Address MGMT-VLAN" interface=\
bridge network=192.168.40.0
add address=192.168.15.20/24 interface=ether5 network=192.168.15.0
/ip dhcp-client
add disabled=no interface=bridge
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid disabled=yes
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new disabled=yes in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add distance=1 gateway=192.168.40.1
/system clock
set time-zone-name=Europe/Berlin
/system routerboard settings
set silent-boot=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
If there is something wrong on the hEX I provide you its config:
The DHCP relay was a old configuration. I deleted this value.
I removed the VLANs from the bridge ports, removed the mentioned VLAN from the bridge blan interface and changed the ethernet ports 3 and 5 from tagged to untagged. Everything is up and running now!
Thank you very much for taking so much time. I take a look if eveything is working correctly until tomorrow.
Thank you very much! Now I got it working and it seems to be stable. Thank you very much.
@Spartacus: I will post my config. Sorry about being late, But I read your last answer. Tomorrow I will post my config of hEX, hAP and wAP working together.