Home network setup with multiple routers/aps, multiple VLANs, multiple WiFi networks and CAPsMAN

RouterOS General
1

Could someone please help me with this configuration.
I’ve read a lot of discussions, but the options are overwhelming, and I’m getting lost.

In short, this is my use case:
I have a house with 3 floors, with 3 routers, one on each floor.
I have a RB4011(with WiFi) on the middle floor, which is the main router.
And I have 2 hAP ac2s on the other two floors, acting as access points.
Here is a link to a simplified diagram: https://drive.google.com/file/d/1HM8sGMzK5mh-qOsWJD3TIGTt_Hp2AjbQ/view?usp=sharing

My current configuration is a simple makeshift solution, just so I get everything working.
There are no VLANs, everything is currently on the same subnet.
The RB4011 acts as a router. The ISP router (in bridge mode) is connected to it on port 1.
The hAPs are connected to the RB4011 on ports 9 and 10, acting as caps.
I’ve setup capsman on the RB4011 with just 1 WiFi network.
The hAPs get provisioned. And that part works.
The RB4011 also works as a cap, and gets provisioned by capsman.
So, I have 3 caps in total.

The RB4011 has IP 192.168.88.1 and has these port connections:

  • port 1: WAN
  • port 2: RPi running Home Assistant (further called Hassio)
  • port 3: nothing (possibly connect NAS in the future)
  • port 4: nothing (possibly connect another RPi, running Rhasspy server)
  • port 5: “living room secondary”. I have a cable, but nothing is connected with it currently. It’s meant for future use if I add IP TV
  • port 6: “living room primary”. This is connected to a dumb switch, which has the TV, AVR, Android box, Gaming console etc connected to it.
  • port 7: “office secondary”. I have cable, but nothing is connected with it currently.
  • port 8: “office primary”. This is connected to a dumb switch, which as the PC, printer etc connected to it.
  • port 9: “bottom floor AP”. One of the hAPs.
  • port 10: “top floor AP”. One of the hAPs.

The “bottom floor AP” hAP has IP 192.168.88.2 and has these port connections:

  • port 1: connected to RB4011
  • port 2: Vaillant boiler controller
  • port 3: nothing
  • port 4: nothing
  • port 5: nothing

The “top floor AP” hAP has IP 192.168.88.3 and has these port connections:

  • port 1: connected to RB4011
  • port 2: nothing
  • port 3: nothing
  • port 4: nothing
  • port 5: nothing

In short, I want to segregate devices in VLANs, and I want multiple WiFi networks accordingly.

VLANs

  • Management (VLAN 1, subnet 192.168.88.0/24)
  • Routers, switches, possibly Hassio
    • I guess these need access to the whole network
  • NoT (VLAN 10, subnet 192.168.10.0/24)
  • IoT devices that have restricted access, preferably no internet access at all
    • e.g. Shelly relays, Tuya lights/light switches/curtain motors/thermostats/sensors… (if I can get them to run without Internet)
    • Currently, all of these are WiFi devices (not wired)
    • Hassio needs to read the state, and send commands to these devices
    • They don’t need to communicate with devices from other VLANs (apart from Hassio)
    • They don’t need to communicate with other devices on the same VLAN
  • IoT (VLAN 11, subnet 192.168.11.0/24)
  • Similar to NoT, but for devices that do need internet access
    • These will be both WiFi and wired devices. Currently the Vaillant boiler controller is wired (bottom floor AP, port 2), the rest are WiFi
    • Hassio needs to read the state, and send commands to these devices
    • They don’t need to communicate with devices from other VLANs (apart from Hassio)
    • They don’t need to communicate with other devices on the same VLAN
  • Multimedia (VLAN 20, subnet 192.168.20/24)
  • These are multimedia devices, that need to limited access to devices from the same and other VLANs
    • e.g. TV, AVR, Android Box, gaming console, NAS, security/doorbell cameras
    • Most of these are wired (RB4011 ports 5 and 6), and some WiFi devices
    • After I add a NAS, all of these devices need access to it
    • Hassio needs to read the state, and send commands to these devices
    • They do need to communicate with other devices on the same VLAN (e.g. cast doorbell camera to TV, access NAS from any device…)
    • Devices from the “Main VLAN” (PCs, phones…) need to be able to cast to multimedia devices, but multimedia devices should not have direct access to “Main” devices
  • Main (VLAN 30, subnet 192.168.30/24)
  • These are “consumer” devices belonging to members of the household
    • e.g. PCs, laptops, phones, printers/scanners etc.
    • Most of these are wired (RB4011 ports 7 and 8 ), and some WiFi devices
    • Hassio needs to read the state, and send commands to these devices
    • They do need to communicate with other devices on the same VLAN
    • They do need to communicate (e.g. cast, or read/write NAS) to devices on the “Multimedia VLAN”
    • Not a must have, but it would be nice, if I could cherry-pick devices that have access to HASSIO UI (e.g. only my wired PC)
  • Guest (VLAN 40, subnet 192.168.40/24)
  • Guest devices that need internet access (mostly WiFi)
    • They should not have access to anything else on the network

WiFi networks
WiFi networks follow the similar structure as VLANs. Since I have 3 APs (and will add more possibly) I would prefer to configure them with capsman.
So overall, I want these networks:

  • NoT (probably just 2.4Ghz): for the NoT VLAN
  • IoT (probably just 2.4Ghz): for the IoT VLAN
  • Multimedia (both 2.4Ghz and 5Ghz): for the Multimedia VLAN
  • Main (both 2.4Ghz and 5Ghz): for Main VLAN
  • Guest (probably just 2.4Ghz): for Guest VLAN

Questions and dilemmas:
I have done a lot of reading, but I’m getting lost, and still not sure where some things belong.
So apart from configuring everything above, if anyone has a suggestion regarding these, I would appreciate the the help.

  1. I have a dilemma where to put the Hassio device. By firewall rules, it would probably go together with the routers in the “Management VLAN”. Is that a good idea? Alternatively I could put it in the “IoT” or “Main” VLANs, but I would probably need to add some firewall rules, since it needs more access that any of those VLANs provide. Or maybe to put it in it’s own VLAN?
  2. I plan to run the Rhasspy server on the same device as Hassio, which is not ideal from the firewall perspective. The RPI will run the Rhasspy server, while I will build my own smart speakers with RPI Zeros as Rhasspy satellites. I presume they will require to run in the same VLAN as the server. This is not ideal firewall-wise, since I don’t want all smart speakers running on the “Management VLAN”. Does anyone have an suggestion how to configure this, other than using another RPi just to run the Rhasspy server, separate from Hassio, on the NoT VLAN. I presume that Rhasspy only needs to communicate with Hassio, not other devices directly (e.g. a TV)
  3. I was planning on putting all security/doorbell cameras in the “Multimedia VLAN”. However, I don’t like the idea of my cameras having internet access. I plan to get all cameras with local control. I do want Hassio to be able to stream from them to a phone or a TV remotely, but I don’t want cameras having direct internet access. Would it make more sense to split this VLAN into 2 VLANS: one with, and one without internet access? Or just to cut off internet access to those cameras exclusively, via the firewall?
  4. If I do split it into 2 VLANs, where would the NAS go? Is it normal for a NAS to have no internet access? On the other hand, if I put it on the “internet VLAN”, then the cameras would need store their feeds to a different VLAN.
  5. I’m not sure where to put printers and scanners. Intuitively I wanted to put them in the “Main VLAN”, although it doesn’t really feel like they belong here communication wise (they could be Multimedia). But for convenience I think it makes more sense to keep them here. I will be printing/scanning exclusively from Consumer devices (possibly Hassio). I definitely don’t need to print something from a device on some other VLAN (e.g. a TV).
  6. As for the CAPsMAN and VLAN setup, I have been reading the docs here https://wiki.mikrotik.com/wiki/Manual:CAPsMAN_with_VLANs, but I’m still not sure if I should use local or capsman forwarding in my configuration.

I know It’s a lot of questions, and I’m asking for a lot…
I’m a newbie at networking. I know roughly what I want to achieve, but RouterOS has been overwhelming so far.
Any help will be appreciated.

2

What you are asking is possible but not simple…
If you were to say to me “Can you build this ?” then I would say yes…
If you say “Can you teach a self-confessed network newbie how to do this?” - Then I would say this will take a lot of time and effort on both our parts especially if trying to do it via text rather than hands on. Probably more than is reasonable to expect in a forum (although others may disagree / volunteer)
This is the sort of config in a business environment that I would be engaged by the IT dept as a consultant to set up as they know when it is more cost effective to ask an ‘expert’.

A few answers:
You could put the HAssio in a ‘server’ VLAN (along with NAS devices etc) and control access with firewall rules.
You should be able to set up VLAN tagging on the PI (You can in Linux…) so maybe you can run the 2 servers on different NICs/VLANs (don’t know the software capabilities)
Anything that relies on ‘finding’ peer devices will need them all in the same VLAN (Eg Rhassspy)
If your doorbell cameras alert to your phone then they (usually) require internet access to do this.
The cameras should be able to specify an IP address for the storage so it doesn’t matter if the NAS is on a different VLAN
Printers go on the main VLAN - otherwise you will have to manually add them to every device as they won’t be discoverable by windows.

3

I have to agree with @djmuk, your post (and your other related threads Home network setup advice, VLANs and unmanaged switches) is more like a Request for Proposal than something that can be easily answered on a forum.

My suggestion is to use your “top floor” hAP ac2 as a lab router and do some playing with it (letting the RB4011 be its “ISP” that will provide the hAP ac2 with ip address via DHCP). It is unfortunate you didn’t get a vlan-aware switch, as you could then more easily play with vlans as well.

I am not aware of a book length free resource that covers a setup similar to what you propose using MikroTik. There is Mike Pott’s free Ubiquiti Home Network.pdf that covers something similar using a Ubiquiti ER-X, and the principles are the same no matter what the vendor involved will be, but the execution (how things are configured) is very different. It’s a bit like the difference between a program written in C vs one in Pascal, they may do the exact same thing, but seeing the implementation in Pascal may not be very helpful in helping you learn C syntax, although the “algorithms” and program flow may be very similar, and therefore may give you ideas for how to implement in C.

4

Here’ another similar thread, with some links he used, but no real resolution that I saw.

AT&T FTTH, VLANs, CapsMAN Full Config

5

It would take me very little time if you removed the capsman requirement which really you dont need.
The three configs, what each wired port on each device was connected to if anything.
Which devices would pump out which ssids/vlans

Done, easy peasy.

6

With some further Googling and ChatGpt I’ve managed to setup something that, at least partially works.
I haven’t setup any firewall rules manually yet.
But I’ve managed to define all the VLANs, connected them to ether ports and wifis, have the subdomain dhcps working etc…
The WiFi networks I’ve managed to setup fully through capsman.
Currently, I have all of them running fine on all 3 aps. All have internet currently.

I’ve attached my config in the message. If someone has the time, could someone check if it makes any sense.
Btw. I’ve taken @djmuk suggestion, and added another “server” vlan for hassio, and possibly other system wide servers. (ID 2)

In short:

  1. I’ve left the existing bridge created by the quick set, it was no vlans setup. I’ve left it assigned to ports 9 and 10, where I have my haps wired
  2. For each vlan, I created a separate bridge. Assigned ethernet ports that I want. e.g. port 2 is assigned to bridge-server, ports 5 and 6 are assigned to bridge-media…
  3. I’ve added gateway ips and ip pools for all subnets (2, 10, 11, 20, 30, 40)
  4. I’ve created dhcp servers for each vlan/gateway id, and assigned it to the appropriate vlan bridge
  5. Then in capsman I’ve created data sources and each wifi network, setup VLAN ID, and assigned it to the appropriate vlan bridge. I’ve also created security configs for each network, channel configs for 2.4/5 etc.
  6. In capsman I have only 2 provisioning configs, one for 2.4, other for 5. For each I deploy the “Main” config as master, and all the other configs as slaves

And as I’ve said, I can see all the wifi networks, can connect to them by phone, verify that I’m on the correct subnet.
In DHCP Server → Leases, I can see all the wired devices are getting expected ips.
All of the have internet currently. I haven’t checked if cross-vlan communication works, but I assume it doesn’t.

In case this makes sense, and I haven’t monkey-patched some monster, the next step would be adding firewall rules, I guess.
conf.rsc (9.24 KB)

7

Is that the main router or all three configs…

8

Yes, that is the main router config.

For the haps, I pretty much just configured them in caps mode (from quick set).
Not sure I did any custom config, apart from that.
I still need to configure ethernet ports for them.

9

Also, here is my attempt of the firewall config, for the main router.

Some rules were generated by quick set. I left all of them.

My custom rules start from “server-vlan: Allow to communicate with all devices”
firewall.rsc (3.94 KB)

10

With my setup posted above (more or less) everything is working fine with my wifis and vlans.

And everything is working fine with the VLANs that are assigned to ethernet ports of the main router.

But I can not get any ports on the secondary routers working with VLANs.
I’ve tried assigning it to that bridge, vlan id, etc, but it never gets an ip assigned.
The only way I can get it to get an ip, is to leave it on the default bridge, without vlans. But that it not what I’m after. I want different ports on the secondary routers to be assigned to different vlans.

I know I’m asking for a lot, but could someone steer me in the right direction.
I assume my main problem is creating separate bridges for different vlans, and I should only have one.
RouterOS kind of steered me to do it like this, since it dynamically generates pretty much everything this way (vlan, interface…), and everything works nicely (and seems to make sense) in capsmap.

11

When you get rid of capsman I will gladly help. Its called Tied Aid.

12

I’m really not following why is capsman such a problem in all of this.
I really don’t want to get rid of it unless I absolutely must.

  1. It’s a great feature. I have 3 APs, will possibly add more, and 5-6 WiFi networks. I really don’t want to configure each ap from scratch. Every time I change anything (even something as simple as the password), I would need to update it on each device.

  2. Unlike the ethernet, I actually got capsman to work. I don’t want to rip apart the only thing that works, and be left with nothing.

Can you help steer me in the right direction if you ignore capsman and wifi entirely? Forget that it even exists.
How to configure ethernet so VLANs work on the secondary routers?
Is it the problem (as I suspect) that I should have a single bridge, and not one per vlan? Can a multi bridge solution work at all?
Or am I missing something else completely?

13

Yes, single bridges, all subnets as vlans is usually optimal.

14

Is there anyone willing to help me with this for a fee? To do a screen sharing session and finish the config.

I don’t think I’m that far of, but this is too overwhelming for me, and I keep spinning in circles.
Currently, I’m at the stage where I think it might actually work, but I’m too afraid to turn on VLAN filtering on the main bridge, so I don’t screw up everything ang get locked out, since I don’t have a deep enough understanding of the changes that I’ve made.

Preferably with CAPsMAN support… but I can live without it.
Once all the ethernet stuff is working, I think I could manage to get CAPsMAN working on my own.
Firewall, and all the inter-vlan/internet blocking is also a nice to have, but not a must.

15

I’ve managed to come up with something that works myself.
My config files are in the attachment.

There are still a few problems with the management vlan, although not critical:

  1. from a PC connected to ether6 on the rb4011, I can only winbox to the rb4011, not the haps. If I need to connect to the hap, I need to switch the PID of ether6 from 30 to 88 temporarily
  2. from a RPI (running home assistant) connected to ether2 on the rb4011, the Mikrotik Home Assistant integration can’t ping the haps. It can ping the rb4011, but not the haps. I haven’t found a workaround yet

Note:
The most suspicions thing I’ve found so far is the dhcp server that handles the routers. I need to set it to “bridge” in order for the haps to get ip addresses (even though I can’t winbox to them). If I set it to “vlan-mgmt” (similar as for other vlans), which seemed more logical, the haps never get ip address assigned

Does anyone have an idea how to solve these remaining issues?
rb4011.backup.rsc (17.3 KB)
hap.backup.rsc (2.15 KB)