This is the planned network topology, I’m not really certain on how to set this one.
For now, what’s working is:
[]I can connect to the internet from Home_AP
[]Hotspot service is running and the users are able to log in
[*]BW management for home/office/guest is ok
As for these, I do not know how to set the mikrotik
[]I can’t connect to the internet from the AP/Modem, the Mikrotik refuses to gave DHCP address to any devices connected to AP/Modem
[]I’m also lost at the VLAN setting, will it work with a non-mikrotik AP?
Why would you use the ISPs modem and router for anything and you have given the ISP direct access to your traffic coming from wirelessly connected devices?
In addition you will suffer from double nat.
Can you put the gateway in bridge mode and thus give the Hex router a public IP and thus keep the ISPs access/control to their modem and no further??
The hotspot box is confusing. Is there a device associated with that block or are you using it to merely state that ether3 an ether4 are conceptually trunk ports to provide VLANs to two separate floors for both office and guest users?
Are we to assume the router is providing the vlan structure and DHCP service?
Are we to assume the APs (non microtik) are capable of tagging wifi traffic with the correct vlan?
I personally avoid using vlan1 for anything as its normally associated with default network LAN but transparent.
In this case I would simply use vlan10 for the office and vlan20 for the guests as it matches the networks structure.
If that didn’t make any sense security-wise, I’ll just deploy another AP to substitute that. Can you elaborate on the “double NAT”?
The hotspot box is confusing. Is there a device associated with that block or are you using it to merely state that ether3 an ether4 are conceptually trunk ports to provide VLANs to two separate floors for both office and guest users?
The hotspot box means a Mikrotik’s hotspot service for captive portal. So users connecting to Guest & Office will be presented by captive portal while the home users didn’t.
Are we to assume the router is providing the vlan structure and DHCP service?
Are we to assume the APs (non microtik) are capable of tagging wifi traffic with the correct vlan?
Yes, VLAN and DHCP will be handled by the router (at least that what I want to). For the tagging part, did the tag had a standard or its differs from vendor to vendor? The AP was able to set the VLAN tag but I dunno whether it’ll work or not.
In case that it didn’t work, is it possible to bridge two subnet together? (i.e. 1st floor is 192.168.10.x and 2nd floor is 192.168.20.x, can the device on 1st floor communicate with 2nd floor?)
I personally avoid using vlan1 for anything as its normally associated with default network LAN but transparent.
In this case I would simply use vlan10 for the office and vlan20 for the guests as it matches the networks structure.
I personally think its much better security wise to have total control over what comes in and out of the router to devices behind the router.
Double NAT means that the IP the modem/gateway gives you is a private IP already and thus if you want to have the ability for outside users to gain access to any of your devices, (typical are for example, being able to print something from away, access to a database, RDP traffic, game server, FTP server etc…) Becomes much more difficult because you have to go to the modem gateway and forward all incoming traffic on that port to the private IP its giving you, then you have to do the same on the router. You lose fidelity of how you can control the traffic, especially if port forwarding limitations exist on the modem gateway. The modem gateway may have other built in limitations such as throughput allowed, whether or not VPN is permitted or perhaps limited to some types… etc… Its a smorgasbord of unknowns. For the typical home user its usually fine but for business level needs, its a abhorrent.
The APs should work fine if they can vlan tag!
So my question is,… what is providing the hotspot service, another device or the mikrotik router??
Your answer also indicated something new, that perhaps along with the office and guest users, there will be separate home wifi users ON THE TWO APs downstair and upstairs?
Or we you simply referring to the home users currently connecting to the modem gateway (which will probably get their own AP??)
So my question is,… what is providing the hotspot service, another device or the mikrotik router??
Yes, they can vlan tag. But how do I check that the tags work properly? Is it possible to route the VLAN tag so that only a specific tag is routed to different hotspot service?
So, VLAN tag 10 → hotspot service A with only a confirmation and ToS page. Users just have to press the “Login” button
VLAN tag 20 → hostspot service B with usual user:password entry
The hotspot service will be handled by the RB750r2
Your answer also indicated something new, that perhaps along with the office and guest users, there will be separate home wifi users ON THE TWO APs downstair and upstairs?
Or we you simply referring to the home users currently connecting to the modem gateway (which will probably get their own AP??)
In total, there will be 4 APs.
2 APs for the home users (the first one is the Modem/AP that I proposed in my initial topology, but from your input I’ll just plug another AP on ether4 and bridge ether2+ether4 together?)
2 APs for office 2 VAPs each
