An hybrid port can only have vlan untagged (same as any other access port), plus a bunch tagged. What I’m proposing is you configure both Mikrotik (taking your initial image as starting point) with all ports in a single bridge, as if they were simple APs, and enable vlan filtering on both. As soon as you do that, you will see vlan1 (the “no vlan”) in action on the bridge vlan table, managing the traffic that comes from the gateway (you could move this to a “vlan10”, but there is no real need for that). That will be your “untagged” traffic for the hybrid port ether1, in both Mikrotiks. Once you move the port in the bridge, remember to update the DHCP client (if any) or the static address, to be on the bridge, rather than ether1
From this moment you would have exactly the same network you have right now, but “vlan aware” from Mikrotik perspective, while gateway still don’t know what a vlan is. At this point, all that is in the bridge will have the default “no vlan” = 1, so all will still be addressed by the gateway. This could be your “default” or “home” network, that is born from the gateway (managed and addressed from there), and where you only play a role of access point on Mikrotik devices.
If it is easier for you, you can start both routers from scratch without config (System > Reset Configuration > no default configuration) and just create a single bridge, put all the ports in, create a dhcp client over the bridge and enable bridge vlan filtering. You will end up having something like this in both Mikrotik devices:
/interface bridge
add name=bridge vlan-filtering=yes
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=wifi1
add bridge=bridge interface=wifi2
/ip dhcp-client
add interface=bridge
Now, let’s add couple of vlans (who say “a couple”, say a dozen) for other use cases. For example, vlan 100 for “IoT” and vlan 101 for guest users. And, as a test, let’s deliver vlan 100 to ether4 and vlan 101 as to ether5 in both devices (access ports), making possible to communicate things connected to these port on both Mikrotik routers in L2, passing this through the gateway as tagged traffic (gateway won’t see this traffic, but it will forward it anyway). For achieving this, we should tag the vlans over the bridge and over ether1, that becomes our “hybrid” port, managing vlan1 untagged (coming from the gateway) + 100, 101 as tagged. This is to be executed in Mikrotik hAP-ac3. Why we create and tag vlans over the bridge? Because this device will be the one addressing the vlans, so we want this vlans to have access to device CPU for that. Why do we tag over ether1? because is the link that joins both routers using your gateway as an intermediate switch (no vlan aware), so that becomes our “hybrid” port, passing vlan1 untagged (gateway addressing) + vlan 100/101 as tagged.
For testing purposes, we will create ether5 as access port for vlan100, so we can test from there if the new L2 network is propagated accordingly.
# To execute at hAP-ac3
/interface vlan
add interface=bridge name=vlan-iot vlan-id=100
add interface=bridge name=vlan-guest vlan-id=101
/interface bridge vlan
add bridge=bridge comment=iot tagged=bridge,ether1 vlan-ids=100
add bridge=bridge comment=guest tagged=bridge,ether1 vlan-ids=101
/interface bridge port
set [find interface=ether4] pvid=100
set [find interface=ether5] pvid=101
For the hAP-ac2, very similar, but only filtering the vlans, as they will be addressed from the hAP-ac3. In that case, we don’t need to create interface vlans, and we just need to work with bridge vlan table, declaring tagged both vlans for ether1, and updating PVID from bridge ports ether4, ether5 to create an access ports
# To execute at hAP-ac2
/interface bridge vlan
add bridge=bridge comment=iot tagged=ether1 vlan-ids=100
add bridge=bridge comment=guest tagged=ether1 vlan-ids=101
/interface bridge port
set [find interface=ether4] pvid=100
set [find interface=ether5] pvid=101
At this point, if you connect two devices to ether4 / ether5 on each Mikrotik, and addresss them manually, they should be able to see each other in L2, isolated in layer2.
Let’s say now we want this addressing to be done at hap-ac3, the device we chose as your future CAPsMAN. All you have to do is to create the addressing information for those VLANs, plus pools, network, dhcp-server, etc.
Something like this:
# To execute at hAP-ac3
# Addressing
/ip address
add interface=vlan-iot address=192.168.100.1/24
add interface=vlan-guest address=192.168.101.1/24
# DHCP pool, network, server, etc...
/ip pool
add name=pool-iot ranges=192.168.100.2-192.168.100.254
add name=pool-guest ranges=192.168.101.2-192.168.101.254
/ip dhcp-server network
add address=192.168.100.0/24 comment=iot dns-server=1.1.1.1,1.0.0.1 gateway=192.168.100.1
add address=192.168.101.0/24 comment=guest dns-server=1.1.1.1,1.0.0.1 gateway=192.168.101.1
/ip dhcp-server
add address-pool=pool-iot interface=vlan-iot name=dhcp-iot
add address-pool=pool-guest interface=vlan-guest name=dhcp-guest
# NAT outgoing bridge traffic (gateway)
/ip firewall nat
add action=masquerade chain=srcnat out-interface=bridge
At this point, if you connect something on ether4 in any of the Mikrotiks, you should get an IP from 192.168.100.X and be able to surf the internet, using your provider router as a gateway. Same way with ether5 and vlan-guest. If you connect anything to ether 2,3 in both routers, you should still get an address from the gateway.
At this point, VLANs would be isolated in L2, but visible from L3, as we don’t have any firewall rule preventing it. We will address this later at hAP-ac3, with a simple forward rule.
When you reach this point let me know, as it will be the moment to play with CAPsMAN setup, and this will depend on the wireless package version you have installed.
Kind regards!
