Make CAPSMAN-Setup VLAN-aware (mac-adress based)

RouterOS Wireless Networking
1

Hello,

This Topic is about my thoughts of transitioning a single VLAN Capsman-Setup to a vlan-segmented Setup based on mac-authentication of the connected clients.

Now i have a working capsman installation with 2 SSIDs (2,4 and 5 GHZ)
At the moment i have one big subnet and everything is working as expected. (2 cfgs for each ssid on capsman etc.)

Capsman mode is local forwarding for performance reasons (so i have created local bridges manually on each cap)

I want to convert my current network (one broadcast domain) into a vlan-segmented setup (vlan 10 for lan, vlan 11 for iot-devices, vlan12 for dmz for private cloud webserver etc.)
Packets between those vlans will be routed with a hardware firewall (pfsense) wich is also my internet-router.

For performance Reasons, i want to have only one ssid for 2,4 an 5 ghz. I dont want to waste Airtime and CPU-Cycles for additional virtual APs on my caps to reach my goal wich is to put each wifi-device in its vlan.

Because of that, i want to put each wifi-client wich connects to my capsman-infrastructure to be put in the vlan based on a central mac-adress database.
(since it is my personal home-network mac-based authentication is enough, because in my case its used as a management-feature instead of a security-feature)

I think about the following steps:

  • Make all necessary switch ports vlan 10,20,30 tagged and vlan 1 untagged for management
  • add the vlans on each cap to ether1 (is it possible to do this in capsman and push it to all caps?)
  • create 3 additional bridges on the caps for VLAN 10,11,12 and both wireless interfaces (same here, is that possible to do on capsman?)

Now iam stuck because i dont know, were to maintain a central mac-address database. I dont want to maintain the acl on the caps itself since this would be redundant.

If anyone of you have some ideas how to reach this goal i would be very happy to discuss with you.

2

A few answers to your questions:

  • CAPsMAN can only be used to provision wireless interface(s). So you can’t configure vlans on ether1 interfaces on CAPs using CAPsMAN, you have to do it manually on each CAP.
  • You don’t want to have multiple bridges on any MT device. Why it affects your use case? Because one interface (i.e. wlan1) can only be member of single bridge which means you have to use single bridge (in your case could be with or without VLAN support … but better make it VLAN-aware).
  • Proper place for MAC-to-VLAN table is probably RADIUS server. But that can be overkill for home environment. Another possibility is to use wireless interface access list where it is possible to create such a table. Look at this thread. It should be possible to do it via CAPsMAN, /caps-man access-list offers needed attributes (e.g. vlan-id, vlan-mode and mac-address).
3

hey there,

thank you very much, you cleared some things up :smiley:

  • i will add the 3 vlans manually to each of my caps ether1 interfaces
  • use the existing bridge on my caps and make it vlan aware (have to check how to do it)

Since i wont ever need user-authentication ever in my home network, i think you are right, its better to work with mac-acls on capsman-level, since a RADIUS-Server would introduce additional complexity that would be of no benefit for this case (KISS priciple :wink: )

I think It would be nice to put new devices with unknown mac-addresses in a fourth vlan (guest-wifi, maybe provided through my pfsense firewall)

take care

4

A really good tutorial about VLANs in ROS.

When using CAPsMAN, beware that changes in configuration on CAPsMAN device don’t propagate to CAPs automatically, you have to kick CAPs to reprovision and AFAIK you have to do it on each CAP individually.

5

thanks! i will try it on one less used cap (in case i will break something) next chance i got and will report back with my solution.

6

Hallo,

it now works, it was actually not difficult.

Just create vlans on aps and capsman and connect it with bridges.

Create entrys for devices in capsman and specify vlan Tag

To allow communication between the clients in vlans, you have to enable „multicast helper“ to full in your capsman configs.


Unfortunately, Now i have a new Problem:

i have two wireless bridges to printers without wifi. They dont work anymore. (Both mikrotik, wap ac, wap lite)

The are connected via station pseudobridge Mode.

Enabling multicast helper doesnt seem to help.

When they are on, clients on the ap they connect too dont get ip adresses from dhcp server of the vlan.

Strange thing is: as Soon as i turn the printer-bridge device off it starts to work again.

Unfortunately, it seems i can only use station pseudobridge mode, i wanted to use station mode, but it doesnt connect in this mode.


Any Suggestions?

7

… just found an old article that stated, station bridge mode is not supported with a capsman managed Network, also wds is not.

So this is still the case?

how would i connect my wired printers now with my Network?

8

The problem with the station pseudobridge mode is that they don’t work well with dhcp clients due to the Mac translation. Station pseudobridge clone mode will help if you only have one dhcp client on that device. It is best to statically assign ip addresses to client devices (the printers in your case) if you need to use station pseudobridge mode.

9

Hello,

my printers have static ips.

my Problem is:

As soon as i enable multicast-helper in capsman the printers behind the mikrotik station pseudobride (wich connects with one of my caps) and the mikrotik itself is no longer reachable at all!

also, dhcp distribution of ips to devices connected with this cap doesnt funktion anymore.

the moment i turn off the bridge between the printer and the cap everything works again (not the printer ofcourse…)

Maybe i should create a new topic for this?