Metal 52 Virtual AP

JPMARTINS · April 7, 2020, 3:41pm

Hello
I am trying to create 2 access points in my metal 52. After reading several posts and tutorials I arrived at this configuration, but without any results. Is there anyone here who can help me?
What am I doing wrong or what do I need to do more?

# apr/07/2020 17:23:59 by RouterOS 6.46.4
# software id = KT9S-5YPH
#
# model = RBMetalG-52SHPacn
# serial number = B7D90B0F83A4
/interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-eC \
    country=no_country_set disabled=no frequency=auto frequency-mode=\
    superchannel installation=outdoor mode=ap-bridge ssid=AG_NETWORK
/interface vlan
add interface=BR1 name=AG_VLAN vlan-id=2
add interface=BR1 name=BASE_VLAN vlan-id=99
add interface=BR1 name=LM_VLAN vlan-id=101
add interface=BR1 name=SSL_VLAN vlan-id=10
/interface list
add name=WAN
add name=LAN
add name=BASE
add name=VLAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    management-protection=allowed mode=dynamic-keys name=ssl \
    supplicant-identity=""
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    management-protection=allowed mode=dynamic-keys name=lm44 \
    supplicant-identity=""
/interface wireless
add disabled=no keepalive-frames=disabled mac-address=C6:AD:34:26:59:1F \
    master-interface=wlan1 multicast-buffering=disabled name=wlan2 \
    security-profile=ssl ssid=SSL_NETWORK wds-cost-range=0 wds-default-cost=0 \
    wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=C6:AD:34:26:59:20 \
    master-interface=wlan1 multicast-buffering=disabled name=wlan3 \
    security-profile=lm44 ssid=LM44_NETWORK wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=AG_POOL ranges=192.168.1.2-192.168.1.254
add name=SSL_POOL ranges=192.168.2.2-192.168.2.254
add name=LM_POOL ranges=10.101.1.41-10.101.1.50
add name=BASE_POOL ranges=192.168.0.10-192.168.0.254
/ip dhcp-server
add address-pool=AG_POOL disabled=no interface=AG_VLAN name=AG_DHCP
add address-pool=SSL_POOL disabled=no interface=SSL_VLAN name=SSL_DHCP
add address-pool=LM_POOL disabled=no interface=LM_VLAN name=LM_DHCP
add address-pool=BASE_POOL disabled=no interface=BASE_VLAN name=BASE_DHCP
/interface bridge port
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan1 pvid=2
add bridge=BR1 ingress-filtering=yes interface=wlan2 pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan3 pvid=101
add bridge=BR1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=BR1 untagged=wlan1 vlan-ids=2
add bridge=BR1 untagged=wlan2 vlan-ids=10
add bridge=BR1 untagged=wlan3 vlan-ids=101
add bridge=BR1 tagged=BR1,ether1 vlan-ids=99
/interface list member
add interface=ether1 list=WAN
add interface=BASE_VLAN list=BASE
add interface=BASE_VLAN list=VLAN
add interface=AG_VLAN list=VLAN
add interface=SSL_VLAN list=VLAN
add interface=LM_VLAN list=VLAN
/ip address
add address=192.168.0.3/24 interface=BASE_VLAN network=192.168.0.0
add address=192.168.1.1/24 interface=AG_VLAN network=192.168.1.0
add address=192.168.2.1/24 interface=SSL_VLAN network=192.168.2.0
add address=10.101.1.40/24 interface=LM_VLAN network=10.101.1.0
/ip dhcp-server network
add address=10.101.1.0/24 dns-server=192.168.0.1 gateway=10.101.1.40
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
add address=192.168.1.0/24 dns-server=192.168.0.1 gateway=192.168.1.1
add address=192.168.2.0/24 dns-server=192.168.0.1 gateway=192.168.2.1
/ip firewall filter
add action=accept chain=input comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=input comment="Allow Base_Vlan Full Access" \
    in-interface=BASE_VLAN
add action=drop chain=input comment=Drop
add action=accept chain=forward comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=forward comment="VLAN Internet Access only" \
    connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment=Drop
/ip route
add distance=1 gateway=192.168.0.1
/system clock
set time-zone-name=Europe/Lisbon
/system identity
set name=SSL_FOH_AP
/tool mac-server
set allowed-interface-list=BASE
/tool mac-server mac-winbox
set allowed-interface-list=BASE

Zacharias · April 7, 2020, 5:44pm

Metal 52 has a selectable band either 2.4 OR 5.0 GHz band…
Now, in case you want to create a virtual AP, just click the plus sign on your wireless tab, click virtual, at the second tab set mode as AP bridge, set SSID and the security profile. All the rest will be taken from the Master Interface… as simple as that…

JPMARTINS · April 7, 2020, 7:41pm

Yes, i know how to setup basic configurations.
What about vlans? How do i setup vlans ?

Zacharias · April 7, 2020, 7:53pm

But nothing in your config shows any virtual AP !!!
Unless i missed it…
What about VLANs? Your question is so general…
A nice article here http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

JPMARTINS · April 7, 2020, 8:03pm

But nothing in your config shows any virtual AP !!!
Unless i missed it…

They are there:
wlan1=Master interface ssid=AG_NETWORK
wlan2=Virtual AP ssid=SSL_NETWORK
wlan3=Virtual AP ssid=LM44_NETWORK

A nice article here viewtopic.php?f=13&t=143620

This configuration was created based on that article

JPMARTINS · April 7, 2020, 8:13pm

What about VLANs? Your question is so general…

I have 3 sets of gear i wich to remote control with a single Metal52

Amplifiers: VLAN2; Subnet 192.168.1.0; wlan1
Mixing console: VLAN10; Subnet 192.168.2.0; wlan2
System Processor; VLAN101; Subnet 10.101.1.0; wlan3

All the gear is connected to a switch, with the VLANS configured. There is also a trhruk port conneting the switch to Metal52

mkx · April 7, 2020, 8:20pm

In the section /interface bridge vlan you have to add bridge interface (BR1) as tagged member to all VLANs where router has IP address set (via vlan interfaces created in /interface vlan). In the posted config it’s done only for VLAN 99, but should be done for all the rest as well (or else wlan-connected devices can not talk even to DHCP servers configured on respective vlan interfaces). And similarly for ether1 … you’re saying it’s a trunk port so it shoukd be tagged member of all VLANs it’s supposed to pass.

Zacharias · April 7, 2020, 8:27pm

@JPMARTINS i missed it
As for the VLANs i would strongly suggest you read the article i posted earlier… It is not about doing something but we must know why we do it…!

JPMARTINS · April 7, 2020, 8:32pm

Tue Apr 07, 2020 9:20 pm

In the section /interface bridge vlan you have to add bridge interface (BR1) as tagged member to all VLANs where router has IP address set (via vlan interfaces created in /interface vlan). In the posted config it’s done only for VLAN 99, but should be done for all the rest as well (or else wlan-connected devices can not talk even to DHCP servers configured on respective vlan interfaces).
BR,
Metod

I notice that and i have it corrected

# apr/07/2020 17:59:40 by RouterOS 6.46.4
# software id = KT9S-5YPH
#
# model = RBMetalG-52SHPacn
# serial number = B7D90B0F83A4
/interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] ampdu-priorities=0,1,2,3,4,5,6,7 band=\
    2ghz-b/g/n channel-width=20/40mhz-eC country=no_country_set disabled=no \
    frequency=auto frequency-mode=superchannel installation=outdoor mode=\
    ap-bridge ssid=AG_NETWORK
/interface vlan
add interface=BR1 name=AG_VLAN vlan-id=2
add interface=BR1 name=BASE_VLAN vlan-id=99
add interface=BR1 name=LM_VLAN vlan-id=101
add interface=BR1 name=SSL_VLAN vlan-id=10
/interface list
add name=WAN
add name=LAN
add name=BASE
add name=VLAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    management-protection=allowed mode=dynamic-keys name=ssl \
    supplicant-identity=""
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    management-protection=allowed mode=dynamic-keys name=lm44 \
    supplicant-identity=""
/interface wireless
add disabled=no keepalive-frames=disabled mac-address=C6:AD:34:26:59:1F \
    master-interface=wlan1 multicast-buffering=disabled name=wlan2 \
    security-profile=ssl ssid=SSL_NETWORK vlan-id=10 wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=C6:AD:34:26:59:20 \
    master-interface=wlan1 multicast-buffering=disabled name=wlan3 \
    security-profile=lm44 ssid=LM44_NETWORK vlan-id=101 wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=AG_POOL ranges=192.168.1.2-192.168.1.254
add name=SSL_POOL ranges=192.168.2.2-192.168.2.254
add name=LM_POOL ranges=10.101.1.41-10.101.1.50
add name=BASE_POOL ranges=192.168.0.10-192.168.0.254
/ip dhcp-server
add address-pool=AG_POOL disabled=no interface=AG_VLAN name=AG_DHCP
add add-arp=yes address-pool=SSL_POOL disabled=no interface=SSL_VLAN name=\
    SSL_DHCP
add address-pool=LM_POOL disabled=no interface=LM_VLAN name=LM_DHCP
add address-pool=BASE_POOL disabled=no interface=BASE_VLAN name=BASE_DHCP
/interface bridge filter
add action=drop chain=input dst-port=68 in-interface=ether1 ip-protocol=udp \
    mac-protocol=ip
/interface bridge port
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan1 pvid=2
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan2 pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan3 pvid=101
add bridge=BR1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=BR1 tagged=BR1 untagged=wlan1 vlan-ids=2
add bridge=BR1 tagged=BR1 untagged=wlan2 vlan-ids=10
add bridge=BR1 tagged=BR1 untagged=wlan3 vlan-ids=101
add bridge=BR1 tagged=BR1,ether1 vlan-ids=99
/interface list member
add interface=ether1 list=WAN
add interface=BASE_VLAN list=BASE
add interface=BASE_VLAN list=VLAN
add interface=AG_VLAN list=VLAN
add interface=SSL_VLAN list=VLAN
add interface=LM_VLAN list=VLAN
add interface=wlan1 list=LAN
/ip address
add address=192.168.0.3/24 interface=BASE_VLAN network=192.168.0.0
add address=192.168.1.1/24 interface=AG_VLAN network=192.168.1.0
add address=192.168.2.1/24 interface=SSL_VLAN network=192.168.2.0
add address=10.101.1.40/24 interface=LM_VLAN network=10.101.1.0
/ip dhcp-client
add disabled=no interface=BR1
/ip dhcp-server network
add address=10.101.1.0/24 dns-none=yes gateway=10.101.1.40
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
add address=192.168.1.0/24 dns-none=yes gateway=192.168.1.1
add address=192.168.2.0/24 dns-none=yes gateway=192.168.2.1
/ip firewall filter
add action=accept chain=input comment="Allow Estab & Related" \
    connection-state=established,related disabled=yes
add action=accept chain=input comment="Allow Base_Vlan Full Access" disabled=\
    yes in-interface=BASE_VLAN
add action=drop chain=input comment=Drop disabled=yes
add action=accept chain=forward comment="Allow Estab & Related" \
    connection-state=established,related disabled=yes
add action=accept chain=forward comment="VLAN Internet Access only" \
    connection-state=new disabled=yes in-interface-list=VLAN \
    out-interface-list=WAN
add action=drop chain=forward comment=Drop disabled=yes
/ip route
add disabled=yes distance=1 gateway=192.168.0.1
/system clock
set time-zone-name=Europe/Lisbon
/system identity
set name=SSL_FOH_AP
/system leds
set 1 leds=led1 type=interface-activity
add interface=wlan2 leds=led3 type=interface-activity
add interface=wlan3 leds=led5 type=interface-activity
/tool mac-server
set allowed-interface-list=BASE
/tool mac-server mac-winbox
set allowed-interface-list=BASE

JPMARTINS · April 7, 2020, 8:41pm

I read the article and it was based on it that I created this configuration.
However, something is missing.
So I asked for help

Zacharias · April 7, 2020, 9:12pm

wow you are fast… it took me days to read it and i still consult it from time to time…

JPMARTINS · April 7, 2020, 9:17pm

This is something i´m working on a few days, based on that article

mkx · April 8, 2020, 5:47pm

@JPMARTINS: I’ve re-read the whole thread … and I realized you never write what exactly seems to be the problem.

Zacharias · April 8, 2020, 6:50pm

That’s true @mkx…

JPMARTINS · April 10, 2020, 10:23am

Hi
The problem is that I can’t reach the gear connected in the switch.
Connecting my iPad to wlan2, I get up address from DHCP server in Vlan10, but the App can’t “see” the mixing console connect to the switch.
I seems that the wlans are working fine, since I get IP address from DHCP servers, but there’s something wrong in the bridge config because I can’t reach the gear connected to the switch.
The switch has the same VLANs. Trunk is on VLAN ID1.
VLAN ID2, 10 and 101 for audio gear
VLAN ID99 for management.
The only VLAN that is working is VLAN 99

mkx · April 10, 2020, 3:00pm

Can you ping devices on different VLANs from the router itself?

Simply running /ping from terminal window will tell.

JPMARTINS · April 10, 2020, 5:29pm

No. I can’t ping any devices.
All audio devices usually have static IP address and I’m no sure are getting up address from VLANs DHCP Server. Next Tuesday I will change them to DHCP.

JPMARTINS · April 17, 2020, 10:50am

Hello
I found that the VLANS were not configured correctly on the ETHER1 side.
Everything is working as I intend