Hi, my first time posting and would like new setup advice on moving over to Mikrotik?
-Can my new hEXs handle my back office securely from my Hotspot?
-My Hotspot is small under 30 clients.
I’m new to Mikrotik, but think I’ve found it’s the right way to go finally.
My existing router setup:
Main router for back office Linksys WRT54GL with DD-WRT.
Second router is the same WRT54GL coming off the main router lan for guest (hotspot) network.
GOAL: replace both routers with my new hEXs
Also existing:
-EnGenius wireless bridge wired to lan on second router with Engenius AP at remote end.
-(2) EnGenius wireless AP wired to second router lan.
I’ve setup the Microtik Hotspot and have been testing with EnGenius AP. Usermanager works and I think I have the Hotspot configured correctly. I config the landing page nicely.
Cable ISP WAN on ether1 and all lans bridged to ether1.
It depends, hotspot and userman are not the most commonly used features, so there are less people who can help you with your requirements regarding these. Also questions like “my config for feature X doesn’t work, it fails in this specific way, here is exported configuration, logs and everything, what can I do?” are easier to answer. Your post sounds like you’re on right way, everything seems to work, … so it’s difficult to give you tips when nobody really knows much about what exactly you have.
I’m just explaining, hotspot and userman are not my thing. But try to be more specific and hopefully someone will be able to help you.
Sure and thanks - myconfig is attached, I think attachment is the preferred way. Please let me know.
I want to:
-create backoffice secure from the Hotspot
I have an existing wireless network.
I know I can disable security on all my AP’s and plug them into the Mikrotik router and the Hotspot will work/handle clients. Is this correct?
Need advice?:
I have some IP cameras on the AP’s, how should I config them? I think Vlans?
Where is backoffice? Connected to main router and this config is from second one, right?
In any case, you can prevent communication between different networks using firewall filter. Use statefull firewall, something like this:
/ip firewall filter
add action=accept chain=forward connection-state=established,related,untracked comment="allow existing connections and some other ok stuff"
add action=drop chain=forward connection-state=invalid comment="block invalid packets"
add action=accept chain=forward in-interface=<LAN1> comment="allow from LAN1 to any destination"
add action=accept chain=forward in-interface=<LAN2> out-interface=<WAN> comment="allow from LAN2 to WAN"
...
add action=accept chain=forward connection-nat-state=dstnat comment="allow forwarded ports"
add action=drop comment="block everything else"
Devices in LAN1 can connect everywhere (LAN2, WAN, whatever else there is). Devices in LAN2 only to WAN (but not to LAN1). You get the idea.
Not exactly something where I shine, but if by security on AP’s you mean WPA2, I think it’s good idea to leave it there and not have the network completely open.
VLAN for cameras sounds like a good plan. Or one VLAN for them and other for users, whatever your APs supports. If they send tagged packets to RB, you can make interface for each VLAN and work with them like with any other interface.
Some random hints:
Export has useful parameter “/export hide-sensitive”
When interface is in bridge (your ether5), IP address should go on bridge, not on the bridged interface.
It’s good idea to secure access to router, it’s done using firewall too, only in chain=input. Same idea as with forward, allow what you need, block the rest. You don’t want to give hotspot users opportunity to guess router’s password.
Sob - thanks for helping, any directions are useful!
This Mikrotik router I sent the config file isn’t in production yet, just testing. So no password. I have to make sure of the protection between Hotspot and backoffice first before production. Trying to get it configured.
I’m wanting to replace the 2 current routers (Linksys wrt54gl) I have with the new Mikrotik hEXs
Questions: If I don’t leave AP’s wide open (no security WPA2) then they won’t work with the Hotspot. Doesn’t the Hotspot stop anyone from getting internet service? Shouldn’t Hotspot do the authentication?
-I haven’t used Vlan’s, but know what they are so I will need help enabling the interface in the Mikrotik router - yes my AP’s do tag packets (like 1,2,3,4).
-I’ve been reading pcunite’s thread on Vlan’s and it’s great, but a lot of info to put together.
AP security - I see it as different levels. WPA2 should make sure that anyone can’t see what’s flying through the air (although I’m not sure how much it’s true for shared PSK that anyone knows). And if you don’t advertise the password to whole world, not every random person who sees the AP will be able to connect (but maybe you do want that). And then hotspot is the next level for users who were allowed to connect to wifi.
VLANs - If all devices would be connected only to one port on router, it’s enough to add VLAN interfaces on that port. If multiple ports are used, it needs a little more config, but not too much. I like examples in manual, they are short and easy to understand.
My Hotspot - Clients will purchase per-generated voucher for user id and password. So I think the AP’s left open is right?
-VLANs - I want to use (1) router interface port for the wireless bridge, which has an AP at the remote end.
AND
(1) router interface port for (1) AP
AND
(1) router interface port for (1) AP
I’m hung-up on the VLANS setup, but looking for the combination. The manual link is good, but not sticking yet. I will continue reading over…
Looking at my network diagram. Let me know if I’m on the right track?
AP-1:
-VLAN for Backoffice (say VLAN10) for the IP camera.
-Not sure what I need for the Hotspot? I think leave open for usermanager on SSID (myhotspot).
AP-2:
-Just for Hotspot. So leave open for usermanager on SSID (myhotspot).
AP-3:
-VLAN for Backoffice computer (say VLAN10).
-SSID (myhotspot) for HotSpot (open for usermanager)
So create a VLAN for just BackOffice and not the HotSpot?
There’s nothing clearly wrong with the image, and I’m sure it can be configured like that. But there’s usually more than one possible solution, and to decide which one is the best is difficult without knowing all details about existing network. And it’s not easy to explain those accurately to someone else, not leave something out, etc.
Whether you put one network in tagged VLAN, or the other, or both, doesn’t make much difference. It also depends on your other equipment, what’s possible. I’d suggest to continue reading about VLANs, do some experiments (you have two free routers for that) and once you get hang of it, it will become clear what’s best for you.
I don’t see where exactly you have two routers, it looks like one should be enough (but there’s no major difference between one and two, you’d just spread the config between them). So one independent port would be WAN, and the remaining four would go in bridge. Office can be directly on bridge untagged and hotspot in tagged VLAN (you need to configure your APs to tag hotspot traffic). So bridge will be LAN interface for office and VLAN interface will be where you add hotspot.
The only thought to consider:
hEX S have a very weak switch chip implementation - it can’t do vlan’s in hardware, only in software.
It is not a real problem for small loads, but depending of the intra-vlan/inter-vlan ratio it can be a good idea to put a more decent switch between hEX and the rest of the network, so only inter-vlan routing is done on the hEX, and all intra-vlan switching is done on a switch.
If the existing Netgear switch is a managed type and if it can be done “geographically”, you can rearrange your layout to use it, instead of the extra one.
Sob - the diagram doesn’t show my currently in use (2) Linksys routers. I want to replace them with the hEXs.
I currently have bridged all Ethernet ports on the Mikrotik to the WAN - (1) bridge.
If I setup like you suggest - will my office be protected from the Hotspot? Tagging Hotspot on (3) AP’s? Do all AP’s get tagged with the same id? Like VLAN10 or can they have different numbers on each?
Also - what about the IP cameras? Should I use IP bindings through the Hotspot? I really want them on the office network, but how?
Have no experience using it, but it should do the work.
But once again - it MAY help, if most of your traffic stays inside separate vlans.
If most of you traffic is from LAN to WAN and back, and from one vlan to another, then it won’t make real difference.
So I think, you’d better start with just a hEX S, but be prepared to add a switch
