No CAPsMan forwarding on new CAPsMan?

[atomicduck]

I think this is kind of tied to what I’d like to accomplish as well. On my Capsman manager rb5009, I have different wireguard and ike2 tunnels active for different bridges/networks. How can I create a slave WIFi interface on some CAP and have all that traffic go through a certain bridge which is bridged to a certain vpn tunnel?

Hello, to acchieve this kind of functionality, you would need to VLAN you LANs. This is a two (or three if you have a poe switch or other switches) step process, where you need:

1. Set up your router to use VLANned network - this encompasses using one bridge, WAN on port (or bridge if failover) and creating trunk and untagged ports to direct communication. CAPs set in this way need trunks to them.
2. Do kind of the same on the CAP, where you will have only base VLAN for management for the device itself and then VLAN paths for each SSID / WAN slave.

To achieve a VLAN setup there is really no way to skip reading the documentation, and yes, it is confusing and frustrating. In essence, you will have to:

1. Create VLAN networks on Interfaces
2. Add all of the interfaces, sans WAN ones to as ports to Bridge and define VLAN ids
3. Define tagged / untagged ports on VLANs on Bridge (tagged/untagged)

If done correctly, this should work on router level.

Then you have a CAP. I will skip switch, as it is similar to bridge.

1. Add just the base VLAN that you will use to access the CAP in interfaces
2. Add slave WLAN interfaces that you will use for SSIDs and set them to static + settings from Mikrotik guide (it is important to follow it correctly)
3. Add those WLAN interfaces to bridge ports and set VLAN id
4. Define VLANSv in VLANs under bridge with trunks untagged ports

Honestly, this is really not a walk in the park, not because of the sheer complexity, but because you need to be very careful not to make mistakes. You really do need to read documentation, because this is on another level. If it is too hard, you can use old CapsMan if you have old devices, but your performance will suffer tremendously. From my measurements you will get about 50% of the speed as on Wave2 + very hight CPU load on router.

On AX CAPs you can set VLAN paths on CApsman directly, but the router should still be VLANned.

The samples on MikroTik site re CAPSMAN are good, but limited in nature. Still, they are enough to make it work. What I did is I printed rules and read them very carefully to fully grasp it.

This guide was very helpful to me: http://forum.mikrotik.com/t/guide-capsman-configuration-with-management-vlan-routeros-7-14-3/176344/16

And don’t fool yourself thinking this is easy to do. It is not. I design networks for a living and still often pull what is left of my hair out when I encounter a problem.