Noob needs help...

RouterOS Beginner Basics
1

Please excuse me for the long post.

I’ve had this Mikrotik Hap AC2 for a while now running as a wireless router. It has been running like a champ for a couple of years to the point where I didn’t have to touch it. Recently, I upgraded the router to a proxmox+pfsense combo and the mikrotik was retired.. until recently.

As a result of the change to proxmox/pfsense, the wifi range provided by my ubiquiti U6-LR, located at the rear of the house, could not provide coverage to the front of the house that was previously covered by Mikrotik. So I decided to repurpose the Mikrotik as a wireless AP.

I attempted the following setup:

  1. Ether1 as trunk port to pfsense appliance
  2. Ether2 as VLAN1
  3. Ether3 as VLAN10
  4. Ether4 as VLAN11
  5. Ether4 as VLAN12
  6. SSID Delta on 2.4Ghz serving VLAN12
  7. SSID Zulu_5G on 5Ghz serving VLAN1
  8. Virtual SSID Delta_5G on 5Ghz serving VLAN12

The reason for the weird wireless setup is that I have an IOT device that can only operate on the 2.4Ghz - hence Delta. I have other IOT devices that I put on Delta_5G because when they were on the 2.4Ghz, everytime the microwave was turned on, they would drop connection.

I had everything setup and working but I have noticed that my android phone and windows laptop would sometimes not connect to Zulu_5G. It would try to obtain an IP address but ultimately fail. Both the U6-LR and Mikrotik have Zulu_5G as an SSID on the same VLAN. So when I move to the back of the house, the phone and laptop connect instantly, but when I move to the front and it goes out of range of the U6, it tries to connect to the Mikrotik and fails. Both the phone and laptop were connecting to the Mikrotik under Zulu_5G when I completed the setup. I only noticed this problem when I move out of range and back in range of the Mikrotik.

Here’s my config:

# dec/13/2023 09:33:57 by RouterOS 6.49.4
# software id = N83N-150U
#
# model = RBD52G-5HacD2HnD
# serial number = CDFC0D883155
/interface bridge
add name=bridge1 vlan-filtering=yes
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=Delta \
    supplicant-identity=""
add authentication-types=wpa2-psk mode=dynamic-keys name=Zulu \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=canada disabled=no \
    mode=ap-bridge name=Delta security-profile=Delta ssid=Delta wps-mode=\
    disabled
set [ find default-name=wlan2 ] band=5ghz-n/ac channel-width=20/40/80mhz-eCee \
    country=canada disabled=no frequency=auto installation=indoor mode=\
    ap-bridge name=Zulu_5G security-profile=Zulu ssid=Zulu_5G wps-mode=\
    disabled
add disabled=no keepalive-frames=disabled mac-address=0A:55:31:9E:2A:3A \
    master-interface=Zulu_5G multicast-buffering=disabled name=Delta_5G \
    security-profile=Delta ssid=Delta_5G wds-cost-range=0 wds-default-cost=0 \
    wps-mode=disabled
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether3 pvid=10
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether4 pvid=11
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether5 pvid=12
add bridge=bridge1 interface=Delta pvid=12
add bridge=bridge1 ingress-filtering=yes interface=Zulu_5G
add bridge=bridge1 interface=Delta_5G pvid=12
/interface bridge vlan
add bridge=bridge1 tagged=ether1 untagged=ether2,Zulu_5G vlan-ids=1
add bridge=bridge1 comment="VLAN10 Ether3" tagged=ether1 untagged=ether3 \
    vlan-ids=10
add bridge=bridge1 comment="VLAN11 Ether 4" tagged=ether1 untagged=ether4 \
    vlan-ids=11
add bridge=bridge1 comment="VLAN12 Ether 5" tagged=ether1 untagged=\
    ether5,Delta,Delta_5G vlan-ids=12
/ip dhcp-client
add disabled=no interface=bridge1

I don’t know what is going on with Zulu_5G. I think there is something wrong with the way I’ve set it up but I don’t know what. Anybody have any ideas?

2

There is no such thing as vlan1 for data when it comes to useful setups on the MT product line.

IF you have a trunk port from the main router to the MT router, then its a trunk port carrying all DATA VLANS.
Which VLAN is the trusted or managment VLAN where the MT gets its IP address.

This is the only vlan that needs to be identified as a VLAN interface.
This is the only vlan that needs to be identified with a bridge member on /interface bridge vlans as the rest are simply being switched from the Trunk Port to the exiting port/WLAN.

Funny reading further its zule soming on guess… vlan1 that is not working, NO surprize!~!
https://forum.mikrotik.com/viewtopic.php?t=182276

3

@anav
If I may attempt a simplification, OP should not use VLAN 1 on a Mikrotik devices since for whatever reason it is used internally and using it may cause issues.
Correct?

@ckl88
Try changing VLAN 1 to some other number, like VLAN 13.

4

Like any other switch I have used, vlan1 is in the background and should not be used for data vlans.

5

Thanks for the forum link and clarification.

I forgot that VLAN1 had some special meaning. I will change it and try again.

6

Lots of devices (not just Mikrotik) do strange things with VLAN 1. Best to NEVER use VLAN 1 unless you have a specific use case that requires it (I do).

7

That’s worth knowing. What kind of strange things?

8

That’s the first time I’ve seen it that way around. The range of the UBNT kit, esp. the LR variants, seems to be superior to the Mikrotik radios. In fact, the weakness and problems with the Mikrotik radios seem to be it’s weakest point. Maybe it’s improved. I’m basing this around implementation of CAP AC devices.

9

Treat it as a management VLAN (often without telling you that).
Treat it as a VLAN that you have no control of.
Treat it as if it were untagged and add to your other untagged traffic
A few others I can’t remember seeing.

Best to just never use VLAN 1 (unless some device gives you no choice).