Reached the end of my competence, request for review

RouterOS General
1

Hello all,

I’ve been learning networking with Mikrotik products and I think I have reached the end of where I am able to competently judge if my setup is working properly. Its working (including the wifi), everything connects, can use internet as normal, but I dont know if I’m missing something or have done something stupid or unsafe. I would very kindly ask for your help in a quick sanity/security check to help me as a checkpoint so I can experiment on my own further knowing I have a safe and secure configuration.

Details:

  • The network is router on a stick, with RB4011(wifi) as router, CRS328-24p-4s as central switch, and cAP-ax as wAP (currently have one and learning with it, but planning for 2-3 more).
  • The network is connected to ISP router via the 5ghz radios on the RB4011 as I cannot run ethernet between them, just to explain that little oddity. The ISP router is operating as a normal ISP router, so that the rest of the household devices aren’t reliant on my learning, with my little network behind the RB4011.
  • Once I move, the goal is to have a more normal setup, with ISP modem and RB4011(radios off) handling all the routing/firewall.
  • This is why I've attempted the CAPsMAN, but if this is nuts for 3-4 wAP then please say.
  • I'm intending to implement WireGuard for things like NextCloud, and VLANs for Guest, IoT, Managment, etc, but havent gotten there yet.

(Config redacted due to lack of response)

I hope this is enough detail, and as an aside I wanted to say thank you to all of you who bother helping the beginners. Your comments on other posts have helped me get this far and were very kind with your time.

2

I personally would approach this ias going wired now from ISP modem to router and to switch and to single capax, WITHOUT capsman.

Once you are happy with all, then add the other cap aX after transitioning the setup to capsman for the single cap AX. In this way you are not trying to chew on to many things at once.

3

Hey, thanks for the response. Yeah I understand and agree with you, but I think I've got a bit of an understanding of the wired and router portion, its really the jump to the wifi part that I'm unsure if I've done correctly.

I'm pretty happy with the rest unless I've missed something, and thats what I'm struggling with. I just have no idea how to tell if I've done it right/securely beyond 'yay internet works', so hoping to get a bit of guidance from here. Any suggestions on how to tell if I've done things correctly? I want to continue learning and experimenting, but seems sensible to make sure I have a secure base to build from. Also for so few access points does it make sense to just ignore capsman? It seems like a useful tool if I can ever figure it out aha.

If anyone has even just word based guidance, eg first set up the security keys, then do configurations making sure to x, then I can go and do more research/learning based on that. Dont want to ask for peoples time, but just really not sure how to progress so any help would be really appreciated.