Router-AP configuration with VLAN

RouterOS Beginner Basics
1

Hello,
I’m quite new to Mikrotik and have a use case I’d like to configure on a RB960PGS device. Help is appreciated, thank you.

Eth1 is WAN port,
Eth2-Eth4 have connected POE Unifi Access Points
The APs have two SSIDs configured, one for home use, other for guest use. Each SSID has a different VLAN.
I would like to be able to apply some firewall rules on the different SSIDs.

I tried the configuration of RouterSwitchAP.rsc from this thread (http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1) but I cannot get it to work. When I connect the AP to the Eth2 port, it doesn’t get an address. I’m probably doing something wrong, just don’t know what.

2

post your config…
open terminal window in winbox
/export hide-sensitive file=myconfigtoday (any name will do)
Go to the file menu in winbox find the file created, download, open in notepad++ ensure you delete anything not already removed (wanip comes to mind).

3

Hello anav,

thank you for your response. Got it working eventually.
Problem was that the bridge had no dhcp server assigned, so devices were not picking an ip address. After setting an dhcp server and opening the firewall, everything started working as it should.

Thanks again, cheers

4

Cool,
I prefer NOT to use the bridge for DHCP or much else besides as a conduit for my vlans.
I use all vlans. The thread you noted also does not use the bridge for DHCP as far as I can recall.

5

Hello,

yes, you are right. They don’t use it.
Could you explain why is using the bridge for dhcp bad for configuration? Is it a security issue?

I blocked with firewall all contacts between vlans and bridge network. I hope it’s enough for a rental house use case.

Cheers

6

Hi Cresit, I dont think there is anything wrong with your setup. Personal preference i guess.

7

As @anav wrote: there’s nothing particularly wrong with mixing tagged VLAN and untagged (direct use of bridge interface), it’s just that it’s mixing … IMHO it’s much clearer if one converted to all-VLAN config, this way all traffic is treated/configured equally. No need to treat one VLAN differently just because it happens to serve most of devices.