separating hotspot subnets from office network

RouterOS General
1

Is there an easy way to separate a hotspot into four different VLANs/subnets and still protect the office subnets. The plan is:

10.2.1.0/24–
10.2.2.0/24 \ 10.2.0.0/24 hotspot
10.2.3.0/24 /
10.2.4.0/24–/ >1.2.3.4 (WAN address)
==firewall–dns and http allowed== /
192.168.100.0/22 → Office network /

2

Yes, one of the way to VLAN, but you need to ensure proper VLAN configuration on the client end too.

3

I think I’ve got it. The main problem is, I only want to make the firewall rules once, but I guess I can just use a large subnet mask for the firewall rules.

src=10.2.0.0/16 dst=192.168.100.0/22 port 80 action=allow
src=10.2.0.0/16 dst=192.168.100.0/22 action=drop

Also, I’ve already VLAN’d the network. 192. and 10. networks are on different physical interfaces, though.

Thanks!!