Setting up a dedicated wifi network for iot devices

RouterOS Wireless Networking
1

Hello Folks,

I am a new Mikrotik user. I am trying to achieve with my new hAP ax3 device what I couldn’t do with my former ISP’s router. But I am not even close to being a network engineer. So I rely on both the (impressive) GUI of Router OS and tutorials. But some of these tutorials are only based on CLI (which I am comfortable with for general Linux computing, but not for firewalling and networking).

So, this leads me to my question. I am trying to set up a dedicated wifi network for my iot devices, in order to isolate them from my main network, that hosts a self-hosted system. I have found that tutorial, which seems very helpful but … I don’t understand that part

/interface wifi configuration 
  add name=guestcfg ssid="Guest" \
  datapath.client-isolation=yes \
  security.authentication-types=wpa2-psk \
  .passphrase=yourGuestPSKgoesHere

/interface wifi 
  add name=wifi2g configuration=guestcfg \
  master-interface=wifi2

I did successfully set up one guestcfg interface with the GUI but I had to assign it to a master-interface, which seems to defeat the purpose of the wifi2g (please bear with me). And I found no way to set up the wifi2g interface.

So I supposed that setting up the guestcfg interface was sufficient and I proceeded. But when I set up the dhcp2 dhcp-server, I got the message “Interface not running”. I presume that the interface in reference is the wifi2g of the tutorial, which does not exist but which I replaced with guestcfg interface. So I’m a bit lost.

Does anyone understand my gibberish and can help me ?

2

Let us assume that you only have one Access Point, because it is more complicated if you have more.

The bit you don't understand for the first part makes a configuration - in Webfig or Winbox [WiFi -> Configuration] - which fore the second part is applied to a wireless interface. SLightly more flexible than doing it all in one step and it allows you to replicate the configuration and its SSID to both 2 and 5 GHz.

Have you successfully set up the Master interface? Because the slave depends on that running.

3

I am not sure to understand what the issue is, however:

This part:

/interface wifi configuration 
  add name=guestcfg ssid="Guest" \
  datapath.client-isolation=yes \
  security.authentication-types=wpa2-psk \
  .passphrase=yourGuestPSKgoesHere

adds (creates) a new wifi configuration called "guestcfg" with ssid "Guest", a given passphrase with wpa2-psk authentication and setting "datapath.client-isolation.

Loosely you can have as many wifi configurations as you want, they are only a "self-standing" set of instructions.

This part:

/interface wifi 
  add name=wifi2g configuration=guestcfg \
  master-interface=wifi2

adds (creates) a new interface called "wifi2g" slave to master-interface "wifi2" and specifies the wifi configuration to be used on this interface.

The configuration is called "guestcfg", the interface is called "wifi2g".

If you follow a tutorial, you should use - at least until you are getting familiar with the interface/tools used - the SAME method to create/edit settings, those command lines you can copy on Notepad, edit the passphrase (and NOTHING ELSE) then copy again and paste in a terminal in Winbox.

If you keep open in Winbox:

  1. a terminal window
  2. a GUI view of interfaces

You will see the "wifi2g" added as soon as you paste the snippets and press [ENTER].

4

Thank you folks, I understand where I was lost. Instead of creating a configuration, I in the first place created a wifi. I have reverted to the backup, am trying to set up the whole thing and will let you know.

5

Finished my setup. I still get this message Interface not running, but I could anyway catch the wifi, connect, get an IP and connect to the Big Bad Web. So I assume that the message is either a warning of little significance or a bug …

Thank you again !

6

On RouterOS, a WiFi interface is only considered “running” while at least one client is connected.

1 Like
7

Yep, once you have a device connected to the ssid "Guest" the interface should not show "not running" anymore.

8

...and you can get around the "not running" with setting "disable-running-check=yes" for the interface. It is only available using the cli, at /interface/wifi set xxx disable-running-check.

In many cases it solves not-so-cosmetic problems, like when the interface is part of a bridge with some form of stp, the link-up generated by the first connecting client triggers the initial wait, which some client devices take offense at.

1 Like