Split Router Ports Into Two Completely Isolated Networks

RouterOS Beginner Basics
1

UPDATE:

The attached .rsc file:

micro-soho-vlans-20250629.rsc (5.5 KB)

is a basic router / switch / wifi access point configuration but splits physical ports into two networks using VLANs like:

ether1  <DhcpAssignedIp>  WAN 
ether2  192.168.88.1/24   HOME-VLAN
ether3  192.168.88.1/24   HOME-VLAN
ether4  10.11.11.1/24     OFFICE-VLAN
ether5  10.11.11.1/24     OFFICE-VLAN
wifi1   192.168.88.1/24   HOME-VLAN
wifi2   192.168.88.1/24   HOME-VLAN

Devices in HOME-VLAN are (should be) completely isolated from devices in OFFICE-VLAN.
Only devices in the OFFICE-VLAN can connect to the MikroTik using WinBox or WebFig.

This config was created by taking the default config of the hAPax2 running RouterOS 7.18.2 and modifying it to factor in the VLAN directives from the RouterSwitchAp.rsc example.

To install this file, first change:

  1. The admin-mac (get this from your default config by looking at /export output)
  2. The wifi1 and wifi2 SSIDs
  3. The wifi1 and wifi2 PSK passphrases
  4. The OFFICE-POOL starting address (default is .32 to leave room for servers with static IPs)
  5. Change names, addresses and vlan-ids as desired to make unique
  6. time-zone-name (although probably best done later in the UI to get the right name)

Login to the MikroTik, go to Files and upload the .rsc file.

Select System > Reset Configuration > No Default Configuration, Run After Reset, select the .rsc file and Reset Configuration.

Wait 2 minutes and, using a port on the OFFICE-VLAN, try to login as admin with a BLANK password (apparently Reset Configuration resets the password to “” and not the factory password).

If you cannot connect, presumably the config failed.
Try to figure out why and make chages / revert things.
Use the hardware Reset Button and login with the factory password and try again.
Rinse and repeat.

Note that if you export a config and modify it, you will need to re-add the wifi passphrases.
And make sure that either vlan-filtering=yes at the top or add /interface bridge set bridge vlan-filtering=yes at the bottom (you will get locked out if vlan-filtering is not enabled).

–

OP:

I just got a hAPax2 for a micro SOHO.

I want to split the physical ports into different networks:

  PORT    INTERFACE   COMMENT
  ether1  WAN         Internet for all
  ether2  HOME        tv
  ether3  HOME        potentially hostile guest device
  ether4  OFFICE      unmanged switch 1
  ether5  OFFICE      unmanged switch 2
  wifi1   HOME        more potentially hostile devices
  wifi2   HOME

The HOME and OFFICE networks MUST be completely isolated from each other.
They would not even be sharing a printer or time service.

The HOME network should be hardened as much as reasonably possible (no management access, ..)

I have little experience with lower level network configuration or mikrotik devices but I am very comfortable with (and much prefer) text configuration.

I have recorded the
/print default-configuration print
of the unmodified device and after selecting “Remove Configuration” and found the two configuations to be identical.

I have recorded the
/export file=outfile
of the unmodified device and found it to be a derivative additional “layer” of configuration and that after performing the “Remove Configuration” is almost completely removed.

So my first question is, given the overall objective, should I apply my changes as one .rsc script to the default configuration or “Remove Configuration” and create a .rsc script that rebuilds everything?

After scanning over the various documents on help.mikrotik.com and posts on forum.mikrotik.com, this “Using RouterOS to VLAN your network” document seems like it could be relevant:

https://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/

I am still trying to absorb everything but my vague thoughts are to create two VLANs with a single bridge with a DHCP server with two address ranges (like 192.168.88.1/24 for HOME and 10.11.11.1/24 for OFFICE) for the two completely isolated networks.

But can anyone recommend a general plan?

Which pitfalls should I look out for?

2

The forum post you have referenced is the Holy Bible of VLAN and IT IS relevant because this is IMO the best way to fully isolate two or more networks.

In your case you could set multiple networks - one for TV, one for potentially hostile guests, etc., and you could adjust the communication between them through firewall rules.

The general plan is to create a bridge, add all ports which will be untagged to it except one for administrative purposes, create VLAN interfaces on top of the bridge and assign to them addresses, DHCP and so on, configure PVIDs for the access ports and the bridge VLAN table and lastly, enable VLAN filtering for the bridge.

A pitfall to be avoided is to lock yourself out of the router by prematurely enabling VLAN filtering and not leaving one port out of the bridge

3

My first attempt at this has failed.

I created a .rsc by merging the default config with this example:

Using RouterOS to VLAN your network - #3 by pcunite

I used the Reset Button to reset the device, connected with the default password, selected “Remove Configuration”, waited for it to restart, reconnect and run:

> /import file-name=usoho.rsc
Script file loaded and executed successfully

WinBox disconnects, Neighbors sees the device and I can reconnect by MAC.

If I run:

> /export file=usolo1.rsc

I get the file attached which looks just like the usoho.rsc imported.

usoho1.rsc (2.6 KB)

The failure point is when I enable vlan-filtering:

> /interface bridge set bridge vlan-filtering=yes
>

This executes without error and diconnects WinBox.

WinBox sees the device in the Neighbors list but I cannot connect.

Does anyone see an issue with the config?

Do I need a firewall for vlan-filtering to work?
I left it out thinking it might help me get a toe-hold.

4

If you’re connected to the internet, you definitely need a firewall! Otherwise, you’re missing a trunk port - a port that’ll carry all the VLAN tags to a switch, and the Winbox disconnection thing is probably due to the IP of the computer not being in the 192.168.0.0/24 range

5

It is not connected to the Internet no. It is connected to the current router which it will replace (hopefully).

There is no switch. The example config from which it was created reads:

Router-Switch-AP (all in one)
Overview:
This is a configuration for a home or even a micro business. Everything lives on a single hardware unit with PCs, laptops, NAS servers, printers, and phones all on the Blue VLAN. The Blue network is considered the home LAN making use of local ethernet ports and a home SSID. When friends come over, you give them a Guest SSID to keep them off your network.

My understanding (which is obviously very limited) is that all ports are access ports and that when traffic enters the router it’s tagged for the bridge to filter things but as soon as it sends traffic out anywhere, the tags are removed. So there’s no trunk ports or downstream switches (other than unmanaged “dumb” switches).

Regarding connecting, should I not be able to connect by MAC?

I tried changing the PC’s address to 192.168.0.2 but no effect.

So do you see any other issues with the config?

6

I saw the problem with MAC - it is set to the BASE interface list which contains ether5. But ether5 is part of a VLAN-aware bridge, so the BASE VLAN interface should be also a member of this interface list and ether5 not

7

If I use what I think you’re suggesting (and what the “Router-Switch-AP” example does):

/interface vlan
add interface=bridge name=BASE-VLAN vlan-id=99
add interface=bridge name=HOME-VLAN vlan-id=11
add interface=bridge name=OFFICE-VLAN vlan-id=22
...
/interface list member
add interface=ether1 list=WAN
add interface=HOME-VLAN list=VLAN
add interface=OFFICE-VLAN list=VLAN
add interface=BASE-VLAN list=VLAN
add interface=BASE-VLAN list=BASE

WinBox cannot connect, even before set bridge vlan-filtering=yes.

So I changed this last element to:

add interface=ether5 list=BASE

and found that WinBox could connect and successfully import the script (but not after set bridge vlan-filtering=yes).

Maybe this is a clue as to what the problem is?

8

Actually I think it might be working …

10

@TheCat12 Your assistance is greatly appreciated.

It’s working.

I get leases for both vlans and dns works.

The problem, which I suspect you were just about to tell me, was that the

/interface bridge set bridge vlan-filtering=yes

directive MUST be applied with the script (at the end) in one import step.

Otherwise it cannot work with and without vlan-filtering at the same time (at least until mikrotik devices quantum superposition capability).

For posterity: Interestingly, when I /export, I do not see the vlan-filtering=yes line. I had to peek at the Bridge in the WinBox UI to see that vlan-filtering was in fact enabled.

So now I need a firewall but first I have another issue.

This device only as 5 ports and I really need them all.

What’s the best way to preserve and protect WinBox access without using a dedicated port?

If I just factor out BASE-VLAN and do:

add interface=OFFICE-VLAN list=MGMT
...
set allowed-interface-list=MGMT
/tool mac-server mac-winbox
set allowed-interface-list=MGMT

am I going to get into trouble?

11

The BASE VLAN is intended for management but you can use whichever VLAN you think is the most protected. Just be sure to put it in the appropriate interface list

12

I have posted an UPDATE at the top with the latest .rsc that now includes the firewall.

If anyone sees any holes or can recommend improvements, please let me know.

13

I can recommend an improvement: If you want/are able to do port forwarding, add the following rule before the drop all forward one:

/ip firewall filter
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat

You can also change the in-interface-list of this firewall rule:

add action=accept chain=input in-interface-list=VLAN

to MGMT

14

I probably will need to do port forwarding actually so I’ll add this eventually.

I do need to make DNS available to the VLAN so I cannot lock that down to just MGMT.

15

Actually, there is a way - you just allow for all VLANs TCP and UDP port 53:

/ip firewall filter
add action=accept chain=input comment="Allow DNS UDP" dst-port=53 in-interface-list=VLAN protocol=udp
add action=accept chain=input comment="Allow DNS TCP" dst-port=53 in-interface-list=VLAN protocol=tcp
16

Yup. If people use this config these are good tweaks for specific cases. For now I’ll just keep it simple.

Sounds like I can pull the old router out of the way and put it on the Internet for real.

1 Like