I am at a loss. I really don’t know what to try anymore.
My current setup is rather basic:
Internet ——hap ac3——cap ac
The hap acts as a router the cap as an access point. It should basically just provide access so nothing else should be there.
There are two fundamental problems. And I thing they are somehow related.
I am unable to have winbox access to the cap ac when connected to the wifi. I have changed the port fo winbox in the hap and tried romon but something simpler is happening I think.
The apple devices are not stable in connection. They connects and disconnects repeteadly. I think it has to do with the 5ghz ifaces but I just cannot make sense.
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
this sets two categories. WAN and LAN (if you prefer outside and inside, dangerous and safe).
But then you have:
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
BUT bridge “bridge” has only ether2 in it (why?) and ether1 has been added to bridge BR1.
That should become:
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=myconf interface=BR1 list=LAN
It makes little sense (to me) to have a bridge with only one port in it, probably it would be better to have ether2 as “self-standing”, removing bridge “bridge” alltogether, but first do the changes above and you should be able to access the cAP from wifi.
Until you have not the bridge “BR1” (comprising wifi interfaces) into list “LAN” the default firewall rule:
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
disabled=yes in-interface-list=!LAN
should block any access to the router.
Conversely, if the device is a bridge, firewall “forward” rules make little sense (the “input” ones may still be useful, but they would need to be revised if you want to limit access from some devices in LAN).
Then you have an error on dhcp client on ether1, you should disable or remove it:
/ip dhcp-client
# DHCP client can not run on slave or passthrough interface!
add comment=defconf interface=ether1
This was the result of me fighting to get the cap working.
The only goal I have is to have three ssid one for each vlan..
I will give it a go. I’ll put both ether on the bridge remove all firewall rules (this is, after all a bridge as you said) I will then only have a lan interface list and put both ether there and on the bridge.
/ip neighbor discovery-settings
set discover-interface-list=MGMT
CHOOSE ONE, not both, either IP address for WAN or IP DHCP client. /ip address
add address= comment=“Public IP” interface=ether1 network=
169.26.26.0 OR ( not both)
/ip dhcp-client
add comment=defconf interface=ether1 use-peer-dns=no
a. dst-address=WANIP ( if WANIP is static/fixed )
OR
b. in-interface-list=WAN ( if WANIP is dynamic )
OR
c. dst-address-list=MyWAN ( if WANIP is dynamic but you are running into hairpin nat )
Remove winbox 0.0.0.0
WHEN YOU HAVE NO ENTRY in the winbox settings, this assumes all addresses
Suggest at least put in subnet of Office and subnet of wireguard
set winbox address=192.168.1.0/24,192.168.10.0/24
OR
Blank entry.
Add router as NTP Client and NTP server.
====================================================================================== BASE AP ONLY USE ONE BRIDGE !!!
The untaggings are created dynamically but I like to always add them manually to ensure the OP understands vlan filtering setups and to ensure it shows up on export of config.
The Trusted VLAN needs to be tagged to the bridge.
9./interface list member add interface=BASE_VLAN list=TRUSTED
The only IP assigned to the ap is the base vlan 100 IP address! /ip address
add address=192.168.1.2/24 interface=BASE_VLAN network=192.168.1.0
REMOVE DHCP CLIENT, DHCP SERVER< DHCP SERVER NETWORK… the AP is NOT a router!
REMOVE static DNS setting keep → /ip dns
set 192.168.1.1
REMOVE FIREWALL FILTER RULES< not a router!
REMOVE NAT Rule not a router
15, Disable ipv6 and remove lists and rules.
16./tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
only need one…
/ip route
add distance=1 gateway=192.168.1.1
Suggest you rename ether2 if not used as name=OffBridge2
Removal from bridge I already did.
give it an IP address
192.168.55.1/30
add the interface OffBridge2 to the TRUSTED interface list as a member/
=========
Then you should be able to plug in your laptop into ether2 and change ipv4 settings to 192.168.55.2
and you should be able to configure the AP from there…
I typically config the cap before placing it at location. If the cap is not easy to get to I run a second wire from ether2 to the closest convenient location (aka a closet etc) so that I can plug in my laptop to modify the config. This is in case something happens on the bridge, one has a separate way to access the device.