Hiya people!
I am a bit stuck. I have run my network for about a year now, and things are going great. That is the signal for me to change things.
My current setup is quite simple.
At home I have working data for my stuff, people also live at home, and we have smart crap (some light bulbs and, a DVR and, for some unexplained reason, a washing machine. One needs to choose battles) I have a HAP AC3, with three different networks (office 192.168.88.0, home 192.168.100.0, smart crap 10.0.0.0). Each with their own ip range and firewall rules to prevent traffic between them. I have also assigned different eth ports to each use, so that I have that segmented as well. This has worked rather well, and I am able to filter things out quite easily. I access some services in my house through a wireguard interface running on 192.168.89.0 with some firewall rules to allow traffic between it and 192.168.88.0. This has worked great.
I want to add another layer to the network now. I am aiming at using a small HEX router as the main router and the HAP AC3 as the Access point. I now the HAP is more powerful, but the HEX is plenty for what I need.
So, in the HEX, eth1 will be the WAN port, eth2 the AP port and the remaining assigned to each network (office, smart crap and home). The HAP would be setup with three wifi networks (6 if you count 5 GHz), but it still want to maintain the separation as much as possible.
I have tried a whole lot so far, and I think I home come to this point
For the HEX, I am starting fresh from a blank router, I create three bridges, one for each network
/interface ethernet set [ find default-name=ether1 ] name=wan
/ip address add address=****/24 interface=wan
/ip route add dst-address=0.0.0.0/0 gateway=****
#create brigdges, add ports and assign ips.
/interface bridge
add name=bridge-office
add name=bridge-home
add name=bridge-smart_crap
/interface bridge port
add bridge=bridge-office interface=ether2
add bridge=bridge-office interface=ether3
add bridge=bridge-home interface=ether4
add bridge=bridge-smart_crap interface=ether5
/ip address
add address=192.168.88.1/24 interface=bridge-office
add address=192.168.100.1/24 interface=bridge-home
add address=10.0.0.1/24 interface=bridge-smart_crap
#for DHCP servers
/ip pool
add name=dhcp-office ranges=192.168.88.50-192.168.88.254
add name=dhcp-home ranges=192.168.100.2-192.168.100.254
add name=dhcp-smart_crap ranges=10.0.0.2-10.0.0.254
/ip dhcp-server
add address-pool=dhcp-office interface=bridge-oficina name=dhcp-office
add address-pool=dhcp-home interface=bridge-home name=dhcp-home
add address-pool=dhcp-smart_crap interface=bridge-smart_crap name=dhcp-smart_crap
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.88.1
add address=192.168.100.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.100.1
add address=10.0.0.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=10.0.0.1
# I have the very basic firewall. This is clearly not safe, but is for testing purposes
/ip firewall filter
add chain=input action=accept connection-state=established,related
add chain=input action=drop connection-state=invalid
add chain=input action=accept src-address=192.168.88.0/24 dst-address=192.168.88.1
add chain=input action=drop
/ip firewall nat
add chain=srcnat action=masquerade out-interface=wan
I am sure you already know why this is not working, But connecting to any eth port with a windows machien does not result in assigned IP. I connect only through MAC.
I have not given any thought as to how to configure the HAP AP but I will cross that bridge when I get to it.
Unless someone has done this before and has a better idea about how to simplify this, to ensure that networks are segmented and somewhat safe from the smart_crap.
Thank you!