use vlan to separate trafic and route on different gateways

RouterOS Beginner Basics
1

Hi Geeks,

Sorry if this might have been discused in other topics. Have been trying to make some adaptions to the network to separate wifi network from the pc network. Actually I dont have access and I am not allowed to change the main subnet (this is a bit frustrating). I am allowed to configure only the mikrotik devices.

This is the situation:
There is only one big broadcast subnet 10.10.0.0/19 covering 2 buildings with fiber connection. All switches are vlan default (access ports).
In order to provide wifi for the mobiles there are 2 miktrotik devices which route the wifi trafic directly to internet throught Mk1
current network.jpg
The problem is that all the trafic is going through the some LAN subnet (which mean all devices are one same lan, switches, servers, PC etc)

I will need some help to configure the Mk2 communicate with Mk1 through LAN subnet in secure way.
is there any chance to use vlans in miktrotik but the uplink shoud be untagged trafic?
or, make Mk2 as extension of Mk1 via encrypted tunnel through LAN?

another idea is to use unify APs and use a single controller. how can i reach mk 2 wifi lan from mk1?

2

You could look into VXLAN or EoIP to create an overlay Layer 2 network for your 192.168.50.0/24 and 192.168.51.0/24 subnets over the Layer 3 10.10.0.0/19 network.

3

I have done some changes by incorporating vlans on both mikrotik devices.
current vlan network.jpg
Add all ports to bridge, ingress filtering active
Tagg all incoming traffic with id 300, strip on eggress for WAN interface
Assing vlans on bridge
IP on vlan interface

[admin@MikroTik] > /interface bridge vlan print
Flags: X - disabled, D - dynamic 
 #   BRIDGE                VLAN-IDS  CURRENT-TAGGED               CURRENT-UNTAGGED              
 0   bridge                300       bridge                       ether1                        
                                     ether2                      
 1   bridge                200       bridge                      
                                     ether2                      
 2 D bridge                1                                      bridge                        
                                                                  ether5                        
                                                                  ether2

Unify controller is configured with 2 networks
SSID 1 default untagged dhcp client
SSID 2 tagged vlan 300 (mac address filtering enabled)

On the SSID 1 clients take IP from vlan200 DHCP
On SSID 2 clients (PC only) take IP from LAN DHCP

Since my routerOS doesnt support VXLAN i use static routes for vlan200 IP on both mikrotiks so controller is able to see all APs in both networks.
Haven’t tried yet EoIP (need some help)
I’ll appreciate if someone have other ideas to improve the configuration.

Thanks