The router example configuration shows an optional and commented out BASE_VLAN dhcp server for your consideration. Base, as you noted, is the MGMT vlan on 99. If you want to use a DHCP for the base network, uncomment that section. Then on each of your switches and other network equipment, you would add a dhcp client on the BASE_VLAN interface. Some folks like to assign static ip addresses to network equipment, or you can use DHCP. The choice is yours.
@pcunite, any reason you don’t include allowing ICMP in firewall filter used in the examples? Without it, it breaks PMTUD for flows with a <1500 MTU.
e.g.
/ip firewall filter add action=accept chain=input protocol=icmp
I was keeping the configurations at the absolute minimum to demonstrate the VLAN concept. No other concept is realistically being shown. So, I was simply being brief.
AMMMO its a vlan setup…if you need fw advice 
, then go here → https://forum.mikrotik.com/viewtopic.php?t=180838
@pcunite, make sense.
@anav, If your cause célèbre is Cloudflare… mine is preventing folks breaking PMTUD by blocking ping 
.
On the topic of “ICMP accept”, you do say it’s “essential for networking ignore the bad advice everywhere!!”. Problem is I think some folks stop at steps here for VLAN and never move on .
Ahh, now I get where you are coming from! PCUNITE added in the last post a “FIREWALL CUSTOMIZATIONS:”
Which IMHO he should have avoided or simply pointed to the link provided OR do it properly.
LIke anything else firewall rules without context to the rest of the config is not all that useful, or at least make clear the approach being used (either a. accept all blindly and try to block bad stuff default mode [ basically useless after changing default settings ], or b. accept known traffic needs, block everything else.)
RouterSwitchAP.rsc is not working.
If i set address and dhcp to vlan I have no IP and no internet.
If I set it ti bridge then all works. Then it’s no point.
# 2023-10-17 13:05:18 by RouterOS 7.11.2
# software id = ############
#
# model = RB951Ui-2HnD
# serial number = ###############
#######################################################
# wireless is uninportant now
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
#######################################################
/interface bridge
add name=BR1 protocol-mode=none
/interface bridge port
add bridge=BR1 interface=ether2 pvid=99
/interface bridge vlan
add bridge=BR1 tagged=BR1 vlan-ids=99
/interface vlan
add interface=BR1 name=BASE_VLAN vlan-id=99
/ip dhcp-client
add interface=ether1
/ip address
add address=192.168.16.1/24 disabled=yes interface=BR1 network=192.168.16.0
add address=192.168.17.1/24 interface=BASE_VLAN network=192.168.17.0
/ip pool
add name=pool_BR1 ranges=192.168.16.2-192.168.16.254
add name=pool_BASE_VLAN ranges=192.168.17.2-192.168.17.254
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8,8.8.4.4
/ip dhcp-server
add add-arp=yes address-pool=pool_BR1 disabled=yes interface=BR1 name=dhcp_BR1
add add-arp=yes address-pool=pool_BASE_VLAN interface=BASE_VLAN name=dhcp_BASE_VLAN
/ip dhcp-server network
add address=192.168.16.0/24 dns-server=192.168.16.1 gateway=192.168.16.1
add address=192.168.17.0/24 dns-server=192.168.17.1 gateway=192.168.17.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/system clock
set time-zone-name=#########
/system note
set show-at-login=no
PS: got it, wrong DNS’s in IP/DHCP/NETWORK
nice kris have an issue post it on the beginner or general forum for help, this thread is to present the article and comments on improving the article…
Speaking of which, I have decided this paragraph is TOO WEAK!!
Native, Base, & MGMT (management) VLAN:
Before designing IP Addressing & Routing, you’ll need to choose a VLAN scheme. To get your VLAN going you have to start somewhere and that’s usually something termed the Native VLAN. This would be the base network that you used to initiate your first connection to a router or switch. The Native VLAN is not a requirement but rather something that continues to exist if you allow it. Think of the Native VLAN as a term used to describe packets without a VLAN tag that move between your equipment and network. Whether or not this is a good thing is up to you. In our examples, we do not allow for this scenario. Instead we implement a Base VLAN (our name for the management VLAN). Over this network will be device to device traffic (routing, etc.). We also default Winbox availability here as well.
People are using your article and still using vlan1!! WHY because you HIDE it so well LOL. You never mention the fact that vlan1 is the native vlan and you only state we dont allow for this, instead we implement a base vlan. All true, but new users are MISSING the point, you need to capture them better!
Fix it as you will but for example. You confuse native and Base from the getgo, The native vlan on any equipment Ive worked on is vlan1, so keep it that way.
Native, Base, & MGMT (management) VLAN:
Before designing IP Addressing & Routing, you’ll need to choose a VLAN scheme. To get your VLAN going you have to start somewhere and that’s usually something termed the Base VLAN. This would be the base subnet that you used to manage all smart devices on the network and is the trusted subnet. The Native VLAN is not a requirement but rather something that all routers/switches come with ( normally vlan1 ) as the starting point for connectivity and is a term used to describe packets without a VLAN tag that move between your equipment and network. All mikrotik devices use VLAN1 in the background for this purpose and we will leave it quite alone. VLAN1 should not be used for any vlans passing data unless your a trained expert! To control and manage devices we implement a Base VLAN (our name for the management VLAN). Over this network will be device to device traffic (routing, etc.). We also default Winbox availability here as well. In a home network typically the HOME VLAN is the Base VLAN and in a business environment a Management VLAN is considered the Base VLAN.
Agreed. It was an incorrect way to describe it. I’ve updated it.
Don’t get me wrong the way you write and format your articles is mouth watering… Mine are sheite in comparison.
Next item, people keep messing up on. They keep a bridge address and pool and add addresses for the vlans but FORGET about pools, dhcp server etc for the VLANS.
Please add a paragraph that says, NO need for bridge to do DHCP once you have vlans make all subnets vlans for a clean, consistent approach. This dovetails well into the fact that you have a trusted BASE vlan, could be home vlan or for busisness, a management vlan.
Ensure you note taht the vlans need the six items: definition to the bridge, ip address, ip pool, dhcp server, dchp-server network , added to interface list…
Does anyone have a version of the Access Point config for newer devices using the “wifi” package? I was confused until I realized the new hardware (hAP ax2 in my case) needs to use different commands. Then after reading more I installed the 7.13 beta version of RouterOS because it appears that wifiwave2 is being replaced by wifi going forward. I then got even more confused because it also looks like the method of setting the VLANs for each interface/SSID has changed?
The examples I could find of setting up VLANs with the new wifi configuration all use CAPsMAN, which I don’t want/need to use with only a single AP.
The article is meant for vlans primarily and is not intended for vlans under capsman.
I agree its sorely needed but that is best left to an article describing capsman setup and suggest you go bug holvoetn to make such an article
I’ll put it on a someday/maybe list … moving places, still got large part of current house to be emptied.
Is this a planned exciting move, or a not so glad eviction notice?
I was specifically asking about VLANs not under capsman - there’s a capsman example here: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample:
I guess I need to know either how to translate the example at that link into a non-CAPsMAN (single standalone AP) config, or how to update the one at the top of this tutorial to use the new “wifi” command set. And in general, I suppose all the configs in this tutorial will eventually benefit from that, when the wifi package hits full release.
Maybe, with 7.13 still in beta, I picked exactly the wrong time to decide to do this. 
Off topic:
Planned move to apartment.
Our house was built for 5, the kids all left. So time to move into something smaller, easier to maintain, …
In reality the new place is as far as habitable floor space is concerned, the same as what we USE in our current house.
Most people plan this move way too late in their lives. When it’s too late, it’s usually really too late.
this is really great. can anyone convert it to an .epub format so I can take it all in slowly on my kindle?
kindle??, sorry this is not a site use by children under 5 or great grandparents