Virtual WLAN and VLAN's

RouterOS Wireless Networking
41

Ufff, so many new informations hehe, sry for not posting, busy day at work…

Soooo i updated configuration (After reading posts ofcourse so i can see what is happening).

I forgot to assign ether3 to VLAN10, my mistake, that is corrected now, tested and working.
I deleted default configuration (all hopefully) so here is updated configuration again:

# mar/21/2022 18:31:11 by RouterOS 7.2rc4
# software id = 2NZF-BKUH
#
# model = RB760iGS
# serial number = D4500FA09027
/interface bridge
add admin-mac=DC:2C:6E:0D:34:53 auto-mac=no comment=defconf \
    ingress-filtering=no name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=CCTV_network vlan-id=20
add interface=bridge name=Guest_network vlan-id=15
add interface=bridge name=Home_network vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=Home
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=172.16.10.2-172.16.10.254
add name=dhcp_pool2 ranges=172.16.15.2-172.16.15.254
add name=dhcp_pool3 ranges=172.16.20.2-172.16.20.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=Home_network name=dhcp1
add address-pool=dhcp_pool2 interface=Guest_network name=dhcp2
add address-pool=dhcp_pool3 interface=CCTV_network name=dhcp3
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=bridge comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether4 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged \
    interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=Home
/interface bridge vlan
add bridge=bridge tagged=bridge,ether5 untagged=ether4,ether3 vlan-ids=10
add bridge=bridge tagged=bridge,ether5 vlan-ids=15
add bridge=bridge tagged=bridge,ether5 vlan-ids=20
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=Home_network list=Home
add interface=ether2 list=Home
add interface=Home_network list=LAN
add interface=Guest_network list=LAN
add interface=CCTV_network list=LAN
/ip address
add address=172.16.0.1/24 interface=ether2 network=172.16.0.0
add address=172.16.10.1/24 interface=Home_network network=172.16.10.0
add address=172.16.15.1/24 interface=Guest_network network=172.16.15.0
add address=172.16.20.1/24 interface=CCTV_network network=172.16.20.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=172.16.10.254 client-id=1:f4:30:b9:d7:5:5a comment="Admin laptop" \
    mac-address=F4:30:B9:D7:05:5A server=dhcp1
/ip dhcp-server network
add address=172.16.10.0/24 gateway=172.16.10.1
add address=172.16.15.0/24 gateway=172.16.15.1
add address=172.16.20.0/24 gateway=172.16.20.1
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=172.16.10.254 list=authorized
add address=172.16.0.2 list=authorized
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="Winbox access" dst-port=8291 \
    in-interface-list=Home protocol=tcp src-address-list=authorized
add action=accept chain=input comment="Service (DNS)" dst-port=53 \
    in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Service (DNS)" dst-port=53 \
    in-interface-list=LAN protocol=tcp
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=input comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Zagreb
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=Home

@mkx
yea i know that was shit, i was using wrong tutorial.

All of this is going into PDF and i store it for later use (also wireguard tutorial is in pdf now, and wifi config), I also read other links and topics provided before atempting to do any configuration so i can understand what am i doing here as there is no point for me to blindly entering commands into terminal without knowing what are they doing.

Also i think that just copiyng command without understanding would be highly disrespectful to anybody who is trying to help me here. I know this is a piece of cake for all of you.

42

Not a piece of cake for sure…

The only overall suggestion I highly recommend is that ORGANIZE your firewall rules.
PUT ALL THE INPUT CHAIN RULES TOGETHER FOLLOWED BY THE FORWARD CHAIN RULES.

(1) /interface list member
add comment=defconf interface=bridge list=LAN

You can remove bridge from membership list of LAN
its fully covered by vlans being members…

(2) /ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
INSERT–> add action=drop chain=input connection-state=invalid ← INSERT
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp

In other words move the RULE at the end up into the correct order.

(3) I would put simpy the letters winboxport# here not the actual winbox port number you use. I would not publish it.
IF it is need 8291, CHANGE IT FROM DEFAULT@

_add action=accept chain=input comment=“Winbox access” dst-port=8291 _

(4) This rule should go after the forward chain IPSEC default rules and BEFORE the forward chain ALLOWED/ ESTABLISHED RULE

add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes

(5) Lets make your forward chain, cleaner and safer…

We are going to dismantle this very ugly default rule (but works well for the new beginner). What is basically says drop all traffic from WAN to LAN (good!!) but allow port forwarding to occur (good!)
However it misses any LAN to LAN?WAN traffic we dont want to all, or stated differently it allows ALL LAN to LAN traffic and ALL LAN to WAN traffic (not good).
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN

Thus we are going to make the port forwarding part of the rule very clear and easy to understand
add chain=forward action=accept connection-nst-stat=dstnat

Since we eliminate all LAN to LAN and LAN to WAN traffic, NORMALLY we add this rule…
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN { to permit internet traffic from the lan }

Finally we want to drop all else (all LAN to LAN and all LAN to WAN) we have not expressly permitted above and most importantly of all DROP ALL WAN to LAN traffic!!!
add chain=forward action=drop comment=“drop all else”

NOTE: if you wanted to allow VLANX to VLANY then make the appropriate rule prior to the drop all else rule.
If you wanted all to access a shared device then make an appropriate rule for that.

43

Unfortunately, i can’t make any changes until wednesday because tomorrow i’m going on a business trip but when i return i will continue with changes.

As for the port, i tried to enter exactly what you wrote but terminal was giving me an error so i input port number.

This configuration is for learning purposes only and in real configuration port will be changed ofcourse.

It’s a good thing that you explained a little bit of firewall rules. I always put default config here, i saw on couple of sites and here on the forum that it’s good enough.

I don’t think that i will need vlans to communicate with each other because guest network will be only internet access, home network have all other devices excluding cctv and security. I could try to create rule just for learning and testing

44

yup no rush.
If you change the default winbox port you may have to relog in.
I use mac address and rarely if ever use IPaddress:port# at the winbox login

45

One question, which router should i buy, RB5009 or RB4011 ?

46

If you need rock-solid solution now, then get RB4011 and make sure its factory installed software is 6.4x.y … then keep ROS at v6.

If you can play a bit and wait for v7 and RB5009 become stable (as in behaviour, not as marketing name), then get RB5009 … but don’t complain if you’ll experience any type of glitches in next full year.

47

I would rather have rock solid solution right now. And rb5009 is not available… So rb4011 is better solution right now.

48

I ordered RB4011 as there is no RB5009 available, and it’s unknown delivery time.

49

Nice the RB4011 on the latest long term 6 firmware is your best bet. I went to ver7 on the one I have to use wireguard.

50

Yea, and it has 10 ports plus sfp (i have sfp to rj45 adapter) so every room is connected directly to the router, no need for switch. I also bought RB260GSP so i can connect AP (its poe out)

Tomorrow when i return i will continue with configuration on AP.

51

I’m sure you’re aware that device has two switch chips built in, each connecting half of RJ45 ports. Each of switch chips is in turn connected to CPU, SFP+ port as well. So any traffic between any pair of these 3 entities (switch1, switch2, sfpplus1) has to pass CPU. So plan physical connections wisely to minimize burden on CPU.

In this regard, RB5009 is much better (single switch chip connecting all ports).

52

Mkx do you mean that intervlan traffic between ports should drive one to ensure the maximum traffic should be hosted within the same port half…
Aka if the maximum traffic is HOuse Users accessing NAS, then both the users vlan and the NAS port or the VLAN that the NAS is on should be on one side..

53

With v6, RB4011 doesn’t do any VLAN in hardware, so with VLANs in picture, one doesn’t have to plan physical connections :wink:
But without VLANs (i.e. one single LAN) in v6 (or with VLANs in v7, where VLANs are offloaded to HW), one should take care to connect devices which communicate with each other most, to same group of ports (either ether1-ether5 or ether6-ether10) so that switch chip does most of work. So yes, by all means connect heavy users of domestic SAN to same group of ports as SAN itself. Or connect multicast source and sinks (IP TV on my mind here) to same group of ports … although this is not so gross, IP TV streams are relatively modest at around 10Mbps give or take.
It’s been said numerous times: SFP+ port is ideal to be used as all-routed port … either to connect towards ISP or to connect to larger swtich (as trunk port). But it is not as useful as “yet another switched port”.

54

RB4011 is indeed a good choice…
If it is a home Router, i would suggest you try V7 and Bridge Hardware Offloading…
If something does not work as expected you can always downgrade…

55

RB5009 is unavailable right now, and it’s unknown when it will be available. RB4011 was available but in small quantities (about 5 was available) so i took a chance and buy it.

I do have IPTV but it’s connected to other ISP router (it’s their service) so that won’t be an issue.

So I have 6 ports in my rooms in total (2 in each room)

One port is for IPTV and one port is for my wife’s work PC, so i could use for eg.

Ether6 to 9 to be home network, ether10 as trunk port for APs, so majority of traffic would be on one switch chip.

Ether5 could be vlan for wife’s work PC.

ether4 for network video recorder. That would be the only link between two switch chips because VLAN20 would go through ether10 and ether4. I have 7 cameras, 2 mbps bandwith, and it’s recording on motion so i presume that shouldn’t be a problem for the router ?

56

So i managed to continue configuring AP, i tried to use @anav AP/switch config (i used vlan id’s and everything from my main router) and i get 3 separate WiFi, but can’t get IP… (At least mgmt port is working…)

Here is my sad attempt at configuring AP:

# jan/02/1970 01:12:40 by RouterOS 7.2rc4
# software id = 
#
# model = RB952Ui-5ac2nD
# serial number = 
/interface bridge
add ingress-filtering=no name=bridgeAP vlan-filtering=yes
/interface vlan
add interface=bridgeAP name=CCTV_network vlan-id=20
add interface=bridgeAP name=Guest_network vlan-id=15
add interface=bridgeAP name=Home_network vlan-id=10
/interface list
add name=Home
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Home \
    supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Guest \
    supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=CCTV \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n basic-rates-b="" country=\
    croatia disabled=no frequency=2437 mode=ap-bridge name=GostiWiFi \
    rate-set=configured security-profile=Guest skip-dfs-channels=all ssid=\
    GostiWiFi supported-rates-b=11Mbps wireless-protocol=802.11 wmm-support=\
    enabled wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-onlyac channel-width=20/40mhz-Ce \
    country=croatia disabled=no mode=ap-bridge name=KucniWifi \
    security-profile=Home skip-dfs-channels=all ssid=Kucni_WiFi \
    wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=XX:XX:XX:XX:XX:XX \
    master-interface=GostiWiFi multicast-buffering=disabled name=\
    Mreza_za_Goste_15 security-profile=Guest ssid=Gosti vlan-id=15 vlan-mode=\
    use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled wps-mode=\
    disabled
add disabled=no keepalive-frames=disabled mac-address=XX:XX:XX:XX:XX:XX \
    master-interface=GostiWiFi multicast-buffering=disabled name=\
    CCTV_mreza_20 security-profile=CCTV ssid=CCTV vlan-id=20 vlan-mode=\
    use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled wps-mode=\
    disabled
add disabled=no keepalive-frames=disabled mac-address=XX:XX:XX:XX:XX:XX \
    master-interface=KucniWifi multicast-buffering=disabled name=\
    Kucna_mreza_10 security-profile=Home ssid="Kucni wifi" vlan-id=10 \
    vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled \
    wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/interface bridge port
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
    interface=Kucna_mreza_10 pvid=10
add bridge=bridgeAP interface=ether1
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
    interface=Mreza_za_Goste_15 pvid=15
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
    interface=CCTV_mreza_20 pvid=20
/ip neighbor discovery-settings
set discover-interface-list=Home
/interface bridge vlan
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Kucna_mreza_10 vlan-ids=\
    10
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Mreza_za_Goste_15 \
    vlan-ids=15
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=CCTV_mreza_20 vlan-ids=20
/interface list member
add interface=Kucna_mreza_10 list=Home
add interface=Mreza_za_Goste_15 list=Home
add interface=CCTV_mreza_20 list=Home
/ip address
add address=172.16.50.1/24 interface=ether2 network=172.16.50.0
add address=172.16.10.254/24 interface=ether1 network=172.16.10.0
/ip dns
set allow-remote-requests=yes servers=172.16.10.1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=172.16.10.1
57

A few things…

(1) Only the trusted subnet has to be defined under vlans. I prefer to do all of them if nothing else to communicate to yourself or the reader what is traveling through the device. (no change required).
/interface vlan
add interface=bridgeAP name=CCTV_network vlan-id=20
add interface=bridgeAP name=Guest_network vlan-id=15
add interface=bridgeAP name=Home_network vlan-id=10

(2) The only items that need to be added to the HOME interface list are
a. the trusted subnet
b. any port you designated as an OFF bridge access.

Should look like ( MODIFY your setup!! )
/interface list member
add interface=Kucna_mreza_10 list=Home
add interface=ether2 list=Home

(3) THE MAIN PROBLEM - Your IP address is incorrectly assigned to ether1. FIX ASAP!!
Corrected
/ip address
add address=172.16.50.1/24 interface=ether2 network=172.16.50.0
add address=172.16.10.254/24 interface**=Home_network** network=172.16.10.0

EDIT: Fixed due to Bucks keen eye!!!


(4) MISSING TWO ITEMS… ADD!!

A. /ip neighbor discovery-settings
set discover-interface-list=Home

B. /ip tool
/ip tool mac-server mac-winbox
set allowed-interface-list=Home

58

@anav, I realize you know more about this than me, but can you explain why the address should be added to bridgeAP instead of Home_network? Since this is for vlan 10 (not the base PVID 1).

e.g. like this: add address=172.16.10.254/24 interface=Home_network network=172.16.10.0

From config:

/interface vlan
add interface=bridgeAP name=CCTV_network vlan-id=20
add interface=bridgeAP name=Guest_network vlan-id=15
add interface=bridgeAP name=Home_network vlan-id=10

59

Because I screwed up Buckeye! ( my apologies there giga…)
Good eye (pun intended) and thanks!.. note to self, dont try and address multiple problems in the same time frame.
As per the User article it should be an IP address on the Trusted subnet. Not sure what I was thinking !!!

This is indeed still wrong
add address=172.16.10.254/24 interface=ether1 network=172.16.10.0
and the correction as you pointed out should be…
add address=172.16.10.254/24 interface=Home_network1 network=172.16.10.0

60

So I did the changes and my devices still can’t get IP address. I also changed 172.16.10.254 to 253 because my laptop is on 254.

Here is the config:

# jan/02/1970 01:12:40 by RouterOS 7.2rc4
# software id = 
#
# model = RB952Ui-5ac2nD
# serial number = 
/interface bridge
add ingress-filtering=no name=bridgeAP vlan-filtering=yes
/interface vlan
add interface=bridgeAP name=CCTV_network vlan-id=20
add interface=bridgeAP name=Guest_network vlan-id=15
add interface=bridgeAP name=Home_network vlan-id=10
/interface list
add name=Home
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Home \
    supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Guest \
    supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=CCTV \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n basic-rates-b="" country=\
    croatia disabled=no frequency=2437 mode=ap-bridge name=GostiWiFi \
    rate-set=configured security-profile=Guest skip-dfs-channels=all ssid=\
    GostiWiFi supported-rates-b=11Mbps wireless-protocol=802.11 wmm-support=\
    enabled wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-onlyac channel-width=20/40mhz-Ce \
    country=croatia disabled=no mode=ap-bridge name=KucniWifi \
    security-profile=Home skip-dfs-channels=all ssid=Kucni_WiFi \
    wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=XX:XX:XX:XX:XX:XX \
    master-interface=GostiWiFi multicast-buffering=disabled name=\
    Mreza_za_Goste_15 security-profile=Guest ssid=Gosti vlan-id=15 vlan-mode=\
    use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled wps-mode=\
    disabled
add disabled=no keepalive-frames=disabled mac-address=XX:XX:XX:XX:XX:XX \
    master-interface=GostiWiFi multicast-buffering=disabled name=\
    CCTV_mreza_20 security-profile=CCTV ssid=CCTV vlan-id=20 vlan-mode=\
    use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled wps-mode=\
    disabled
add disabled=no keepalive-frames=disabled mac-address=XX:XX:XX:XX:XX:XX \
    master-interface=KucniWifi multicast-buffering=disabled name=\
    Kucna_mreza_10 security-profile=Home ssid="Kucni wifi" vlan-id=10 \
    vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled \
    wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/interface bridge port
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
    interface=Kucna_mreza_10 pvid=10
add bridge=bridgeAP interface=ether1
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
    interface=Mreza_za_Goste_15 pvid=15
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
    interface=CCTV_mreza_20 pvid=20
/ip neighbor discovery-settings
set discover-interface-list=Home
/interface bridge vlan
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Kucna_mreza_10 vlan-ids=\
    10
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Mreza_za_Goste_15 \
    vlan-ids=15
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=CCTV_mreza_20 vlan-ids=20
/interface list member
add interface=Kucna_mreza_10 list=Home
add interface=Mreza_za_Goste_15 list=Home
add interface=CCTV_mreza_20 list=Home
/ip address
add address=172.16.50.1/24 interface=ether2 network=172.16.50.0
add address=172.16.10.253/24 interface=Home_network network=172.16.10.0
/ip dns
set allow-remote-requests=yes servers=172.16.10.1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=172.16.10.1

Regarding adding VLANs 15 and 20 instead only 10, is it okay if i do that way in the future ? As you said, it’s maybe easier to know what is happening.