… good just one more step…
/ip address
add address=172.16.50.1/24 interface=ether2 network=172.16.50.0
add address=172.16.10.253/24 interface**=Home_network** network=172.16.10.0
Did you assign the address .253 manually on the AP, (its what I would do).
Next step is to go to the Router and DHCP leases, with the mac address of the AP and add your AP to the vlan manually, as a fixed static IP.
If you do that, the hap ac lite will try to route within the hap ac lite, because it will have “connected” routes to all subnets.
In my opinion, if you want to have a single place to control inter-vlan routing, it would be better to do all intervlan routing from the same device where the firewall is defined.
I didn’t think you wanted to allow guest to log into the hap ac lite anyway.
Edit: I don’t even think you need the vlan interface for 15 an 20 on the hap ac lite. Since it is essentially just acting as a L2 bridge with one interace to manage it from.
In other words, I think these lines are NOT needed:
/interface vlan
add interface=bridgeAP name=CCTV_network vlan-id=20
add interface=bridgeAP name=Guest_network vlan-id=15
add interface=bridgeAP name=Home_network vlan-id=10
as they represent the hap ac lite routing block’s connection to the bridge, and we won’t be doing routing on the hap ac lite, just bridging(switching) at the ethernet mac layer. Inter-vlan routing and firewalling will be delegated to the hEX (or RB4011 when it is configured).
Interesting discussion, I concur they are not required, but thought it was not harmful in at least having them there as explanation.
Seems like that might not be the case. Good tip, I will look into it and modify my useful article if necessary.
… good just one more step…
/ip address
add address=172.16.50.1/24 interface=ether2 network=172.16.50.0
add address=172.16.10.253/24 interface=Home_network network=172.16.10.0Did you assign the address .253 manually on the AP, (its what I would do).
Next step is to go to the Router and DHCP leases, with the mac address of the AP and add your AP to the vlan manually, as a fixed static IP.
Yes, I manually assigned 172.16.10.253/24 on the AP but… I didn’t assign static IP on the router… I forgot about that… Will do that when i’m back from work.
So I just need to add trusted subnet, in my case Home_network @ 172.16.10.0/24, and then i add into HAP’s bridge new configured virtual wifi interfaces and untagged them with the correct ID ? And Hex will send all VLAN’s from his ether5 which is tagged for all VLANs(10,15,20) to ether1 on hap lite where are ether1 and bridgeAP tagged so they accept all VLANs . And then virtual wifi interfaces are access ports, i untagged them with vlan’s i want on that interface. I hope i understand correctly.
To be honest, I haven’t looked at how this works, my assumption was that there would still be a single bridge, but that part of it would be software based but with an “internal” trunk to the switch chip.
I drew this up, before I really read your post closely.
Then I found this @pcunite Access Point setup and after skimming it, it think it is reasonably close to your config, with the exception that they have a more proper Management only vlan, where yours is using the “home” vlan as the management access vlan.
But I will defer to others on this, because I have no way to test, since all I have is the hEX S with no wifi.
Note that you could enable other ports on the hAP ac lite to be access ports for vlans of your choosing, but if in a work environment, you would probably want the other ports disabled, or limited to being access ports for the guest vlan. In a home, I don’t think that is a requirement, but how it is configured is up to your discretion.
Damn, that is really detail schematics 
I can test whatever is needed, no problem at all.
Regarding other ports, i can configure it for the sake of learning but in reality, when i setup proper network, i will use cAP ac, they have 2 ports, one trunk and one will be managment so… Right now i have only one cAP ac, but when all equipement arrive and i have some spare time, i will make proper network.
I will draw network diagram later
I stole most of that from the hap ac lite block diagram. These block diagrams exist for all MikroTik routers that I have been interested in.
Look in the product page https://mikrotik.com/product/RB952Ui-5ac2nD#fndtn-downloads
So in HexS under Leases i added IP address i reserved for AP = 172.16.10.253. I added MAC address and choose dhcp server dhcp1 but there is no connection. Status is waiting
Here is new HexS config:
# mar/25/2022 16:27:35 by RouterOS 7.2rc4
# software id = 2NZF-BKUH
#
# model = RB760iGS
# serial number = D4500FA09027
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf \
ingress-filtering=no name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=CCTV_network vlan-id=20
add interface=bridge name=Guest_network vlan-id=15
add interface=bridge name=Home_network vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=Home
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=172.16.10.2-172.16.10.254
add name=dhcp_pool2 ranges=172.16.15.2-172.16.15.254
add name=dhcp_pool3 ranges=172.16.20.2-172.16.20.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=Home_network name=dhcp1
add address-pool=dhcp_pool2 interface=Guest_network name=dhcp2
add address-pool=dhcp_pool3 interface=CCTV_network name=dhcp3
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether4 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged \
interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=Home
/interface bridge vlan
add bridge=bridge tagged=bridge,ether5 untagged=ether4,ether3 vlan-ids=10
add bridge=bridge tagged=bridge,ether5 vlan-ids=15
add bridge=bridge tagged=bridge,ether5 vlan-ids=20
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=Home_network list=Home
add interface=ether2 list=Home
add interface=Home_network list=LAN
add interface=Guest_network list=LAN
add interface=CCTV_network list=LAN
/ip address
add address=172.16.0.1/24 interface=ether2 network=172.16.0.0
add address=172.16.10.1/24 interface=Home_network network=172.16.10.0
add address=172.16.15.1/24 interface=Guest_network network=172.16.15.0
add address=172.16.20.1/24 interface=CCTV_network network=172.16.20.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=172.16.10.254 client-id=1:zz:zz:zz:zz:zz:zz comment="Admin laptop" \
mac-address=ZZ:ZZ:ZZ:ZZ:ZZ:ZZ server=dhcp1
add address=172.16.10.253 mac-address=YY:YY:YY:YY:YY:YY \
server=dhcp1
/ip dhcp-server network
add address=172.16.10.0/24 gateway=172.16.10.1
add address=172.16.15.0/24 gateway=172.16.15.1
add address=172.16.20.0/24 gateway=172.16.20.1
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=172.16.10.254 list=authorized
add address=172.16.0.2 list=authorized
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="Winbox access" dst-port=8291 \
in-interface-list=Home protocol=tcp src-address-list=authorized
add action=accept chain=input comment="Service (DNS)" dst-port=53 \
in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Service (DNS)" dst-port=53 \
in-interface-list=LAN protocol=tcp
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=input comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system clock
set time-zone-name=Europe/Zagreb
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=Home
Given your situation, I would partition the problem.
First make sure dhcp is working on every vlan when connected through the RB760iGS. If it doesn’t work there, it won’t work from the other side of a trunk port and wifi bridge. You should be able to connect a PC into RB760iGS port 4 and get an address from dhcp1 server in the 172.16.10.0/24 network. But if you plan to use the laptop across multiple vlans, the following section may cause a problem, but I don’t know for sure what the following does
/ip dhcp-server lease
add address=172.16.10.254 client-id=1:zz:zz:zz:zz:zz:zz comment=“Admin laptop”
mac-address=ZZ:ZZ:ZZ:ZZ:ZZ:ZZ server=dhcp1
add address=172.16.10.253 mac-address=YY:YY:YY:YY:YY:YY
server=dhcp1
so I looked in DHCP Server documentation and I don’t see any answer.
I am not understanding the documentation and how it relates to actual behavior on v7.2rc5 on an RB760iGS
DHCP Documentation from help.mikrotik.com
There seems to be only a small intersection between what /ip dhcp-server lease add [tab] shows and what the documentation shows here ROS/DHCP#DHCP-Parameters
[demo@MikroTik] /ip/dhcp-server/lease> add
address client-id disabled queue-type
address-lists comment insert-queue-before rate-limit
allow-dual-stack-queue copy-from lease-time routes
always-broadcast dhcp-option mac-address server
block-access dhcp-option-set parent-queue use-src-mac
I assume it is assigning a static mapping between a MAC address and what address the dhcp-server will return to a client with that MAC address, but the documentation needs to be updated, and the dhcp-server in v7.2rc5 needs some additional work if many of the options in the documentation work in v6 (I have never used ROS v6, so I am only assuming that the documentation was copied from v6, and that it isn’t all working yet in v7).
/ip dhcp-server network
add address=172.16.10.0/24 gateway=172.16.10.1
add address=172.16.15.0/24 gateway=172.16.15.1
add address=172.16.20.0/24 gateway=172.16.20.1
Shouldn’t you be specifying a dns-server with each dhcp-server?
If a PC plugged into ether4 works, and can get to the internet, the next step will be to test the other vlans by reconfiguring bridge port ether3 to use a different pvid (and probably you will need to change the bridge vlan setting for the vlan specified by the pvid applied to ether3). Then verify that the PC connected to ether3 can get an ip address from the Guest and CCTV pools (when set to the appropriate pvid / vlan) After you have that working, then we will move to the hAP ac Lite (and start with adding access ports for each vlan using the available ethernet ports). Then when that’s working we can move to the wifi.
So I tried to asign every VLAN to ether4 and i get IP with correct format (172.16.15.x for VLAN_15, 172.16.20.x for VLAN_20), and i get internet access (I’m writing this while on VLAN20) so i can presume that there is no problem with wire connection on hexs. (I untagged every VLAN on desired port and i changed PVID in port settings)
Regarding specifying dns-server in dhcp server, i don’t know, but it’s working without it.
Ok, i tried to untag ether3 on switch/AP and nothing, can’t get IP, so something is wrong with switch settings ? I have aruba smart switch so i can test if i can get all vlans on him.
I wouldn’t untag multiple vlans on the same port, maybe that’s not what you did, but what you said makes it sound like there were multiple vlans on the port. PVID only tells the switch what to do with incoming untagged ethernet frames. Having multiple vlans definged for the bridge port but untagging them all can lead to interesting results. I’ve seen it done on TP-Link SG108E switches to have asymmetric vlans for “port isolation”, but that’s not the way port isolation is usually implemented.
If you use ipconfig /all it will display more info, like this:
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . :
IPv4 Address. . . . . . . . . . . : 192.168.101.196(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, March 07, 2022 11:40:33 PM
Lease Expires . . . . . . . . . . : Sunday, March 27, 2022 5:35:26 PM
Default Gateway . . . . . . . . . : 192.168.101.1
DHCP Server . . . . . . . . . . . : 192.168.101.1
DHCPv6 IAID . . . . . . . . . . . : 247214171
DHCPv6 Client DUID. . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.101.1
NetBIOS over Tcpip. . . . . . . . : Enabled
Can you tell us what is not working? Is it that you are not getting an IP address from the dhcp server when you connect to the wifi on the hap ac lite?
If that’s the case, we need to add some access ports on the switch on the hap ac lite, and connect wired connections there to see if dhcp works. That will tell us if the problem is the trunk link or something with the wifi setup or link to the bridge. And I won’t be of much help there.
First, can you connect to the hap ac lite from the a PC connected to vlan 10? Can you ping 172.16.10.253 (the management interface on the hap ac lite) from a PC connected to the HEX vlan 10?
I just saw this:
Can you post updated hap ac lite config? before and after if you make change below.
Try the following on the hap ac lite
/interface bridge port
add interface=ether2 pvid=10
add interface=ether3 pvid=15
add interface=ether4 pvid=20
/interface bridge vlan
set bridge=bridgeAP tagged=ether1,bridgeAP untagged=Kucna_mreza_10**,ether2** vlan-ids=10
set bridge=bridgeAP tagged=ether1,bridgeAP untagged=Mreza_za_Goste_15**,ether3** vlan-ids=15
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=CCTV_mreza_20**,ether4** vlan-ids=20
Okey, so to clarify what i did:
First I untagged ether4 for VLAN15, then i changed PVID to 15, plugged the laptop into ether4, i get IP address and internet access.
Then i untagged ether4 for VLAN20, then i changed PVID to 20, plugged the laptop into ether4, i get IP address and internet access.
I didn’t untag all vlans at the same time as i presume that won’t work.
When i tried to ping 172.16.10.253 i get destination host unreachable.
When i tried to untag ports on switch/AP i cant get IP address
Here is config before changes (just my test)
# jan/02/1970 07:34:35 by RouterOS 7.2rc5
# software id =
#
# model = RB952Ui-5ac2nD
# serial number =
/interface bridge
add ingress-filtering=no name=bridgeAP vlan-filtering=yes
/interface vlan
add interface=bridgeAP name=CCTV_network vlan-id=20
add interface=bridgeAP name=Guest_network vlan-id=15
add interface=bridgeAP name=Home_network vlan-id=10
/interface list
add name=Home
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Home \
supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Guest \
supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=CCTV \
supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n basic-rates-b="" country=\
croatia disabled=no frequency=2437 mode=ap-bridge name=GostiWiFi \
rate-set=configured security-profile=Guest skip-dfs-channels=all ssid=\
GostiWiFi supported-rates-b=11Mbps wireless-protocol=802.11 wmm-support=\
enabled wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-onlyac channel-width=20/40mhz-Ce \
country=croatia disabled=no mode=ap-bridge name=KucniWifi \
security-profile=Home skip-dfs-channels=all ssid=Kucni_WiFi \
wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address= \
master-interface=GostiWiFi multicast-buffering=disabled name=\
Mreza_za_Goste_15 security-profile=Guest ssid=Gosti vlan-id=15 vlan-mode=\
use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled wps-mode=\
disabled
add disabled=no keepalive-frames=disabled mac-address= \
master-interface=GostiWiFi multicast-buffering=disabled name=\
CCTV_mreza_20 security-profile=CCTV ssid=CCTV vlan-id=20 vlan-mode=\
use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled wps-mode=\
disabled
add disabled=no keepalive-frames=disabled mac-address= \
master-interface=KucniWifi multicast-buffering=disabled name=\
Kucna_mreza_10 security-profile=Home ssid="Kucni wifi" vlan-id=10 \
vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled \
wps-mode=disabled
/interface bridge port
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
interface=Kucna_mreza_10 pvid=10
add bridge=bridgeAP frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
interface=Mreza_za_Goste_15 pvid=15
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
interface=CCTV_mreza_20 pvid=20
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
interface=ether3 pvid=10
/ip neighbor discovery-settings
set discover-interface-list=Home
/interface bridge vlan
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Kucna_mreza_10,ether3 \
vlan-ids=10
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Mreza_za_Goste_15 \
vlan-ids=15
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=CCTV_mreza_20 vlan-ids=20
/interface list member
add interface=Kucna_mreza_10 list=Home
add interface=ether2 list=Home
/ip address
add address=172.16.50.1/24 interface=ether2 network=172.16.50.0
add address=172.16.10.253/24 interface=Home_network network=172.16.10.0
/ip dns
set allow-remote-requests=yes servers=172.16.10.1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=172.16.10.1
/system package update
set channel=testing
/tool mac-server mac-winbox
set allowed-interface-list=Home
And here is after @anav config changes (Note: when i tried to input for eg. add interface=ether3 pvid=10 when i hit enter it asked me to provide bridge so i put bridgeAP. When i tried to input other command it asked me for a nubmer at the end, i just hit enter and then i saw that none of the interfaces were untagged so i untag them manually)
# jan/02/1970 07:42:53 by RouterOS 7.2rc5
# software id =
#
# model = RB952Ui-5ac2nD
# serial number =
/interface bridge
add ingress-filtering=no name=bridgeAP vlan-filtering=yes
/interface vlan
add interface=bridgeAP name=CCTV_network vlan-id=20
add interface=bridgeAP name=Guest_network vlan-id=15
add interface=bridgeAP name=Home_network vlan-id=10
/interface list
add name=Home
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Home \
supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Guest \
supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=CCTV \
supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n basic-rates-b="" country=\
croatia disabled=no frequency=2437 mode=ap-bridge name=GostiWiFi \
rate-set=configured security-profile=Guest skip-dfs-channels=all ssid=\
GostiWiFi supported-rates-b=11Mbps wireless-protocol=802.11 wmm-support=\
enabled wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-onlyac channel-width=20/40mhz-Ce \
country=croatia disabled=no mode=ap-bridge name=KucniWifi \
security-profile=Home skip-dfs-channels=all ssid=Kucni_WiFi \
wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address= \
master-interface=GostiWiFi multicast-buffering=disabled name=\
Mreza_za_Goste_15 security-profile=Guest ssid=Gosti vlan-id=15 vlan-mode=\
use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled wps-mode=\
disabled
add disabled=no keepalive-frames=disabled mac-address= \
master-interface=GostiWiFi multicast-buffering=disabled name=\
CCTV_mreza_20 security-profile=CCTV ssid=CCTV vlan-id=20 vlan-mode=\
use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled wps-mode=\
disabled
add disabled=no keepalive-frames=disabled mac-address= \
master-interface=KucniWifi multicast-buffering=disabled name=\
Kucna_mreza_10 security-profile=Home ssid="Kucni wifi" vlan-id=10 \
vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wmm-support=enabled \
wps-mode=disabled
/interface bridge port
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
interface=Kucna_mreza_10 pvid=10
add bridge=bridgeAP frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
interface=Mreza_za_Goste_15 pvid=15
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged \
interface=CCTV_mreza_20 pvid=20
add bridge=bridgeAP interface=ether3 pvid=10
add bridge=bridgeAP interface=ether4 pvid=15
add bridge=bridgeAP interface=ether5 pvid=20
/ip neighbor discovery-settings
set discover-interface-list=Home
/interface bridge vlan
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Kucna_mreza_10,ether3 \
vlan-ids=10
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Mreza_za_Goste_15,ether4 \
vlan-ids=15
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=CCTV_mreza_20,ether5 \
vlan-ids=20
/interface list member
add interface=Kucna_mreza_10 list=Home
add interface=ether2 list=Home
/ip address
add address=172.16.50.1/24 interface=ether2 network=172.16.50.0
add address=172.16.10.253/24 interface=Home_network network=172.16.10.0
/ip dns
set allow-remote-requests=yes servers=172.16.10.1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=172.16.10.1
/system package update
set channel=testing
/tool mac-server mac-winbox
set allowed-interface-list=Home
how are you getting connected to the hap ac lite?
Is link status up on trunk between hex and hap?
/interface ethernet print detail
if you issue /interface bridge host print on the hap and the hex can you see more than one ethernet mac address for each vid
https://jcutrer.com/howto/networking/mikrotik/show-mac-address-table
what about /ip arp print
Yes, I had several errors there… sorry.
As far as the number I think you have to use [ find … ] but I haven’t quite figured out the syntax in every case.
Using WinBox makes modifying existing things easier than the command line, at least on a one off situation.
For example from another post I made today.
So on hAP ac lite i have ether2 as managment port with diferent address (172.16.50.1) and that is how i connect to AP and make any changes.
Here you can see what i get when i list interfaces:
For ether1 on hac ac lite i only see one mac address and that is only for vid 10
for arp print on hap ac lite i get:
0 DC 172.16.10.1 mac address Home_network
1 DC 172.16.50.2 mac address ether1
On hexs:
0 D 172.16.20.254 Same MAC CCTV_network
1 D 172.16.15.254 Same MAC Guest_network
2 DC 172.16.10.253 Different MAC Home_network
3 DC 172.16.10.254 Same MAC Home_network
4 DC 172.16.10.254 Same MAC Guest_network
5 D 192.168.1.106 No MAC ether1
6 DC 192.168.1.1 Different MAC ether1
Why are you putting vlans inside wifi settings?
They only need to be connected to the WLAN at the bridge port setting…
Further why do you have FIVE WLANS?
What are the other two for??
Here is a fixed up config… You dont need to identify the other vlans as they are simply going through the ap/switch from ether1 to their respective bridge port.
Also, they do not need to be tagged to the bridge either! Added refinements to bridge ports…
The five wlans have been reduced to THREE set wlan1, set wlan2, add virtual wlan
/interface bridge
add ingress-filtering=no name=bridgeAP vlan-filtering=yes
/interface vlan
add interface=bridgeAP name=Home_network vlan-id=10
/interface list
add name=Home
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Home \
supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=Guest \
supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=CCTV \
supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n basic-rates-b="" country=\
croatia disabled=no frequency=2437 mode=ap-bridge name=Mreza_za_Goste_15 \
rate-set=configured security-profile=Guest skip-dfs-channels=all ssid=\
GostiWiFi supported-rates-b=11Mbps wireless-protocol=802.11 wmm-support=\
enabled wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-onlyac channel-width=20/40mhz-Ce \
country=croatia disabled=no mode=ap-bridge name=Kucna_mreza_10 \
security-profile=Home skip-dfs-channels=all ssid=Kucni_WiFi \
wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address= \
master-interface=GostiWiFi multicast-buffering=disabled name=\
CCTV_mreza_20 security-profile=CCTV ssid=CCTV vwds-cost-range=0\
wds-default-cost=0 wmm-support=enabled wps-mode=disabled
/interface bridge port
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes\
interface=Kucna_mreza_10 pvid=10
add bridge=bridgeAP frame-types=admit-only-vlan-tagged ingress filtering=yes
interface=ether1
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes \
interface=Mreza_za_Goste_15 pvid=15
add bridge=bridgeAP frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes\
interface=CCTV_mreza_20 pvid=20
add bridge=bridgeAP interface=ether3 pvid=10 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridgeAP interface=ether4 pvid=15 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridgeAP interface=ether5 pvid=20 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
/ip neighbor discovery-settings
set discover-interface-list=Home
/interface bridge vlan
add bridge=bridgeAP tagged=ether1,bridgeAP untagged=Kucna_mreza_10,ether3 \
vlan-ids=10
add bridge=bridgeAP tagged=ether1 untagged=Mreza_za_Goste_15,ether4 \
vlan-ids=15
add bridge=bridgeAP tagged=ether1 untagged=CCTV_mreza_20,ether5 \
vlan-ids=20
/interface list member
add interface=Home_network list=Home
add interface=ether2 list=Home
/ip address
add address=172.16.50.1/24 interface=ether2 network=172.16.50.0
add address=172.16.10.253/24 interface=Home_network network=172.16.10.0
/ip dns
set allow-remote-requests=yes servers=172.16.10.1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=172.16.10.1
/system package update
set channel=testing
/tool mac-server mac-winbox
set allowed-interface-list=Home
Because im an idiot… i added three virtual wireless interfaces… and i didn’t use real interfaces at all… So i assign vlans at bridge port settings only, i don’t touch anything else
Tommorow i will change configuration (i will leave ether3,4 and 5 for now just for testing, later i will disable them as they are not needed)
Correct… it all depends if your fingers obey the brain when making the changes. 