VLANs and Virtual AP's

RouterOS Wireless Networking
1

I have a need for both tagged and untagged virtual AP’s. All interfaces need to be bridged out the ether1 port with tags intact.

Here is the history of what i have tried.

  1. Bridging the vlan interfaces and the nontagged virtual ap interfaces to the ether1 port. Failure: The vlan interfaces failed to pass traffic.

  2. Bridging all virtual ap’s to the ether1 port. The vlans failed to tag the packets as the bridging occurs before the tagging.

  3. Bridging all virtual AP’s and tag the appropriate virtual ap’s with a tag. I cannot seem to get this to happen.

Any thoughts?

David

2
  • Create vlan interfaces on ether1
  • Create virtual access point interfaces
  • Create a bridge for each pair of virtual-AP and VLAN interface that should go together
  • Do NOT included the native ether1 interface in any bridge


    –Tom
3

Thanks a ton to Butch Evans for his timely help!

Here is what ended up working.

  1. Create a Virtual AP
  2. Create a vlan for each AP and a matching one for ether1
  3. Create a bridge for each vlan
  4. Insert into each bridge both matching vlans and the virtual AP.

This solution allowed us to send tagged traffic that was segmented by each virtual AP.

David

4

I think Tom provided similar scenario, but interesting way to accomplish your scenario would be:

  • create Virtual AP interfaces;
  • add to bridge required VAP interfaces+Ether1;
  • use ‘bridge nat’ to assign/deassign VLAN-ID for the specific host’s data.
5

am english I understand time hard

Is there a version of these instructions that is a bit more verbose and easy to understand?

6

An alternative solution is:

1.-Create the VAP that you need on Wlan
2.-For each VAP you need create a VLAN, The interface for the vlan must be Ether1
3.-Add the BRIDGE and then add the ports. For example Bridge1 = (vlan1-vap1), bridge2=(vlan2-vap2).

Don’t forget the VLAN NAME AND VLAN ID.

I hope help you with this

7

interesting … please i need to know:

1- why we need to make VAP ? cant vlan be on real AP only ? as I see for each AP there is on Vlan !!
2- can we pass a dhcp , hotspot or pppoe on the VLAN ? so we can make 2 kinds of networks for each AP ?

8

any helpfull answer please ?

9

I emailed support and all I got was this:

  1. Bridge VLANs interfaces not actual interfaces, to get bridged working
    properly.
    However more detailed explanation about configuration setup is necessary.


    I honestly cannot understand point 1. The language he uses follows no gramatical rules i have ever seen.

The detailed explanation was not included.

10

let us assume this scenario :

where vlan1 is for hotspot1 , vlan2 for hotspot2 they are on both ethernet in the main ROS ..
RB1 is the main AP , according to above there should be 2 vlan’s on RB1 ether1 , 2 vlan’s on RB1 Wlan ..
so we bridge ( RB1eth1 vlan1 + RB1wlan Vlan1 ) , bridge2 = ( RB1eth1 vlan2 + RB1wlan Vlan2 )
at RB2 : RB2wlan vlan1 ..
end user at RB2 may be connected via RB2eth1 and natted ..

is this correct ??? is it possible to achieve ??? any one succeeded with such scenario ???

11

We are trying to do something similar.

We have a campus with an exisitng LAN in place. There will be hotspots all over campus. We want one SSID for corporate use that will use WPA. Then an unencrypted VSSID which will vlan back to the hotspot controller for public access.

So we will have 2 networks, non-vlan and VLAN1. VLAN1 will transport over the existing non-vlan network.

So basically it is a totally bridged network and any packets going to or from the VSSID for public access need to get tagged before they are allowed on the existing LAN.

12

Yes its almost the same , but you add a VAP for public access , is there any need to make a VAP except for public access in your case ?

13

It sounds like:
“If you want to made a bridge, you have to use the virtual interface, NOT the “actual” (ether1,wlan1,etc…) interface”.
So, from this sentence, i understand something like you have to made a VLAN over your Ethernet int., a VLAN over your wireless int. (VAP or VLAN over VAP?), and bridge it together.

14

I have a similar problem,

I am running a WAN where each depot has 2 VLAN’s, namely:

VLAN1 - Default Data VLAN
VLAN192 - Voice VLAN
The switch configuration is all ports “Untagged” on VLAN1 and “Tagged” on VLAN192

All devices on VLAN1 (Untagged) get an IP from the MPLS router.
All devices on VLAN192 (Tagged) get an IP from the Voice Server.

This setup works fine, provided you tag the devices for the 192 VLAN in order to get an IP from the voice server.

What I want to do is set up a WiFi network with 2 SSID’s, namely “Data” and “Voice”. The Voice SSID needs to tag all traffic with 192 in order to connect to the voice server.

I tried the following from pervious posts:

eth0: Native LAN Interface:
eth1: Native WiFi Card – SSID “Data”
eth2: VLAN Interface to eth0
eth3: VirtualAP – SSID “Voice”

I created 2 bridges

bri0 – bridges eth0 and eth1
bri1 – bridges eth2 and eth3

I have one ethernet cable connected to the native ethernet port.

I can connect to the “Data” network and all is fine.
I cannot connect to the “Voice” network. I don’t even get an IP.

Not quite sure what is wrong with the setup.

Your assistance will be greatly appreciated.

15

I’ve pulled my hair out more than once when trying to attach multiple vlan interfaces to a physical interface. I gave up and put the vlans on a bridge instead.

Here’s a model that should get you going:
vlan_bridge.png
vlan100 and vlan200 are attached to the lan_bridge, then included as ports in their respective bridges.

Clients connecting to wlan1 will be untagged as they’re going straight into the lan_bridge and into the rest of the network. Follow standard practice for WDS.

Clients connected on VAP1 or VAP2 are put into their respective bridges, where packets will be tagged by their respective vlans as they enter the network.

16

This thread just saved my life:) I was trying to solve that problem for the last 6 hours…

I guess my searching skillz are not that great:)

MAtej

17

yep, saved me lots of tears too. creating vlans over ether1 feels intuitive for me.

funny thing is, vlan over eth1 ALMOST work. just broadcast to wlan doesnt pass.
(wired dhcp server got request on correct vlan but returning broadcast ends god knows where)

long story short: thanks for that last image, i finally got it working

18

Following up…

I just took over a network that has a number of MT routers (CCR and RB1100) that are configured with the VLANs directly on the ethernet interfaces. It seems to work just fine. I guess the person who set it up had a magic touch.

It’s scary though. One such interface is currently passing both tagged and untagged traffic, yet everything in my experience tells me it shouldn’t be working.

19

Hello. I have a similar problem: there is one mikrotik router, that connected by one interface (ether2-master-local) to FreeBSD gateway like an access point.
I want to separate lan and guests traffic. I create one vlan on FreeBSD router and configure network to work with two flows: untagged default vlan 1 is a LAN and tagged vlan 10 is a guest network. On FreeBSD router addresses will be 192.168.1.1 and 192.168.12.1. On mikrotik - 192.168.1.2 and 192.168.10.2 with gateways *.1. Two DHCP servers to both subnets is on FreeBSD router.
On mikrotik I configure first access point on wlan1 interface, create a bridge (br1) and add ether2-master-local, ether1-gateway and wlan1 to it. Than I assign ip 192.168.1.2 on br1. Everything works well. Wifi client connects and work on internet.

Than I create bridge (br2), vlan (VLAN10) and virtual AP (wlan2). Wlan2 use wlan1 as a master interface. VLAN10 use br1 as an interface. Vlan10, wlan2 added to br2. Ip address 192.168.10.2 assigned to vlan10.
From FreeBSD router I can ping 192.168.10.2 but no one can connect to wifi on wlan2. In ‘bridge->ports’ window wlan2 marked as a disabled port. Why?

Where is my mistake? Please help me to solve this problem!!!

P.S. I am trying to assign VLAN10 to physical port (ether2-master-local), but this has no effect…

20

Inactive interfaces will be marked as disabled in the bridge. Ethernet ports are inactive and disabled in the bridge if they are unplugged. Wireless ports are inactive and disabled when there are no active wireless associations.

P.S. I am trying to assign VLAN10 to physical port (ether2-master-local), but this has no effect…

Not sure what you were expecting, but if the MT is only connected via ether1, then putting the vlan on a different interface won’t help. The VLAN/Bridge/IP configuration will not have any impmact on a client’s ability to connect to the AP. Check your AP settings and try again.