I welcome any feedback on this access point configuration I have developed for deployment in the network.
When I worked for a corporation, IT coffee sessions provided the opportunity for peer review of ideas. In a one-man-IT shop for a small rural farming network, I don’t have that luxury. I am short on experience using MikroTik network devices. I am looking to community members for peer review.
This is my third deployment of an AP. The other two don’t use VLANs. This one does. In developing this configuration, I’ve created a procedure that would enable me to move the legacy AP to this VLAN arrangement.
The network vlan infrastructure (i.e. switch, routers) already exists today. My goal is to manage network devices on a management vlan42. This configuration enables me to do that while keeping client traffic on vlan70.
I have bench-tested this configuration in the lab. The lab has a router that has a configuration reflecting production. Before deployment, I wish for an experienced MikroTik person(s) to examine it and provide feedback.
[admin@legg_AP] > export
# 2026-09-01 11:15:34 by RouterOS 7.23.2
# software id = KMRS-W937
#
# model = L22UGS-5HaxD2HaxD
# serial number =
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge pvid=70 vlan-filtering=yes
/interface vlan
add comment="Management VLAN42" interface=bridge name=vlan42_MGMT vlan-id=42
/interface list
add comment="Management interfaces" name=MGMT_IF
/interface wifi channel
add band=5ghz-ax frequency=5180 name=5GHZ::CH36 width=20mhz
add band=5ghz-ax frequency=5200 name=5GHZ::CH40 width=20mhz
add band=5ghz-ax frequency=5220 name=5GHZ::CH44 width=20mhz
add band=5ghz-ax frequency=5240 name=5GHZ::CH48 width=20mhz
add band=5ghz-ax frequency=5745 name=5GHZ::CH149 width=20mhz
add band=5ghz-ax frequency=5765 name=5GHZ::CH153 width=20mhz
add band=5ghz-ax frequency=5785 name=5GHZ::CH157 width=20mhz
add band=5ghz-ax frequency=5805 name=5GHZ::CH161 width=20mhz
add band=5ghz-ax frequency=5825 name=5GHZ::CH165 width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5200,5220,5240 name=5GHZ::UNII-1 width=20mhz
add band=5ghz-ax disabled=no frequency=5745,5765,5785,5805,5825 name=5GHZ::UNII-3 width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5200,5220,5240,5745,5765,5785,5805,5825 name=5GHZ::NON-DFS width=20mhz
add band=2ghz-ax frequency=2412 name=2GHZ::CH1 width=20mhz
add band=2ghz-ax frequency=2437 name=2GHZ::CH6 width=20mhz
add band=2ghz-ax frequency=2462 name=2GHZ::CH11 width=20mhz
add band=2ghz-ax disabled=no frequency=2412,2437,2462 name=2GHZ::AUTO width=20mhz
/interface wifi
set [ find default-name=wifi1 ] channel=2GHZ::AUTO channel.band=2ghz-ax .frequency=2412,2437,2462 .skip-dfs-channels=10min-cac .width=20mhz \
comment=yard_2G configuration.country=Canada .mode=ap .ssid=yard_2G .tx-chains="" disabled=no name=wifi1_2G \
security.authentication-types=wpa2-psk,wpa3-psk .encryption="" .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel=5GHZ::NON-DFS channel.band=5ghz-ax .frequency=5180,5200,5220,5240,5745,5765,5785,5805,5825 \
.skip-dfs-channels=10min-cac .width=20mhz comment=yard_5G configuration.country=Canada .mode=ap .ssid=yard_5G disabled=no name=wifi2_5G \
security.authentication-types=wpa2-psk,wpa3-psk .encryption="" .ft=yes .ft-over-ds=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether1 pvid=70
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge interface=wifi1_2G pvid=70
add bridge=bridge interface=wifi2_5G pvid=70
/ip neighbor discovery-settings
set discover-interface-list=none
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge comment="VLAN42 Management" tagged=bridge,ether1 vlan-ids=42
add bridge=bridge comment="VLAN70 Clients" tagged=bridge,ether1 untagged=wifi1_2G,wifi2_5G vlan-ids=70
/interface list member
add interface=vlan42_MGMT list=MGMT_IF
/ip address
add address=192.168.42.23/24 comment="VLAN42 Management" interface=vlan42_MGMT network=192.168.42.0
/ip dns
set servers=149.112.121.20,149.112.122.20
/ip firewall address-list
add address=192.168.42.200 comment=Management list=MGMT
add address=192.168.42.201 comment=Management list=MGMT
add address=192.168.42.1 comment="VLAN42 Router - Emergency SSH Management" list=MGMT
/ip firewall filter
add action=drop chain=input comment="Drop invalid" connection-state=invalid
add action=accept chain=input comment="Allow from MGMT host" dst-port=22,80,8291 protocol=tcp src-address-list=MGMT
add action=accept chain=input comment="Allow established/related" connection-state=established,related
add action=accept chain=input comment="Allow ping" protocol=icmp
add action=drop chain=input comment="Drop everything else"
/ip firewall nat
add action=masquerade chain=srcnat comment=masquerade out-interface=bridge out-interface-list=all
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.42.1
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
set reverse-proxy disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set strong-crypto=yes
/snmp community
add addresses=::/0
/system clock
set time-zone-name=
/system identity
set name=legg_AP
/system ntp client
set enabled=yes
/system ntp client servers
add address=ca.pool.ntp.org
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=MGMT_IF
/tool mac-server ping
set enabled=no