CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

samreiss · Thu Jan 14, 2021 6:25 am

I am configuring a hAP AC to be a Router/Switch/AP all-in-one using CAPsMAN (I do have other APs that I'll add later, but I need to get this configuration worked out first). Here's the objective:

-3 VLANS (Private=20, Public=21, Kids=22)
-3 SSIDS to align with each VLAN

I am able to connect to SSIDs, but they do not pull an IP address from the DHCP server. Also, I can't access winbox configuration on the Private SSID. Thoughts? See anything wrong? Here's export of the configuration:

# jan/02/1970 02:00:41 by RouterOS 6.43.7
# software id = JVFK-X1M2
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 8A7D08DEEF06
/caps-man channel
add band=2ghz-b/g/n extension-channel=XX name=2ghz reselect-interval=1m
add band=5ghz-a/n/ac extension-channel=XXXX name=5ghz reselect-interval=1m
/interface bridge
add admin-mac=CC:2D:E0:E0:8D:3B auto-mac=no ingress-filtering=yes name=bridge \
    pvid=20 vlan-filtering=yes
/interface wireless
# managed by CAPsMAN
# channel: 2462/20-eC/gn(28dBm), SSID: PRIVATE_CAP, local forwarding
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto mode=ap-bridge name=wlan2ghz \
    ssid=DEFAULT wireless-protocol=802.11
# managed by CAPsMAN
# channel: 5180/20-Ceee/ac(27dBm), SSID: PRIVATE_CAP, local forwarding
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto mode=\
    ap-bridge name=wlan5ghz ssid=DEFAULT wireless-protocol=802.11
/interface vlan
add interface=bridge name=vlan-20-private vlan-id=20
add interface=bridge name=vlan-21-public vlan-id=21
add interface=bridge name=vlan-22-kids vlan-id=22
add interface=bridge name=vlan-23-vpn-mn-stillwater vlan-id=23
/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=\
    datapath-20-private vlan-id=20 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=no local-forwarding=yes name=\
    datapath-21-public vlan-id=21 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=\
    datapath-22-kids vlan-id=22 vlan-mode=use-tag
/caps-man security
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm \
    group-encryption=aes-ccm name=security-20-private
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm \
    group-encryption=aes-ccm name=security-21-public
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm \
    group-encryption=aes-ccm name=security-22-kids
/caps-man configuration
add channel=2ghz country="united states3" datapath=datapath-20-private mode=\
    ap name=cfg-20-private-2ghz security=security-20-private ssid=PRIVATE_CAP
add channel=5ghz country="united states3" datapath=datapath-20-private mode=\
    ap name=cfg-20-private-5ghz security=security-20-private ssid=PRIVATE_CAP
add channel=2ghz country="united states3" datapath=datapath-21-public mode=ap \
    name=cfg-21-public-2ghz security=security-21-public ssid=GUEST_CAP
add channel=5ghz country="united states3" datapath=datapath-21-public mode=ap \
    name=cfg-21-public-5ghz security=security-21-public ssid=GUEST_CAP
add channel=2ghz country="united states3" datapath=datapath-22-kids mode=ap \
    name=cfg-22-kids-2ghz security=security-22-kids ssid=KIDS_CAP
add channel=5ghz country="united states3" datapath=datapath-22-kids mode=ap \
    name=cfg-22-kids-5ghz security=security-22-kids ssid=KIDS_CAP
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp-pool-20-private ranges=192.168.20.10-192.168.20.254
add name=vpn ranges=192.168.89.2-192.168.89.255
add name=dhcp-pool-21-public ranges=192.168.21.10-192.168.21.254
add name=dhcp-pool-22-kids ranges=192.168.22.10-192.168.22.254
add name=dhcp-pool-23-vpn-mn-stillwater ranges=192.168.23.10-192.168.23.254
/ip dhcp-server
add address-pool=dhcp-pool-20-private disabled=no interface=vlan-20-private \
    name=dhcp-server-20-private
add address-pool=dhcp-pool-21-public disabled=no interface=vlan-21-public \
    name=dhcp-server-21-public
add address-pool=dhcp-pool-22-kids disabled=no interface=vlan-22-kids name=\
    dhcp-server-22-kids
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=\
    cfg-20-private-5ghz name-format=prefix-identity slave-configurations=\
    cfg-21-public-5ghz,cfg-22-kids-5ghz
add action=create-dynamic-enabled master-configuration=cfg-20-private-2ghz \
    name-format=prefix-identity slave-configurations=\
    cfg-21-public-2ghz,cfg-22-kids-2ghz
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether2 pvid=20
add bridge=bridge interface=ether3 pvid=21
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=sfp1
add bridge=bridge interface=wlan2ghz pvid=20
add bridge=bridge interface=wlan5ghz pvid=20
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge untagged=ether3 vlan-ids=21
add bridge=bridge untagged=ether2 vlan-ids=20
add bridge=bridge vlan-ids=22
add bridge=bridge vlan-ids=23
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=wlan2ghz list=WAN
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/interface wireless cap
# 
set discovery-interfaces=bridge enabled=yes interfaces=wlan2ghz,wlan5ghz
/ip address
add address=192.168.20.1/24 interface=vlan-20-private network=192.168.20.0
add address=192.168.21.1/24 interface=vlan-21-public network=192.168.21.0
add address=192.168.22.1/24 interface=vlan-22-kids network=192.168.22.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\
    ether1
/ip dhcp-server network
add address=192.168.20.0/24 gateway=192.168.20.1 netmask=24
add address=192.168.21.0/24 gateway=192.168.21.1 netmask=24
add address=192.168.22.0/24 gateway=192.168.22.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.20.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
    protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
    192.168.89.0/24
/ppp secret
add name=vpn
/system identity
set name=BASEMENT
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

sindy · Thu Jan 14, 2021 9:09 am

Set the pvid parameter on the /interface bridge row to some unused VLAN ID, e.g. the default 1, and add tagged=bridge to all four rows in /interface bridge vlan.

The idea behind is that each row of /interface bridge actually aggregates parameters for three distinct types of objects linked together:

the bridge itself, as in "virtual switch"
the virtual member port of that bridge, to which a virtual port of a virtual router is connected
the virtual port of a virtual router, connected to the virtual switch

As there is a 1:1:1 relationship between those objects, they are referred to by a single common name, and the actual relationship of the particular setting to a particular object is determined by context.

So

the pvid parameter on the /interface bridge row relates to the type 2 object (for other member ports of bridges, the pvid parameter is on the /interface bridge port rows)
on the /interface bridge vlan row, the bridge parameter refers to the type 1 objects, and the tagged and untagged lists contain type 2 objects and other member ports of bridges
on the /interface vlan, /ip dhcp-client, /ip address, /ip dhcp-server and some other less "popular" rows, the interface parameter refers to type 3 objects

samreiss · Thu Jan 14, 2021 10:34 pm

Thank you for the detailed response! That helps alot, but unfortunately I am not quite resolved. I am still not pulling an IP from the DHCP server assigned range when connecting via SSID (I don't even get an IP from DHCP when I am connected directly into the router with a cable). Any ideas? Below is the export with the changes you recommended.

# jan/02/1970 00:46:51 by RouterOS 6.43.7
# software id = JVFK-X1M2
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 8A7D08DEEF06
/caps-man channel
add band=2ghz-b/g/n extension-channel=XX name=2ghz reselect-interval=1m
add band=5ghz-a/n/ac extension-channel=XXXX name=5ghz reselect-interval=1m
/interface bridge
add admin-mac=CC:2D:E0:E0:8D:3B auto-mac=no ingress-filtering=yes name=bridge \
    vlan-filtering=yes
/interface wireless
# managed by CAPsMAN
# channel: 2442/20-Ce/gn(28dBm), SSID: PRIVATE_CAP, local forwarding
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto mode=ap-bridge name=wlan2ghz \
    ssid=DEFAULT wireless-protocol=802.11
# managed by CAPsMAN
# channel: 5180/20-Ceee/ac(27dBm), SSID: PRIVATE_CAP, local forwarding
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto mode=\
    ap-bridge name=wlan5ghz ssid=DEFAULT wireless-protocol=802.11
/interface vlan
add interface=bridge name=vlan-20-private vlan-id=20
add interface=bridge name=vlan-21-public vlan-id=21
add interface=bridge name=vlan-22-kids vlan-id=22
/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=\
    datapath-20-private vlan-id=20 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=no local-forwarding=yes name=\
    datapath-21-public vlan-id=21 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=\
    datapath-22-kids vlan-id=22 vlan-mode=use-tag
/caps-man security
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm \
    group-encryption=aes-ccm name=security-20-private
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm \
    group-encryption=aes-ccm name=security-21-public
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm \
    group-encryption=aes-ccm name=security-22-kids
/caps-man configuration
add channel=2ghz country="united states3" datapath=datapath-20-private mode=\
    ap name=cfg-20-private-2ghz security=security-20-private ssid=PRIVATE_CAP
add channel=5ghz country="united states3" datapath=datapath-20-private mode=\
    ap name=cfg-20-private-5ghz security=security-20-private ssid=PRIVATE_CAP
add channel=2ghz country="united states3" datapath=datapath-21-public mode=ap \
    name=cfg-21-public-2ghz security=security-21-public ssid=GUEST_CAP
add channel=5ghz country="united states3" datapath=datapath-21-public mode=ap \
    name=cfg-21-public-5ghz security=security-21-public ssid=GUEST_CAP
add channel=2ghz country="united states3" datapath=datapath-22-kids mode=ap \
    name=cfg-22-kids-2ghz security=security-22-kids ssid=KIDS_CAP
add channel=5ghz country="united states3" datapath=datapath-22-kids mode=ap \
    name=cfg-22-kids-5ghz security=security-22-kids ssid=KIDS_CAP
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp-pool-20-private ranges=192.168.20.10-192.168.20.254
add name=vpn ranges=192.168.89.2-192.168.89.255
add name=dhcp-pool-21-public ranges=192.168.21.10-192.168.21.254
add name=dhcp-pool-22-kids ranges=192.168.22.10-192.168.22.254
/ip dhcp-server
add address-pool=dhcp-pool-20-private disabled=no interface=vlan-20-private \
    name=dhcp-server-20-private
add address-pool=dhcp-pool-21-public disabled=no interface=vlan-21-public \
    name=dhcp-server-21-public
add address-pool=dhcp-pool-22-kids disabled=no interface=vlan-22-kids name=\
    dhcp-server-22-kids
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=\
    cfg-20-private-5ghz name-format=prefix-identity slave-configurations=\
    cfg-21-public-5ghz,cfg-22-kids-5ghz
add action=create-dynamic-enabled master-configuration=cfg-20-private-2ghz \
    name-format=prefix-identity slave-configurations=\
    cfg-21-public-2ghz,cfg-22-kids-2ghz
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether2 pvid=20
add bridge=bridge interface=ether3 pvid=21
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=sfp1
add bridge=bridge interface=wlan2ghz pvid=20
add bridge=bridge interface=wlan5ghz pvid=20
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge untagged=ether3 vlan-ids=21
add bridge=bridge tagged=bridge untagged=ether2 vlan-ids=20
add bridge=bridge tagged=bridge vlan-ids=22
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=wlan2ghz list=WAN
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/interface wireless cap
# 
set discovery-interfaces=bridge enabled=yes interfaces=wlan2ghz,wlan5ghz
/ip address
add address=192.168.20.1/24 interface=vlan-20-private network=192.168.20.0
add address=192.168.21.1/24 interface=vlan-21-public network=192.168.21.0
add address=192.168.22.1/24 interface=vlan-22-kids network=192.168.22.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\
    ether1
/ip dhcp-server network
add address=192.168.20.0/24 gateway=192.168.20.1 netmask=24
add address=192.168.21.0/24 gateway=192.168.21.1 netmask=24
add address=192.168.22.0/24 gateway=192.168.22.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.20.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
    protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
    192.168.89.0/24
/ppp secret
add name=vpn
/system identity
set name=BASEMENT
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

sindy · Thu Jan 14, 2021 10:46 pm

Cannot spot anything. What does /interface bridge vlan print show?

samreiss · Thu Jan 14, 2021 11:03 pm

[admin@BASEMENT] > /interface bridge vlan print
Flags: X - disabled, D - dynamic 
 #   BRIDGE           VLAN-IDS  CURRENT-TAGGED          CURRENT-UNTAGGED         
 0   bridge           21        bridge                 
 1   bridge           20        bridge                  wlan2ghz                 
                                                        wlan5ghz                 
 2   bridge           22        bridge                 
 3 D bridge           1                                 bridge                   
                                                        ether4

sindy · Thu Jan 14, 2021 11:17 pm

Hm, it seems that the automatic addition of untagged ports to vlans based on their pvid, and automatic addition of caps-man interfaces, did not work yet in 6.43.7. What makes you stick with more than two years old release?

tdw · Fri Jan 15, 2021 12:14 am

As the wireless interfaces are managed by CAPsMAN they should not be manually added under /interface bridge port

samreiss · Fri Jan 15, 2021 7:16 am

I have updated to the latest version, but have the same issue. Any recommendations on how to tag the VLAN in CAPsMAN properly? I am able to get this working by bypassing CAPsMAN & setting the PVID on the wlan5ghz interface, but I don't want to do that with CAPsMAN because the WLANs are set dynamically.

sindy · Fri Jan 15, 2021 7:48 am

Again, I cannot see anything wrong in the configuration, the datapath settings are correct. As you don't get a lease even if you connect a wired client, it doesn't seem to be related to capsman.

After the upgrade (to what version?), what does /interface bridge vlan print show?

samreiss · Sat Jan 16, 2021 4:52 am

I was able to turn on CAPsMAN forwarding to get this to work. Unfortunately, I can't seem to get it working with local forwarding mode on CAPsMAN. Thank you for your help!

CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC) [SOLVED]

CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC) [SOLVED]

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Re: CAPsMAN with Local Forwarding & VLANS Router/Switch/AP (hAP AC)

Who is online