Community discussions

MikroTik App
 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

How to for a guest network that can't access the internal network

Wed Jan 16, 2019 7:38 am

I have a Mikrotik hAP ac2 running RouterOS 6.43.2. I need to create a guest network that cannot access the internal network but I haven't been able to find any simple straightforward step by step instructions for this. Can anyone assist?
 
User avatar
baragoon
Member Candidate
Member Candidate
Posts: 295
Joined: Thu Jan 05, 2017 10:38 am
Location: Kyiv, UA
Contact:

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 8:12 am

 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 10:56 am

According to the comments this one is outdated. Also I have no option for "Master-interface: ap-private". I have only wlan1 and wlan2.
 
User avatar
baragoon
Member Candidate
Member Candidate
Posts: 295
Joined: Thu Jan 05, 2017 10:38 am
Location: Kyiv, UA
Contact:

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 11:32 am

According to the comments this one is outdated. Also I have no option for "Master-interface: ap-private". I have only wlan1 and wlan2.
if you banned in google the best way for you is quickset which allow to setup guest wifi ap.
 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 11:42 am

if you banned in google the best way for you is quickset which allow to setup guest wifi ap.
Sorry I have no idea what you're talking about. A quick setup how to for guest wifi is what I'm looking for but cannot find.
 
User avatar
baragoon
Member Candidate
Member Candidate
Posts: 295
Joined: Thu Jan 05, 2017 10:38 am
Location: Kyiv, UA
Contact:

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 11:51 am

if you banned in google the best way for you is quickset which allow to setup guest wifi ap.
Sorry I have no idea what you're talking about. A quick setup how to for guest wifi is what I'm looking for but cannot find.
Quick Set - first upper button on left bar in Winbox.
Image
 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 11:59 am

I see this option but I don't understand how to make it a guest network that can only access the internet and none of the rest of my internal network. In fact it looks like this loads my existing wifi configuration which i do not want to screw with at all.
 
User avatar
baragoon
Member Candidate
Member Candidate
Posts: 295
Joined: Thu Jan 05, 2017 10:38 am
Location: Kyiv, UA
Contact:

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 12:38 pm

I see this option but I don't understand how to make it a guest network that can only access the internet and none of the rest of my internal network. In fact it looks like this loads my existing wifi configuration which i do not want to screw with at all.
You can disable connectivity between lan and guest with route rules. For example:
/ip route rule
add action=drop dst-address=lan.network/mask src-address=guest.network/mask
add action=drop dst-address=guest.network/mask src-address=lan.network/mask
 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 2:45 pm

Is there not a simple step by step guide that contains all the steps that is also compatible with the current OS? I cannot follow this with one step here, another step there, and some steps that are not compatible with my OS.
 
User avatar
AlainCasault
Trainer
Trainer
Posts: 632
Joined: Fri Apr 30, 2010 3:25 pm
Location: Prévost, QC, Canada
Contact:

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 3:18 pm

Is there not a simple step by step guide that contains all the steps that is also compatible with the current OS? I cannot follow this with one step here, another step there, and some steps that are not compatible with my OS.

Hello,

The URL and examples shown by Baragoon will work. Yes, the URL has some steps that I would not do, such as masquerading the guest network (kind of useless). Otherwise, it's good. And his firewall filters suggestions are accurate also. They will prevent both subnets from accessing each other.

That's about as step-by-step as you'll get.

Les see if this will help resume it:
  • create a wireless security profile
  • create a VAP, using security profil
  • assign IP address to VAP
  • create DHCP server for VAP (no bridge required. I've done this)
  • create firewall filters to restrict traffic flow between local subnets

Cheers,
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11383
Joined: Thu Mar 03, 2016 10:23 pm

Re: How to for a guest network that can't access the internal network

Wed Jan 16, 2019 4:38 pm

Just to add: this only works if guest VAP is setup on the device which is also the internet router. If one wants to add guest VAP on an AP device which connects to router via ethernet cable, then there are more steps to be taken.
 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

Re: How to for a guest network that can't access the internal network

Thu Jan 17, 2019 6:44 am

Is there not a simple step by step guide that contains all the steps that is also compatible with the current OS? I cannot follow this with one step here, another step there, and some steps that are not compatible with my OS.

Hello,

The URL and examples shown by Baragoon will work. Yes, the URL has some steps that I would not do, such as masquerading the guest network (kind of useless). Otherwise, it's good. And his firewall filters suggestions are accurate also. They will prevent both subnets from accessing each other.

That's about as step-by-step as you'll get.

Les see if this will help resume it:
  • create a wireless security profile
  • create a VAP, using security profil
  • assign IP address to VAP
  • create DHCP server for VAP (no bridge required. I've done this)
  • create firewall filters to restrict traffic flow between local subnets

Cheers,


As far as being "sep by step" the guide is perfect except I get lost at step 15 - I do not have an interface option of "ap-private" for "Master interface:" I only have wlan1 and wlan2.
 
User avatar
AlainCasault
Trainer
Trainer
Posts: 632
Joined: Fri Apr 30, 2010 3:25 pm
Location: Prévost, QC, Canada
Contact:

Re: How to for a guest network that can't access the internal network

Thu Jan 17, 2019 11:59 am

Ya, since the names can be changed, it can be confusing. Use wlan1 or 2.

Sent from my cell phone. Sorry for the errors.

 
apouwels
just joined
Posts: 4
Joined: Sun Jan 20, 2019 8:31 am

Re: How to for a guest network that can't access the internal network

Sun Jan 20, 2019 7:49 pm

I have the issue that some of my VAP have internet access. I defined 3 VAP on three bridges and one has internet, next to the normal Wlan1. What did I do wrong?
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11383
Joined: Thu Mar 03, 2016 10:23 pm

Re: How to for a guest network that can't access the internal network

Tue Jan 22, 2019 8:24 am

Post complete configuration (in terminal windows execute /export hide-sensitive and copy-paste output in [ code] ... [ /code] environment).
 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

Re: How to for a guest network that can't access the internal network

Wed Jan 23, 2019 5:39 am

Is there not a simple step by step guide that contains all the steps that is also compatible with the current OS? I cannot follow this with one step here, another step there, and some steps that are not compatible with my OS.

Hello,

The URL and examples shown by Baragoon will work. Yes, the URL has some steps that I would not do, such as masquerading the guest network (kind of useless). Otherwise, it's good. And his firewall filters suggestions are accurate also. They will prevent both subnets from accessing each other.

That's about as step-by-step as you'll get.

Les see if this will help resume it:
  • 1. create a wireless security profile
  • 2. create a VAP, using security profil
  • 3. assign IP address to VAP
  • 4. create DHCP server for VAP (no bridge required. I've done this)
  • 5. create firewall filters to restrict traffic flow between local subnets

Cheers,
I believe I got down to step 4. No idea how to do step 5. Also my network doesn't work this way. when I try to connect it says "No internet connection". No clue where I screwed up, seems pretty straightforward however ever single dialog box has 1,000 options so I don't know if I missed something critical. I can connect but that's it.

By default my subnets cannot access each other and the new one cannot access anything.

"such as masquerading the guest network (kind of useless). " I have no idea which steps I can just "skip" and which ones are critical to make it work.
 
User avatar
AlainCasault
Trainer
Trainer
Posts: 632
Joined: Fri Apr 30, 2010 3:25 pm
Location: Prévost, QC, Canada
Contact:

Re: How to for a guest network that can't access the internal network

Wed Jan 23, 2019 5:33 pm

Is there not a simple step by step guide that contains all the steps that is also compatible with the current OS? I cannot follow this with one step here, another step there, and some steps that are not compatible with my OS.

Hello,

The URL and examples shown by Baragoon will work. Yes, the URL has some steps that I would not do, such as masquerading the guest network (kind of useless). Otherwise, it's good. And his firewall filters suggestions are accurate also. They will prevent both subnets from accessing each other.

That's about as step-by-step as you'll get.

Les see if this will help resume it:
  • 1. create a wireless security profile
  • 2. create a VAP, using security profil
  • 3. assign IP address to VAP
  • 4. create DHCP server for VAP (no bridge required. I've done this)
  • 5. create firewall filters to restrict traffic flow between local subnets

Cheers,
I believe I got down to step 4. No idea how to do step 5. Also my network doesn't work this way. when I try to connect it says "No internet connection". No clue where I screwed up, seems pretty straightforward however ever single dialog box has 1,000 options so I don't know if I missed something critical. I can connect but that's it.

By default my subnets cannot access each other and the new one cannot access anything.

"such as masquerading the guest network (kind of useless). " I have no idea which steps I can just "skip" and which ones are critical to make it work.

Hello,

For step 5, something along the lines of:
chain=Forward
src address=subnetA/maskA
dst address=subnetB/maskB
action=drop
chain=Forward
src address=subnetB/maskB
dst address=subnetA/maskA
action=drop

This will prevent both LANs from communicating with each other.

For the natting (Masquerade)
Chain=src-nat
action=masquerade
out interface="WAN_PORT"

There's no need to specify a subnet as all traffic will (needs to) be masqueraded.

Hope this helps.
 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

Re: How to for a guest network that can't access the internal network

Thu Jan 24, 2019 5:38 am

Thanks guys.

This article got an update: https://www.marthur.com/networking/mikr ... wifi/2582/

This one is working perfect for me on RouterOS 6.4.x
 
User avatar
Jotne
Forum Guru
Forum Guru
Posts: 3279
Joined: Sat Dec 24, 2016 11:17 am
Location: Magrathean

Re: How to for a guest network that can't access the internal network

Thu Jan 24, 2019 8:28 am

You have some video to get you going here:


https://www.youtube.com/watch?v=6P0MDlYWR_E
https://www.youtube.com/watch?v=lDAG_U7NwxM

As long as guest network are on its own network, then it just to set the correct firewall rules to separate network
 
staplebattery
just joined
Topic Author
Posts: 20
Joined: Tue Aug 28, 2018 3:57 pm

Re: How to for a guest network that can't access the internal network

Thu Jan 24, 2019 8:43 am

You have some video to get you going here:


https://www.youtube.com/watch?v=6P0MDlYWR_E
https://www.youtube.com/watch?v=lDAG_U7NwxM

As long as guest network are on its own network, then it just to set the correct firewall rules to separate network

Thanks.
 
User avatar
Jotne
Forum Guru
Forum Guru
Posts: 3279
Joined: Sat Dec 24, 2016 11:17 am
Location: Magrathean

Re: How to for a guest network that can't access the internal network

Sat Feb 02, 2019 10:10 pm

Just search google.
This may do (have not seen it)
https://www.youtube.com/watch?v=64Z9WDbcPvU
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: How to for a guest network that can't access the internal network

Sat Feb 02, 2019 11:20 pm

Nice link to that blog post. One thing I noticed that I do, is I check off the box that says Disable PMKID at the bottom of the first jpeg. At least it doesnt hurt.
 
csheadunternktik
just joined
Posts: 3
Joined: Fri Apr 09, 2021 3:30 am

Re: How to for a guest network that can't access the internal network

Fri Apr 09, 2021 3:35 am

What extra steps are needed to make this happen? My guest VAP is set up on a device which is set up as an AP device connected to the router via ethernet cable. When I connect to the guest wifi I get "NO INTERNET".
Just to add: this only works if guest VAP is setup on the device which is also the internet router. If one wants to add guest VAP on an AP device which connects to router via ethernet cable, then there are more steps to be taken.
Last edited by csheadunternktik on Fri Apr 09, 2021 6:23 am, edited 1 time in total.
 
lap
just joined
Posts: 16
Joined: Thu Jul 20, 2017 10:23 pm

Re: How to for a guest network that can't access the internal network

Thu Mar 31, 2022 12:00 pm

Are there any updated instructions for RouterOS v7? I tried all instructions suggested in this thread as well as few others that I have found, however none of them has worked. In some cases the clients don't even get correct IP addresses (they get 169.254....) and in others they get correct IP addresses, but have no internet connectivity. I am using RouterOS 7.1.5 if that makes any difference.
 
gotsprings
Forum Guru
Forum Guru
Posts: 2087
Joined: Mon May 14, 2012 9:30 pm

Re: How to for a guest network that can't access the internal network

Thu Mar 31, 2022 12:19 pm

Go into firewall address lists.
Make a list for local devices.
Make a list for guest devices.

At the top of the forwarding chain in firewall filters...
/IP firewall filter add chain=forward src-address-list=guest dst-address-list=local action=drop

That's keeps guest from talking to devices on the local network.

If you wanna keep them out of the router...
Add a rule in the INPUT CHAIN to drop things like 21-23,80,443,8291
 
lap
just joined
Posts: 16
Joined: Thu Jul 20, 2017 10:23 pm

Re: How to for a guest network that can't access the internal network

Thu Mar 31, 2022 5:50 pm

Go into firewall address lists.
Make a list for local devices.
Make a list for guest devices.

At the top of the forwarding chain in firewall filters...
/IP firewall filter add chain=forward src-address-list=guest dst-address-list=local action=drop

That's keeps guest from talking to devices on the local network.

If you wanna keep them out of the router...
Add a rule in the INPUT CHAIN to drop things like 21-23,80,443,8291

I was thinking of this, but there is a problem with devices with randomized MAC addresses that would not necessarily get the same IP addresses every time.
 
gotsprings
Forum Guru
Forum Guru
Posts: 2087
Joined: Mon May 14, 2012 9:30 pm

Re: How to for a guest network that can't access the internal network

Thu Mar 31, 2022 9:14 pm

Go into firewall address lists.
Make a list for local devices.
Make a list for guest devices.

At the top of the forwarding chain in firewall filters...
/IP firewall filter add chain=forward src-address-list=guest dst-address-list=local action=drop

That's keeps guest from talking to devices on the local network.

If you wanna keep them out of the router...
Add a rule in the INPUT CHAIN to drop things like 21-23,80,443,8291

I was thinking of this, but there is a problem with devices with randomized MAC addresses that would not necessarily get the same IP addresses every time.
In my explanation it assumes 2 different IP scopes.
i.e.
Local = 192.168.88.0/24
Guest = 10.0.0.1/24
 
lap
just joined
Posts: 16
Joined: Thu Jul 20, 2017 10:23 pm

Re: How to for a guest network that can't access the internal network

Thu Mar 31, 2022 10:46 pm




I was thinking of this, but there is a problem with devices with randomized MAC addresses that would not necessarily get the same IP addresses every time.
In my explanation it assumes 2 different IP scopes.
i.e.
Local = 192.168.88.0/24
Guest = 10.0.0.1/24

The problem was not isolating the two networks, but having connectivity on the Guest network. Either no IP address (and thus no connectivity) or no internet connectivity at all on the Guest network.
 
strykertoo
just joined
Posts: 22
Joined: Wed Mar 16, 2022 3:57 pm

Re: How to for a guest network that can't access the internal network

Fri Apr 22, 2022 5:46 pm

The answer lies in firewall rules. I have created 2 videos on this topic.

This video explains the concept of grouping of interfaces:
https://youtu.be/ZVICffssvSQ

And the other video explains how to use interface grouping to solve your exact problem:
https://youtu.be/CMyKxicSpIY

Hope this helps.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: How to for a guest network that can't access the internal network

Fri Apr 22, 2022 10:39 pm

Optimal solutions result in well defined requirements.
1. Need a guest network, purpose of guest network is to...........................
2. Guest network should have access too.........................
3. Guest network should not have access toooo

example A.
1. Need to provide wifi for visitors
2. They should be able to access the internet
3. Anything else.

example B.
1. I need a place where guest can share files between each other
2.a They need to access other guests within the same network,
2b. They need to be able to print stuff
3. Nothing else and no internet

In both cases one has many options.
-one bridge, two vlans
-one bridge with DHCP serving all ports except one, and that port used for another subnet/network assigned to the etherport directly
-Subnet A assigned to one port, Subnet B assigned to another port
-two bridges

Etc etc.... All of the above pretty much block all traffic at layer 2
Then use firewall rules to ensure no routing takes place not needed.

Typically I prefer to run one bridge and all vlans as I know I will run out of etherports and want to segregate traffic as things get more complex.
vidoe cameras, iot devices, thermostats, work from home users, media devices etc............

PS recommend updating firmware to at least latest longterm 6.48 version.

Who is online

Users browsing this forum: Amazon [Bot], connorcrb and 39 guests