What if I told you that you don't *need* a VLAN?

https://tangentsoft.com/mikrotik/wiki?n ... ns%20VLANs

Just to be clear, this config only applies to the cAP? There's no additional config for the hEX? If not, the new firewall rules being added to the cAP won't affect the current set of rules on the hEX?

Daunting as it may seem in the beginning, once you grasp the concept and see the building blocks, VLANs are nothing to be afraid of.

wink indeed!
1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use Quickset
4) You do not use detect internet
5) Dont listen to jacklaz until his list is complete
6)...

To configure a MikroTik router for a guest VLAN with the subnet 10.10.10.0/24 and VLAN ID 20, where this VLAN will be trunked to an external access point, follow these steps:

1. Create the VLAN interface on the MikroTik Router:
This will define VLAN ID 20 on the physical interface that connects to the external access point (for example, ether1).

Steps:
Go to Interfaces → VLAN and add a new VLAN.

Name: guest_vlan20
VLAN ID: 20
Interface: ether1 (or whatever interface connects to the access point)
MTU: Leave as default (typically 1500)
You can create it using the following CLI command:

csharp
Copy code

/interface vlan add name=guest_vlan20 vlan-id=20 interface=ether1

2. Assign IP Address to the VLAN Interface:
Next, assign the IP address 10.10.10.1/24 to the newly created VLAN interface. This will serve as the default gateway for devices in the guest VLAN.

Steps:
Go to IP → Addresses and add the IP address.

Address: 10.10.10.1/24
Interface: guest_vlan20

Or using the CLI:

csharp
Copy code

/ip address add address=10.10.10.1/24 interface=guest_vlan20

3. Set Up DHCP Server (Optional, for automatic IP assignment):
If you want to assign IP addresses dynamically to devices in the guest VLAN, you can configure a DHCP server.

Steps:
Go to IP → DHCP Server and click Add.

Name: guest_vlan20_dhcp
Interface: guest_vlan20
Address Pool: guest_pool
Gateway: 10.10.10.1 (the router’s address in this VLAN)
DNS Server: (optional) You can use a public DNS server, e.g., 8.8.8.8.
You will also need to create a DHCP Pool:

bash
Copy code

/ip pool add name=guest_pool ranges=10.10.10.2-10.10.10.254
Finally, add the DHCP Server:

csharp
Copy code

/ip dhcp-server add name=guest_vlan20_dhcp interface=guest_vlan20 address-pool=guest_pool disabled=no

4. Create Firewall Rules to Isolate the Guest VLAN (Optional):
If you want to isolate guest users from your internal network, create firewall rules to block traffic between the guest VLAN and your internal network.

Example: Block traffic from the guest VLAN to the internal LAN:
Go to IP → Firewall → Filter Rules and click Add.

Chain: forward
Src. Address: 10.10.10.0/24
Dst. Address: 192.168.0.0/24 (example internal subnet)
Action: drop
Or use the CLI:

css
Copy code

/ip firewall filter add chain=forward src-address=10.10.10.0/24 dst-address=192.168.0.0/24 action=drop

5. Configure the Access Point to Tag VLAN 20:
On the external access point, you need to ensure the VLAN tag 20 is properly assigned to the guest network. The exact steps depend on your access point model, but typically, you will:
Set the VLAN tag for the guest network to 20 on the access point.
Set the access point to operate in 802.1q trunking mode for the interface connecting to the MikroTik router (or configure the SSID to tag the traffic with VLAN 20).

6. Test Connectivity:
Connect a device to the access point.
Ensure it gets an IP in the 10.10.10.0/24 range, and check if it can reach the gateway 10.10.10.1 (the MikroTik router).
Verify that the device in the guest VLAN cannot access other networks (depending on your firewall rules).
Summary Configuration Overview:

VLAN ID: 20
Subnet: 10.10.10.0/24
Router IP (Gateway): 10.10.10.1
DHCP Range: 10.10.10.2 - 10.10.10.254
Firewall Rule: Block access to internal network (192.168.x.x) from the guest VLAN (10.10.10.x).

CLI Configuration:
bash
Copy code

/interface vlan add name=guest_vlan20 vlan-id=20 interface=ether1
/ip address add address=10.10.10.1/24 interface=guest_vlan20
/ip pool add name=guest_pool ranges=10.10.10.2-10.10.10.254
/ip dhcp-server add name=guest_vlan20_dhcp interface=guest_vlan20 address-pool=guest_pool disabled=no
/ip firewall filter add chain=forward src-address=10.10.10.0/24 dst-address=192.168.0.0/24 action=drop

This should set up your MikroTik router to properly handle the guest VLAN traffic, provide IP addresses to connected clients, and optionally isolate the guest network from the rest of your internal network.

Perhaps in vernacular you may understand, unlike nz sheep we are able to say no!

So ChatGPT has a reason to know that VLAN itf needs to be attached to ether1 ?