USING ROS DEVICE AS AN AP/SWITCH
Having seen enough requests lately for this requirement its clear there is a need for an article, or at least a common place to look for links for useful stuff.
See the example DEVICE setup below.
PRACTICAL APPROACH
For WIFI capable devices, as BPWL has noted, one could elect to choose - WISP AP- mode in quickset to start and then clean it up as per the posts/links below. (Use of quickset other than selecting a mode is generally a bad idea)
RECOMMENDED
To avoid getting into too many lockouts and issues during configuring I always recommend use of SAFE MODE, and also when entering any MT device for the first time with all its default settings, I recommend to create an independent entry point to the router for config purposes. OFF BRIDGE access - viewtopic.php?t=181718
AP SWITCH
For those looking for a bare bones AP - Switch Setup this is it (courtesy of pukkita).
viewtopic.php?p=905562#p905562
Another Similar post from Jotne
viewtopic.php?p=893722&hilit=ap+switch#p693337
One from Vecernik87 My favourite unicorn pony.
viewtopic.php?p=893722&hilit=ap+switch#p693336
This is an internet link provided by Richard....
https://tehnoblog.org/mikrotik-router-h ... nt-bridge/
NEED VLANS?
VLANS ON THE SWITCH (hex etc.) - viewtopic.php?t=143620#p706997
VLANS ON THE AP - (capac etc.) - viewtopic.php?t=143620#p706999
VLANS on the AP/SWITCH - (hapac etc.) - viewtopic.php?t=143620#p706998
EXAMPLE (ANY RoS) DEVICE SETUP
Note1: homeVLAN is the trusted subnet (where the admin works or accesses devices for config purposes)
Note2: Ingress filtering and frame-types-allowed are applied on BRIDGE PORTS!
Note3: If you dont have WLANS, then just ignore them in the example.
Note4: ONLY the managment vlan needs to be identified (with interface=bridge) as the other vlans are simply acting as conduits for traffic and not going through the cpu-bridge.
Finally, you will see two extra IP ADDRESS entries, besides the one required for the MT device itself (from the trusted subnet), one is designed for a wired "off bridge access" to the device (emergaccess) which involves assigning an etherport for this purpose.
The other IP Address, (testaccess) is designed to be an "off bridge" wifi access to the device. Both are made to be able to config the device in case the bridge configuration causes any issues.
[ "Off Bridge" access explained: viewtopic.php?t=181718 ]
.....
Code: Select all
/interface bridge
add ingress-filtering=no name=bridgegym vlan-filtering=yes
/interface ethernet
set [ find default-name=ether2 ] name=emergaccess
/interface vlan
add interface=bridgegym name=cerv49 vlan-id=49 { optional, I put this here as a communication piece to myself and any reader }
add interface=bridgegym name=homeVlan vlan-id=12 { mandatory, management vlan must be identified in /interface vlan }
add interface=bridgegym name=mediaVlan vlan-id=40 { optional, I put this here as a communication piece to myself and any reader }
/interface list
add name=management
/interface wireless
set [ find default-name=wlan2 ] band=5ghz-onlyac channel-width=20/40mhz-Ce country=canada disabled=no frequency=5500 \
mode=ap-bridge name=homeWLan security-profile=home_Security skip-dfs-channels=all ssid=NoPain-NoGain wireless-protocol=\
802.11 wmm-support=enabled wps-mode=disabled
set [ find default-name=wlan1 ] band=2ghz-g/n basic-rates-b="" country=canada disabled=no frequency=2437 mode=ap-bridge \
name=mediaWlan rate-set=configured security-profile=media_Security skip-dfs-channels=all ssid=Media \
supported-rates-b=11Mbps wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
add keepalive-frames=disabled mac-address=xx.xx.xx.xx master-interface=mediaWlan multicast-buffering=disabled \
name=testaccess security-profile=testprofile ssid=capacbackdoor wds-cost-range=0 wds-default-cost=0 wmm-support=\
enabled wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=yy.yy.yy.yy master-interface=mediaWlan multicast-buffering=\
disabled name=HVAC_WLAN security-profile=Cerv_key ssid=machine wds-cost-range=0 wds-default-cost=0 wmm-support=\
enabled wps-mode=disabled
/interface bridge port
add bridge=bridgegym frame-types=admit-only-untagged-and-priority-tagged interface=homeWLan pvid=12
add bridge=bridgegym ingress-filtering=yes interface=ether1
add bridge=bridgegym frame-types=admit-only-untagged-and-priority-tagged interface=HVAC_WLAN pvid=49
add bridge=bridgegym frame-types=admit-only-untagged-and-priority-tagged interface=mediaWlan pvid=40
/ip neighbor discovery-settings
set discover-interface-list=management
/interface bridge vlan
add bridge=bridgegym tagged=ether1,bridgegym untagged=homeWLan vlan-ids=12
add bridge=bridgegym tagged=ether1 untagged=mediaWlan vlan-ids=40
add bridge=bridgegym tagged=ether1 untagged=HVAC_WLAN vlan-ids=49
/interface list member
add interface=homeVlan list=management
add interface=emergaccess list=management
add interface=testaccess list=management
/ip address
add address=192.168.10.84/24 interface=homeVlan network=192.168.10.0 comment="IP of capac on trusted subnet"
add address=192.168.36.1/24 interface=emergaccess network=192.168.36.0 comment="ether2 access off bridge"
add address=192.168.24.1/24 interface=testaccess network=192.168.24.0 comment="vWLAN access off bridge"
/ip dns
set allow-remote-requests=yes servers=192.168.10.1 comment="dns through trusted subnet gateway"
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.10.1 comment="ensures route avail through trusted subnet gateway"
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh address=x.x.x.x
set api disabled=yes
set winbox address=y.y.y.y/24,z.z.z.z/24,s.s.s.s/24
set api-ssl disabled=yes
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.10.1
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=management
