networking:mikrotik:wireless_vlan
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| networking:mikrotik:wireless_vlan [2019/11/26 16:11] – rplecko | networking:mikrotik:wireless_vlan [2020/02/27 06:49] (current) – rplecko | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===== Mikrotik wireless with dual band / dual SSID ===== | + | ===== Mikrotik wireless with dual band / dual SSID / multiple VLANs ===== |
| - | [[http:// | + | [[http:// |
| - | The purpose of this example is to explain how to create dual SSID AP with separated traffic. How to transport the separated traffic to another device via VLAN-s and finaly how to disable trafic between VLAN-s but enable them both to access Internet. We are using two Mikrotik devices. First is "hEX S" (Router_1) which is connected to internet, and taking care of traffic separation, and second is "cAP ac" (AP_1) acting as dual band AP with separated private and public SSID. | + | The purpose of this example is to explain how to create dual SSID on dual band AP with separated traffic. How to transport the separated traffic to another device via VLAN-s and finaly how to disable trafic between VLAN-s but enable them both to access Internet. We are using two Mikrotik devices. First is "hEX S" (Router_1) which is connected to internet, and taking care of traffic separation, and second is "cAP ac" (AP_1) acting as dual band AP with separated private and public SSID. |
| We will assume that you already have access to internet via ether4 on Router_1 whether using ADSL or a leased line. | We will assume that you already have access to internet via ether4 on Router_1 whether using ADSL or a leased line. | ||
| ==== Configuring Router_1 (hEX S) ==== | ==== Configuring Router_1 (hEX S) ==== | ||
| + | |||
| + | {{: | ||
| 1. Create neccessary bridges (**bridge_VLAN**, | 1. Create neccessary bridges (**bridge_VLAN**, | ||
| Line 17: | Line 19: | ||
| </ | </ | ||
| - | 2. Add neccessary IP addressess. | + | 2. Create VLAN interfaces on **bridge_VLAN** |
| - | + | ||
| - | < | + | |
| - | /ip address | + | |
| - | add address=10.100.101.254/ | + | |
| - | add address=10.100.201.254/ | + | |
| - | </ | + | |
| - | + | ||
| - | 3. Create VLAN interfaces on **bridge_VLAN** | + | |
| < | < | ||
| /interface vlan | /interface vlan | ||
| Line 32: | Line 26: | ||
| </ | </ | ||
| - | 4. Add VLAN interfaces to corresponding bridges | + | 3. Add VLAN interfaces to corresponding bridges |
| < | < | ||
| Line 40: | Line 34: | ||
| </ | </ | ||
| - | 5. Add trunk port to **bridge_VLAN** | + | 4. Add trunk port (tagged) |
| < | < | ||
| /interface bridge | /interface bridge | ||
| Line 46: | Line 40: | ||
| </ | </ | ||
| - | 6. Add access port to **bridge_priv_101** | + | 5. Add access port (untagged) |
| < | < | ||
| /interface bridge | /interface bridge | ||
| port add bridge=bridge_priv_101 interface=ether1 | port add bridge=bridge_priv_101 interface=ether1 | ||
| + | </ | ||
| + | |||
| + | 6. Add neccessary IP addressess. | ||
| + | |||
| + | < | ||
| + | /ip address | ||
| + | add address=10.100.101.254/ | ||
| + | add address=10.100.201.254/ | ||
| </ | </ | ||
| 7. Add DHCP servers to **bridge_priv_101** and **bridge_pub_201** | 7. Add DHCP servers to **bridge_priv_101** and **bridge_pub_201** | ||
| + | < | ||
| + | /ip pool | ||
| + | add name=dhcp_pool101 ranges=10.100.101.1-10.100.101.253 | ||
| + | add name=dhcp_pool201 ranges=10.100.201.1-10.100.201.253 | ||
| + | /ip dhcp-server network | ||
| + | add address=10.100.101.0/ | ||
| + | add address=10.100.201.0/ | ||
| + | </ | ||
| - | 8. Add firewall rule to prohibit | + | You can also do it by clicking <hi # |
| + | |||
| + | 8. Add firewall rule to prohibit | ||
| + | |||
| + | < | ||
| + | /ip firewall filter | ||
| + | add action=reject chain=forward dst-address=10.100.101.0/ | ||
| + | </ | ||
| ==== Configuring AP_1 (hAP ac) ==== | ==== Configuring AP_1 (hAP ac) ==== | ||
| + | |||
| + | {{: | ||
| 1. Create neccessary bridges (**bridge_VLAN**, | 1. Create neccessary bridges (**bridge_VLAN**, | ||
| Line 83: | Line 102: | ||
| 4. Add trunk port to **bridge_VLAN** | 4. Add trunk port to **bridge_VLAN** | ||
| < | < | ||
| - | interface bridge port add bridge=bridge_VLAN interface=ether1 | + | /interface bridge port |
| + | add bridge=bridge_VLAN interface=ether1 | ||
| </ | </ | ||
| 5. Add access port to **bridge_pub_201**. The purpose of this is to enable to connect a device (e.g. Smart TV) to the AP and restrict it to Internet only. | 5. Add access port to **bridge_pub_201**. The purpose of this is to enable to connect a device (e.g. Smart TV) to the AP and restrict it to Internet only. | ||
| < | < | ||
| - | interface bridge port add bridge=bridge_pub_201 interface=ether2 | + | /interface bridge port |
| + | add bridge=bridge_pub_201 interface=ether2 | ||
| </ | </ | ||
| Line 115: | Line 136: | ||
| </ | </ | ||
| - | …to be continued…. | + | Now you have AP with two SSID (**Private** and **Public**) on both bands (2,4 and 5 GHz), for each of them separate security profile is created (**profile_private** and **profile_public**) where the authentication passwords are stored (// |
| + | |||
| + | <fc # | ||
| + | |||
| + | The traffic from both of them is transported through trunk port to **Router_1** vhere the DHCP server for each subnet is running. Traffic on private wireless is bridged to the **ethernet1** to which the rest of the wired network is connected. Firewall rule prohibits users connected to **Public** SSID to access private network. | ||
networking/mikrotik/wireless_vlan.1574784680.txt.gz · Last modified: 2019/11/26 16:11 by rplecko