341 lines
11 KiB
Markdown
341 lines
11 KiB
Markdown
# VLAN Setup Complete - Session Summary
|
|
|
|
**Date:** 2026-01-31
|
|
**Status:** COMPLETED
|
|
**Backup:** `vlan-setup-complete-2026-01-31.backup` and `.rsc` on router
|
|
|
|
---
|
|
|
|
## Executive Summary
|
|
|
|
Successfully implemented VLAN network segmentation on MikroTik hAP ax³ with:
|
|
- Port-based VLAN assignment for wired infrastructure
|
|
- MAC-based dynamic VLAN assignment for WiFi devices via access-list
|
|
- CAPsMAN configured for CAP XL ac management
|
|
|
|
---
|
|
|
|
## Current Network Configuration
|
|
|
|
### Router Access
|
|
|
|
| Method | IP | Port | User | Notes |
|
|
|--------|-----|------|------|-------|
|
|
| WinBox | 192.168.10.1 | 8291 | xtrm | Primary management |
|
|
| WebFig | 192.168.10.1 | 80 | xtrm | Web interface |
|
|
| SSH (Mac) | 192.168.10.1 | **2222** | xtrm | Key: ~/.ssh/mikrotik_key |
|
|
| SSH (Unraid) | 192.168.10.1 | **2222** | unraid | Key: ~/.ssh/id_ed25519 |
|
|
| WinBox | 192.168.1.1 | 8291 | xtrm | Via VLAN 40 |
|
|
| WinBox | 192.168.20.1 | 8291 | xtrm | Via VLAN 20 |
|
|
|
|
**Important:** SSH is on port **2222**, not 22!
|
|
|
|
### VLAN Structure (Implemented)
|
|
|
|
| VLAN | Name | Subnet | Gateway | DHCP Pool | Status |
|
|
|------|------|--------|---------|-----------|--------|
|
|
| 10 | Management | 192.168.10.0/24 | 192.168.10.1 | .100-.200 | ✅ Working |
|
|
| 20 | Trusted | 192.168.20.0/24 | 192.168.20.1 | .100-.200 | ✅ Working |
|
|
| 25 | Kids | 192.168.25.0/24 | 192.168.25.1 | .100-.200 | ✅ Configured |
|
|
| 30 | IoT | 192.168.30.0/24 | 192.168.30.1 | .100-.200 | ✅ Configured |
|
|
| 40 | Catch-All | 192.168.1.0/24 | 192.168.1.1 | .10-.250 | ✅ Default |
|
|
|
|
### Port Assignments
|
|
|
|
```
|
|
HAP ax³ Ports:
|
|
├── ether1: WAN (ISP DHCP)
|
|
├── ether2: CAP XL ac → VLAN 10 (PVID=10)
|
|
├── ether3: CSS326 switch → VLAN 10 (PVID=10)
|
|
├── ether4: Unraid eth1 → VLAN 10 (PVID=10)
|
|
├── ether5: Unraid eth2 → VLAN 10 (PVID=10)
|
|
├── wifi1: XTRM (5GHz) → Tagged VLANs 20,25,30,40
|
|
└── wifi2: XTRM2 (2.4GHz) → Tagged VLANs 20,25,30,40
|
|
```
|
|
|
|
### Bridge VLAN Table
|
|
|
|
```routeros
|
|
# VLAN 10 - Management (port-based)
|
|
vlan-ids=10 tagged=bridge untagged=ether2,ether3,ether4,ether5
|
|
|
|
# VLAN 20 - Trusted (WiFi MAC-based)
|
|
vlan-ids=20 tagged=bridge,wifi1,wifi2
|
|
|
|
# VLAN 25 - Kids (WiFi MAC-based)
|
|
vlan-ids=25 tagged=bridge,wifi1,wifi2
|
|
|
|
# VLAN 30 - IoT (WiFi MAC-based)
|
|
vlan-ids=30 tagged=bridge,wifi1,wifi2
|
|
|
|
# VLAN 40 - Catch-All (WiFi default)
|
|
vlan-ids=40 tagged=bridge untagged=wifi1,wifi2
|
|
```
|
|
|
|
---
|
|
|
|
## WiFi Configuration
|
|
|
|
### SSIDs
|
|
|
|
| SSID | Band | Interface | Password | Security |
|
|
|------|------|-----------|----------|----------|
|
|
| XTRM | 5GHz | wifi1 | M0stW4nt3d@home | WPA2/WPA3 |
|
|
| XTRM2 | 2.4GHz | wifi2 | M0stW4nt3d@IoT | WPA2 |
|
|
|
|
### WiFi Datapath (Critical for VLAN)
|
|
|
|
```routeros
|
|
/interface wifi datapath
|
|
add name=dp-vlan bridge=bridge
|
|
|
|
/interface wifi configuration
|
|
set cfg-xtrm datapath=dp-vlan
|
|
set cfg-xtrm2 datapath=dp-vlan
|
|
```
|
|
|
|
### WiFi Access-List (MAC-based VLAN Assignment)
|
|
|
|
The access-list assigns VLANs based on client MAC address:
|
|
|
|
```routeros
|
|
/interface wifi access-list
|
|
|
|
# VLAN 20 - Trusted devices
|
|
add action=accept mac-address=AA:ED:8B:2A:40:F1 vlan-id=20 comment="Samsung S25 Ultra - Kaloyan"
|
|
add action=accept mac-address=CE:B8:11:EA:8D:55 vlan-id=20 comment="MacBook - Kaloyan"
|
|
add action=accept mac-address=BE:A7:95:87:19:4A vlan-id=20 comment="MacBook 5GHz - Kaloyan"
|
|
|
|
# VLAN 25 - Kids devices
|
|
add action=accept mac-address=F2:B8:14:61:C8:27 vlan-id=25 comment="iPhone - Dancho"
|
|
add action=accept mac-address=90:91:64:70:0D:86 vlan-id=25 comment="Notebook - Kimi"
|
|
add action=accept mac-address=2A:2B:BA:86:D4:AF vlan-id=25 comment="iPhone - Kimi"
|
|
|
|
# VLAN 30 - IoT devices
|
|
add action=accept mac-address=D0:E7:82:F7:65:DD vlan-id=30 comment="Chromecast"
|
|
add action=accept mac-address=94:27:70:1E:0C:EE vlan-id=30 comment="Bosch Oven"
|
|
add action=accept mac-address=C8:5C:CC:52:EA:53 vlan-id=30 comment="Xiaomi Air Purifier"
|
|
add action=accept mac-address=18:DE:50:5B:C8:A6 vlan-id=30 comment="Tuya Device 1"
|
|
add action=accept mac-address=38:1F:8D:04:6F:E4 vlan-id=30 comment="Tuya Device 2"
|
|
add action=accept mac-address=D4:AD:FC:BE:13:B0 vlan-id=30 comment="Intellirocks"
|
|
|
|
# Default - VLAN 40 for unknown devices (MUST be last!)
|
|
add action=accept vlan-id=40 comment="Default - VLAN40"
|
|
```
|
|
|
|
**Important:** The default rule (no MAC specified) must be LAST in the list!
|
|
|
|
---
|
|
|
|
## VLAN 10 Verified Devices
|
|
|
|
| IP | MAC | Device | Status |
|
|
|----|-----|--------|--------|
|
|
| 192.168.10.1 | 78:9A:18:2C:A5:48 | HAP ax³ (Gateway) | ✅ |
|
|
| 192.168.10.2 | 18:FD:74:54:3D:BC | CAP XL ac | ✅ |
|
|
| 192.168.10.3 | F4:1E:57:C9:BD:09 | CSS326 Switch | ✅ |
|
|
| 192.168.10.10 | 02:42:C0:A8:1F:04 | AdGuard (Unraid) | ✅ |
|
|
| 192.168.10.20 | A8:B8:E0:02:B6:15 | Unraid Server | ✅ Verified |
|
|
| 192.168.10.200 | 48:DA:35:6F:BE:50 | NanoKVM | ✅ |
|
|
|
|
---
|
|
|
|
## CAPsMAN Configuration
|
|
|
|
```routeros
|
|
/interface wifi capsman
|
|
set enabled=yes interfaces=wifi1,wifi2 package-path="" upgrade-policy=suggest-same-version
|
|
|
|
/interface wifi provisioning
|
|
add action=create-enabled master-configuration=cfg-xtrm name-format=identity slave-configurations=cfg-xtrm2 supported-bands=5ghz-ax
|
|
add action=create-enabled master-configuration=cfg-xtrm2 name-format=identity slave-configurations=cfg-xtrm supported-bands=2ghz-ax
|
|
```
|
|
|
|
---
|
|
|
|
## Critical Lessons Learned
|
|
|
|
### 1. VLAN Filtering Breaks IP on Bridge
|
|
When you enable `vlan-filtering=yes` on the bridge:
|
|
- IP address on the bridge interface **stops working**
|
|
- You **must** have IP on the VLAN interface instead
|
|
- Never have same IP on both bridge and VLAN interface simultaneously
|
|
|
|
### 2. Correct Order of Operations
|
|
```
|
|
1. Create VLAN interfaces
|
|
2. Add IPs to VLAN interfaces (can have temporary duplicate)
|
|
3. Configure bridge VLAN table
|
|
4. Set port PVIDs
|
|
5. Add VLAN interfaces to firewall interface lists (LAN)
|
|
6. Enable VLAN filtering
|
|
7. Remove IP from bridge (if any duplicate)
|
|
8. Move DHCP server to VLAN interface
|
|
```
|
|
|
|
### 3. WiFi VLAN Assignment
|
|
- **Do NOT use** `action=query-radius` without configured RADIUS users
|
|
- **Use** WiFi datapath with `bridge=bridge`
|
|
- **Use** access-list with `vlan-id=XX` for MAC-based assignment
|
|
- WiFi interfaces must be **tagged** in bridge VLAN table for dynamic VLANs
|
|
|
|
### 4. Firewall Interface Lists
|
|
After creating VLAN interfaces, add them to the LAN list:
|
|
```routeros
|
|
/interface list member add list=LAN interface=vlan10-mgmt
|
|
/interface list member add list=LAN interface=vlan20-trusted
|
|
/interface list member add list=LAN interface=vlan25-kids
|
|
/interface list member add list=LAN interface=vlan30-iot
|
|
/interface list member add list=LAN interface=vlan40-catchall
|
|
```
|
|
|
|
### 5. Safe Mode
|
|
- Enter with **Ctrl+X** in WinBox
|
|
- Changes auto-rollback if connection lost (~10 minutes)
|
|
- Exit and save with **Ctrl+X** again
|
|
|
|
---
|
|
|
|
## Useful Commands
|
|
|
|
### Verify VLAN Status
|
|
```routeros
|
|
/interface bridge print where name=bridge
|
|
/interface bridge vlan print detail
|
|
/interface bridge port print
|
|
/ip address print
|
|
```
|
|
|
|
### Check WiFi Clients and VLAN Assignment
|
|
```routeros
|
|
/interface wifi registration-table print
|
|
/interface wifi access-list print
|
|
```
|
|
|
|
### Check DHCP Leases per VLAN
|
|
```routeros
|
|
/ip dhcp-server lease print where server=dhcp-vlan10
|
|
/ip dhcp-server lease print where server=dhcp-vlan20
|
|
```
|
|
|
|
### Add New Device to Access-List
|
|
```routeros
|
|
/interface wifi access-list add action=accept mac-address=XX:XX:XX:XX:XX:XX vlan-id=20 comment="Device Name" place-before=[find comment="Default - VLAN40"]
|
|
```
|
|
|
|
### Emergency Rollback
|
|
```routeros
|
|
/interface bridge set bridge vlan-filtering=no
|
|
```
|
|
|
|
### Restore from Backup
|
|
```routeros
|
|
/system backup load name=vlan-setup-complete-2026-01-31
|
|
```
|
|
|
|
---
|
|
|
|
## Pending Tasks
|
|
|
|
1. **Configure CAP XL ac to join CAPsMAN**
|
|
- CAP is on VLAN 10 at 192.168.10.2
|
|
- Needs provisioning to extend WiFi coverage
|
|
|
|
2. **Configure CSS326 for VLAN Trunking**
|
|
- Switch is on VLAN 10 at 192.168.10.3
|
|
- Needs VLAN configuration for room distribution
|
|
|
|
3. **Add Remaining Devices to Access-List**
|
|
- As devices connect, add their MACs to appropriate VLANs
|
|
|
|
4. **Configure Inter-VLAN Firewall Rules**
|
|
- Management → All (full access)
|
|
- Trusted → IoT (control smart home)
|
|
- IoT → Internet only (isolated)
|
|
- Guest → Internet only (isolated)
|
|
|
|
5. **Test VLAN 25 (Kids) and VLAN 30 (IoT)**
|
|
- Connect devices and verify DHCP/internet
|
|
|
|
---
|
|
|
|
## Connection Commands Reference
|
|
|
|
### SSH to Unraid (VLAN 10)
|
|
```bash
|
|
ssh -i ~/.ssh/id_ed25519_unraid root@192.168.10.20 -p 422
|
|
```
|
|
|
|
### SSH to MikroTik (port 2222!)
|
|
|
|
From Mac:
|
|
```bash
|
|
ssh -i ~/.ssh/mikrotik_key -p 2222 xtrm@192.168.10.1
|
|
```
|
|
|
|
From Unraid:
|
|
```bash
|
|
ssh -p 2222 unraid@192.168.10.1
|
|
```
|
|
|
|
### Quick Status from Unraid
|
|
```bash
|
|
ssh -i ~/.ssh/id_ed25519_unraid root@192.168.10.20 -p 422 "docker ps -a --format 'table {{.Names}}\t{{.Status}}'"
|
|
```
|
|
|
|
---
|
|
|
|
## Backup Files on Router
|
|
|
|
| File | Size | Description |
|
|
|------|------|-------------|
|
|
| vlan-setup-complete-2026-01-31.backup | 177.6 KiB | Binary backup (full restore) |
|
|
| vlan-setup-complete-2026-01-31.rsc | 12.5 KiB | Script export (readable) |
|
|
|
|
**Download via:** WinBox → Files → Select file → Download
|
|
|
|
---
|
|
|
|
## Network Diagram (Current)
|
|
|
|
```
|
|
Internet
|
|
│
|
|
▼
|
|
┌───────────────────────────────────────────────────────────────┐
|
|
│ HAP ax³ (192.168.10.1) │
|
|
│ RouterOS 7.21.1 │
|
|
│ │
|
|
│ VLAN 10: 192.168.10.0/24 (Management) │
|
|
│ VLAN 20: 192.168.20.0/24 (Trusted) │
|
|
│ VLAN 25: 192.168.25.0/24 (Kids) │
|
|
│ VLAN 30: 192.168.30.0/24 (IoT) │
|
|
│ VLAN 40: 192.168.1.0/24 (Catch-All/Default) │
|
|
│ │
|
|
│ ether2 ─┬─ CAP XL ac (192.168.10.2) │
|
|
│ ether3 ─┼─ CSS326 (192.168.10.3) ─── NanoKVM (.199) │
|
|
│ ether4 ─┼─ Unraid (192.168.10.20) │
|
|
│ ether5 ─┘ │
|
|
│ │
|
|
│ wifi1 (XTRM 5GHz) ──┬── VLAN 20/25/30/40 via access-list │
|
|
│ wifi2 (XTRM2 2.4GHz)─┘ │
|
|
└───────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
---
|
|
|
|
## Session Timeline
|
|
|
|
1. **CAPsMAN Setup** - Configured WiFi profiles (cfg-xtrm, cfg-xtrm2) and security
|
|
2. **Research** - Studied MikroTik forums for correct VLAN approach
|
|
3. **VLAN Infrastructure** - Created VLANs 10, 20, 25, 30, 40 with DHCP
|
|
4. **Safe Mode Implementation** - Used atomic script for VLAN filtering
|
|
5. **WiFi VLAN** - Configured datapath and access-list for MAC-based assignment
|
|
6. **Verification** - Tested connectivity on all VLANs
|
|
7. **Backup** - Created `vlan-setup-complete-2026-01-31`
|
|
|
|
---
|
|
|
|
**Document Version:** 1.0
|
|
**Last Updated:** 2026-01-31
|