How to set up guest WiFi on Mikrotik

Providing secure and convenient internet access for visitors is one of the basic tasks of a system administrator in an office, cafe, or hotel. Guest WiFi on equipment Mikrotik Allows you to isolate client traffic from the internal corporate network, ensuring the confidentiality of company data. Properly configured isolation prevents unauthorized access to servers or printers located in the local zone.

There are several ways to implement this task, from simply creating a separate subnet to using a full-fledged authorization portal. Captive PortalThe choice of method depends on security requirements and the desired level of user interaction. In this article, we'll discuss the steps to deploy a robust guest access system using the capabilities RouterOS.

Regardless of the chosen equipment model, be it compact hAP or powerful CCRThe logic for building a network remains similar. You'll need to create a virtual interface, configure a DHCP server, and define traffic filtering rules. All of this is done through the graphical interface. WinBox or command line, but we will focus on the visual method for greater clarity.

Planning network architecture and VLANs

Before you begin making changes to your router configuration, you need to clearly plan the logical structure of your network. Using technology VLAN (Virtual Local Area Network) is the de facto standard for traffic segregation. It allows a single physical cable or radio channel to be used to transmit data across different networks that are logically isolated from each other.

Creating a separate Bridge For guest traffic, this is the most appropriate approach. You create a virtual bridge and add an interface to it. VLAN with a unique identifier, such as 20, and assign a separate IP address to this bridge. This way, the guest network will function as a physically separate router within your device.

⚠️ Important: When planning addressing, ensure that the subnets for guests and employees do not overlap. For example, if the office network uses the 192.168.1.0/24 range, then for guests, you should choose 192.168.50.0/24 or any other third octet.

To implement this plan, you will need to perform the following steps in the interface WinBox:

• 🔹 Go to the menu Bridge and create a new bridge named "Guest-Bridge".
• 🔹 In the section VLANs Add a new VLAN by specifying the parent interface (usually your main LAN port or Master port) and an ID, for example 20.
• 🔹 Return to Bridge -> Ports and add the created VLAN interface to "Guest-Bridge".

After creating the basic structure, it's important not to forget about the wireless interface settings if you'll be distributing via WiFi. On the tab Wireless You need to create a new access point or virtual interface and associate it with the newly created bridge. This ensures that all packets arriving over the air from guests will be automatically tagged with VLAN 20.

Setting up a DHCP server for guests

To enable users' devices to obtain IP addresses automatically, you need to deploy DHCP server on the previously created bridge. This process in Mikrotik It is as automated as possible thanks to the setup wizard, which automatically defines the necessary address pools and networks.

Open the menu IP -> DHCP Server and click on the button DHCP SetupIn the window that appears, select the interface corresponding to your guest bridge (e.g., "Guest-Bridge"). The system will automatically suggest an address range, which you can change if the default option doesn't suit you.

When setting up the DHCP pool, ensure the allocated range is sufficient for the expected number of concurrent connections. For a small cafe, 50 addresses are usually sufficient, while a conference room may require expanding the pool to 200 or more.

The final step in this section is to verify address assignment. Connect the test device to the new network and ensure it has received the correct IP address, mask, and gateway. If an address is not assigned, check the interface status in the menu. Interfaces - it must be active (flag R - running).

Creating and configuring a wireless interface

Setting up the radio module requires attention to detail, as it determines the stability of the connection and the speed of data transfer. In the menu Wireless Double click on your radio interface (for example, wlan1) and go to the tab WirelessHere you need to create a new virtual interface by clicking the button with the plus sign.

In the window that opens, specify the interface name (for example, "Guest-Wifi") and, crucially, select the one you created earlier Master InterfaceIn the field SSID Enter the network name that users will see, for example, "Office_Guest". The operating mode must be set to ap bridge.

Pay special attention to the parameter Bridge In the wireless interface settings. This is where you bind the virtual access point to the previously created "Guest Bridge." Without this binding, traffic will not be assigned to the correct VLAN, and the DHCP server will not be able to assign an address.

For increased security and convenience, you can hide the SSID or limit signal strength so the network is not accessible outside the building. However, in most cases, simply setting a strong password for guest access is sufficient.

Organizing security and isolating clients

The key to setting up guest access is isolation. You need to ensure that guests cannot scan your servers' ports or access file storage. Mikrotik this is realized through the mechanism Firewall.

Go to the menu IP -> Firewall and create a new rule in the chain forward. As a source (Src. Address) specify the guest network, and as the destination (Dst. Address) — your local infrastructure network. Action (Action) should be drop.

In addition, it is recommended to enable the option at the level of the wireless interface itself Default Forward in a state no (if complete isolation of clients from each other is required) or use Client-to-Client Forwarding Proceed with caution. This will prevent direct communication between guest devices, which is often exploited by attackers.

Why Drop and not Reject?

When using the Drop action, the packet simply disappears, and the sender waits for a response until the timeout. This slows down the attacker's network scanning. The Reject action immediately reports an error, giving the attacker a quick signal of the filter's existence.

Don't forget to check the settings in the menu as well IP -> ServicesMake sure that router management access (WinBox, SSH, Telnet) is blocked for the guest network. This can be done by adding a rule to Allowed Address only for trusted administrator IP addresses.

Using Hotspot for authentication

For a more advanced scenario where voucher authorization, a pop-up with terms of use, or a time limit is required, the function is used HotspotThis turns your router into a fully-fledged enterprise-class access point.

Configuration is carried out through the wizard IP -> Hotspot -> Hotspot SetupYou'll need to select an interface (your guest bridge), specify the pool address, configure an SMTP server for sending passwords (optional), and select a login page template. Mikrotik offers several built-in templates that you can customize to suit your brand.

Unlike simple WPA2 encryption, Hotspot allows for flexible user management. You can create profiles with speed limits (Rate Limit), traffic limit, or session duration. This is especially relevant for hotels, where access is sold daily, or cafes, where access is granted for one hour.

It's important to note that when Hotspot is enabled, all HTTP traffic from guests will be redirected to the login page until they successfully log in. HTTPS sites may require additional attention due to certificates, but modern browsers generally handle redirects correctly.

Speed ​​limiting and traffic management

To prevent guests from hogging your connection by downloading large files or watching 4K videos, you need to implement a restriction system. RouterOS a mechanism is used for this Simple QueuesIt allows you to set speed limits (Upload/Download) for specific IP addresses or entire subnets.

Create a new menu queue Queues -> Simple QueuesIn the field Target Enter the guest network address (e.g. 192.168.50.0/24). In the fields Max Limit Set your desired values, for example, 5M for downloads and 2M for uploads. This will ensure a basic level of comfort for all users, preventing one device from hogging the entire bandwidth.

⚠️ Note: Speed ​​values ​​are indicated in bits. The letter 'M' stands for megabits, and 'k' stands for kilobits. Do not confuse this with megabytes, otherwise the speed will be 8 times slower than expected.

For more fine-tuning you can use Queue Types And PCQ (Per Connection Queue). This will dynamically distribute available bandwidth equally among active users. If the channel is free, everyone will get the maximum, and when the connection is busy, they will get their fair share.

FAQ: Frequently Asked Questions

How can I prevent guests from seeing other devices on the network?

To do this, you need to use the client isolation feature. In the wireless interface settings (Wireless) find the parameter Default Forward and install it in no, or set up firewall rules that prohibit (drop) any traffic between guest subnet addresses.

Is it possible to limit access time for one user?

Yes, it is possible using the function Hotspot. You can set the parameter in the user profile or in the properties of a specific account. Uptime Limit or Idle Timeout, after which the session will be automatically terminated.

Why won't my Apple devices open the Hotspot login page?

iOS and macOS devices use the Captive Network Assistant mechanism. If the page doesn't pop up automatically, try opening any HTTP (non-HTTPS) website, such as http://captive.apple.com or http://neverssl.comThis will force the authorization window to appear.

Do I need separate physical hardware for a guest network?

No, Mikrotik Allows you to create multiple virtual networks (VLANs) and access points (Virtual Access Points) on a single physical device. Separation occurs at a logical level, saving money and simplifying maintenance.