Providing internet access for office visitors, cafe visitors, or just friends is a task that requires a sound approach to security. Guest WiFi network on equipment MikroTik Allows you to create an isolated segment that doesn't have access to your internal resources but provides access to the external network. This is a basic level of protection that prevents attackers from penetrating your local infrastructure through guest devices.
Unlike simply providing a password from the main access point, guest mode involves the use of separate rules Firewall and often requires the use of authorization mechanisms. Proper hardware configuration ensures that even if a guest laptop is infected with a virus, it won't be able to attack your file server or printer. In this article, we'll cover the detailed process of creating such a segment.
Creating an isolated environment isn't a simple "set it and forget it" approach. Bandwidth must be considered to ensure guests don't choke up all the traffic, and access policies must be carefully considered. The key is to configure routing rules that break the connection between the guest and main network interfaces. Only a comprehensive approach will ensure stability and security.
Planning network architecture and creating VLANs
The first step is to logically separate the networks. Best practice for equipment MikroTik is the use of technology VLAN (Virtual Local Area Network). This allows a single port or interface to be physically divided into multiple logical channels. A guest network is typically assigned a separate VLAN with a unique ID, such as 20, while the main network remains in VLAN 1 or receives its own ID.
Creating a VLAN interface in RouterOS is carried out through the menu InterfacesYou will need to add a new interface of the type vlan, specify the parent interface (for example, ether1 or wifi1) and assign a VLAN ID. After that, the logical interface must be assigned an IP address that will serve as the gateway for guest devices. Typically, this is an address from a separate subnet, for example, 192.168.20.1/24.
Don't forget that the physical infrastructure must also support tagged packets if you're using managed switches. If the router distributes Wi-Fi directly, creating a virtual AP interface on the wireless card is sufficient. SSID (network name) should be clear for guests, but should not contain information about the owner or location.
Configuring a DHCP server for the guest segment
After creating a logical interface and assigning an IP address, you need to configure automatic address distribution to clients. To do this, MikroTik built-in is used DHCP server. Go to the section IP -> DHCP Server and run the setup wizard or create a pool manually. It's important to specify the correct interface created in the previous step so that guest requests are processed correctly.
In the address pool settings (IP Pools) Specify the range of IP addresses to be issued. For a small coffee shop or office, a range of 50-100 addresses is sufficient, for example, 192.168.20.10-192.168.20.110. You also need to specify DNS servers. You can use your provider's addresses or public services like Google DNS (8.8.8.8) or Cloudflare (1.1.1.1) to speed up domain name resolution.
Pay special attention to the rental time of the address (Lease Time). For guest networks, it's recommended to set a timer of, say, 15-30 minutes. This allows addresses to be released more quickly when visitors leave the premises and prevents the pool from being exhausted during heavy traffic. Long-term rentals can lead to a situation where new clients are unable to connect, as all addresses are occupied by departing guests.
Wireless interface configuration and client isolation
Setting up the access point itself requires attention to the details of wireless security. In the menu Wireless create a new entry or edit an existing one by selecting the mode ap bridgeSet the frequency and channel width, avoiding overlap with neighboring networks. For guest access, the standard WPA2-PSK with a strong password that can be changed periodically.
A critical parameter is Client-to-Client Forwarding (or default-authentication And default-forwarding). For maximum security, it is recommended to disable traffic exchange between devices connected to the same guest endpoint. This will prevent port scanning attempts or man-in-the-middle attacks between guests.
IN RouterOS Version 7 and new wireless chips may have different settings than the classic ones. Use Security Encryption configuration profiles. Ensure that the selected encryption method is compatible with all guest devices, although modern standards no longer require support for legacy protocols.
What is AP Isolation?
AP Isolation is a feature that prevents wireless clients connected to the same access point from communicating with each other. They can only access the external network (Internet).
Configuring Firewall Rules to Isolate Traffic
The most important step is creating rules Firewall, which effectively implement isolation. Even if you've created a separate VLAN, the router can still allow routing between its interfaces by default. You need to create a rule in the chain. forward, which will block the transition of packets from the guest subnet to the main one.
The rule should look something like this: source (src-address) - guest subnet, purpose (dst-address) — local network subnet, action (action) — dropThis rule should be above the rules allowing internet access. The order of processing rules in MikroTik strictly sequential, from top to bottom.
It's also worth restricting guest access to the router itself. Create a rule in the chain input, which prohibits connections from guest addresses to the router's IP addresses, with the possible exception of DNS and DHCP, if required, but it is better to close all management ports (WinBox, SSH, WebFig) for the guest zone completely.
☑️ Checking guest network security
Speed limiting and traffic management
To prevent guests from using up all available bandwidth, it is necessary to implement speed limiting mechanisms (Queue). IN MikroTik for this purpose they are used Simple QueuesYou can create a queue that will be applied to the guest subnet IP addresses, limiting the maximum download and upload speeds for a single device or for the entire network.
Setting up max-limit A simple queue allows you to set a strict limit. For example, 5M/1M (5 megabits download and 1 megabit upload) per client will be sufficient for watching videos and working with documents, but will prevent downloading large amounts of data, which would slow down the main office. You can also use dynamic queues, created automatically for each new IP address.
Additionally, you can use Mangle Rules for traffic marking and more complex priority management. For example, you can prioritize VoIP traffic or web surfing, while throttling file-sharing networks (P2P), although on a guest network, it's often easier to apply a general limit.
Using MikroTik Hotspot for Advanced Authentication
For cafes, hotels, or coworking spaces, a simple WPA2 password may not be sufficient. In such cases, the technology HotspotIt intercepts all HTTP requests and redirects the user to the authorization page. This allows for login using vouchers, SMS codes, or social media.
Setting up a Hotspot requires creating a Hotspot profile, configuring the server, and setting up user profiles. Within the user profile, you can set limits on session duration, data transfer volume, and speed. This provides a flexible tool for monetization or controlling online time.
Login page (login.html) can be customized by adding a company logo, advertising banners, or terms of service. Hotspot also allows you to collect device MAC addresses and other statistics, which is useful for marketing traffic analysis.
| Parameter | Main network | Guest network (VLAN) | Hotspot zone |
|---|---|---|---|
| LAN access | Allowed | Drop | Prohibited |
| Authorization | WPA2-PSK | WPA2-PSK / Open | Web form / Vouchers |
| Speed Limit | No / High limit | Strict limit | User profile |
| Logging | Minimum | Average | Full (time, volume) |
Is it possible to combine VLAN and Hotspot?
Yes, that's the practice. You create a VLAN for guests and configure a hotspot server on it. This way, even if someone learns your WiFi password, they won't get internet access without logging in through the portal.
Diagnostics and monitoring of guest access
After setting up, you need to make sure everything works correctly. Use the built-in tools. MikroTik, such as Torches And Graphs, for real-time traffic visualization. They allow you to see who's consuming the most resources and quickly respond to anomalies.
For in-depth diagnostics use LogEnable Firewall event logging to see blocked access attempts from the guest network to the local network. This will help you understand whether guests (or their viruses) are attempting to scan your network and confirm that the isolation rules are working.
⚠️ Attention: Interfaces and menu names in RouterOS These may vary slightly depending on the firmware version (v6 or v7) and the type of hardware installed (hAP, RB, CAP). Always consult the official documentation for your specific model before making changes to the production environment.
Regularly check the lists of active DHCP leases and connected Hotspot users. Clear old entries if automatic clearing is not configured, and analyze the router's CPU load, as encryption and filtering traffic from multiple guests can strain the CPU.
Frequently Asked Questions (FAQ)
Do I need to purchase a license to set up a guest network on MikroTik?
No, the functionality of creating VLANs, configuring Firewalls, DHCP, and even a basic Hotspot is available in all license levels. RouterOS, including the free Level 4, which comes with most devices. Paid levels are only needed for very large numbers of tunnels or hotspot users (more than 50-500 depending on the level).
Will the guest network work if the internet connection goes down?
The local network (DHCP, Hotspot portal authorization) will work, as these are internal router services. However, access to external resources (the internet) will be blocked. If you have a local welcome page configured, it may load, but further navigation will be impossible without a global connection.
How to hide the guest network SSID?
In the wireless interface settings (Wireless) there is a parameter hide-ssidSetting the value yes Hides the network name from the lists of available networks on user devices. However, this isn't a security measure, as an experienced user can still find the hidden network, and for regular users, it can create inconvenience when connecting.
Is it possible to restrict guests to only see a specific site?
Yes, using Firewall and DNS rules. You can allow access only to the IP addresses or domain names of the desired resource (for example, a menu site or presentation), while blocking all other traffic. In Hotspot, this is implemented through the setting Walled Garden.