Providing secure internet access for office visitors, cafe customers, or friends on a home network requires proper traffic isolation. Using the equipment MikroTik Provides administrators with extensive customization options for these zones, going far beyond simply creating a second access point. Proper configuration allows for speed limits, session timeouts, and protection of the local network from unauthorized access.
Implementing a separate segment for guests isn't just a matter of convenience, but a basic network hygiene measure. Guest devices often lack up-to-date security updates or may be infected with malware, posing risks to corporate data. Mikrotik Allows you to create a "sandbox" where external users can access the global network, but will be completely cut off from the company's internal resources or personal storage.
In this article, we'll cover the process of setting up guest access, from basic VLAN separation to complex firewall rules. You'll learn how to configure a login page, limit bandwidth, and ensure stable operation of the primary connection even under heavy guest loads. This guide will help you build a reliable network architecture.
Planning network architecture and creating VLANs
The first step to high-quality traffic isolation is logically dividing the network into virtual segments. Using technology VLAN (Virtual Local Area Network) allows you to create an independent logical network on top of your physical infrastructure. This means that guest devices will operate within their own IP range and won't be able to "see" accounting computers or servers hosting sensitive information.
To implement this scheme, you need to create a new VLAN interface on a physical port or wireless interface. In the menu Interfaces a new element with type is added vlan, where the parent interface and unique identifier are specified VLAN IDTypically, guest segments are assigned IDs in the range of 10-99, such as 20 or 30, to visually distinguish them from service networks.
⚠️ Caution: When configuring VLANs, ensure that the switches to which the access points are connected support traffic tagging (802.1Q). If the switch is unmanaged, tagged traffic may be lost or processed incorrectly.
After creating a virtual interface, you need to assign it an IP address, which will become the gateway for guest devices. In the section IP → Addresses a new address is added, for example, 192.168.20.1/24This address will be used by clients to retrieve settings and access the internet. It's important not to confuse the guest zone subnet with the main local network to avoid routing conflicts.
The next step is to configure the DHCP server for the new subnet. Without this, guest devices will not be able to automatically obtain an IP address, mask, and DNS. In the menu IP → DHCP Server the setup wizard starts (DHCP Setup), which will automatically create an address pool and the necessary rules. You select the previously created VLAN interface and specify the range of addresses to be assigned.
Setting up a wireless network for guests
To transmit guest traffic over the air, you need to create a separate SSID (wireless network name). In the interface WinBox go to the section Wireless and open the settings of your radio module (usually wlan1 or wifi1). Here a new record is created in the table. Wireless with a unique name and SSID, for example, "Guest_WiFi".
Configuring security is critical. It is recommended to use encryption for the guest network. WPA2 or WPA3 with a private key (Pre-Shared Key). Tab Security Profile must contain a complex password that is changed periodically. Avoid using open networks without a password, as this exposes users' traffic to interception.
- 📶 SSID: A unique network name that is understandable to users.
- 🔒 Security: WPA2-PSK or WPA3-SAE encryption protocol.
- 🔑 Passphrase: Complex password longer than 12 characters.
Particular attention should be paid to the parameter Default ForwardIf you want to prevent clients from communicating with each other even within the guest network (which improves security), this setting can be disabled at the driver level, although more flexible control is available through the firewall. It's also worth limiting the maximum number of connected clients (Max Station Count), so that one overloaded range does not "take down" the entire access point.
⚠️ Note: Wireless interfaces have a limit on the number of simultaneous connections. If you plan to host more than 50 users, consider using multiple access points or specialized CAPsMAN equipment for load balancing.
Setting up DHCP Server and NAT
Once the interface and wireless network are created, clients need to be provided with access to the global network. This is accomplished using a mechanism NAT (Network Address Translation). In MikroTik, this is implemented through rules in the section IP → Firewall, tab NATWithout this rule, devices on the guest subnet will not be able to access the Internet.
Create a new NAT rule with the following parameters: in the tab General in the field Chain select srcnat, and in the field Out. Interface Please specify your connection interface to your provider (for example, ether1 or pppoe-out1). In the tab Action select an action masqueradeThis rule will "substitute" guests' internal addresses with the router's external IP address when accessing the internet.
In parallel with NAT, you need to make sure that the DHCP server is distributing addresses correctly. Check the tab Leases in the DHCP Server menu. If the client has connected but has not received an IP address, check if the address pool is active (IP Pool) and whether it has been exhausted. Lease times are often set for guest networks, for example, 1 hour, to ensure addresses are released more quickly after visitors leave.
To control traffic, you can configure speed limits directly in the DHCP server or via Queue. However, basic NAT configuration is essential. If a NAT rule isn't working, check whether a firewall is blocking traffic. By default, MikroTik routers often have Drop All mode enabled for incoming traffic, but outgoing traffic (forward) may be limited.
Client isolation and firewall rules
The most important aspect of a guest network is security. You need to be sure that guests can't access your NAS, printer, or 1C computer. Filtering rules are used for this purpose. IP → Firewall, tab Filter RulesWe'll create a rule that prohibits access from the guest subnet to the local one.
Create a new rule in the chain forwardIn the field Src. Address Specify the guest subnet (e.g. 192.168.20.0/24), and in the field Dst. Address — a subnet of your main network (for example, 192.168.88.0/24). Action (Action) select dropThis rule should be placed above the rules allowing internet access.
/ip firewall filter
add chain=forward src-address=192.168.20.0/24 dst-address=192.168.88.0/24 action=drop comment="Block Guest to Local"
Additionally, it is recommended to prohibit communication between the guest network clients themselves, if this is possible at the access point settings level (parameter Default Forward (in the wireless interface). If a software method is unavailable, complex firewall rules can be used, but this increases the load on the router's processor. The primary priority is protecting internal resources.
☑️ Checking guest network security
Speed Limit and Hotspot
To prevent one guest downloading torrents from "killing" the internet speed for the entire office, it is necessary to implement a bandwidth limiting system (Queues). In MikroTik this is done through Queues → Simple QueuesCreate a new queue, specify the target addresses (guest subnet), and set limits, for example, 5 Mbps for download and 1 Mbps for upload.
A more advanced method is to use a built-in module HotspotIt allows not only to limit speed but also to create authorization pages, require an access code, or accept payments. Setting up a Hotspot is more complex than a simple VLAN, as it requires creating user profiles, servers, and address pools specifically tailored to this service.
When using a Hotspot, guest traffic is routed through a dedicated process that intercepts HTTP requests and redirects users to the login page. This is ideal for cafes and hotels. However, for a simple office network, a VLAN + Simple Queue combination is sufficient, which is less resource-intensive on the router's processor.
The table below compares the two main approaches to guest access:
| Parameter | VLAN + NAT | Hotspot |
|---|---|---|
| Difficulty of setup | Low | High |
| CPU load | Minimum | Medium/High |
| Authorization | By WiFi password | Login Page / Codes |
| Traffic accounting | Base | Detailed by users |
How to limit speed for each device individually?
For individual throttling in Simple Queues, you can use dynamic masks or scripts that create child queues for each new IP address appearing in the guest subnet. This requires writing a small script in the RouterOS language.
Diagnostics and typical errors
During setup, administrators often encounter issues where devices connect to WiFi, but the internet doesn't work. First, check for a NAT rule. If it's missing or configured incorrectly (for the wrong interface), traffic won't flow out. Use this tool Torch in WinBox to view passing traffic in real time.
The second common error is a DNS conflict. Make sure the DHCP Server settings for the guest network are configured with the correct DNS servers (e.g., 8.8.8.8 or your ISP's DNS). If clients can't open websites by name but can ping IP addresses (e.g., 1.1.1.1), the problem lies in name resolution.
It's also worth remembering that some providers limit the number of devices that can be connected simultaneously. If you've added a guest network and the internet connection is lost everywhere, your provider's protection may have kicked in. In this case, you may need to clone the MAC address on the WAN port or contact technical support to increase the limit.
FAQ: Frequently Asked Questions
Is it possible to create a guest network without creating a VLAN?
Technically, it is possible by simply creating a second SSID and assigning addresses from the same subnet as the main network. However, this unsafe, as guests will have direct access to your network resources. Using a VLAN or at least a separate subnet with firewall rules is a mandatory security standard.
Will guest WiFi slow down my main internet speed?
Yes, unless speed limits (Queues) are configured. The entire bandwidth is shared between all users. To avoid problems, be sure to configure Simple Queues with a limit on the guest subnet, leaving the main channel free for business tasks.
Do I need a separate physical port for the guest network?
No, it's not necessary. VLAN technology allows data to be transmitted for different networks over a single cable. However, if you're connecting a separate access point just for guests, you can connect it to any port, after configuring it as an access port for the guest VLAN.
How often should I change my guest WiFi password?
It's recommended to change your password regularly, for example, monthly or quarterly. Commercial establishments (such as cafes) often use a system of vouchers or codes valid for a limited time, eliminating the need to change a static password on the access point.