Using a professional router as a simple switch may seem like overkill, but it gives the network administrator unique traffic segmentation capabilities. By turning the device Mikrotik By adding a managed switch, you gain full control over each port, the ability to create VLANs, and configure isolated access zones. This is especially relevant for offices or apartments where you need to provide internet access to guests without compromising the main local network.
Standard switches, even managed ones, often lack a built-in radio module, and home routers are limited in their traffic forwarding functionality. RouterOS It allows you to connect these worlds, creating a flexible architecture where wired ports and wireless access points work together. In this article, we'll discuss how to properly configure your equipment to function as a Layer 2 switch with advanced security features.
The main challenge is to properly configure bridges and filtering rules to avoid switching loops and data leaks. It is critical to understand that when operating in switch mode, routing between interfaces is disabled and all traffic is processed at the data link layer. We'll walk you through a step-by-step process that will allow you to implement a robust guest network with client isolation.
The concept of network isolation and the role of VLANs
The foundation of any secure network is the separation of traffic into logical segments. Technology VLAN (Virtual Local Area Network) allows you to create multiple virtual networks on top of a single physical infrastructure. In the context of setting up Mikrotik As a switch, this means that employee ports and guest ports will only see their own traffic, ignoring each other's packets.
A guest network requires special consideration: users should not have access to the main organization's administrative panels, file servers, or printers. Using separate VLAN ID For guest traffic, this ensures that even when physically connected to the same switch, the devices are logically located in different broadcast domains. This prevents port scanning and ARP spoofing attempts by guests.
However, simple segmentation does not provide complete protection. Isolation mechanisms must be implemented at the port and wireless client level. In the ecosystem Mikrotik This is implemented through settings bridge And wireless security profileProper configuration ensures that a client connected to a guest SSID cannot "knock on" a neighbor's Wi-Fi or a computer connected by cable to the primary port.
Basic RouterOS preparation and configuration reset
Before you begin complex bridge and VLAN configurations, you need to clean up the device. Standard Configuration Mikrotik Often contains NAT rules and DHCP servers that will interfere with transparent switching. It's recommended to perform a full reset without saving the configuration to eliminate the impact of old rules.
After the reset, the first thing you should do is update the software to the latest stable version!
To switch to switch mode, we need to change the port logic. All ports that will be used for data transfer (both primary and guest) must be added to one bridgeHowever, to separate traffic, we will use VLAN tagging within this bridge or create separate bridges for different types of traffic if the device's hardware architecture allows it.
☑️ Preparing the device
It's important to note that device management itself should occur through a dedicated port or VLAN to avoid interfering with user traffic. This will ensure access to settings even if the underlying network is down. Configure a static IP address on the management interface, making it accessible only to trusted administrators.
Configuring Bridge and Ports to Separate Traffic
The central element of the switch configuration is bridgeIt is this that combines physical ports and virtual interfaces into a single switching matrix. To achieve our goal, we will create a single main bridge to which we will add all physical Ethernet ports. However, simply adding them is not enough—we need to configure the behavior of each port via bridge port.
For ports dedicated to the primary network, we'll leave the default PVID (Port VLAN ID) settings, corresponding to the primary VLAN. For ports that will accommodate guests (or access points with a guest SSID), change the PVID to the guest VLAN ID. This means any untagged traffic entering this port will automatically be tagged as guest.
Particular attention should be paid to the settings Ingress FilteringEnabling this option forces the switch to check incoming VLAN tags and discard packets if the port isn't on the corresponding list of allowed VLANs. This provides powerful protection against connection errors and unauthorized attempts!
| Interface | Connection Type | PVID | VLAN Members | Comment |
|:--- |:--- |:--- |--- |:--- |
| ether1 | Uplink (Tagged) | 1 | 10, 20 | Communication with the main router |
| ether2 | Main client | 10 | 10 | Employees' PCs |
| ether3 | Guest Port | 20 | 20 | Guest Printer |
| wlan1 | Guest Wi-Fi | 20 | 20 | Wireless Clients |
Organizing guest Wi-Fi access
Setting up a wireless network requires careful attention to security settings. Let's create a new interface. wifi or use an existing one, changing its operating mode. The key is to link this interface to the one created earlier. bridge and setting up the correct one security profileIn the security profile, you must activate the option Client-to-Client Forwarding into the "disabled" state.
Disabling forwarding between clients means that devices connected to the guest Wi-Fi will not see each other in the network environment. This prevents the spread of viruses within the guest area and protects users' personal data from nosy neighbors at a cafe or office. Mikrotik This is implemented by setting a flag hide-ssid (optional) and correct configuration access-list.
Additionally, it's worth limiting the signal strength to prevent the guest network from "broadcasting" beyond the premises. This is not only a security issue, but also to reduce interference with the main communication channels. Use the tool scan in the wireless menu to select the least crowded channel in the 2.4 GHz or 5 GHz range.
Speed limit for guests
To prevent channel abuse, you can configure Simple Queue on the guest bridge interface, limiting the speed to, for example, 10 Mbps per client.
Firewall and traffic filtering rules
Even when configured as a switch, Mikrotik retains firewall capabilities. This is our main advantage over regular "dumb" switches. We need to create rules in the chain forward, which will strictly separate data flows. The first rule should deny any traffic from the guest zone (VLAN 20) to the main zone (VLAN 10).
The second rule should allow guests access only to the gateway (to obtain an IP address via DHCP) and the external network (WAN). All other connection attempts should be rejected.
⚠️ Attention: When configuring firewall rules, ensure you don't block access to the Mikrotik device itself. Leave the rule allowing incoming traffic to management ports (WinBox, SSH) only from trusted administrator IP addresses.
To implement a DHCP server for guests, you can use the built-in service ip dhcp-server, binding it to the guest bridge interface. Configure an address pool that does not overlap with the main network, and specify the gateway address of the bridge itself. Mikrotik Or an external router if it's distributing DHCP. Don't forget to configure DNS servers so your guests can access the internet.
Security testing and diagnostics
After applying all the settings, it's important to conduct a thorough test. Connect a laptop to the guest port or Wi-Fi and try pinging the main network devices. A successful ping indicates a VLAN or firewall configuration error. Also, check the router's web interface from the guest device—it should be unavailable.
Use built-in diagnostic tools such as tool traceroute And tool ping, to check the packet path. In the logs (log) you can track dropped connections, which can help identify unauthorized access attempts or configuration errors. If you see a lot of dropped packets from unknown addresses, you might want to enable flood protection.
Check DHCP functionality: the client should receive an address from the correct pool. If an address is not assigned, check whether broadcast traffic is passing through the bridge and whether it is being blocked by firewall rules. A common problem is that the bridge port is not marked as trusted by the DHCP server.
Frequently Asked Questions (FAQ)
Is it possible to use an old Mikrotik router as a switch?
Yes, virtually any Mikrotik model with RouterOS support can operate in switch mode. However, performance will depend on the device's processor. For speeds above 100 Mbps, models with hardware-accelerated switching (SwOS or Chipset Switching) are recommended.
Will my internet speed decrease with this setting?
With hardware offloading configured correctly, speed won't drop and will match the port bandwidth. If acceleration isn't supported or is disabled, the load will shift to the CPU, which can become a bottleneck at higher speeds.
Do I need to purchase a license to work in switch mode?
No, basic switching, VLAN, and wireless access point functionality is available with a free RouterOS license (Level 3 or higher, depending on the model). A Level 4 license may be required for a large number of wireless clients.
How do I return my device to router mode?
It is enough to delete the bridge configuration, disable the bridge mode in the interface settings and reconfigure IP addresses and NAT rules, or simply perform a Reset Configuration.