Install a separate access point with isolated networks.
Several years ago (2014), I got on the Mikrotik bandwagon via an RB2011 series router. Specifically, the RB2011UiAS-2HnD-IN - which has 5 gigabit ethernet ports, 5 fast ethernet ports, and 2 channel 2.4GHz WiFi.
At the time, I had exactly one device which was 5GHz WiFi capable, so the lack of 5GHz 802.11ac support wasn’t a problem. Fast forward to 2017 and 5GHz support on client devices like phones and laptops is pervasive (every new device we acquired in 2017 supported 5GHz 802.11ac). Even more pointed is that my wife’s Acer Spin 15 has no wired ethernet port at all; it’s WiFi all the way (or a USB ethernet adapter), so having a 5GHz access point is now quite desirable.
So, when my parents asked me what they could buy me for Christmas, I asked for a Mikrotik wAP ac. This is a WiFi access point with single gigabit ethernet port, 2 channel 2.4GHz and 3 channel 5GHz WiFi. Many thanks to them!
Installing an access point is usually nothing complicated. But I run a total of 4 virtual WiFi access points, for various isolated networks.
To keep this isolation happening, we need to use VLANs to create… well… virtual LANs for my virtual access point. So the goal of this exercise is to install and configure my shiny new wAP access point, and keep my 4 separate WiFi networks isolated.
Side note: last time I tried to make VLANs work I failed miserably. So no pressure or anything.
Basic stuff first. Unbox the wAP and plug it in to configure core LAN settings.
The wAP is powered via power over ethernet, delivered by a magic injector plus plug pack. Which means I don’t need a power point near the access point itself, only near my router. Nice!
I configured a static IPv4 address and set DNS and the default route to my router. Then, got the access point to check for updates (confirming its network configuration is good) and installed said update.
Finally, I changed the default access points to
grant-new5, and gave them both a password - in preparation for some later tests.
Once I confirmed I can use WinBox to access the device, it’s time for physical installation. Mostly, this involves me drilling holes in my ceiling and cornice, and pulling ethernet cable through my ceiling cavity. Not particularly fun in my book. But only needs to be done once.
The access point has various mounting options from a desktop stand to wall mount to mast mount. I used double sided tape to attach to the wall and installed it up-side-down. And I think the end result is pretty discrete. It’s also installed in a more central location than the RB2011, which is located at the far end of our living room. (See below for a map).
At this point, I’m ready to configure the access point for real use. But there’s a question bugging me: which networks should be hosted on which devices?
That is, I have two 2.4GHz radios on two devices (each of which can occupy 2 usable channels out of a possible 3) and four networks I’d like to run. Which combination will work the best?
The 5GHz situation is less complex as I only have a single 5GHz radio. But it does remain: should all networks run on 5GHz, or just some?
An important piece of theory at this point: WiFi uses a shared medium to send and receive data called the “radio spectrum” (aka “the air”). I’ve highlighted the key words shared medium because it means only one device can send to one other device at any given time. If two devices attempt to send at the same time, their packets literally colide in mid-air (well, OK, they collide the in receivers radio circitry) and must be re-sent. Also, it’s half-duplex, which means you can’t send and receive at the same time: one device sends while another receives, then the roles are reversed. It’s like 10BASE2 ethernet using the old coax cable which I remember from the mid and late 1990’s at LAN parties - there is only one wire shared between all devices so only one device can send at any one time.
This means to get the best out of WiFi, you should run separate networks on separate radios and separate frequencies (which is kind of like running separate wires for separate networks). An article on Ars Technica goes over this in great detail.
(As a side note, Gigabit ethernet does not suffer from this problem because of high performance network switches which magically make sure packets going to and from each device never collide).
Anyway, back to my problem at hand: which networks, which devices, which channels? Oh, and one other: should a create different SSIDs for the 2.4GHz and 5GHz networks, or just let my devices roam between them as they see fit?
I decided to create some heat maps of signal strength for my old access point and new, to see if that would help answer these questions.
(I usually use Nirsoft WiFi Information View on Windows for pretty low level details of access points, but it doesn’t do heatmaps. So I creating the heat maps using my Nexus 5X using the
Wifi Heat Map - Survey app).
I live in a townhouse, which is a single storey dwelling that shares a wall with a neighbour (with 6 dwellings on our common property). The interior of our unit is in the bottom left of the heatmaps, around two thirds of the area is outdoors. It’s pretty small, as far as WiFi coverage goes. And Mikrotik devices are rather overpowered for my dwelling.
(By “overpowered” I mean my neighbour in unit 3 says the RB2011 has stronger signal strength than his home router; and mine has to penetrate 2 double brick walls and ~20m of space)!
(By “overpowered” I mean the RB2011 is visible to my phone around 50m away down my street on the Wigle Wardriving app)!
Well, the amount of green wasn’t very surprising!
The main thing I learned from that exercise was that the 5GHz network has shorter range, so phones need to have a 2.4GHz option.
In the end, I decided on the following 2.4GHz configuration, using the same SSIDs for 2.4 & 5GHz:
|Main LAN||2.4 & 5||6-13, 98-114||wAP|
|Phones||2.4 & 5||6-13, 98-114||wAP|
My general hope is this will use spectrum as widely as possible (eg: phones and kids are not on overlapping channels, and laptops on the main LAN will favour 5GHz). It also has a nice benefit that I can disable the kids network without affecting the adults’ phones or laptops!
So far (after a week of use), my devices have roamed pretty intelligently between 2.4 and 5GHz, depending on signal strength and proximity to access point.
OK, now the radios are configured on the access point, it’s time to replicate the network level isolation of my previous setup. Previously I had one device, several virtual access points and a separate network for each AP. With my new access point, I’d like the router to handle as much of the configurations possible (eg: firewall, DHCP, etc), and the access point to well… just be an access point (with just the SSID and WPA2 passwords). That is, 90% of the configuration is in the router, but the networks remain separate and isolated (except as allowed by the router’s firewall).
Which means I must conquer my fear of VLANs.
In my head, the way Mikrotik does VLANs is like so:
- Create VLAN interfaces as children of the ethernet port, I think of these as virtual ethernet wires.
- Create a bridge which connects the VLAN “wire” to other ports or interfaces (eg: WiFi access points), I think of these as like a network switch you plug the VLAN “wires” into.
- Finally, assign a IP address (and IPv6 address) to the bridge interface, and you can then do all the usual firewall and DHCP things.
I have no idea if this is the “right” way to do things or not, but it does work (at least in my environment).
Also, this was all done with the 6.40 version of RouterOS. 6.41 has a new bridge implementation, which seems to treat a bridge much more like a switch when working with VLANs.
3a. Access Point Configuration
On the access point, create the following:
- Create a virtual access point interface (simply called virtual in the New Interface drop down menu) with an appropriate SSID, WiFi channel and security profile. Do not assign it a VLAN ID. Doco about Wireless Interfaces.
- (You can also just use the main WiFi access point, rather than a virtual one. I have one real Wireless interface and one Virtual on my AP).
- Create a VLAN interface as a child of the ethernet port. Assign it a VLAN ID (which you’ll use on the router to connect the virtual wires); I’m using 10 and 20. Doco about VLAN Interfaces.
- Create a bridge interface. And assign the access point and VLAN interfaces to the bridge. This is done through the Bridge menu. Doco about Bridge Interfaces.
Here’s the configuration on my wAP:
3b. Router Configuration
On the router, we’ll replicate similar VLANs and bridges, and then do the IP level config:
- Create VLANs as child interfaces of the ethernet port your access point is connected to. Use the same VLAN ids as on the access point.
- If you want one of those VLANs to be part of your main LAN, add it to your LAN bridge.
- Otherwise, simply leave the VLAN interface as is.
- Assign IP addresses to the VLAN interfaces (IP -> Address).
- This assumes your main LAN bridge interface already has an IP address.
- Configure DCHP against the VLAN interfaces (IP -> Pool and IP -> DHCP Server).
- Again, this assumes your main LAN bridge interface already has DHCP running on it.
- Configure IPv6 addresses for the VLAN interface (IPv6 -> Pool and IPv6 -> Address).
- Reconfigure your firewall to block / allow access as desired.
- I’ve got rules to deny access to my main LAN from other networks (eg: kids, guest, phones), unless there are explicit rules allowing access.
In general, once you have your VLAN interfaces created and bridged as required, you should configure IP and DHCP the same as any additional network. Thus all DCHP, DNS, firewall, etc configuration is on the router alone.
Here’s the relevant parts of my router config for the main LAN and phones networks, which are now hosted on my wAP device:
3c. Router Configuration for Guest Network
I have my guest WiFi network running off my router, but am also including an ethernet port as part of that guest network. So, I have created a separate guest bridge, which includes the guest WiFi interface and guest ethernet port. No VLANs involved here, just bridging ports to a separate network.
Using VLANs and bridges on Mikrotik devices allows you to add a new physical access point to your network. From there you can transparently add new WiFi networks either to your main LAN or to separate isolated networks. And then it’s just a matter of firewall rules to allow or deny access between the networks.