I am trying to setup my guest wifi network isolated from the main network. I am trying to achieve the isolation through guest bridge. The issue is that when connecting to the guest WiFi, I am still getting the IP assigned from the main network DHCP pool. Could anyone help me please? Here is my config:
Code: Select all
# 2024-11-02 10:38:56 by RouterOS 7.16.1
#
# model = CCR2004-16G-2S+
/interface bridge
add name=bridge-guest port-cost-mode=short
add name=bridge-main port-cost-mode=short
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface bonding
add mode=802.3ad name=bonding1 slaves=ether15,ether16
add mode=802.3ad name=bonding2 slaves=ether13,ether14
/interface list
add name=WAN
add name=LAN
/interface wifi channel
add band=2ghz-ax disabled=no name=channel-2 width=20/40mhz
add band=5ghz-ax disabled=no name=channel-5 width=20/40/80mhz
/interface wifi datapath
add bridge=bridge-main disabled=no name=datapath-main
add bridge=bridge-guest client-isolation=yes disabled=no name=datapath-guest
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk connect-priority=0 disabled=no \
encryption=ccmp ft=yes ft-over-ds=yes name=sec-main wps=disable
add authentication-types=wpa2-psk,wpa3-psk connect-priority=0 disabled=no \
encryption=ccmp ft=yes ft-over-ds=yes name=sec-guest wps=disable
/interface wifi configuration
add channel=channel-2 country=Czech datapath=datapath-main disabled=no mode=\
ap name=main-2 security=sec-main ssid=Wifiname
add channel=channel-2 country=Czech datapath=datapath-guest disabled=no mode=\
ap name=guest-2 security=sec-guest ssid=Wifiname_Guest
add channel=channel-5 country=Czech datapath=datapath-guest disabled=no mode=\
ap name=guest-5 security=sec-guest ssid=Wifiname_Guest
add channel=channel-5 country=Czech datapath=datapath-main disabled=no mode=\
ap name=main-5 security=sec-main ssid=Wifiname
/interface wifi
add configuration=main-2 disabled=no name=cap-wifi3 radio-mac=\
48:A9:8A:BA:2C:ED
add configuration=guest-2 disabled=no mac-address=4A:A9:8A:BA:2C:ED \
master-interface=cap-wifi3 name=cap-wifi4
add configuration=main-2 disabled=no name=cap-wifi7 radio-mac=\
48:A9:8A:BA:27:B9
add configuration=guest-2 disabled=no mac-address=4A:A9:8A:BA:27:B9 \
master-interface=cap-wifi7 name=cap-wifi8
add configuration=main-2 disabled=no name=cap-wifi11 radio-mac=\
48:A9:8A:BA:2C:9D
add configuration=guest-2 disabled=no mac-address=4A:A9:8A:BA:2C:9D \
master-interface=cap-wifi11 name=cap-wifi12
add configuration=main-2 disabled=no name=cap-wifi15 radio-mac=\
48:A9:8A:BA:2D:11
add configuration=guest-2 disabled=no mac-address=4A:A9:8A:BA:2D:11 \
master-interface=cap-wifi15 name=cap-wifi16
add configuration=main-2 disabled=no name=cap-wifi19 radio-mac=\
48:A9:8A:BA:2B:C9
add configuration=guest-2 disabled=no mac-address=4A:A9:8A:BA:2B:C9 \
master-interface=cap-wifi19 name=cap-wifi20
add configuration=main-2 disabled=no name=cap-wifi23 radio-mac=\
48:A9:8A:BA:2A:5D
add configuration=guest-2 disabled=no mac-address=4A:A9:8A:BA:2A:5D \
master-interface=cap-wifi23 name=cap-wifi24
add configuration=main-2 disabled=no name=cap-wifi27 radio-mac=\
48:A9:8A:BA:2B:DD
add configuration=guest-2 disabled=no mac-address=4A:A9:8A:BA:2B:DD \
master-interface=cap-wifi27 name=cap-wifi28
/ip pool
add name=dhcp ranges=192.168.15.100-192.168.15.254
add name=dhcp-guest ranges=192.168.16.100-192.168.16.254
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay interface=bridge-main \
lease-time=12h name=dhcp1
add address-pool=dhcp-guest interface=bridge-guest lease-time=1h name=\
dhcp-guest
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
set 1 name=serial1
/system logging action
set 1 disk-file-count=10
add disk-file-count=10 disk-file-name=firewall-log name=firewall target=disk
/interface bridge port
add bridge=bridge-main interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether6 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether7 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether8 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether9 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether10 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether11 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=ether12 internal-path-cost=10 path-cost=10
add bridge=bridge-main disabled=yes interface=ether13 internal-path-cost=10 \
path-cost=10
add bridge=bridge-main disabled=yes interface=ether14 internal-path-cost=10 \
path-cost=10
add bridge=bridge-main disabled=yes interface=ether15 internal-path-cost=10 \
path-cost=10
add bridge=bridge-main disabled=yes interface=ether16 internal-path-cost=10 \
path-cost=10
add bridge=bridge-main interface=sfp-sfpplus2 internal-path-cost=10 \
path-cost=10
add bridge=bridge-main interface=sfp-sfpplus1 internal-path-cost=10 \
path-cost=10
add bridge=bridge-main interface=bonding1 internal-path-cost=10 path-cost=10
add bridge=bridge-main interface=bonding2 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=all lldp-med-net-policy-vlan=1
/ipv6 settings
set disable-ipv6=yes
/interface list member
add interface=ether1 list=WAN
add interface=bridge-main list=LAN
add interface=wireguard1 list=LAN
add interface=bridge-guest list=LAN
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=bridge-main \
package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi provisioning
add action=create-enabled disabled=no master-configuration=main-2 \
slave-configurations=guest-2 supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=main-5 \
slave-configurations=guest-5 supported-bands=5ghz-ax
/interface wireguard peers
add allowed-address=172.18.0.2/32 interface=wireguard1 name=peer1 \
persistent-keepalive=30s public-key=\
"MYKEY"
/ip address
add address=192.168.15.1/24 comment="default configuration" interface=\
bridge-main network=192.168.15.0
add address=192.168.16.1/24 interface=bridge-guest network=192.168.16.0
add address=172.18.0.1/24 interface=wireguard1 network=172.18.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add interface=ether1
/ip dhcp-server lease
add address=192.168.15.2 comment=Switch mac-address=18:FD:74:A4:8D:C4 server=\
dhcp1
add address=192.168.15.3 comment=AP1 mac-address=48:A9:8A:BA:2C:EA server=\
dhcp1
add address=192.168.15.4 comment=AP2 mac-address=48:A9:8A:BA:27:B6 server=\
dhcp1
add address=192.168.15.20 comment=NAS mac-address=90:09:D0:20:C3:E1 server=\
dhcp1
add address=192.168.15.5 comment=AP3 mac-address=48:A9:8A:BA:2C:9A server=\
dhcp1
add address=192.168.15.6 comment=AP4 mac-address=48:A9:8A:BA:2D:0E server=\
dhcp1
add address=192.168.15.7 comment=AP5 mac-address=48:A9:8A:BA:2B:C6 server=\
dhcp1
add address=192.168.15.8 comment=AP6 mac-address=48:A9:8A:BA:2A:5A server=\
dhcp1
add address=192.168.15.9 comment=AP7 mac-address=48:A9:8A:BA:2B:DA server=\
dhcp1
/ip dhcp-server network
add address=192.168.15.0/24 dns-server=192.168.15.1 domain=\
sakarka.hubikova.cz gateway=192.168.15.1 netmask=24
add address=192.168.16.0/24 comment=guest dns-server=8.8.8.8,8.8.4.4 gateway=\
192.168.16.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall filter
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=input comment="accept established,related" \
connection-state=established,related
add action=accept chain=input comment="accept connections to router WebFig" \
dst-port=80 protocol=tcp
add action=accept chain=input comment="accept connections to OpenVPN" \
dst-port=1194 in-interface-list=WAN protocol=udp
add action=accept chain=input comment="accept connections to WireGuard" \
dst-port=13231 in-interface-list=WAN protocol=udp
add action=drop chain=input comment="drop all from WAN" in-interface-list=WAN
add action=accept chain=forward comment="accept established,related" \
connection-state=established,related
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="isolate guest and main network" \
in-interface=bridge-guest out-interface=bridge-main
add action=drop chain=forward comment="isolate guest and main network" \
in-interface=bridge-main out-interface=bridge-guest
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=dst-nat chain=dstnat disabled=yes dst-port=443 in-interface-list=\
WAN protocol=tcp to-addresses=192.168.15.20 to-ports=443
add action=dst-nat chain=dstnat disabled=yes dst-port=5001 in-interface-list=\
WAN protocol=tcp to-addresses=192.168.15.20 to-ports=5001
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=yes distance=1 dst-address=192.168.254.0/24 gateway=\
192.168.15.10 pref-src="" routing-table=main scope=30 \
suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/system clock
set time-zone-name=Europe/Prague
/system identity
set name=Gate
/system logging
set 0 topics=info,!firewall
add action=disk topics=critical
add action=disk topics=error
add action=firewall topics=firewall
add action=disk topics=warning
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes manycast=yes
/system routerboard settings
set auto-upgrade=yes
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add
