Recipe: a school or association building

Goal: staff, pupils and visitors sit on their own network, the Wi-Fi works in every classroom, the printer is reachable for everyone who needs it, and the volunteer who takes over understands the setup within ten minutes.

What you need

• A router that routes and handles VLANs, an RB5009 for instance, or a hEX S for a small building.
• A switch with enough ports, and an access point per one or two classrooms. Brick and concrete walls are the reason one access point per floor is not enough.
• A short list: how many classrooms, who belongs on the staff network, and what hangs on a cable (printer, smartboards, cameras).

Step 1: the site and the VLANs

Pick Multiple devices and add the router, the switch and the access points. In Shared settings you fill in the VLAN table:

Put staff at the top: the first VLAN in the table is what a wired port gets when you do not name it separately. Tick Mgmt on 99; that is where your switch and access points will be reachable. The numbers count up in tens by themselves, so 99 is one you type in.

A /24 sounds roomy, but a school with three hundred pupils quickly has six hundred devices on the pupil network, phones included. Give that one a /23 or a /22, and set the DHCP lease time in the same section to something short, 4h for example, so addresses of devices that left come back.

Step 2: who may reach whom

In Firewall & NAT:

1. Set Traffic between VLANs to the matrix. Tick only the directions you need: staff towards pupils, for smartboards and the printer, and nothing else. Replies always come back, so you do not tick the opposite direction.
2. Turn on Router manageable only from the management VLAN. WinBox from a classroom then no longer reaches the router.
3. Leave Brute-force protection on if the router has a public address.

Note that with the matrix on, the per-VLAN Isolated tick is no longer used. The Internet tick still is.

Step 3: Wi-Fi that reaches the classroom

1. Make three SSIDs in the shared settings: School on VLAN 10, Pupils on VLAN 20 and Guests on VLAN 30. Every access point broadcasts the same three, with the same security and the same passphrase, otherwise roaming does not work.
2. Turn on Client isolation on Guests, and on Pupils too if nothing has to cast there.
3. For Security pick WPA2 together with WPA3. WPA3 alone shuts out older chromebooks and school PCs.
4. Set Channel width 2.4 GHz to 20 MHz. In a building with many access points close together, 40 MHz mostly produces interference.
5. If you want the Wi-Fi managed in one place, give the router the role Router + CAPsMAN and the access points the role CAP. SSIDs, passphrases and VLANs then come from the router, and there is nothing to set on the CAPs themselves.

The ports towards the access points must be trunk with VLANs 10, 20, 30 and 99 ticked under VLAN membership. On the network board the tool does that for you as soon as you draw the cables.

Step 4: the printer everybody needs

Put the printer on a wired access port and give it a fixed address. Mind one limit of the tool: fixed addresses (static leases) live under LAN & DHCP, not in the VLAN table. So for a printer inside a VLAN you set the fixed address on the printer itself, outside the DHCP range, or you add the lease on the router after rolling out.

Then make a static DNS record in DNS, printer.school.lan pointing at that address for instance, so nobody has to remember an IP address.

Where the printer belongs depends on who prints on it. If everybody does, put it in the pupil VLAN and open the staff towards pupils direction in the matrix. If it is staff only, it sits there and nothing has to be opened. Remember discovery: printers are found over mDNS, and that does not cross a VLAN boundary. The configurator has no mDNS repeater, so in that case add the printer by address instead of picking it from a list. See Printer across several VLANs.

Step 5: filtering, and what the tool can and cannot do about it

What the configurator offers, in DNS:

• Adlist: blocks ad and malware domains through /ip dns adlist, using the StevenBlack list. Available from RouterOS 7.15.
• Force LAN clients through the router: redirects DNS on port 53 to the router, so a device with a hard-coded 8.8.8.8 does not go around it.
• Upstream DNS set to Custom, so you can enter a filtering resolver. Per VLAN is possible too: the VLAN table has DNS server for DHCP clients, so pupils can get a different resolver than staff.

And what it is not: this is not a school filter. There are no categories, no policy per class or per pupil, no time windows, no reporting and no way to enforce SafeSearch. DNS over HTTPS in a browser is not stopped by any of it. If you want real filtering you buy it as a service and enter it here as the upstream, or you put a device in front. The web proxy under Services & tools is not a content filter and only sees unencrypted HTTP; do not use it for this.

Testing

1. Connect a laptop to Pupils: an address from the pupil network, internet works, and a ping to a staff device fails.
2. Try WinBox to the router address from that same network. That should fail.
3. Walk from classroom to classroom with a phone while holding a call. If the call survives, the coverage is right; if it drops, add an access point.
4. Print from a staff laptop, and from a pupil laptop if that is the intention.
5. /ip firewall filter print stats: see which rule counts up when you try something that is not allowed.
6. Read the checks across the whole site: does every device carry the management VLAN, and does no VLAN stop halfway along a cable?

What to watch out for

• The management VLAN untagged on a classroom port puts your management network next to every desk. Management belongs tagged, towards switches and access points.
• The guest passphrase is common knowledge within a week. Change it every school year, or give guests a login page instead; see Guest Wi-Fi with a login page.
• A MAC filter is not security. The access list in the Wi-Fi section is useful for keeping one device out, not for keeping a network closed. Port authentication with 802.1X is not in the tool.
• PoE budget. Add up the access points before you hang them all on one switch, and check PoE-out for what your device supplies.
• Make it readable for the next person. Fill in Port comments, add a login note saying who manages it, print the handover sheet for the folder, and turn on the offbridge port as a way back in. Keep the settings file with the school records, so a successor can carry on where you stopped.

Further reading: Example: office with VLANs, CAPsMAN and Planning VLANs.