VLANs split one cabled network into several separated networks: your ordinary LAN, guests, cameras, IoT. Each with its own address range and its own DHCP server, over the same cables and the same bridge.
The VLANs section is off by default. You turn it on in advanced mode, or you get it through a role that needs it. It only applies to devices with wired ports. The configurator uses bridge VLAN filtering, the RouterOS v7 way.
The VLAN table
The table starts with three VLANs you can change straight away: 10 vlan10-lan, 20 vlan20-guest and 30 vlan30-iot, with addresses 192.168.10.1/24, 192.168.20.1/24 and 192.168.30.1/24. Every VLAN you add after that counts up by ten and gets an address that follows the number. Convenient while it is right: if your plan uses other numbers, change them immediately.
Per row you fill in:
- ID
- The VLAN number, 1 to 4094. Change an id and the ports pointing at it follow along. VLAN 1 is not allowed: it is the bridge's own pvid, and a VLAN interface for id 1 gives you two interfaces on the same VLAN. The configurator reports that as an error and points at the alternative, described under pvid below. VLAN 4095 is reserved and produces a warning.
- Name
- The interface name in RouterOS. You see it again in the firewall rules and in the port selectors.
- Router address
- The router's address in that VLAN, with its prefix. Leave it empty and the VLAN exists at layer 2 only: it runs over the cables, but the router has no address in it and does not route to it. That is exactly what you want on a switch or an access point, and rarely on a router. If no VLAN has an address while the device does route, the configurator warns you.
- DHCP
- A DHCP server of its own for that VLAN. The pool starts at
.10of the subnet. - Internet
- Off means this VLAN may not go out. A drop rule towards the WAN list is written. For cameras that have no business online.
- Isolated
- On means no access to other VLANs, internet allowed. For guests and IoT. Note that this flag only applies under the firewall policy "open, except VLANs marked as isolated". Switch the firewall over to the matrix and the matrix decides everything, so the tick is ignored; the configurator says so.
- Mgmt
- Marks the management VLAN. A device without its own address gets its address in that VLAN instead of on the bridge. In a site this is also the VLAN on which switches and access points get their management address, and the site check reports an error when a device does not carry the management VLAN, because it would be unreachable after pasting.
Below the table sit the lease time, the DNS server for the DHCP clients in these VLANs and a domain name. Those apply to all VLANs together.
Port assignment
The second table says what goes through each port. Ports you do not list here become access ports of the first VLAN in the table. That first row is therefore your default network for wired devices; do not leave your guest VLAN sitting there by accident.
- Access
- One VLAN, untagged. For a laptop, a printer, a camera. Under untagged VLAN (pvid) you pick which VLAN that is.
- Trunk
- Several VLANs, tagged. Towards a switch or an access point. Under VLAN membership you tick which VLANs go over it. A trunk needs at least one tagged VLAN, or you get an error.
For the pvid of a trunk you can also pick —: tagged traffic only, nothing untagged. That is the tidy choice for a trunk to another MikroTik device.
There is a third choice for pvid: bridge (untagged, no VLAN). That is the bridge's own untagged network, not a VLAN. Use it when you want to reach the address that sits on the bridge itself. It is also the answer to "I want a VLAN 1": do not create a VLAN with id 1, set that port's pvid to bridge.
Add a VLAN after your trunks are set up and it is added to every trunk automatically. Without that it would exist on the router and never reach the switch behind it. Delete a VLAN and the references are cleaned up.
In a site with several devices
The VLAN table then belongs to the site and goes to every device, so a number means the same network everywhere. Only the router gets the addresses and the DHCP servers as well. Draw the cables on the network board and the ports with another device on them become trunks, the rest access ports. A trunk then tags every VLAN and carries nothing untagged.
The checks across the whole site then look at whether it adds up: a VLAN that exists on one end of a cable and not on the other stops at that cable, a host on a VLAN its switch does not carry is cut off, and an SSID on a VLAN the access point does not have does nothing. See Multiple devices in one site.
Hardware offload and the switch chip
On a number of models, the Atheros8327 and QCA8337 family, the VLAN table lives in the switch chip and is reached through /interface ethernet switch rather than through the bridge. Bridge VLAN filtering does work there, but it takes the traffic off the switch chip and hands it to the CPU: a device that could switch at wire speed ends up forwarding VLANs in software.
The configurator recognises those models and adds a note. If throughput disappoints on such a board, the switch-chip configuration is the right route, and this section does not write it. On newer chips this does not arise.
What ends up in the script
/interface vlanfor every VLAN with an address or with the management flag, on top of the bridge./ip address,/ip pool,/ip dhcp-serverand/ip dhcp-server networkfor every VLAN with an address and DHCP.- The bridge VLAN table itself and the port settings come from Bridge and ports: a pvid per port,
frame-typesandingress-filtering. - The isolation rules come from the firewall.
When it does not work
- A port is dead. Usually a pvid pointing at a VLAN that no longer exists. With ingress filtering on, its traffic is dropped. The configurator checks this and reports "VLAN does not exist".
- No DHCP behind the switch. Check that the VLAN is really on the trunk leading there.
- You can no longer reach the router. If you put the address on the bridge but no port hangs untagged on the bridge, that address cannot be reached. Set your management port's pvid to bridge, or use the offbridge port from Bridge and ports as emergency access.
Read on: Bridge and ports, The firewall and Example: a guest network.