VLAN on MikroTik: Separating Guests, Staff, VoIP and Cameras

1. Diagnosis

Everyone sits on the same network. Guests, accounting, surveillance cameras, IP phones. Sound familiar?

Someone on the guest WiFi scans the network neighborhood and finds the director’s printer. A Hikvision camera with a default password sits in the same subnet as your accounting software. An employee accidentally shared a folder on their laptop, and now the whole office sees their vacation photos. This isn’t a network. It’s a digital communal apartment.

VLAN on MikroTik fixes this in one evening. You get four isolated networks on a single physical cable. Guests can’t reach accounting. Cameras only stream to the recorder. Phones don’t glitch because someone’s downloading torrents. Setup time: 50 minutes. You’ll need a MikroTik running RouterOS 7.x and the willingness to dig in.

Here’s what’s inside:

• Bridge and VLAN interfaces: the foundation of network separation
• Trunk port: one cable, all VLANs
• Access ports: each port on its own network
• Bridge VLAN filtering: the correct approach in RouterOS 7
• Firewall between VLANs: who can go where
• DHCP and DNS for each VLAN
• Guest WiFi on a separate VLAN

If the basic MikroTik setup isn’t done yet, start there. For isolating servers, check out the article on DMZ.

2. Causes

Why is one flat network a problem? Let’s go through the facts.

Guests see internal resources

A courier connected to the guest WiFi and found a NAS with financial reports. Not because he’s a hacker. Because you don’t have VLANs. Guest traffic should go straight to the internet without touching the office.

Cameras and IoT devices are a security hole

An IP camera bought on AliExpress runs firmware from 2019. It has default credentials, open ports, and zero update support. If it sits on the same network as your workstations, compromising one camera means compromising the whole office. VLAN puts IoT in its own ghetto, where it can’t get out.

VoIP breaks up because of background traffic

A receptionist is talking to a client. Meanwhile someone’s downloading a Windows update. RTP voice packets get lost behind a queue of TCP segments. The voice turns robotic. A dedicated VLAN for VoIP with QoS priority fixes this for good.

Broadcast storms

In a flat /24 network, every ARP request, every DHCP broadcast, every broadcast packet is seen by all 253 devices. Cameras send multicast video streams. Printers announce themselves via LLMNR. The network drowns in noise. VLAN cuts the broadcast domain into pieces.

Access control becomes impossible

Without VLAN, the firewall only works at the internet edge. There are no boundaries inside the network. You can’t say “guests get internet only, cameras only reach the recorder, office gets everywhere.” VLAN gives you those boundaries.

Scaling turns into a nightmare

The office grows. You add a second floor. Then a production floor. Then a branch office. In a flat network, every expansion means redesigning the addressing scheme. With VLAN, you just add another trunk port and pass through the VLANs you need. The router doesn’t even notice the difference.

3. Recipe

Preparation

Check your environment before you start. Lose access and you’ll be running back to the router physically.

Our VLAN scheme:

Port table:

Network architecture:

%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#ffffff',
    'primaryTextColor': '#1e293b',
    'primaryBorderColor': '#94a3b8',
    'lineColor': '#64748b',
    'fontSize': '15px',
    'fontFamily': 'ui-sans-serif, system-ui, sans-serif'
  },
  'flowchart': {'curve': 'linear', 'nodeSpacing': 50, 'rankSpacing': 50}
}}%%
flowchart TD
    A["MikroTik Router"] --> B["ether1 Trunk"]
    B --> C["Managed Switch"]
    C --> D["ether2 Access VLAN10"]
    C --> E["ether3 Access VLAN20"]
    C --> F["ether4 Access VLAN30"]
    C --> G["ether5 Access VLAN40"]
    A --> H["VLAN10 Office 192.168.10.0/24"]
    A --> I["VLAN20 Guest 192.168.20.0/24"]
    A --> J["VLAN30 VoIP 192.168.30.0/24"]
    A --> K["VLAN40 Cameras 192.168.40.0/24"]
    H --> L["Internet + VLAN30"]
    I --> M["Internet only"]
    J --> N["Internet + SIP"]
    K --> O["NVR in VLAN10 only"]
    style A fill:#f8fafc,stroke:#3b82f6,stroke-width:2px,color:#1e40af
    style B fill:#f8fafc,stroke:#3b82f6,stroke-width:2px,color:#1e40af
    style C fill:#f8fafc,stroke:#94a3b8,stroke-width:2px,color:#475569
    style D fill:#f8fafc,stroke:#22c55e,stroke-width:2px,color:#15803d
    style E fill:#f8fafc,stroke:#f97316,stroke-width:2px,color:#c2410c
    style F fill:#f8fafc,stroke:#8b5cf6,stroke-width:2px,color:#6d28d9
    style G fill:#f8fafc,stroke:#ef4444,stroke-width:2px,color:#b91c1c

Step 1. Create the bridge

In RouterOS 7, the bridge is your central switch. All ports and VLAN interfaces live inside it.

/interface bridge add name=bridge1 protocol-mode=rstp comment="MAIN-BRIDGE"

RSTP protects you from loops if someone accidentally bridges two ports with a patch cord. It happens. Usually on Friday evening.

Result: bridge1 is created. Still empty.

Step 2. Add ports to the bridge

Add all ports involved in VLANs to the bridge. That’s the trunk and all access ports.

/interface bridge port add bridge=bridge1 interface=ether1 comment="TRUNK"
/interface bridge port add bridge=bridge1 interface=ether2 comment="ACCESS-OFFICE"
/interface bridge port add bridge=bridge1 interface=ether3 comment="ACCESS-GUEST"
/interface bridge port add bridge=bridge1 interface=ether4 comment="ACCESS-VOIP"
/interface bridge port add bridge=bridge1 interface=ether5 comment="ACCESS-CAMERA"

Result: all five ports are in bridge1. Traffic between them flows without tags for now.

Step 3. Configure bridge VLAN filtering

This is where the magic happens. Enable vlan-filtering on the bridge. Now the bridge starts looking at VLAN tags in frames.

/interface bridge set bridge1 vlan-filtering=yes

Now assign VLANs to ports. Trunk port ether1 is tagged on all VLANs. Access ports are untagged on their own VLAN.

/interface bridge vlan add bridge=bridge1 tagged=ether1 untagged=ether2 vlan-ids=10 comment="VLAN10-OFFICE"
/interface bridge vlan add bridge=bridge1 tagged=ether1 untagged=ether3 vlan-ids=20 comment="VLAN20-GUEST"
/interface bridge vlan add bridge=bridge1 tagged=ether1 untagged=ether4 vlan-ids=30 comment="VLAN30-VOIP"
/interface bridge vlan add bridge=bridge1 tagged=ether1 untagged=ether5 vlan-ids=40 comment="VLAN40-CAMERA"

Here’s the key part. tagged=ether1 means frames from VLAN 10, 20, 30, 40 leave ether1 with an 802.1Q tag. untagged=ether2 means VLAN 10 frames leave ether2 without a tag. The PC on ether2 doesn’t know about VLANs and shouldn’t need to.

Result: the bridge knows which VLANs belong on which ports. The trunk is ready for the switch.

Step 4. Create VLAN interfaces

VLAN interfaces are virtual ports inside MikroTik. Each one sits on bridge1 and has its own VLAN ID. IP addresses go on these.

/interface vlan add name=vlan10-office interface=bridge1 vlan-id=10 comment="VLAN10-OFFICE"
/interface vlan add name=vlan20-guest interface=bridge1 vlan-id=20 comment="VLAN20-GUEST"
/interface vlan add name=vlan30-voip interface=bridge1 vlan-id=30 comment="VLAN30-VOIP"
/interface vlan add name=vlan40-camera interface=bridge1 vlan-id=40 comment="VLAN40-CAMERA"

Result: four virtual interfaces. Each one is isolated at Layer 2.

Step 5. Assign IP addresses to VLANs

Each VLAN is a separate subnet. Assign the gateways.

/ip address add address=192.168.10.1/24 interface=vlan10-office comment="GW-VLAN10"
/ip address add address=192.168.20.1/24 interface=vlan20-guest comment="GW-VLAN20"
/ip address add address=192.168.30.1/24 interface=vlan30-voip comment="GW-VLAN30"
/ip address add address=192.168.40.1/24 interface=vlan40-camera comment="GW-VLAN40"

Result: MikroTik answers ARP requests on each VLAN. Devices know their gateway.

Step 6. DHCP server for each VLAN

Without DHCP, administration turns into a nightmare. Create pools and servers.

/ip pool add name=pool-office ranges=192.168.10.10-192.168.10.254
/ip pool add name=pool-guest ranges=192.168.20.10-192.168.20.254
/ip pool add name=pool-voip ranges=192.168.30.10-192.168.30.254
/ip pool add name=pool-camera ranges=192.168.40.10-192.168.40.254

Now the networks and servers.

/ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=8.8.8.8,1.1.1.1 comment="NET-OFFICE"
/ip dhcp-server network add address=192.168.20.0/24 gateway=192.168.20.1 dns-server=8.8.8.8,1.1.1.1 comment="NET-GUEST"
/ip dhcp-server network add address=192.168.30.0/24 gateway=192.168.30.1 dns-server=8.8.8.8,1.1.1.1 comment="NET-VOIP"
/ip dhcp-server network add address=192.168.40.0/24 gateway=192.168.40.1 dns-server=8.8.8.8,1.1.1.1 comment="NET-CAMERA"

/ip dhcp-server add name=dhcp-office interface=vlan10-office address-pool=pool-office disabled=no comment="DHCP-OFFICE"
/ip dhcp-server add name=dhcp-guest interface=vlan20-guest address-pool=pool-guest disabled=no comment="DHCP-GUEST"
/ip dhcp-server add name=dhcp-voip interface=vlan30-voip address-pool=pool-voip disabled=no comment="DHCP-VOIP"
/ip dhcp-server add name=dhcp-camera interface=vlan40-camera address-pool=pool-camera disabled=no comment="DHCP-CAMERA"

Result: devices in each VLAN get addresses automatically. DNS is independent from the ISP.

Step 7. NAT for all VLANs

Without masquerade, packets from private networks won’t reach the internet. Add src-nat.

/ip firewall nat add chain=srcnat out-interface=wan1 action=masquerade comment="NAT-ALL-VLANS"

One rule covers all VLANs. Srcnat looks at out-interface, not src-address. All four subnets exit through one WAN.

If you have two WANs, like in the article on failover, add a second rule.

/ip firewall nat add chain=srcnat out-interface=wan2 action=masquerade comment="NAT-WAN2"

Result: any packet from any VLAN gets a public IP on its way out.

Step 8. Firewall between VLANs

This is what all of this was for. Isolate the networks from each other.

Rules go in /ip firewall filter. Order matters. Allow first, then deny.

/ip firewall filter add chain=forward action=accept connection-state=established,related comment="ALLOW-ESTABLISHED"

The office can go anywhere.

/ip firewall filter add chain=forward in-interface=vlan10-office action=accept comment="OFFICE-ALLOW-ALL"

VoIP can reach the internet and the office.

/ip firewall filter add chain=forward in-interface=vlan30-voip out-interface=vlan10-office action=accept comment="VOIP-TO-OFFICE"
/ip firewall filter add chain=forward in-interface=vlan30-voip out-interface=wan1 action=accept comment="VOIP-TO-INTERNET"

Cameras only reach the NVR in the office. Our NVR sits in VLAN 10.

/ip firewall filter add chain=forward in-interface=vlan40-camera out-interface=vlan10-office dst-address=192.168.10.0/24 action=accept comment="CAMERA-TO-OFFICE"

Guests only reach the internet. Nowhere else.

/ip firewall filter add chain=forward in-interface=vlan20-guest out-interface=wan1 action=accept comment="GUEST-TO-INTERNET"

Now deny everything else between VLANs.

/ip firewall filter add chain=forward in-interface=vlan20-guest action=drop comment="DROP-GUEST-TO-ANY"
/ip firewall filter add chain=forward in-interface=vlan40-camera action=drop comment="DROP-CAMERA-TO-ANY"
/ip firewall filter add chain=forward in-interface=vlan30-voip action=drop comment="DROP-VOIP-TO-ANY"

Result: guests don’t see the office. Cameras can’t reach the internet. VoIP works and makes calls. The office controls everything.

Step 9. Access to the router from VLANs

By default MikroTik responds on all interfaces. Let’s close off WinBox and SSH access from the guest VLAN.

/ip firewall filter add chain=input in-interface=vlan20-guest action=drop comment="DROP-GUEST-TO-ROUTER"
/ip firewall filter add chain=input in-interface=vlan40-camera action=drop comment="DROP-CAMERA-TO-ROUTER"

Result: router management is only available from the office VLAN, or over VPN if you’ve set one up.

Step 10. Guest WiFi on a separate VLAN

If you have a MikroTik with WiFi or an external access point on the trunk port, set up the guest network.

On the access point, create an SSID “Office-Guest” and assign VLAN 20 to it. Nothing extra to do on MikroTik, packets tagged with 20 are already handled by the bridge.

If it’s WiFi on the MikroTik itself:

/interface wifi add name=wifi-guest ssid="Office-Guest" security-profile=guest-security vlan-id=20

Or for the legacy wireless driver:

/interface wireless add name=wlan-guest ssid="Office-Guest" vlan-mode=use-tag vlan-id=20

Result: guests connect to WiFi and land directly in VLAN 20. They can’t see the office.

Step 11. QoS for the VoIP VLAN

Voice packets need to go out first. Let’s raise the priority of VLAN 30.

/interface bridge set bridge1 priority=0x8000
/queue type add name=voip-priority kind=pfifo pfifo-limit=50
/queue simple add name=voip target=vlan30-voip max-limit=10M/10M priority=1/1 comment="PRIORITY-VOIP"

Result: RTP traffic from VLAN 30 gets priority handling. Calls don’t drop or stutter.

4. Verification

Finished setting it up? Check everything before you head home.

Checking bridge VLAN

/interface bridge vlan print
/interface bridge port print

Make sure ether1 is tagged on all VLANs. Access ports should be untagged on their own VLAN.

Checking VLAN interfaces

/interface vlan print
/ip address print

All four VLANs should be running. IP addresses should be assigned.

Checking DHCP

/ip dhcp-server print
/ip dhcp-server lease print

Devices in each VLAN should have received addresses. If the lease list is empty, check the cable.

Checking connectivity between VLANs

From a computer in VLAN 10, ping an address in VLAN 30.

/ping 192.168.30.1

It should succeed, that’s the gateway. Now ping a device in VLAN 30.

/ping 192.168.30.10

If it works, the firewall allows it. If not, check the forward rules.

Checking guest isolation

From the guest WiFi, try to open \\192.168.10.10. You should get a timeout. Try opening a website. It should work.

Checking cameras

A camera in VLAN 40 should be able to ping the NVR in VLAN 10. It should not be able to ping 8.8.8.8.

/tool ping 8.8.8.8 interface=vlan40-camera

You should see 100% loss. If it goes through, the firewall is allowing too much.

Checking the trunk

Plug a laptop into ether1. Set VLAN 10 on it. Get an address from 192.168.10.0/24. Switch to VLAN 20, get an address from 192.168.20.0/24. The trunk works.

5. Complications

Error: a device on an access port doesn’t get an IP

Cause: the port isn’t added to the bridge. Or bridge VLAN filtering isn’t enabled. Or vlan-ids points to the wrong number.

Fix: check three things.

/interface bridge port print where interface=ether2
/interface bridge print where name=bridge1
/interface bridge vlan print where vlan-ids=10

Make sure ether2 is in bridge1. Make sure vlan-filtering=yes. Make sure VLAN 10 is tied to ether2.

Error: traffic between VLANs doesn’t pass even though the firewall allows it

Cause: devices in different VLANs have a /24 mask and a gateway inside their own network. But MikroTik isn’t routing between VLANs. Or firewall rules are in the wrong order.

Fix: check that IP forwarding is enabled. It’s on by default in RouterOS. Check the rule order.

/ip firewall filter print

Accept rules need to be above drop rules. Move them.

/ip firewall filter move [find comment="OFFICE-ALLOW-ALL"] destination=1

Error: the trunk port doesn’t pass tagged frames

Cause: the switch on the other end has a trunk configured, but on MikroTik the port in bridge VLAN isn’t marked as tagged.

Fix: check the tagged setting.

/interface bridge vlan print where tagged~"ether1"

You should see four entries with VLAN 10, 20, 30, 40. If tagged is empty, add it.

Error: guests can see office printers

Cause: the firewall drop rule for guests sits after the accept-established rule. Or the guest WiFi isn’t on VLAN 20, it’s on the same bridge without a tag.

Fix: confirm the guest WiFi actually uses vlan-id=20. Check the firewall.

/ip firewall filter print where in-interface=vlan20-guest

You should see accept only for wan1, then drop.

Error: router access disappeared after enabling vlan-filtering

Cause: the port you’re connected through isn’t added to bridge VLAN. Or you’re connected to the trunk port without a VLAN configured on your computer.

Fix: connect to an access port on VLAN 10. Or configure a VLAN on your laptop. If you’ve lost access entirely, reset the config via Netinstall.

Error: cameras won’t connect to the NVR

Cause: the NVR is in VLAN 10, cameras are in VLAN 40. The firewall allows camera-to-office, but the NVR only listens for broadcasts within its own subnet. Or the camera is set to a static IP on a different network.

Fix: verify the camera got a DHCP lease from 192.168.40.0/24. Verify the NVR has an address in 192.168.10.0/24. Add a route, or configure the NVR to work with a different subnet.

6. Alternatives

Separation via separate physical interfaces

You could plug guests into one port, the office into another, cameras into a third. No VLAN needed. But then you need a router with 8+ ports. And your cabling infrastructure grows. VLAN lets you run all networks over one cable. Savings on ports and wiring pay off the setup effort in a day.

Separation via access lists on the switch

A managed switch can do ACLs at Layer 2. But that only works within the switch. Once traffic hits the router, the switch’s ACL is powerless. VLAN plus firewall on MikroTik gives you one unified policy for the whole network.

Separation via WiFi isolation

Access points support “Client Isolation.” WiFi clients can’t see each other. But that doesn’t stop a guest laptop from scanning the wired network if it’s plugged into an Ethernet port. VLAN isolates at the network level, regardless of connection type.

Using CapsMAN for centralized WiFi

If you have several MikroTik access points, CapsMAN manages them centrally. The guest VLAN gets configured once, on the controller. Convenient, but it’s beyond the scope of this basic guide. Start with one access point, then scale up.

7. Prevention

Monitoring VLANs

Watch the load on each VLAN. An unexpected traffic spike on VLAN 40 might mean a camera got compromised and is now part of a DDoS botnet.

/interface monitor-traffic vlan10-office once
/interface monitor-traffic vlan40-camera once

Configuration backup

Export the config after every change.

/export file=backup-vlan-config

Store it on an external server. VLAN settings are hard to reconstruct from memory.

Documenting ports

Put stickers on your wall jacks. “VLAN 10, office,” “VLAN 40, cameras.” In six months you won’t remember why ether4 doesn’t give a laptop internet. And your colleague definitely won’t either.

Updating RouterOS

Check for new versions once a quarter. Test updates on a spare device first. In production, stick to the Long-term branch.

/system package update check-for-updates
/system package update download
/system reboot

Segmentation as you grow

If you end up with more than 50 cameras, move them to a separate physical segment with its own switch. One broadcast domain with a hundred cameras is already a real load. But the VLAN scheme stays the same. You just add another trunk port.

8. FAQ

Why doesn’t VLAN work after setup?

Check three things. First, vlan-filtering is enabled on the bridge. Second, ports are added to bridge VLAN with the correct tagged/untagged settings. Third, VLAN interfaces are created on the bridge, not on a physical port. If a VLAN interface is created on ether2 instead of bridge1, the trunk won’t work.

How do I verify the firewall between VLANs works correctly?

From a computer on the guest VLAN, try pinging an address on the office VLAN. You should get 100% loss. Try opening a website. It should work. Check the rule counters.

/ip firewall filter print stats

What if a device doesn’t support VLAN?

Connect it to an access port. The device doesn’t need to know about VLANs, that’s normal. The access port strips the tag before sending the frame to the device. To the device, it just looks like a regular network.

How is bridge VLAN filtering different from the old switch chip VLAN?

Bridge VLAN filtering runs on the CPU and applies to all ports. Switch chip VLAN only worked on certain Atheros chips and required hardware offload. In RouterOS 7, bridge VLAN filtering is the only correct approach. It works the same way on every device.

Can I run a trunk to a plain unmanaged switch?

No. An unmanaged switch doesn’t understand 802.1Q tags. It passes tagged frames through as-is, and devices on the other end receive frames with an unknown tag. They’ll just drop them. A trunk needs a managed switch.

How do I add a fifth VLAN without reconfiguring everything?

Create a VLAN interface. Add it to bridge VLAN with tagged on the trunk and untagged on the access port. Assign an IP and DHCP. Add firewall rules. Nothing in the existing config needs to change. VLANs stay isolated from each other by default.

9. Outlook

You’ve set up VLAN on MikroTik. Four isolated networks now live on a single cable. Guests sit in their own ghetto and can’t reach accounting. Cameras only stream to the recorder. Phones ring without turning into robots. The office runs without surprises.

The trunk port is ready for expansion. Add a fifth floor, run one cable, and enable the VLANs you need on the new switch. No need to rewrite your addressing scheme.

If it didn’t work, drop a comment and we’ll sort it out. Include the output of /export hide-sensitive. Without that I’m guessing blind, and guessing at VLAN configs is worse than reading tea leaves.

And if you need to isolate servers with internet-facing access, check out the article on DMZ. That’s a different level of paranoia, but the same principle: separation and firewall rules.