MikroTik Wi‑Fi’da VLAN orqali Guest va Work AP ajratish

Wi‑Fi tarmoqlarini bir qurilmada birlashtirish ko‘p hollarda xavfsizlik muammolariga olib keladi. VLAN‑lar yordamida har bir virtual AP ni alohida Layer2 segmentiga ajratish mumkin. Ushbu maqola Guest va Work AP‑larni alohida VLAN‑larga ajratib, bridge‑da VLAN filtering ni yoqish jarayonini ko‘rsatadi.

00Talablar

• RouterOS konsoliga administrator huquqi
• Ethernet portlari (kamida bir trunk)
• Wi‑Fi interfeysi va virtual AP yaratish imkoniyati
• RouterOS v6.41 yoki undan yuqori

01Sozlash bosqichlari

1. R1 – Trunk portda VLAN interfeyslarini yaratish

/interface vlan bo‘limida ether1 ga ikki VLAN interfeysi qo‘shamiz. Har bir VLAN ga mos IP manzil beramiz. Bu qadamda trunk portda VLAN‑tagli trafikni qabul qilish uchun tayyorlaymiz.

[admin@R1] >
/interface vlan
add interface=ether1 name=vlan111 vlan-id=111
add interface=ether1 name=vlan222 vlan-id=222

/ip address
add address=192.168.1.1/24 interface=vlan111
add address=192.168.2.1/24 interface=vlan222

2. R2 – Virtual AP‑larni VLAN‑mode bilan sozlash

/interface wireless bo‘limida wlan1 va wlan2 ni yaratib, har biriga mos vlan-id va vlan-mode=use-tag belgilaymiz. Shuningdek, har bir AP uchun mos security-profile ni tanlaymiz.

[admin@R2] >
/interface wireless
set [ find default-name=wlan1 ] disabled=no mode=ap-bridge security-profile=vlan111 ssid=vlan111 vlan-id=111 vlan-mode=use-tag
add disabled=no master-interface=wlan1 name=wlan2 security-profile=vlan222 ssid=vlan222 vlan-id=222 vlan-mode=use-tag

3. R2 – Bridge yaratish, port va VLAN‑larni belgilash

/interface bridge da vlan-filtering=yes bilan bridge1 yaratamiz. bridge port ga ether2, wlan1, wlan2 ni qo‘shamiz. bridge vlan bo‘limida ether2 va mos WLAN interfeyslarini tegishli VLAN‑ga tag‑laymiz.

[admin@R2] >
/interface bridge
add fast-forward=no name=bridge1 vlan-filtering=yes

/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=wlan2
/interface bridge vlan
add bridge=bridge1 tagged=ether2,wlan1 vlan-ids=111
add bridge=bridge1 tagged=ether2,wlan2 vlan-ids=222

4. R3 – Guest AP uchun IP va security‑profile o‘rnatish

/ip address bo‘limida wlan1 ga 192.168.1.3/24 manzilini beramiz. security-profile=vlan111 ni tanlab, Guest AP ga ulanishni ruxsatlaymiz.

[admin@R3] >
/ip address
add address=192.168.1.3/24 interface=wlan1

/interface wireless
set [ find default-name=wlan1 ] disabled=no security-profile=vlan111

5. R4 – Work AP uchun IP va security‑profile o‘rnatish

/ip address bo‘limida wlan1 ga 192.168.2.4/24 manzilini beramiz. security-profile=vlan222 ni tanlab, Work AP ga ulanishni ruxsatlaymiz.

[admin@R4] >
/ip address
add address=192.168.2.4/24 interface=wlan1

/interface wireless
set [ find default-name=wlan1 ] disabled=no security-profile=vlan222

02Tekshirish

Har bir AP dan boshqa VLAN ga ping qilish yoki internetga kirish imkoniyatini tekshiring; VLAN izolyatsiyasi ishlayotgan bo‘lishi kerak.

03Xulosa

Ushbu bosqichlar yordamida bir MikroTik routerda Guest va Work Wi‑Fi tarmoqlarini alohida VLAN‑larga ajratib, xavfsiz va izolyatsiyalangan tarmoq yaratish mumkin.