MikroTik Wi‑Fi’da VLAN orqali Guest va Work AP ajratish

⏱ O‘qish vaqti: 2 daqiqa

Qisqacha

Trunk portda VLAN interfeyslari va IP manzillarini yaratish
Virtual AP‑larda VLAN‑mode ni use-tag qilib sozlash
Bridge‑da vlan‑filtering yoqib, port va VLAN‑larni belgilash
Guest va Work AP‑larga alohida IP va security‑profile o‘rnatish

Wi‑Fi tarmoqlarini bir qurilmada birlashtirish ko‘p hollarda xavfsizlik muammolariga olib keladi. VLAN‑lar yordamida har bir virtual AP ni alohida Layer2 segmentiga ajratish mumkin. Ushbu maqola Guest va Work AP‑larni alohida VLAN‑larga ajratib, bridge‑da VLAN filtering ni yoqish jarayonini ko‘rsatadi.

Talablar

RouterOS konsoliga administrator huquqi
Ethernet portlari (kamida bir trunk)
Wi‑Fi interfeysi va virtual AP yaratish imkoniyati
RouterOS v6.41 yoki undan yuqori

Sozlash bosqichlari

1. R1 – Trunk portda VLAN interfeyslarini yaratish

/interface vlan bo‘limida ether1 ga ikki VLAN interfeysi qo‘shamiz. Har bir VLAN ga mos IP manzil beramiz. Bu qadamda trunk portda VLAN‑tagli trafikni qabul qilish uchun tayyorlaymiz.

[admin@R1] >
/interface vlan
add interface=ether1 name=vlan111 vlan-id=111
add interface=ether1 name=vlan222 vlan-id=222

/ip address
add address=192.168.1.1/24 interface=vlan111
add address=192.168.2.1/24 interface=vlan222

2. R2 – Virtual AP‑larni VLAN‑mode bilan sozlash

/interface wireless bo‘limida wlan1 va wlan2 ni yaratib, har biriga mos vlan-id va vlan-mode=use-tag belgilaymiz. Shuningdek, har bir AP uchun mos security-profile ni tanlaymiz.

[admin@R2] >
/interface wireless
set [ find default-name=wlan1 ] disabled=no mode=ap-bridge security-profile=vlan111 ssid=vlan111 vlan-id=111 vlan-mode=use-tag
add disabled=no master-interface=wlan1 name=wlan2 security-profile=vlan222 ssid=vlan222 vlan-id=222 vlan-mode=use-tag

3. R2 – Bridge yaratish, port va VLAN‑larni belgilash

/interface bridge da vlan-filtering=yes bilan bridge1 yaratamiz. bridge port ga ether2, wlan1, wlan2 ni qo‘shamiz. bridge vlan bo‘limida ether2 va mos WLAN interfeyslarini tegishli VLAN‑ga tag‑laymiz.

[admin@R2] >
/interface bridge
add fast-forward=no name=bridge1 vlan-filtering=yes

/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=wlan2
/interface bridge vlan
add bridge=bridge1 tagged=ether2,wlan1 vlan-ids=111
add bridge=bridge1 tagged=ether2,wlan2 vlan-ids=222

4. R3 – Guest AP uchun IP va security‑profile o‘rnatish

/ip address bo‘limida wlan1 ga 192.168.1.3/24 manzilini beramiz. security-profile=vlan111 ni tanlab, Guest AP ga ulanishni ruxsatlaymiz.

[admin@R3] >
/ip address
add address=192.168.1.3/24 interface=wlan1

/interface wireless
set [ find default-name=wlan1 ] disabled=no security-profile=vlan111

5. R4 – Work AP uchun IP va security‑profile o‘rnatish

/ip address bo‘limida wlan1 ga 192.168.2.4/24 manzilini beramiz. security-profile=vlan222 ni tanlab, Work AP ga ulanishni ruxsatlaymiz.

[admin@R4] >
/ip address
add address=192.168.2.4/24 interface=wlan1

/interface wireless
set [ find default-name=wlan1 ] disabled=no security-profile=vlan222

Tekshirish

Har bir AP dan boshqa VLAN ga ping qilish yoki internetga kirish imkoniyatini tekshiring; VLAN izolyatsiyasi ishlayotgan bo‘lishi kerak.

Diqqat:

Bridge VLAN filtering yoqilganda ba’zi qurilmalarda hardware offloading o‘chadi, bu Wi‑Fi ga ta’sir qilmaydi.
VLAN‑mode ni use-tag qilib belgilash muhim; aks holda trafik to‘g‘ri taglanmaydi.
VLAN filtering yoqilmaganida noma’lum VLAN ID larni uzatish xavfi bor.

Xulosa

Ushbu bosqichlar yordamida bir MikroTik routerda Guest va Work Wi‑Fi tarmoqlarini alohida VLAN‑larga ajratib, xavfsiz va izolyatsiyalangan tarmoq yaratish mumkin.

Manba: VLANs on Wireless — help.mikrotik.com