Im aiming this model too.. last time bought hAP AC2 from sublime.. thanks soonwai

Hi,
I have a question about VLAN. I know what a VLAN is, but I am not sure what purpose Mikrotik's implementation of 'Interface -> VLAN' is for.

For instance, if you put in a bridge and turn on VLAN filtering, you will filter VLAN. If you go to "Switch->Ports" and perform VLAN configuration, you can manipulate packets. This is filtering behaviour on ports. You can also tag VLANs on per port basis.

What I don't understand is the purpose of 'Interface -> VLAN'. To get Unifi working, you have to create VLAN 500 and assign it to the WAN port. For HyppTV, create another 'Interface->VLAN' 600 and assign it to the same WAN port. What purpose does this VLAN interface achieve? Is it to tag outgoing traffic to PPPoE?

P.S. It seems I may have answered my own question, I just need to confirmation. Looks like the technique or recommendation on VLAN configuration changed with 6.41 firmware in December 2017? Can someone confirm? Technically, I don't need to assign VLAN 500 and 600 on the ethernet port anymore? Instead, I can have 1 bridge with VLAN filtering, passing VLAN500 and 600.

This post has been edited by cwtien: Feb 15 2021, 10:53 AM

To my understanding, both have the same function. The VLAN on interface is handled by the software, while the VLAN on the switch is handled by the hardware chip itself. Correct me if I am wrong.

Need help. I setup my mikrotik hap a 2 according to this wiki:
https://wiki.mikrotik.com/wiki/Mikrotik_and...y_arpee/soonwai but still unable to connect to unifi.

It seems the OS is slightly different but I think I'd set everything according to this guide but I still cannot connect to the net. Any suggestion?

Assuming your WAN port is ether1:

- Add VLAN 500 to ether1.
- Add a PPPoE client on that VLAN500.

Does the PPPoE client managed to connect to the server?

Are you using UniFi? The steps for VLAN and PPPoE should be the same. Don't follow the HyppTV steps as it uses master and slave ethernet which RouterOS doesn't use anymore.

I can no longer edit the Mikrotik wiki so I'll post any updates to the guide that's here in this forum. https://forum.lowyat.net/index.php?showtopic=4202122

Can you post your current router config? Do a /export.

Thanks for replying. I'd done all that was stated in the guide (without the part regarding HyppTV), ie setting the VLAN and PPPoE.

This is the /export:

# jan/02/1970 23:52:00 by RouterOS 6.45.9
# software id = 5ZJE-NUM2
#
# model = RBD52G-5HacD2HnD
# serial number = CDFD0DE55891
/interface bridge
add admin-mac=08:55:31:34:0C:5E auto-mac=no comment=defconf name=bridge
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out2 password=[removed for privacy] use-peer-dns=yes user=[removed for privacy]
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX country=malaysia disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-340C62 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX country=malaysia disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-340C63 wireless-protocol=802.11
/interface vlan
add interface=ether1 name=vlan500 vlan-id=500
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan500 name=pppoe-out1 password=[removed for privacy] use-peer-dns=yes user=[removed for privacy]
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=[removed for privacy] wpa2-pre-shared-key=[removed for privacy]
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add interface=pppoe-out2 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN


-|END|-

I don't think I'd done anything stupid like typing wrong password or username (triplechecked it) and I'd redo the part of setting up the VLAN and PPPoE. But the PPPoE still shows as disconnect.

This post has been edited by perseides: Mar 6 2021, 03:38 PM

Interface for pppoe client should be vlan500.

Wow that's quick.
Thank you very much. I'm not sure how I set it as ether1 but I do noticed that I have 2 pppoe-out2..?
I'm trying to reset the thing and redo it. Will update here again once i done it.

Update:

Somehow I don't know how I'd created pppoe-out2 (means I have 2 pppoe-out?).

I'd deleted the pppoe-out2 and re-set the interface to pppoe-out1 and internet is working fine. I'm a idiot.

Thanks a lot for you help!!

Edit.. I accidentally posted the password online. Although I'd edited them within minutes but it's safe to say I should reset my unifi passowrd with TMnet.... right?

This post has been edited by perseides: Mar 6 2021, 03:58 PM

No problem. Just keep pppoe-out1 and delete pppoe-out2. Did you happen to run QuickSet twice? Maybe that's where the pppoe-out2 came from. Usually it's not a good idea to run QuickSet more than once. It does weird things some times.

Setup is so much easier now. QuickSet does most of the hard work already. We just need to add vlan 500 and point pppoe client to it.

Yeap. You're right on point. I think i ran quickset twice cos I thought the I typed the wrong password or smth wrong so I set it again.
Thanks for your help!

I looked at the /export again. Actually your pppoe-out1 is correct already. Just need to delete pppoe-out2. Have fun.

For easier way this is the drawing as ppl today saying "lukis bang"


_ether1
|__vlan500
|___pppoe-out1

For those on M1 Macs, nrlquaker-winbox 3.27.1 is working.

Hahahaha.. always kena like this.. so i draw la..

Btw, still in dilemma.. want to upgrade from ac2 - ac3 but some of my mikrotiks group friends said wait... wait for MikroTik wifi6 device.. save money first..

Can anyone explain why routerOS use 192.168.88.1 as default IP while other router brands usually use 192.168.1.1? Is there any difference?

This post has been edited by perseides: Mar 6 2021, 06:39 PM

Just a number. No reason really but chinese ppl will sure like. LOL.

Thanks. So this means I can change the router ip range to 192.168.1.2 - 192.168.1.255 right? This shouldn't be breaking anything within the routeros?

Because I have a raspi4 with openmediavault and pi hole on docker which I think had configured the ip range specifically to that particular range. Using the default router OS ip range most likely is gonna break something on the raspi.

This post has been edited by perseides: Mar 6 2021, 08:37 PM

Can, no problem. You can change the IP address to anything. Remember to change the dhcp pool also.

I suggest you buy the hap ac3. Do not wait for wifi6 from mikrotik as their wireless driver have limitation. Their product still cannot benefits with wave2 wifi technology, let more wifi6. If you want a wifi6 device i suggest you to get from ubiquiti. They already release wifi 6 product. IIRC it is called u6-lite.