I am currently migrating from an best-effort line to a dedicated line and I have decided to change the hardware used.
The access to the ISP's line will be through a cat5e cable, which is connected to a Mikrotik RouterBoard. No settings was made on this piece of hardware.
I have purchased a UniFi Security Gateway as I was told that the ISP will not provide a router, a UniFi Switch for switching and about 10 wireless APs to provide internet access to guest and employees. The employees network will have a different SSID using WPA-Enterprise whereas the guest network will use password authentication through a guest server.
I have initially configured the network within the same subnet using UniFi Controller.
Now, I wish to configure the network into this:
Note: The UniFI Security Gateway has been removed due to the wider capabilities of the Mikrotik RouterBoard
Employees Network (VLAN 80): 10.88.80.1/24
Guest Network (VLAN 90): 10.88.90.1/24
Now, the problem comes. The portal server is at VLAN 80, in which guests (VLAN 90) needs to authenticate against in order to access the network.
So, how can I ensure that the Mikrotik allows my guests to access my server at certain ports (through inter subnets) and how do I set the users connected by Ethernet and RADIUS to use my server as a DNS and DHCP? And is there a way to log the router's traffic?