I am currently migrating from an best-effort line to a dedicated line and I have decided to change the hardware used.

The access to the ISP's line will be through a cat5e cable, which is connected to a Mikrotik RouterBoard. No settings was made on this piece of hardware.

I have purchased a UniFi Security Gateway as I was told that the ISP will not provide a router, a UniFi Switch for switching and about 10 wireless APs to provide internet access to guest and employees. The employees network will have a different SSID using WPA-Enterprise whereas the guest network will use password authentication through a guest server.

I have initially configured the network within the same subnet using UniFi Controller.

Initial Configuration:

Now, I wish to configure the network into this:

Note: The UniFI Security Gateway has been removed due to the wider capabilities of the Mikrotik RouterBoard

Employees Network (VLAN 80):

Guest Network (VLAN 90):

Now, the problem comes. The portal server is at VLAN 80, in which guests (VLAN 90) needs to authenticate against in order to access the network.

So, how can I ensure that the Mikrotik allows my guests to access my server at certain ports (through inter subnets) and how do I set the users connected by Ethernet and RADIUS to use my server as a DNS and DHCP? And is there a way to log the router's traffic?

  • If someone has provided an answer that resolves your question, please consider marking it as the accepted answer. This will reward both the person who provided the answer and yourself with additional reputation. If you do not do so, your question will periodically get refreshed back to the main page, possibly distracting community members from other questions they may be able to help answer for other users. Thank you. – YLearn Nov 23 '15 at 19:30

If the only router in your network is the Routerboard shown on the diagram, then in terms of routing both VLANs should be reachable from one to another without any other configuration as long as the devices on both VLANs have a default gateway to the routerboard.

By default mikrotik comes with a pre-configured firewall only on the Input chain.
So it doesn't block anything between vlans or any other interface unless you configure it to do so.

To allow only certain ports to be accessed from VLAN90 to VLAN80 you need to set up some firewall rules on IP > Firewall > Filter on the Forward chain.
The rules depend on what you need to allow apparently.

Regarding the Ethernet users can you be more specific? It doesn't sound like a Routerboard/Mikrotik issue.

Regarding logging the router's traffic, there are various ways to do that.
Mikrotik itself has a graphs function that logs historical traffic data for each configured interface (Tools > Graphs).

But this feature is quite basic. The most standard way to measure the traffic is via SNMP (IP > SNMP) using any solution that suits you.
Check this thread: Get Avarage network trafic data in MB

Not the answer you're looking for? Browse other questions tagged or ask your own question.