Some Kinda Advanced Networking Assistance Needed

Progenix Oj101

Progenix Oj101

Dealer
Joined
Jun 4, 2010
Messages
6,859
Reaction score
4,428
Location
Kempton Park
The topology: CPE -> MiktoTik RB2011iL-RM with a Level 4 RouterOS license -> Unmanaged 24 port switch -> APs and wired devices, possibly including a TP-Link Archer C20 as one of the APs.

The complete list of devices connected to the switch would be as follows

1x PC, VLAN1 only
1x printer, VLAN1 only
1x VoIP phone, VLAN1 only
1x NAS, VLAN1 and VLAN2
5x mobile devices, VLAN2
2x UAP-AC-LR, VLAN1, VLAN2 and VLAN3
1x TP-Link Archer, VLAN1, VLAN2 and VLAN3 (optional)

The goal: 3 VLANs
  • One completely unrestricted VLAN on several cabled devices;
  • A second VLAN on Wi-Fi and one or two cabled devices with an internet bandwidth restriction of 25Mbps, several per-device restrictions such as Device A limited to 30 minutes of Tiktok, 30 minutes of Mybroadband, and a total of 3 hours of internet per day, with difference restrictions for Device B and Device C both in the sites being time restricted, what those time restrictions are, and total time allowed. Zero time restrictions on eg Netflix and YouTube other than the 25Mbps restriction. An alternative bandwidth restriction would be eg 40Mbps for the entire VLAN, with up to 20Mbps per primary device and 10Mbps per secondary device
  • A third VLAN for a completely open (as in no password) Wi-Fi connection limited to banking apps and one or two websites, with a 2Mbps bandwidth restriction.
The questions:
  1. Would the MikroTik handle all of this? I believe so, but confirmation would be nice
  2. Where can I find the IP addresses used by banking apps, YouTube, Tiktok, etc?
  3. Is the topology correct, or will the MikroTik router need to be the other side of the switch (i.e. CPE -> switch -> MikroTik -> wired devices)? I would imaging the MikroTik can be between the CPE and switch, but want confirmation
  4. Would devices indeed be allowed to be on multiple VLANs? The NAS, for example, would have separate shares for VLAN1 and VLAN2
  5. Is my thinking correct that devices on VLAN1 are oblivious to the very existence of VLAN2, etc?
My networking skills are way below average and I will be getting someone in to set everything up. I know the end result I want, I don't know how to get there.

Thanks :)
 
Your filtering I think is going to be a problem. I dont really know MIkrotik OS but I would be surprised if it could do this.
You are also going to have a miserable time trying to restrict items by IP address (especially things like Youtube) and I really doubt the Mikrotik will do SSL inspection which means any of your filtering will be bypassed by tunneling or proxy avoidance techniques.

  1. Would devices indeed be allowed to be on multiple VLANs? The NAS, for example, would have separate shares for VLAN1 and VLAN2
No unless it is 801.q capable. I.E can do a trunk (dont like this word). You would need to separate the shares using permissions on the NAS rather than via VLANS on the networking side
  1. Is my thinking correct that devices on VLAN1 are oblivious to the very existence of VLAN2, etc?
A VLAN creates virtual switches. So imagine your switch being cut up into multiple small switches, each one is a VLAN. The switches have no way of connecting with each other unless there is a "cable" between them, with that "cable" being inter-vlan routing (a layer 3 device)

  1. Is the topology correct, or will the MikroTik router need to be the other side of the switch (i.e. CPE -> switch -> MikroTik -> wired devices)? I would imaging the MikroTik can be between the CPE and switch, but want confirmation
Your switch is unmanaged, so it has no knowledge of VLANS and will flood all traffic out all ports. I am not sure how many ports the Mikrotik has so this will determine what and where you plug stuff.
If you use the switch as the access medium then you arent technically separating the traffic. You are likely to use different IP subnets per VLAN, but that doesnt mean the traffic will be separated and if anyone changes their IP address they will be able to access the traffic on the other VLAN since the switch has no idea what a VLAN is.

Do your AP's support 802.1q? How are you going to tag the Guest VLAN from the other VLAN?
Again subnets can help a little and you can probably put ACL's on the AP if that is supported to restrict it from going to any other subnets (your end user could give themselves a IP in a different subnet and then get that access) so ACL's might restrict that SSID from going anywhere except the default gateway for its own VLAN
 
Last edited:
sounds way over complicated, but if you insist

search for mikrotik inter-vlan routing.

there are guides and vids
 
not going to read the ops long story but to summarize ..

1) purchase a managed switch that support vlans (ie doesnt have to be a L3 but just a normal managed switch that supoports vlans).

2) Use the mikrotik router to do the intervlan routing and apply the security between the different vlans.
 
syntax said:
Your filtering I think is going to be a problem. I dont really know MIkrotik OS but I would be surprised if it could do this.
You are also going to have a miserable time trying to restrict items by IP address (especially things like Youtube) and I really doubt the Mikrotik will do SSL inspection which means any of your filtering will be bypassed by tunneling or proxy avoidance techniques.

  1. Would devices indeed be allowed to be on multiple VLANs? The NAS, for example, would have separate shares for VLAN1 and VLAN2
No unless it is 801.q capable. I.E can do a trunk (dont like this word). You would need to separate the shares using permissions on the NAS rather than via VLANS on the networking side
  1. Is my thinking correct that devices on VLAN1 are oblivious to the very existence of VLAN2, etc?
A VLAN creates virtual switches. So imagine your switch being cut up into multiple small switches, each one is a VLAN. The switches have no way of connecting with each other unless there is a "cable" between them, with that "cable" being inter-vlan routing (a layer 3 device)

  1. Is the topology correct, or will the MikroTik router need to be the other side of the switch (i.e. CPE -> switch -> MikroTik -> wired devices)? I would imaging the MikroTik can be between the CPE and switch, but want confirmation
Your switch is unmanaged, so it has no knowledge of VLANS and will flood all traffic out all ports. I am not sure how many ports the Mikrotik has so this will determine what and where you plug stuff.
If you use the switch as the access medium then you arent technically separating the traffic. You are likely to use different IP subnets per VLAN, but that doesnt mean the traffic will be separated and if anyone changes their IP address they will be able to access the traffic on the other VLAN since the switch has no idea what a VLAN is.

Do your AP's support 802.1q? How are you going to tag the Guest VLAN from the other VLAN?
Again subnets can help a little and you can probably put ACL's on the AP if that is supported to restrict it from going to any other subnets (your end user could give themselves a IP in a different subnet and then get that access) so ACL's might restrict that SSID from going anywhere except the default gateway for its own VLAN
Click to expand...
A lot of that went a bit over my head, but how about this - all wired devices are on one VLAN. That means the switch, too, is on a single VLAN. The NAS has two Ethernet ports, so connect each to a different VLAN?

YouTube (and Netflix) was an example of something to always be allowed. Even if the 3 hours total usage or whatever on the device are finished, YouTube should still be allowed. Can it not be allowed by URL or some other way?

Not one user on VLAN2 even knows what tunnelling or a proxy is, so no issues there

VLAN3 needs to be restricted to a single IP address/website and online banking only (via the mobile apps). Any attempt to access anything other than that should redirect to a landing page.

I had to Google what 802.1q is and no, I don’t believe the APs support it, but by using the TP-Link router as an AP there are a total of three APs available - two Ubiquitis for VLAN2 and the router for VLAN3 which needs minimal range.
 
ubercal said:
not going to read the ops long story but to summarize ..

1) purchase a managed switch that support vlans (ie doesnt have to be a L3 but just a normal managed switch that supoports vlans).

2) Use the mikrotik router to do the intervlan routing and apply the security between the different vlans.
Click to expand...
The switch will be on VLAN1. The MikroTik has four more 1Gbps ports as well as another 5 10/100 ports. I’ll draw a picture quickly as I think it’ll be easier.
 
layout.JPG

Blue = VLAN1
Yellow = VLAN2
Red = VLAN3

VLAN1 = no restrictions on anything, maximum bandwidth allowed

VLAN 2 = Phone 1 restricted to 50Mbps; Phone 2 restricted to 50Mbps, Phone 3 restricted to 20Mbps with time limits; Phone 4 restricted to 20Mbps with time limits, entire VLAN restricted to 50Mbps. NAS connected to two VLANs using its two network ports??

VLAN3 = only banking allowed, as well as one additional website

If push comes to shove, what about VLAN2 being allowed access during certain hours only? Eg 5:00 to 6:00, 16:00-18:00, 20:00-21:00 on a Monday, 09:00-11:00, 14:00-17:00 on a Tuesday, etc?
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X