How to configure VLANs on Mikrotik and isolate your network

Why you need to segment your network with VLANs

Imagine your home or office has work computers, security cameras, printers, and guest phones all connected to the same Wi-Fi router. In practice, this means any compromised device can directly access your main computer's hard drive. To solve this security problem without buying separate cables and routers for each device, we use a technology called VLAN, which works like virtual walls inside the same physical network.

In simple terms, a VLAN (Virtual Local Area Network) takes a single cable or switch and divides it into several isolated paths using numerical tags on data packets. No device in one VLAN can communicate directly with another VLAN without passing through a routing or firewall rule. To learn more about the importance of this separation, you can check out the guide on how to configure VLANs on managed switches securely, which details port shielding and addressing principles.

Within the Mikrotik ecosystem, the operating system called RouterOS manages these divisions with great flexibility, although it requires attention to configuration details. Each environment gains its own identity, allowing home automation, guest networks, and file servers to remain in completely separate worlds. It is an essential strategy both for small businesses handling sensitive data and for enthusiasts wanting to protect their home network from intrusions.

Understanding Access, Trunk, and VLAN ID concepts

Before opening your Mikrotik configuration screen, we need to clarify three fundamental terms that appear constantly in network administration. The first is the VLAN ID, which is simply an identification number from 1 to 4094 stamped on each data packet to indicate which group it belongs to. If a packet has no tag, it usually falls into the port's native or default VLAN.

The second essential concept is the access port, known technically as an Access port. It is used to connect standard devices that do not understand VLANs, such as an old printer, a smart TV, or a desktop computer. When the packet leaves the Access port toward the computer, the VLAN tag is removed; when it enters, the tag is automatically added by the switch or router.

The third term is the trunk port, responsible for carrying multiple different VLANs at the same time over a single network cable. This is what we use to connect the main Mikrotik router to a smart switch or a corporate Wi-Fi access point. To deepen your knowledge of physical and logical infrastructure isolation, it is worth reading the article on how to isolate local networks with switch VLANs and secure data.

Step-by-step guide to creating VLANs in Mikrotik RouterOS

Let us now get hands-on by configuring RouterOS through the WinBox graphical interface or command line. The process requires care to avoid losing access to the device during physical port changes. Make sure to perform adjustments using a port that will not be modified immediately or via a rescue connection.

The first step is to define the main physical interface, usually called a bridge, where all virtual networks will be anchored. Open your Mikrotik terminal or follow the menu sequence to create virtual interfaces associated with the desired VLAN number, as shown in the example below for creating VLAN 20 intended for guests.

/interface vlan add name=vlan20-guests vlan-id=20 interface=bridge1

With the virtual interface created, the second step is to assign a unique IP address for this new network, which will act as the entry and exit portal, technically known as the gateway. The following command sets the IP address 192.168.20.1 for our new guest VLAN.

/ip address add address=192.168.20.1/24 interface=vlan20-guests network=192.168.20.0

The third and final essential step for devices to gain automatic internet access is to configure the IP address distribution service, called DHCP Server. We create an IP pool and bind the service to the newly created VLAN interface, allowing any visitor to receive a valid address as soon as they connect to the dedicated Wi-Fi.

/ip pool add name=pool-guests ranges=192.168.20.10-192.168.20.250
/ip dhcp-server add name=dhcp-guests interface=vlan20-guests address-pool=pool-guests disabled=no
/ip dhcp-server network add address=192.168.20.0/24 gateway=192.168.20.1

Configuring firewall rules to isolate traffic

Creating VLANs and IP addresses separates groups logically, but by default, the Mikrotik router allows different networks to talk to each other to facilitate initial communication. To ensure true isolation and prevent the guest network from accessing office computers, we must create blocking rules in the RouterOS firewall.

Filtering rules must be inserted into the firewall's forward table, instructing the router to drop any packet trying to go from the guest IP range to the main corporate network IP range. It is essential to position these blocking rules before rules allowing general traffic to ensure proper reading order by the system.

Besides blocking access between internal networks, remember to allow exclusive internet access for the restricted VLAN, letting them browse the web without touching local servers. For industrial scenarios or environments requiring additional protections for machinery and programmable logic controllers, check out the guidelines in how to isolate industrial VLANs and protect PLCs from attacks.

Final considerations on network maintenance and security

Implementing VLANs on Mikrotik equipment completely transforms the maturity and security level of a corporate or residential network. By dividing environments, you drastically reduce the attack surface and prevent a failure in an IoT device or visitor computer from compromising the entire organization's infrastructure.

Keeping VLAN IDs and IP range documentation updated is a habit that saves hours of headache during future troubleshooting. Periodically review your firewall rules and keep RouterOS updated with the latest security patches provided by the manufacturer, ensuring ongoing stability and protection.