How to Isolate VLANs on MikroTik for Secure Server and IoT

Why separate IoT devices and servers on MikroTik?

When we place security cameras, smart bulbs, and corporate servers on the same local network, we create a massive security gap. Internet of Things (IoT) devices usually have scarce firmware updates and vulnerabilities that attackers easily exploit. To shield the environment, we need to divide this physical infrastructure into isolated compartments using virtual networks.

In practice, this means creating logical barriers so that a smart appliance connected to the internet can never see or talk directly to the company database. Before tweaking the router, it is worth remembering that isolation also depends on good physical infrastructure, as discussed in our guide on how to configure VLANs on managed switches for IoT and servers, ensuring network tags travel intact across cables.

Creating virtual interfaces and trunking on MikroTik

The first practical step on the MikroTik router is creating VLANs (Virtual Local Area Networks), which act as invisible dividers traveling through the same physical port. Imagine a main water pipe internally divided by smaller ducts to separate drinking water from rainwater; the router port does exactly this with data.

To configure this in RouterOS, we must associate the new virtual networks with the main physical interface linking the router to the core switch, usually ether1. Below is the executable code to create the IoT VLAN (ID 20) and the server VLAN (ID 10) using the command line interface:

/interface vlan add name=vlan10-servers vlan-id=10 interface=ether1
/interface vlan add name=vlan20-iot vlan-id=20 interface=ether1

Assigning IP addresses and configuring network pools

With the virtual interfaces created, the next step is defining who lives in each house, meaning assigning IP addresses and subnet masks for each VLAN. Each IP range will represent a different neighborhood in our digital city, preventing residents of one neighborhood from accessing another's yard without explicit permission.

To organize this cleanly, we create the address pool and bind the DHCP Server, which automatically distributes IPs to devices connecting. Here is how to do this directly on your MikroTik through the terminal:

/ip address add address=192.168.10.1/24 interface=vlan10-servers network=192.168.10.0
/ip address add address=192.168.20.1/24 interface=vlan20-iot network=192.168.20.0
/ip pool add name=pool-iot ranges=192.168.20.10-192.168.20.250
/ip dhcp-server add name=dhcp-iot interface=vlan20-iot address-pool=pool-iot disabled=no

Writing firewall rules to block cross-traffic

The magic of security happens in the firewall, acting like the bouncer at the club door deciding who enters and who stays outside. By default, MikroTik allows all networks to talk to each other right after creating interfaces, which nullifies isolation if we do not intervene quickly.

We need to create rules in the Filter Rules table to prohibit the IoT VLAN from sending packets to the server network. To debug potential communication failures or monitor dropped packets during security tests, you can use techniques similar to those covered in how to monitor network traffic on specific ports with tcpdump. Here are the commands to block unwanted access: To explore these architectural concepts further in production, see our related technical analysis on How to test crystal oscillator with oscilloscope on board.

/ip firewall filter
add chain=forward action=drop src-address=192.168.20.0/24 dst-address=192.168.10.0/24 comment='Block IoT accessing Servers'
add chain=forward action=accept connection-state=established,related comment='Allow established responses'

Validating isolation and ensuring secure operation

After applying firewall rules, the work does not end at the command line; you must test whether the barrier actually works in practice. Try running pings or port scans from a device on the IoT network toward the production server to confirm the traffic was dropped.

Keeping active monitoring and periodically reviewing router logs ensures no malicious rule is bypassed by future firmware updates or topology changes. Properly executed VLAN isolation transforms a vulnerable network into a resilient and secure corporate environment.