I am setting up a new wireless network using two Mikrotik routers using WDS.
I'm no means a network/wlan expert, but I am going to have several virtual AP's running with different SSID, some with WDS, some without, ipv6 and a bunch of other stuff that will complicate my setup.
My problem is that I want a setup where I can have guests visiting, but I want to specify which other resources on my network they should have access to.
10.0.0.1-2: routers 10.0.0.5: sensitive server which I want some ips to have access to only 10.0.0.6: public service which guests also should see 10.0.0.100-150: scope for machines getting access to Internet, 10.0.0.5 and 10.0.0.6 10.0.0.200-250: scope for guests. only access to Internet, and 10.0.0.6
How can I solve this problem?
Thought solution 1:
- Setting up guest virtual ap (ap-guest) that gets 10.0.0.200-250 addresses
- Creating firewall rules to deny ap-guest from talking to anything if they are not using that ip-range
- Creating exception rules for the resources I want them to have access to.
- Access all rule for the normal secure ap.
Thought solution 2:
- Setting up vlan for each ap, but will this work as I am thinking?
Is there anything wrong with solution 1? I really dont want to use vlans, extra bridges if I dont haveto. Firewall rules seems much simpler.
Or is there an even better solution?