VLAN Segmentation on MikroTik: A Practical Guide

Why VLAN Segmentation Matters

Network segmentation isolates traffic between departments, devices, and security zones. On MikroTik, bridge-based VLANs with hardware offloading deliver wire-speed performance.

Bridge VLAN Filtering Setup

BASH

# Create bridge with VLAN filtering
/interface bridge add name=br1 vlan-filtering=yes

# Add ports to bridge
/interface bridge port add bridge=br1 interface=ether2 pvid=10
/interface bridge port add bridge=br1 interface=ether3 pvid=20
/interface bridge port add bridge=br1 interface=ether4 pvid=30

# Add trunk port (uplink)
/interface bridge port add bridge=br1 interface=ether1 pvid=1

# Configure VLAN table
/interface bridge vlan add bridge=br1 vlan-ids=10 tagged=ether1 untagged=ether2
/interface bridge vlan add bridge=br1 vlan-ids=20 tagged=ether1 untagged=ether3
/interface bridge vlan add bridge=br1 vlan-ids=30 tagged=ether1 untagged=ether4

Inter-VLAN Routing

Create VLAN interfaces on the router for inter-VLAN routing:

BASH

/interface vlan add interface=br1 name=vlan10 vlan-id=10
/interface vlan add interface=br1 name=vlan20 vlan-id=20
/interface vlan add interface=br1 name=vlan30 vlan-id=30

/ip address add address=192.168.10.1/24 interface=vlan10
/ip address add address=192.168.20.1/24 interface=vlan20
/ip address add address=192.168.30.1/24 interface=vlan30

DHCP per VLAN

BASH

/ip pool add name=pool10 ranges=192.168.10.100-192.168.10.200
/ip dhcp-server add name=dhcp10 interface=vlan10 address-pool=pool10
/ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=8.8.8.8

Firewall Rules for VLAN Isolation

BASH

# Block inter-VLAN by default, allow specific traffic
/ip firewall filter add chain=forward in-interface=vlan10 out-interface=vlan20 action=drop comment="Block staff to guest"
/ip firewall filter add chain=forward in-interface=vlan30 action=drop comment="Block POS from internet"

Common VLAN Design

VLAN	Purpose	Subnet
10	Staff	192.168.10.0/24
20	Guest WiFi	192.168.20.0/24
30	POS / IoT	192.168.30.0/24
99	Management	10.99.0.0/24

Always put management on a dedicated VLAN with strict ACLs.