Back to all articles
Tutorial By MikroRadius Team

How to Configure VLANs on MikroTik Router (Network Segmentation Made Easy)

VLANs let you split one physical network into multiple isolated networks – perfect for separating guests, IoT devices, or corporate traffic. This step‑by‑step guide covers VLAN creation, trunk ports, access ports, and inter‑VLAN routing on MikroTik RouterOS.

If you want to separate your WiFi guest traffic from your main LAN, isolate IoT devices, or carve out a dedicated VoIP network, VLANs (Virtual LANs) are the answer. MikroTik RouterOS makes VLAN configuration straightforward – but the concepts can be tricky for beginners. This guide explains everything from basics to advanced inter‑VLAN routing.

What Are VLANs and Why Use Them?

A VLAN is a logical network that behaves as if it were physically separate, even though it shares the same switch or router ports. Benefits include:

  • Security – Isolate guest, IoT, or untrusted devices from your main network.
  • Performance – Reduce broadcast traffic by limiting it to each VLAN.
  • Flexibility – Group devices by function, not physical location.
  • IP conservation – Use different subnets for different purposes.

Prerequisites

  • A MikroTik router with RouterOS v6 or v7.
  • At least one Ethernet port (or bridge) to host VLANs.
  • If using managed switches, they must support 802.1Q VLAN tagging.
  • WinBox or SSH access.

VLAN Basics on MikroTik

In RouterOS, VLANs are created as virtual interfaces attached to a parent interface (physical port or bridge). Each VLAN gets its own IP subnet, DHCP server, and firewall rules.

Key terms:

  • VLAN ID – A number from 1 to 4095 that identifies the VLAN.
  • Access port – A port that carries traffic for one untagged VLAN (e.g., connecting a single device or an AP).
  • Trunk port – A port that carries multiple tagged VLANs (e.g., between router and managed switch).
  • Tagged vs. Untagged – Tagged frames include the VLAN ID; untagged frames belong to the native/default VLAN.

Step 1: Create VLAN Interfaces on the Router

We'll create three example VLANs:

  • VLAN 10 – Main LAN (192.168.10.0/24)
  • VLAN 20 – Guest network (192.168.20.0/24)
  • VLAN 30 – IoT devices (192.168.30.0/24)

Attach them to a bridge (or physical interface like ether2). Using a bridge is more flexible – you can later add multiple ports to the same VLAN.

/interface bridge add name=bridge-vlan
/interface bridge port add interface=ether2 bridge=bridge-vlan
/interface bridge port add interface=ether3 bridge=bridge-vlan

/interface vlan add name=vlan10 interface=bridge-vlan vlan-id=10
/interface vlan add name=vlan20 interface=bridge-vlan vlan-id=20
/interface vlan add name=vlan30 interface=bridge-vlan vlan-id=30

WinBox: Interfaces → VLAN → Add New → Name, VLAN ID, Interface = bridge.

Step 2: Assign IP Addresses to Each VLAN

Each VLAN interface needs its own IP subnet and gateway.

/ip address add address=192.168.10.1/24 interface=vlan10
/ip address add address=192.168.20.1/24 interface=vlan20
/ip address add address=192.168.30.1/24 interface=vlan30

Step 3: Configure DHCP Servers for Each VLAN

So devices on each VLAN automatically get IP addresses.

/ip pool add name=pool-vlan10 ranges=192.168.10.2-192.168.10.254
/ip pool add name=pool-vlan20 ranges=192.168.20.2-192.168.20.254
/ip pool add name=pool-vlan30 ranges=192.168.30.2-192.168.30.254

/ip dhcp-server add name=dhcp-vlan10 interface=vlan10 address-pool=pool-vlan10
/ip dhcp-server add name=dhcp-vlan20 interface=vlan20 address-pool=pool-vlan20
/ip dhcp-server add name=dhcp-vlan30 interface=vlan30 address-pool=pool-vlan30

/ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=1.1.1.1
/ip dhcp-server network add address=192.168.20.0/24 gateway=192.168.20.1 dns-server=1.1.1.1
/ip dhcp-server network add address=192.168.30.0/24 gateway=192.168.30.1 dns-server=1.1.1.1

/ip dhcp-server enable [find]

Step 4: Configure VLAN Access Ports (Untagged)

An access port connects a single device (e.g., a laptop or an access point) that doesn't understand VLAN tags. The router strips tags before sending frames to that device.

In MikroTik, you use a bridge VLAN table to assign untagged ports. First, enable VLAN filtering on the bridge:

/interface bridge set bridge-vlan vlan-filtering=yes

Warning: Enabling vlan-filtering on a bridge you are connected to might disconnect you. Do this via MAC WinBox or serial console, or have a backup plan.

Now assign access ports. For example, let ether2 be untagged access for VLAN 10, ether3 for VLAN 20:

/interface bridge vlan add bridge=bridge-vlan tagged=bridge-vlan untagged=ether2 vlan-ids=10
/interface bridge vlan add bridge=bridge-vlan tagged=bridge-vlan untagged=ether3 vlan-ids=20
/interface bridge vlan add bridge=bridge-vlan tagged=bridge-vlan vlan-ids=30

Explanation: tagged=bridge-vlan means the router's own bridge interface participates in the VLAN (for routing). untagged=ether2 means traffic from that port is placed into VLAN 10 without tags.

Step 5: Configure Trunk Ports (Tagged)

A trunk port carries multiple VLANs to a managed switch or another router. All frames retain their VLAN tags.

Suppose ether4 is a trunk port to a managed switch. Add it as a tagged member for all three VLANs:

/interface bridge vlan add bridge=bridge-vlan tagged=ether4,bridge-vlan vlan-ids=10,20,30

If you later add VLAN 40, simply add it to the same trunk:

/interface bridge vlan add bridge=bridge-vlan tagged=ether4,bridge-vlan vlan-ids=40

Step 6: Firewall Rules for Inter‑VLAN Traffic

By default, all VLANs can talk to each other because the router routes between them. Usually you want to restrict this.

6.1 Allow established/related forwarding (always do this first)

/ip firewall filter add chain=forward connection-state=established,related action=accept comment="Fwd accept established/related"

6.2 Allow internet access for all VLANs (but not inter‑VLAN)

/ip firewall filter add chain=forward action=drop comment="Drop inter‑VLAN by default"

Then add explicit allow rules for specific traffic. For example, allow IoT VLAN to talk to a specific server on main LAN:

/ip firewall filter add chain=forward src-address=192.168.30.0/24 dst-address=192.168.10.50 action=accept comment="IoT to printer"

Or block guest from accessing main LAN entirely:

/ip firewall filter add chain=forward src-address=192.168.20.0/24 dst-address=192.168.10.0/24 action=drop comment="Block guest to main LAN"

6.3 Allow VLANs to access the internet via NAT (one rule is enough)

Your existing masquerade rule likely already covers all private subnets. If not, add:

/ip firewall nat add chain=srcnat src-address=192.168.0.0/16 action=masquerade comment="MASQ all private VLANs"

Step 7: Test Your VLAN Configuration

  1. Connect a laptop to ether2 (access port for VLAN 10). It should get an IP in 192.168.10.x via DHCP.
  2. Connect another laptop to ether3 (VLAN 20). It should get 192.168.20.x.
  3. Attempt to ping from the VLAN 20 device to the VLAN 10 device – it should fail (unless you added an allow rule).
  4. Both should be able to ping 8.8.8.8 (internet) and browse the web.

To verify VLAN tagging from the router:

/interface bridge vlan print
/interface bridge host print

Advanced: Using a Managed Switch with MikroTik Router

If your MikroTik has only a few ports, connect one trunk port to a managed switch (e.g., Cisco, TP‑Link, or another MikroTik). Configure the switch similarly:

  • Port connected to router = trunk (tagged for VLANs 10,20,30).
  • Other ports on switch = access ports for specific VLANs.

The router handles all routing between VLANs and internet.

VLANs with WiFi (CAPsMAN or Standalone AP)

You can assign different SSIDs to different VLANs. On a MikroTik CAP or any VLAN‑aware AP:

/interface wireless set wlan1 vlan-id=10 vlan-mode=use-tag
/interface wireless set wlan2 vlan-id=20 vlan-mode=use-tag

Then ensure the port connecting the AP is a trunk port carrying those VLANs.

Troubleshooting VLANs

  • Device gets no IP address: Check that DHCP server is running on the correct VLAN interface. Also verify that the access port is correctly assigned to the VLAN (untagged).
  • Device gets IP but cannot ping gateway: Ensure the VLAN interface is up (/interface vlan print). Also check that the IP address is correctly assigned and that the firewall isn't blocking ICMP on the input chain.
  • Inter‑VLAN routing works when it shouldn't: Review your forward chain rules. The default drop rule must be placed after accept rules.
  • Bridge VLAN filtering causes loss of management: Always have a backup access path (MAC WinBox, console, or a dedicated management port outside the bridge). If locked out, reset via Netinstall or reset button.
  • Trunk port not passing all VLANs: Verify the bridge VLAN table includes the trunk port as tagged for the required VLAN IDs.

Sample Complete Script for 3 VLANs

Here's a copy‑paste ready script (change interface names and subnets as needed). Run it from CLI, but be careful – it will overwrite existing bridge and VLAN config.

/interface bridge add name=bridge-vlan
/interface bridge port add interface=ether2 bridge=bridge-vlan
/interface bridge port add interface=ether3 bridge=bridge-vlan
/interface bridge port add interface=ether4 bridge=bridge-vlan

/interface vlan add name=vlan10 interface=bridge-vlan vlan-id=10
/interface vlan add name=vlan20 interface=bridge-vlan vlan-id=20
/interface vlan add name=vlan30 interface=bridge-vlan vlan-id=30

/ip address add address=192.168.10.1/24 interface=vlan10
/ip address add address=192.168.20.1/24 interface=vlan20
/ip address add address=192.168.30.1/24 interface=vlan30

/ip pool add name=pool10 ranges=192.168.10.2-192.168.10.254
/ip pool add name=pool20 ranges=192.168.20.2-192.168.20.254
/ip pool add name=pool30 ranges=192.168.30.2-192.168.30.254

/ip dhcp-server add name=dhcp10 interface=vlan10 address-pool=pool10
/ip dhcp-server add name=dhcp20 interface=vlan20 address-pool=pool20
/ip dhcp-server add name=dhcp30 interface=vlan30 address-pool=pool30

/ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=1.1.1.1
/ip dhcp-server network add address=192.168.20.0/24 gateway=192.168.20.1 dns-server=1.1.1.1
/ip dhcp-server network add address=192.168.30.0/24 gateway=192.168.30.1 dns-server=1.1.1.1

/ip dhcp-server enable dhcp10,dhcp20,dhcp30

/interface bridge set bridge-vlan vlan-filtering=yes

/interface bridge vlan add bridge=bridge-vlan tagged=bridge-vlan untagged=ether2 vlan-ids=10
/interface bridge vlan add bridge=bridge-vlan tagged=bridge-vlan untagged=ether3 vlan-ids=20
/interface bridge vlan add bridge=bridge-vlan tagged=bridge-vlan vlan-ids=30

# Basic firewall forward rules
/ip firewall filter add chain=forward connection-state=established,related action=accept comment="established/related"
/ip firewall filter add chain=forward src-address=192.168.10.0/24 action=accept comment="Allow main LAN internet"
/ip firewall filter add chain=forward src-address=192.168.20.0/24 action=accept comment="Allow guest internet"
/ip firewall filter add chain=forward src-address=192.168.30.0/24 action=accept comment="Allow IoT internet"
/ip firewall filter add chain=forward action=drop comment="Drop all other forward"

Conclusion

VLANs give you enterprise‑grade network segmentation on affordable MikroTik hardware. Once you master the bridge VLAN table and understand tagged vs. untagged ports, you can build complex multi‑tenant networks, secure guest access, and isolate risky IoT devices – all with a single router.

Next steps: explore VLAN‑aware bridges in RouterOS v7, MVRP for dynamic VLAN registration, or VLAN trunking over L2TP tunnels for distributed networks.

You might also like

How to Set Up a MikroTik Router from Scratch: A Complete Beginner's Guide (2026)

How to Set Up a PPTP Server on MikroTik Router (And Why You Should Think Twice)

How to Set Up WireGuard VPN on MikroTik Router (Fast & Secure)

Was this article helpful?

Share Share