Building a Multi-VLAN MikroTik Router with IPsec Back-Haul: Cameras, Guest Wi-Fi, and a Clean HQ Tunnel

Small remote sites often need more than “one flat network and a firewall.” At one of our remote facilities we needed a single MikroTik router (RB760iGS, RouterOS 7.23.2) to cleanly separate three very different types of traffic — a management LAN, a camera network, and guest Wi-Fi — while backhauling the right traffic to head office over an IPsec tunnel to a Sophos XG. Here’s the complete configuration and the reasoning behind it.

The design goals

  • Main Network – trusted devices, full access to head office over IPsec.
  • Camera VLAN – NVR/camera traffic, also tunnelled to HQ, but otherwise isolated.
  • Wi-Fi VLAN – internet-only, completely isolated from everything else, using public DNS instead of internal resolvers.
  • A single PPPoE WAN uplink, with strict inbound rules (only management access from head office and the router’s own public IP).

VLAN and bridge layout

Three VLANs ride a single bridge, tagged out across four trunk ports to an Aruba switch, each with its own gateway, DHCP pool, and DNS domain:

NetworkSubnetDNS given to clientsNotes
Main Network192.168.43.0/24Router (192.168.43.254)Full internal + HQ access
Camera VLAN192.168.44.0/24Router (192.168.44.254)Internal + HQ, isolated from Wi-Fi
Wi-Fi VLAN192.168.45.0/241.1.1.1 / 8.8.8.8Internet-only, fully isolated

Wi-Fi isolation

Rather than relying on a single “guest” checkbox, isolation is enforced explicitly in the firewall — Wi-Fi is dropped from talking to the Main Network, the Camera VLAN, and the head-office ranges in both directions, while Main Network and Camera VLAN traffic to the internet and to head office is permitted explicitly rather than by default.

IPsec back-haul to head office

Only Main Network and Camera VLAN traffic is tunnelled to HQ (via a Sophos XG peer). Local subnet-to-subnet traffic is explicitly excluded from the tunnel so it doesn’t get pointlessly encrypted, and a couple of static routes force the router’s own traffic (NTP, management) to also match the IPsec policy selectors.

Management access and hardening

Inbound rules only allow Winbox/HTTP management from the internal head-office range and from the site’s own public IP — nothing else reaches the router from the WAN. FTP, Telnet, and the API are disabled outright, and SSH/WWW/Winbox are all address-restricted rather than open to any source. A small detect-DDoS chain rate-limits new connections from the WAN, alongside a standard SYN-flood guard on both input and forward.

Complete configuration

The full export below is sanitized: the device serial number, software ID, all public IP addresses, and credential fields (PPPoE password and IPsec pre-shared key) have been replaced with placeholders. Fill these in with real secrets from your own password manager/vault when deploying.

# 2026-07-28 15:15:40 by RouterOS 7.23.2
# software id = [REDACTED]
#
# model = RB760iGS
# serial number = [REDACTED]
/interface bridge
add name=LAN-Bridge port-cost-mode=short vlan-filtering=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=WAN-PPPoE \
    user=<PPPOE_USERNAME> password=<PPPOE_PASSWORD>
/interface vlan
add comment="Camera VLAN - tunnelled to HQ-LAN, plus internet access" \
    interface=LAN-Bridge name=Camera-VLAN vlan-id=44
add comment="WiFi VLAN - internet-only, isolated from all internal networks" \
    interface=LAN-Bridge name=WiFi-VLAN vlan-id=45
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip dns forwarders
add dns-servers=<HQ-DNS-1>,<HQ-DNS-2> name=hq-dns-pool
/ip ipsec policy group
add name=Sophos-XG-HQ
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
add dh-group=modp2048 dpd-interval=30s dpd-maximum-failures=5 enc-algorithm=\
    aes-256 hash-algorithm=sha256 name=Sophos-XG-HQ
/ip ipsec peer
add address=<HQ-SOPHOS-PUBLIC-IP>/32 exchange-mode=ike2 name=Sophos-XG-HQ profile=\
    Sophos-XG-HQ
/ip ipsec proposal
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc lifetime=1d name=\
    Sophos-XG-HQ pfs-group=modp2048
/ip pool
add comment="Main Network DHCP pool" name=LAN-POOL ranges=\
    192.168.43.1-192.168.43.250
add comment="Camera VLAN DHCP pool" name=CAMERA-POOL ranges=\
    192.168.44.1-192.168.44.250
add comment="WiFi VLAN DHCP pool (guest/isolated)" name=WIFI-POOL ranges=\
    192.168.45.1-192.168.45.250
/ip dhcp-server
add address-pool=LAN-POOL comment="DHCP for Main Network" interface=\
    LAN-Bridge lease-time=10m name=LAN-DHCP
add address-pool=CAMERA-POOL comment=\
    "DHCP for cameras (HQ-tunnelled + internet)" interface=Camera-VLAN \
    lease-time=10m name=CAMERA-DHCP
add address-pool=WIFI-POOL comment="DHCP for WiFi (internet-only, isolated)" \
    interface=WiFi-VLAN lease-time=10m name=WIFI-DHCP
/ip smb users
set [ find default=yes ] disabled=yes
/interface bridge port
add bridge=LAN-Bridge comment=\
    "Trunk to Aruba switch - native VLAN1, tagged 44 & 45" interface=ether2 \
    internal-path-cost=10 path-cost=10
add bridge=LAN-Bridge comment=\
    "Trunk to Aruba switch - native VLAN1, tagged 44 & 45" interface=ether3 \
    internal-path-cost=10 path-cost=10
add bridge=LAN-Bridge comment=\
    "Trunk to Aruba switch - native VLAN1, tagged 44 & 45" interface=ether4 \
    internal-path-cost=10 path-cost=10
add bridge=LAN-Bridge comment=\
    "Trunk to Aruba switch - native VLAN1, tagged 44 & 45" interface=ether5 \
    internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=!WAN
/ip settings
set tcp-syncookies=yes
/interface bridge vlan
add bridge=LAN-Bridge comment=\
    "Main Network - untagged/native on all trunk ports" untagged=\
    ether2,ether3,ether4,ether5 vlan-ids=1
add bridge=LAN-Bridge comment="Camera VLAN - tagged on all trunk ports" \
    tagged=LAN-Bridge,ether2,ether3,ether4,ether5 vlan-ids=44
add bridge=LAN-Bridge comment="WiFi VLAN - tagged on all trunk ports" tagged=\
    LAN-Bridge,ether2,ether3,ether4,ether5 vlan-ids=45
/interface list member
add interface=LAN-Bridge list=LAN
add interface=Camera-VLAN list=LAN
add interface=WiFi-VLAN list=LAN
add interface=WAN-PPPoE list=WAN
add comment="Covers ether1 for bench-test/fallback DHCP - inert in normal PPPo\
    E production use" interface=ether1 list=WAN
/ip address
add address=192.168.43.254/24 comment="Main Network Gateway" interface=\
    LAN-Bridge network=192.168.43.0
add address=192.168.44.254/24 comment="Camera VLAN Gateway" interface=\
    Camera-VLAN network=192.168.44.0
add address=192.168.45.254/24 comment="WiFi VLAN Gateway (isolated)" \
    interface=WiFi-VLAN network=192.168.45.0
/ip dhcp-client
add comment="Bench-test/fallback only - real site uses PPPoE. Enable only when\
    testing off-site." interface=ether1 name=client1 use-peer-dns=no
/ip dhcp-server lease
add address=192.168.43.249 client-id=1:58:20:b1:df:11:90 mac-address=\
    58:20:B1:DF:11:90 server=LAN-DHCP
add address=192.168.43.248 client-id=1:64:4e:d7:1d:95:71 mac-address=\
    64:4E:D7:1D:95:71 server=LAN-DHCP
/ip dhcp-server network
add address=192.168.43.0/24 comment="Main Network" dns-server=192.168.43.254 \
    domain=<INTERNAL-DOMAIN> gateway=192.168.43.254
add address=192.168.44.0/24 comment="Camera VLAN" dns-server=192.168.44.254 \
    domain=<INTERNAL-DOMAIN> gateway=192.168.44.254
add address=192.168.45.0/24 comment="WiFi VLAN (public DNS)" dns-server=\
    1.1.1.1,8.8.8.8 domain=<PUBLIC-DOMAIN> gateway=192.168.45.254
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip dns static
add comment="Internal domain" forward-to=hq-dns-pool match-subdomain=yes \
    name=<PUBLIC-DOMAIN> type=FWD
add comment="Internal domain (legacy spelling)" forward-to=hq-dns-pool \
    match-subdomain=yes name=<INTERNAL-DOMAIN> type=FWD
/ip firewall address-list
add address=192.168.0.0/16 list=HQ-LAN
add address=192.168.43.0/24 list=Local-Network
add address=192.168.44.0/24 list=Camera-Network
add address=192.168.45.0/24 list=WiFi-Network
add address=172.16.5.0/24 list=HQ-DMZ
add address=<SITE-PUBLIC-IP> comment="HQ Public IP" list=HQ-PUBLIC-IP
add address=192.168.43.254 comment="DNS target for Main Network" list=\
    Local-Gateway
add address=192.168.44.254 comment="DNS target for Camera VLAN" list=\
    Camera-Gateway
/ip firewall filter
add action=return chain=detect-ddos comment="Protection against DDoS" \
    dst-limit=32,32,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddos-targets \
    address-list-timeout=10m chain=detect-ddos
add action=add-src-to-address-list address-list=ddos-attackers \
    address-list-timeout=10m chain=detect-ddos
add action=return chain=detect-ddos comment="SYN-ACK Flood" dst-limit=\
    32,32,src-and-dst-addresses/10s protocol=tcp tcp-flags=syn,ack
add action=jump chain=input comment="Send new connections to DDoS detection" \
    connection-state=new in-interface-list=WAN jump-target=detect-ddos
add action=jump chain=forward comment="SYN Flood protect FORWARD" \
    connection-state=new jump-target=syn-attack protocol=tcp tcp-flags=syn
add action=jump chain=input comment="SYN Flood protect INPUT" \
    connection-state=new jump-target=syn-attack protocol=tcp tcp-flags=syn
add action=accept chain=syn-attack connection-state=new limit=400,5:packet \
    protocol=tcp tcp-flags=syn
add action=drop chain=syn-attack connection-state=new protocol=tcp tcp-flags=\
    syn
add action=fasttrack-connection chain=forward comment=Fasttrack \
    connection-state=established,related ipsec-policy=out,none \
    out-interface-list=WAN
add action=accept chain=forward comment="Accept established,related" \
    connection-state=established,related
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=accept chain=forward comment=\
    "IPSec tunnel to HQ (Main Network to HQ-LAN)." dst-address-list=HQ-LAN \
    ipsec-policy=out,ipsec out-interface-list=WAN src-address-list=\
    Local-Network
add action=accept chain=forward comment=\
    "IPSec tunnel to HQ (HQ-LAN to Main Network)." dst-address-list=\
    Local-Network in-interface-list=WAN ipsec-policy=in,ipsec \
    src-address-list=HQ-LAN
add action=accept chain=forward comment=\
    "IPSec tunnel to HQ (Main Network to HQ-DMZ)." dst-address-list=HQ-DMZ \
    ipsec-policy=out,ipsec out-interface-list=WAN src-address-list=\
    Local-Network
add action=accept chain=forward comment=\
    "IPSec tunnel to HQ (HQ-DMZ to Main Network)." dst-address-list=\
    Local-Network in-interface-list=WAN ipsec-policy=in,ipsec \
    src-address-list=HQ-DMZ
add action=accept chain=forward comment=\
    "IPSec tunnel to HQ (Camera VLAN to HQ-LAN)." dst-address-list=HQ-LAN \
    ipsec-policy=out,ipsec out-interface-list=WAN src-address-list=\
    Camera-Network
add action=accept chain=forward comment=\
    "IPSec tunnel to HQ (HQ-LAN to Camera VLAN)." dst-address-list=\
    Camera-Network in-interface-list=WAN ipsec-policy=in,ipsec \
    src-address-list=HQ-LAN
add action=accept chain=forward comment="Main Network to Camera VLAN" \
    dst-address-list=Camera-Network src-address-list=Local-Network
add action=accept chain=forward comment="Camera VLAN to Main Network" \
    dst-address-list=Local-Network src-address-list=Camera-Network
add action=drop chain=forward comment="Isolate WiFi from Main Network" \
    dst-address-list=Local-Network src-address-list=WiFi-Network
add action=drop chain=forward comment=\
    "Isolate WiFi from Main Network (reverse)" dst-address-list=WiFi-Network \
    src-address-list=Local-Network
add action=drop chain=forward comment="Isolate WiFi from Camera VLAN" \
    dst-address-list=Camera-Network src-address-list=WiFi-Network
add action=drop chain=forward comment=\
    "Isolate WiFi from Camera VLAN (reverse)" dst-address-list=WiFi-Network \
    src-address-list=Camera-Network
add action=drop chain=forward comment="Isolate WiFi from HQ-LAN" \
    dst-address-list=HQ-LAN src-address-list=WiFi-Network
add action=drop chain=forward comment="Isolate WiFi from HQ-LAN (reverse)" \
    dst-address-list=WiFi-Network src-address-list=HQ-LAN
add action=drop chain=forward comment="Isolate WiFi from HQ-DMZ" \
    dst-address-list=HQ-DMZ src-address-list=WiFi-Network
add action=drop chain=forward comment="Isolate WiFi from HQ-DMZ (reverse)" \
    dst-address-list=WiFi-Network src-address-list=HQ-DMZ
add action=accept chain=forward comment=\
    "IPSec tunnel to HQ (Camera VLAN to HQ-DMZ)." dst-address-list=HQ-DMZ \
    ipsec-policy=out,ipsec out-interface-list=WAN src-address-list=\
    Camera-Network
add action=accept chain=forward comment=\
    "IPSec tunnel to HQ (HQ-DMZ to Camera VLAN)." dst-address-list=\
    Camera-Network in-interface-list=WAN ipsec-policy=in,ipsec \
    src-address-list=HQ-DMZ
add action=accept chain=forward comment="Main Network to internet" \
    out-interface-list=WAN src-address-list=Local-Network
add action=accept chain=forward comment="Camera VLAN to internet" \
    out-interface-list=WAN src-address-list=Camera-Network
add action=accept chain=forward comment="WiFi to internet" \
    out-interface-list=WAN src-address-list=WiFi-Network
add action=accept chain=input comment=\
    "Allow Encapsulating Security Payload (ESP)" protocol=ipsec-esp
add action=accept chain=input comment="IPSec incoming" dst-port=500,4500 \
    log-prefix=pass-ipsec protocol=udp
add action=accept chain=input comment="Accept established,related" \
    connection-state=established,related
add action=accept chain=input comment="Allow DHCP requests" dst-port=67 \
    in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow Main Network DNS" \
    dst-address-list=Local-Gateway dst-port=53 protocol=udp src-address-list=\
    Local-Network
add action=accept chain=input comment="Allow Main Network DNS TCP" \
    dst-address-list=Local-Gateway dst-port=53 protocol=tcp src-address-list=\
    Local-Network
add action=accept chain=input comment="Allow Camera VLAN DNS" \
    dst-address-list=Camera-Gateway dst-port=53 protocol=udp \
    src-address-list=Camera-Network
add action=accept chain=input comment="Allow Camera VLAN DNS TCP" \
    dst-address-list=Camera-Gateway dst-port=53 protocol=tcp \
    src-address-list=Camera-Network
add action=accept chain=input comment=\
    "Allow access to Mikrotik Router Winbox from HQ Public IP." dst-port=\
    8291 in-interface-list=WAN protocol=tcp src-address-list=HQ-PUBLIC-IP
add action=accept chain=input comment="Allow ping from HQ Public IP." \
    in-interface-list=WAN protocol=icmp src-address-list=HQ-PUBLIC-IP
add action=accept chain=input comment=\
    "Allow access to Mikrotik Router Winbox from HQ." dst-port=8291 \
    in-interface-list=WAN protocol=tcp src-address-list=HQ-LAN
add action=accept chain=input comment=\
    "Allow access to Mikrotik Router Web UI from HQ." dst-port=80 \
    in-interface-list=WAN protocol=tcp src-address-list=HQ-LAN
add action=accept chain=input comment=\
    "Allow access to Mikrotik Router Winbox from Main Network." dst-port=8291 \
    in-interface-list=LAN protocol=tcp src-address-list=Local-Network
add action=drop chain=input comment="Drop invalid" connection-state=invalid
add action=drop chain=input comment="Block ping from WAN." in-interface-list=\
    WAN protocol=icmp
add action=accept chain=input comment="Accept ICMP" protocol=icmp
add action=drop chain=input comment="Drop all other traffic to router" \
    log-prefix=DROPPED-INPUT
add action=drop chain=forward comment="Drop all other forwarded traffic" \
    log-prefix=DROPPED-FWD
/ip firewall nat
add action=accept chain=dstnat comment="Don't redirect WiFi/guest DNS" \
    dst-port=53 protocol=udp src-address-list=WiFi-Network
add action=accept chain=dstnat comment="Don't redirect WiFi/guest DNS" \
    dst-port=53 protocol=tcp src-address-list=WiFi-Network
add action=redirect chain=dstnat comment=\
    "Force Main Network and Camera VLAN to use router DNS (UDP)" dst-port=53 \
    in-interface-list=LAN protocol=udp to-ports=53
add action=redirect chain=dstnat comment=\
    "Force Main Network and Camera VLAN to use router DNS (TCP)" dst-port=53 \
    in-interface-list=LAN protocol=tcp to-ports=53
add action=accept chain=srcnat dst-address-list=HQ-LAN src-address-list=\
    Local-Network
add action=accept chain=srcnat dst-address-list=HQ-DMZ src-address-list=\
    Local-Network
add action=accept chain=srcnat dst-address-list=HQ-LAN src-address-list=\
    Camera-Network
add action=accept chain=srcnat dst-address-list=HQ-DMZ src-address-list=\
    Camera-Network
add action=masquerade chain=srcnat comment="Masquerade Rule for WAN" \
    ipsec-policy=out,none out-interface-list=WAN
/ip firewall raw
add action=drop chain=prerouting dst-address-list=ddos-targets \
    src-address-list=ddos-attackers
/ip ipsec identity
add peer=Sophos-XG-HQ policy-template-group=Sophos-XG-HQ secret=<IPSEC_PSK_PLACEHOLDER>
/ip ipsec policy
add action=none comment="Exclude local Main Network traffic from IPsec" \
    dst-address=192.168.43.0/24 src-address=192.168.43.0/24
add action=none comment="Exclude local Camera VLAN traffic from IPsec" \
    dst-address=192.168.44.0/24 src-address=192.168.44.0/24
add action=none comment=\
    "Exclude Main Network <-> Camera VLAN local traffic from IPsec" \
    dst-address=192.168.44.0/24 src-address=192.168.43.0/24
add action=none comment=\
    "Exclude Camera VLAN <-> Main Network local traffic from IPsec" \
    dst-address=192.168.43.0/24 src-address=192.168.44.0/24
add dst-address=192.168.0.0/16 level=unique peer=Sophos-XG-HQ proposal=\
    Sophos-XG-HQ src-address=192.168.43.0/24 tunnel=yes
add dst-address=172.16.5.0/24 level=unique peer=Sophos-XG-HQ proposal=\
    Sophos-XG-HQ src-address=192.168.43.0/24 tunnel=yes
add dst-address=192.168.0.0/16 level=unique peer=Sophos-XG-HQ proposal=\
    Sophos-XG-HQ src-address=192.168.44.0/24 tunnel=yes
add dst-address=172.16.5.0/24 level=unique peer=Sophos-XG-HQ proposal=\
    Sophos-XG-HQ src-address=192.168.44.0/24 tunnel=yes
/ip route
add comment="Force router's own traffic to HQ-LAN to match the IPsec policy s\
    elector" dst-address=192.168.0.0/16 gateway=LAN-Bridge pref-src=\
    192.168.43.254
add comment="Force router's own traffic to HQ-DMZ to match the IPsec policy s\
    elector" dst-address=172.16.5.0/24 gateway=LAN-Bridge pref-src=\
    192.168.43.254
/ip service
set ftp disabled=yes
set ssh address=192.168.0.0/16,192.168.43.253/32
set telnet disabled=yes
set www address=192.168.0.0/16,192.168.43.0/24
set winbox address=192.168.0.0/16,192.168.43.0/24,<SITE-PUBLIC-IP>/32
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Pacific/Auckland
/system identity
set name=Remote-Site-RTR-1
/system logging
add disabled=yes topics=ipsec
add topics=system
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.nz.pool.ntp.org
add address=1.nz.pool.ntp.org
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool romon
set enabled=yes

Takeaways

  • VLAN-filtering bridges plus explicit address-lists make multi-network isolation on a single MikroTik router very manageable, without needing separate physical interfaces per network.
  • Excluding local/inter-VLAN traffic from IPsec policy selectors keeps the tunnel doing only what it needs to.
  • Restricting management services by source address list, rather than relying on strong passwords alone, meaningfully shrinks the attack surface on a WAN-facing router.
  • Keep real secrets (PPPoE password, IPsec PSK) out of exported/shared configs entirely — store them in a password manager and fill placeholders in at deploy time.

Device serial number, software ID, public IP addresses, and credential fields have been redacted from the configuration above.

Tags
admin
admin
Articles: 51

Leave a Reply

Your email address will not be published. Required fields are marked *