How to run multiple networks on a Mikrotik for Homelab

1) Before we begin, let’s look at the diagrams of what we are trying to accomplish with our MikroTik router. Basically, we are creating two separate networks, 192.168.3.0/24 and 192.168.4.0./24. Our home network will be running on one network, and our homelab on the other, with a firewall filter rule preventing devices on either network from communicating with devices on the other network.

2) Connect an Ethernet cable to port 1 of your MikroTik router and the other end to your WAN connection. In most cases this would be the port on your modem.

3) Connect an Ethernet cable to port 2 of your MikroTik router and the other end of the cable to the Ethernet port of your Windows computer.

4) Next open up the Winbox application and connect to your MikroTik by clicking on the neighbors tab and selecting the MikroTik on the network. The default password is blank.

5) Remove ether3, 4, and 5 from Master port of (ether2)
 a. Go to Interfaces -> then find ether3-slave-local, ether4-slave-local, and ether5-slave-local. For each one, set the Master Port: none.

6) Next we need to set up IP addresses for each port 3 through 5.
 a. Go to IP -> Addresses -> click on the plus sign and enter the following information.
  i. Address: 192.168.3.1/24
  ii. Network: 192.168.3.0
  iii. Interface: ether3-slave-local
  iv. Click Apply
  v. Click Copy
 b. Edit the settings for port 4 on the copy.
  i. Address: 192.168.4.1/24
  ii. Network: 192.168.4.0
  iii. Interface: ether4-slave-local
  iv. Click Apply
  v. Click Copy
 c. Edit the settings for port 5 on the copy.
  i. Address: 192.168.5.1/24
  ii. Network: 192.168.5.0
  iii. Interface: ether5-slave-local
  iv. Click Apply
  v. Click Okay

7) We now need to set up IP pool to DHCP for each ether port and WLAN.
 a. Go to IP -> Pool -> Click on the plus sign and enter the following.
  i. Name: pool-ether3
  ii. Addresses: 192.168.3.10-192.168.3.250
  iii. Next Pool: none
  iv. Click apply
  v. Click copy
 b. Edit the copy with the ether 4 IP pool configuration.
  i. Name: pool-ether4
  ii. Addresses: 192.168.4.10-192.168.4.250
  iii. Next Pool: none
  iv. Click apply
  v. Click copy
 c. Edit the copy with the ether 5 IP pool configuration.
  i. Name: pool-ether5
  ii. Addresses: 192.168.5.10-192.168.5.250
  iii. Next Pool: none
  iv. Click apply
  v. Click copy

8) Next, we will need to set up DHCP and Network.
 a. Go to IP -> DHCP Server -> under the DHCP tab click on the plus sign.
 b. Enter the following configuration for port 3.
  i. Name: Server-ether3
  ii. Interface: ether3-slave-local
  iii. Relay:
  iv. Lease Time: 3d 00:00:00
  v. Bootp Lease Time: forever
  vi. Address Pool: pool-ether3
  vii. Click Apply
  viii. Click Copy
 c. Edit the copy with the DHCP server configuration for ether 4.
  i. Name: Server-ether4
  ii. Interface: ether4-slave-local
  iii. Relay:
  iv. Lease Time: 3d 00:00:00
  v. Bootp Lease Time: forever
  vi. Address Pool: pool-ether4
  vii. Click Apply
  viii. Click Copy
 d. Edit the copy with the DHCP server configuration for ether 5.
  i. Name: Server-ether5
  ii. Interface: ether5-slave-local
  iii. Relay:
  iv. Lease Time: 3d 00:00:00
  v. Bootp Lease Time: forever
  vi. Address Pool: pool-ether5
  vii. Click Apply
  viii. Click Okay

9) Next go to the network tab and type the following configurations.
 a. Edit ether3 network
  i. Address: 192.168.3.0/24
  ii. Gateway: 192.168.3.1
  iii. Netmask:
  iv. DNS Servers: 8.8.8.8 (or whatever DNS server you want to use)
  v. Domain:
  vi. WINS Servers:
  vii. NTP Servers:
  viii. Next Server:
  ix. Boot File Name:
  x. DHCP Options:
  xi. DHCP Option Set:
  xii. Comment: ether3
  xiii. Click Apply
  xiv. Click Copy
 b. Edit ether4 network
  i. Address: 192.168.4.0/24
  ii. Gateway: 192.168.4.1
  iii. Netmask:
  iv. DNS Servers: 8.8.8.8 (or whatever DNS server you want to use)
  v. Domain:
  vi. WINS Servers:
  vii. NTP Servers:
  viii. Next Server:
  ix. Boot File Name:
  x. DHCP Options:
  xi. DHCP Option Set:
  xii. Comment: ether4
  xiii. Click Apply
  xiv. Click Copy
 c. Edit ether5 network
  i. Address: 192.168.5.0/24
  ii. Gateway: 192.168.5.1
  iii. Netmask:
  iv. DNS Servers: 8.8.8.8 (or whatever DNS server you want to use)
  v. Domain:
  vi. WINS Servers:
  vii. NTP Servers:
  viii. Next Server:
  ix. Boot File Name:
  x. DHCP Options:
  xi. DHCP Option Set:
  xii. Comment: ether5
  xiii. Click Apply
  xiv. Click Copy

10) If you are using wireless, you will need to setup wireless with step 10. If not, skip to step 11.
 a. Go to Wireless -> double click on wlan1 in the interfaces tab
 b. A new window will open for the wlan1 interface, go to the Wireless tab and rename the SSID to whatever you want to name your network.
  i. Example Rayos Homelab Network
 c. Click OK
 d. Next go to the Security Profiles tab and double click on the default entry.
  i. Configure with the following
  ii. Name: default
  iii. Mode: dynamic keys
  iv. Authentication Types:
   1. WPA PSK = checked
   2. WPA2 PSK = checked
   3. WPA EAP = unchecked
   4. WPA2 EAP = unchecked
  v. Unicast Ciphers:
   1. Tkip = unchecked
   2. Aes ccm = checked
  vi. Group Ciphers:
   1. Tkip = unchecked
   2. Aes ccm = checked
  vii. WPA Pre-Shared Key: Password you set!
  viii. WPA2 Pre-Shared Key: Password you set!
  ix. Supplicant Identity: MikroTik
  x. Group Key Update 00:05:00
  xi. Management Protection: disabled
  xii. Management Protection Key:
  xiii. Click Apply
  xiv. Click OK

11) If you are not using Wifi, go to Interfaces, right click on the Wifi interfaces and click on Disable.

12) Next we need to setup NAT (Network Address Translation)
 a. Go to IP -> Firewall -> NAT Tab -> Delete all entries and create a new entry.
  i. Leave all fields default, Chain: field should have srcnat.
  ii. Go to action tab, and under the action pull down, select masquerade.
 b. Click Apply
 c. Click OK

13) Next we set up DNS
 a. Go to IP -> DNS -> Enter the following configuration
  i. Servers: 8.8.8.8 (Click on the down arrow to add another server)
  ii. Servers: 8.8.4.4
  iii. Dynamic Servers:
  iv. Allow Remote Requests = Checked
  v. Max UDP Packet Size: 4096
  vi. Cache Size: 2048
  vii. Cache Used: 9
  viii. Click Apply
  ix. Click OK

14) Test your configuration.
 a. Go to New Terminal
 b. Type the following commands to test.
  i. Ping 8.8.8.8
  ii. Ping google.com
 c. Next move the Ethernet cable at the MikroTik end from port 2 to port 3. Check your computers IP address again, it should have something on the 3 subnet. Example 192.168.3.250. Do the same with ports 4 and 5.
 d. With a wireless device, connect to the Wireless coming from the MikroTik. It should get an IP address similar to 10.0.0.250.

15) To separate traffic between the VLANS/networks, you will need to create firewall rules.
 a. Go to IP -> Firewall -> Click on the plus sign
  i. Configure the new rule with the following:
   1. Chain: forward
   2. Sr c. Address: ether 3 (Home Network)
   3. Dst. Address: ether 4 (Homelab Network)
   4. Go to the Action Tab and select “drop” from the Action pull down.
   5. Add a comment that this rule is to block ether 4 from ether 3.
  ii. Configure another rule with the following:
   1. Chain: forward
   2. Sr c. Address: ether 4 (Homelab Network)
   3. Dst. Address: ether 3 (Home Network)
   4. Go to the Action Tab and select “drop” from the Action pull down.
   5. Add a comment that this rule is to block ether 4 from ether 3.
  iii. We can still ping at this point, we need one more step to block ether 3 (Home) from ether 4 (Homelab network).
   1. Go to Bridge -> Click on Setting button at the top -> Check “Use IP Firewall”
   2. Click OK
   3. You won’t be able to ping from ether 4 to ether 3 and vice versa now.

16) You should be good to go now.