Немножко комментариев:
rates - режимы, в которых будет работать CAPsMAN;
access-list - уровень, при котором сбрасывать клиента с Wi-Fi точки. Клиент с уровнем сигнала -70 dBm и хуже (-120 dBm) будет сбрасываться с точки. Поиграйтесь с уровнями от -75 до -85 (т.е. -120..-75, -120..-80, -120..-85), чтобы выбрать оптимальный для вас.
security - настройки безопасности. Не забудьте поменять имя сети mtwifi и пароль сети wifipasswordqwerty
datapath - здесь указывается бридж, в который будут лететь пакеты
configuration - конфигурации, распространяемые на точки доступа в 2-х диапазонах
provisioning - здесь указывается всем CAP присваивать одинаковую конфигурацию на основе их аппаратных возможностей (используемых радиомодулей)
/caps-man rates add name=rates_mt
/caps-man access-list
add action=accept allow-signal-out-of-range=10s disabled=no interface=all \
signal-range=-70..120 ssid-regexp=""
add action=reject allow-signal-out-of-range=10s disabled=no interface=all \
signal-range=-120..-70 ssid-regexp=""
/caps-man security
add authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm \
group-encryption=aes-ccm name=secpol passphrase=wifipasswordqwerty
/caps-man datapath
add bridge=LAN bridge-horizon=10 name=LAN client-to-client-forwarding=yes
/caps-man channel
add band=5ghz-n/ac extension-channel=disabled frequency=5180,5200,5220 name=\
chanel-5.0GHz reselect-interval=1d save-selected=yes tx-power=22
add band=2ghz-g/n extension-channel=disabled frequency=2412,2437,2462 name=\
chanel-2.4GHz reselect-interval=1d save-selected=yes tx-power=17
/caps-man configuration
add channel=chanel-2.4GHz country=russia3 datapath=LAN disconnect-timeout=15s \
distance=indoors hide-ssid=no hw-protection-mode=cts-to-self \
max-sta-count=100 mode=ap multicast-helper=full name=2.4-configuration \
rates=rates_mt rx-chains=0,1,2,3 security=secpol ssid=mtwifi tx-chains=0,1,2,3
add channel=chanel-5.0GHz country=russia3 datapath=LAN disconnect-timeout=15s \
distance=indoors hide-ssid=no hw-protection-mode=cts-to-self \
max-sta-count=20 mode=ap multicast-helper=full name=5.0-configuration \
rates=rates_mt rx-chains=0,1,2,3 security=secpol ssid=mtwifi tx-chains=0,1,2,3
/caps-man provisioning
add action=create-dynamic-enabled comment=5.0 hw-supported-modes=ac \
master-configuration=5.0-configuration name-format=identity
add action=create-dynamic-enabled comment=2.4 hw-supported-modes=gn \
master-configuration=2.4-configuration name-format=identity
/caps-man manager
set enabled=yes
В случае если вы настраиваете CAPsMAN на устройстве, на котором есть WIFI-интерфейсы, то нужно передать их под управление CAPsMANа (или не передавать, решать вам).
Выполняем нижеприведенные строки в терминале, но оговоркой по количеству: если вещаем в только в диапазоне 2.4, то не забудьте из строки убрать упоминание о WLAN2. В моём случае это двухдиапазонник HAP AC^2.
/interface wireless cap set enabled=yes interfaces=wlan1,wlan2 caps-man-addresses=127.0.0.1
Т.к. у нас в FireWall-е предпоследним правилом запрещен весь неразрешенный выше трафик в цепочке input, то необходимо создать 2 разрешающих правила для CAPsMAN в цепочках input и output для портов 5246 и 5247 и разместить перед запретом. Я размещаю их в самом начале.
/ip firewall filter add chain=output action=accept protocol=udp src-address=127.0.0.1 \
dst-address=127.0.0.1 port=5246,5247 place-before=0 comment="Enable CAPsMAN"
/ip firewall filter add chain=input action=accept protocol=udp src-address=127.0.0.1 \
dst-address=127.0.0.1 port=5246,5247 place-before=0 comment="Enable CAPsMAN"
Создадим виртуальные интерфейсы для гостевой сети.
/interface bridge add name=wifi-guest disabled=no
/ip address add disabled=no address=10.10.20.1/24 interface=wifi-guest
/ip pool add name=wifi-guest ranges=10.10.20.100-10.10.20.254 comment="wifi-guest"
/ip dhcp-server add name=wifi-guest interface=wifi-guest address-pool=wifi-guest lease-time=1d authoritative=yes disabled=no
/ip dhcp-server network add gateway=10.10.20.1 address=10.10.20.0/24
Теперь необходимо настроить CAPsMAN, чтобы он создал на устройствах виртуальные Wi-Fi интерфейсы. Параметр client-to-client-forwarding в datapath мы не указываем, чтобы гостевые устройства не общались друг с другом в сети.
/caps-man security
add authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm \
group-encryption=aes-ccm name=secpol_guest passphrase=wifipasswordqwertyguest
/caps-man datapath
add bridge=wifi-guest bridge-horizon=10 name=wifi-guest
/caps-man configuration
add channel=chanel-2.4GHz country=russia3 datapath=wifi-guest disconnect-timeout=15s \
distance=indoors hide-ssid=no hw-protection-mode=cts-to-self \
max-sta-count=100 mode=ap multicast-helper=full name=2.4-configuration-guest \
rates=rates_mt rx-chains=0,1,2,3 security=secpol_guest ssid=mtwifi-guest tx-chains=0,1,2,3
add channel=chanel-5.0GHz country=russia3 datapath=wifi-guest disconnect-timeout=15s \
distance=indoors hide-ssid=no hw-protection-mode=cts-to-self \
max-sta-count=20 mode=ap multicast-helper=full name=5.0-configuration-guest \
rates=rates_mt rx-chains=0,1,2,3 security=secpol_guest ssid=mtwifi-guest tx-chains=0,1,2,3
/caps-man provisioning
set [find hw-supported-modes=ac] slave-configurations=5.0-configuration-guest
set [find hw-supported-modes=gn] slave-configurations=2.4-configuration-guest
Запретим взаимодействие клиентов локальной и гостевой сети:
/ip route rule add src-address=10.10.20.0/24 dst-address=10.10.10.0/24 action=drop
/ip route rule add src-address=10.10.10.0/24 dst-address=10.10.20.0/24 action=drop
Промаркируем гостевой трафик, настроим очереди.
/ip firewall address-list add address=10.10.20.0/24 list=guests
/ip firewall mangle
add action=mark-connection chain=prerouting comment=Guest_connections_Out connection-state=new new-connection-mark=Guest_conn passthrough=yes src-address-list=guests place-before=0
add action=mark-connection chain=prerouting comment=Guest_connections_In connection-state=new dst-address-list=guests new-connection-mark=Guest_conn passthrough=yes place-before=0
add action=mark-packet chain=prerouting comment=Guest_packets connection-mark=Guest_conn new-packet-mark=Guest_packets passthrough=no place-before=0
/queue tree
set [find name~"SIP*"] priority=3
set [find name~"DNS*"] priority=4
set [find name~"HTTP*"] priority=5
set [find name~"RDP*"] priority=6
set [find name~"Other*"] priority=7
add burst-limit=7M burst-threshold=3M burst-time=16s limit-at=2M max-limit=5M name=GUEST-WAN packet-mark=Guest_packets parent=WAN-queue
add max-limit=7M name=GUEST-queue parent=wifi-guest
add burst-limit=7M burst-threshold=3M burst-time=16s limit-at=2M max-limit=5M name=GUEST-LAN packet-mark=Guest_packets parent=GUEST-queue
Вот и всё. Спасибо за внимание.
Ну, и традиционно все вышеописанное одним блоком вставить в терминал.
/caps-man rates add name=rates_mt
/caps-man access-list
add action=accept allow-signal-out-of-range=10s disabled=no interface=all \
signal-range=-70..120 ssid-regexp=""
add action=reject allow-signal-out-of-range=10s disabled=no interface=all \
signal-range=-120..-70 ssid-regexp=""
/caps-man security
add authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm \
group-encryption=aes-ccm name=secpol passphrase=wifipasswordqwerty
/caps-man datapath
add bridge=LAN bridge-horizon=10 name=LAN client-to-client-forwarding=yes
/caps-man channel
add band=5ghz-n/ac extension-channel=disabled frequency=5180,5200,5220 name=\
chanel-5.0GHz reselect-interval=1d save-selected=yes tx-power=22
add band=2ghz-g/n extension-channel=disabled frequency=2412,2437,2462 name=\
chanel-2.4GHz reselect-interval=1d save-selected=yes tx-power=17
/caps-man configuration
add channel=chanel-2.4GHz country=russia3 datapath=LAN disconnect-timeout=15s \
distance=indoors hide-ssid=no hw-protection-mode=cts-to-self \
max-sta-count=100 mode=ap multicast-helper=full name=2.4-configuration \
rates=rates_mt rx-chains=0,1,2,3 security=secpol ssid=mtwifi tx-chains=0,1,2,3
add channel=chanel-5.0GHz country=russia3 datapath=LAN disconnect-timeout=15s \
distance=indoors hide-ssid=no hw-protection-mode=cts-to-self \
max-sta-count=20 mode=ap multicast-helper=full name=5.0-configuration \
rates=rates_mt rx-chains=0,1,2,3 security=secpol ssid=mtwifi tx-chains=0,1,2,3
/caps-man provisioning
add action=create-dynamic-enabled comment=5.0 hw-supported-modes=ac \
master-configuration=5.0-configuration name-format=identity
add action=create-dynamic-enabled comment=2.4 hw-supported-modes=gn \
master-configuration=2.4-configuration name-format=identity
/caps-man manager
set enabled=yes
/interface wireless cap set enabled=yes interfaces=wlan1,wlan2 caps-man-addresses=127.0.0.1
/ip firewall filter add chain=output action=accept protocol=udp src-address=127.0.0.1 \
dst-address=127.0.0.1 port=5246,5247 place-before=0 comment="Enable CAPsMAN"
/ip firewall filter add chain=input action=accept protocol=udp src-address=127.0.0.1 \
dst-address=127.0.0.1 port=5246,5247 place-before=0 comment="Enable CAPsMAN"
/interface bridge add name=wifi-guest disabled=no
/ip address add disabled=no address=10.10.20.1/24 interface=wifi-guest
/ip pool add name=wifi-guest ranges=10.10.20.100-10.10.20.254 comment="wifi-guest"
/ip dhcp-server add name=wifi-guest interface=wifi-guest address-pool=wifi-guest lease-time=1d authoritative=yes disabled=no
/ip dhcp-server network add gateway=10.10.20.1 address=10.10.20.0/24
/caps-man security
add authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm \
group-encryption=aes-ccm name=secpol_guest passphrase=wifipasswordqwertyguest
/caps-man datapath
add bridge=wifi-guest bridge-horizon=10 name=wifi-guest
/caps-man configuration
add channel=chanel-2.4GHz country=russia3 datapath=wifi-guest disconnect-timeout=15s \
distance=indoors hide-ssid=no hw-protection-mode=cts-to-self \
max-sta-count=100 mode=ap multicast-helper=full name=2.4-configuration-guest \
rates=rates_mt rx-chains=0,1,2,3 security=secpol_guest ssid=mtwifi-guest tx-chains=0,1,2,3
add channel=chanel-5.0GHz country=russia3 datapath=wifi-guest disconnect-timeout=15s \
distance=indoors hide-ssid=no hw-protection-mode=cts-to-self \
max-sta-count=20 mode=ap multicast-helper=full name=5.0-configuration-guest \
rates=rates_mt rx-chains=0,1,2,3 security=secpol_guest ssid=mtwifi-guest tx-chains=0,1,2,3
/caps-man provisioning
set [find hw-supported-modes=ac] slave-configurations=5.0-configuration-guest
set [find hw-supported-modes=gn] slave-configurations=2.4-configuration-guest
/ip route rule add src-address=10.10.20.0/24 dst-address=10.10.10.0/24 action=drop
/ip route rule add src-address=10.10.10.0/24 dst-address=10.10.20.0/24 action=drop
/ip firewall address-list add address=10.10.20.0/24 list=guests
/ip firewall mangle
add action=mark-connection chain=prerouting comment=Guest_connections_Out connection-state=new new-connection-mark=Guest_conn passthrough=yes src-address-list=guests place-before=0
add action=mark-connection chain=prerouting comment=Guest_connections_In connection-state=new dst-address-list=guests new-connection-mark=Guest_conn passthrough=yes place-before=0
add action=mark-packet chain=prerouting comment=Guest_packets connection-mark=Guest_conn new-packet-mark=Guest_packets passthrough=no place-before=0
/queue tree
set [find name~"SIP*"] priority=3
set [find name~"DNS*"] priority=4
set [find name~"HTTP*"] priority=5
set [find name~"RDP*"] priority=6
set [find name~"Other*"] priority=7
add burst-limit=7M burst-threshold=3M burst-time=16s limit-at=2M max-limit=5M name=GUEST-WAN packet-mark=Guest_packets parent=WAN-queue
add max-limit=7M name=GUEST-queue parent=wifi-guest
add burst-limit=7M burst-threshold=3M burst-time=16s limit-at=2M max-limit=5M name=GUEST-LAN packet-mark=Guest_packets parent=GUEST-queue
