MikroTik VLAN Configuration for ISPs: Separating Subscriber, Management & Backhaul Traffic on Your Network

As your ISP in Uganda, Kenya, or Tanzania grows, mixing subscriber traffic, management traffic, and backhaul on the same physical network becomes a serious security and operational risk. A subscriber could accidentally — or deliberately — reach your router management interface. VLANs (Virtual Local Area Networks) solve this by logically separating different traffic types on the same physical infrastructure, giving you isolation, security, and control without running separate cables for each traffic type.

Why VLANs Matter for African ISPs

• Security — subscribers cannot reach router management interfaces or your billing system server
• Traffic isolation — a subscriber broadcast storm doesn’t affect management or backhaul traffic
• Scalability — add new zones or services without rewiring; just add a VLAN
• QoS simplification — apply queue rules per VLAN rather than per subscriber IP
• Multi-tenant support — run hotspot, PPPoE residential, and business traffic on separate VLANs over the same link

Recommended VLAN Design

Recommended Hardware

• MikroTik hEX S RB760iGS — VLAN-capable core PoP router; SFP trunk uplink, PoE output
• MikroTik hEX RB750Gr3 — zone distribution router; 802.1Q VLAN tagging on all ports
• MikroTik hAP RouterBOARD with PoE — subscriber CPE on access port
• MikroTik hAP lite Wireless Router — residential CPE
• MikroTik hAP lite RB941-2nD — budget CPE
• MikroTik RouterBOARD Wireless Router — backhaul and distribution; trunks VLANs across radio links
• MikroTik MANTBox 12s — sector AP; trunks multiple VLANs to subscriber zones

Cabling: Cat6 Flat Ethernet Cable (indoor trunk runs) and Cat6 Indoor/Outdoor UTP Cable (outdoor). Browse the full MikroTik Routers collection.

Step 1: Create VLANs on the Core Router

Interfaces → VLAN → + for each VLAN:

1. Name: vlan10-mgmt | VLAN ID: 10 | Interface: ether1
2. Name: vlan30-pppoe | VLAN ID: 30 | Interface: ether1
3. Name: vlan40-hotspot | VLAN ID: 40 | Interface: ether1
4. Repeat for each VLAN in your design

Step 2: Assign IP Addresses to VLAN Interfaces

IP → Addresses → +:

1. 10.0.10.1/24 on vlan10-mgmt
2. 10.10.0.1/16 on vlan30-pppoe
3. 192.168.88.1/24 on vlan40-hotspot

Step 3: Configure PPPoE Server on Subscriber VLAN

1. PPP → PPPoE Servers → +
2. Interface: vlan30-pppoe
3. Link to IP pool and RADIUS server

Your ISP billing system controls subscriber access via RouterOS API on the management VLAN — fully isolated from subscriber traffic.

Step 4: Firewall Rules for VLAN Isolation

Block subscribers from reaching management VLAN:

Chain: input | In Interface: vlan30-pppoe | Dst Address: 10.0.10.0/24 | Action: drop

Block inter-subscriber traffic:

Chain: forward | In Interface: vlan30-pppoe | Out Interface: vlan30-pppoe | Action: drop

Step 5: Trunk VLANs Across Uplinks and Radio Links

1. Create VLAN interfaces on the same physical/radio interface for each VLAN ID on both ends
2. Access ports (subscriber CPE): untagged, carry VLAN 30 only
3. Trunk ports (uplinks to core): tagged 802.1Q, carry all VLANs

Step 6: Restrict Management VLAN Access

Chain: input | In Interface: vlan10-mgmt | Src Address: !10.0.10.0/24 | Action: drop

Common Mistakes to Avoid

• No firewall rules — VLANs alone don’t prevent inter-VLAN routing if the router has IPs on both; explicitly block unwanted traffic
• Mismatched VLAN IDs — VLAN ID must match exactly on core, distribution, and switches
• Untagged VLAN confusion — document which VLAN is untagged on each port; inconsistency causes traffic on the wrong VLAN

Conclusion

VLANs are the foundation of a secure, scalable ISP network. Separating subscriber, management, backhaul, and hotspot traffic protects your billing system, prevents interference, and makes your network easier to troubleshoot as you grow across Uganda.

Manage your VLAN-segmented ISP network with our billing platform →