Introduction to MikroTik VLAN Configuration for ISPs

For Internet Service Providers managing hundreds or thousands of subscribers, network segmentation is not optional — it is essential. VLANs (Virtual Local Area Networks) allow ISPs to logically separate traffic across a shared physical infrastructure, improving security, performance, and manageability.

MikroTik routers, widely used by ISPs across India, offer powerful and flexible VLAN support through RouterOS. Whether you are running a fiber network, wireless broadband, or a hybrid setup, understanding MikroTik VLAN configuration is critical to building a scalable ISP network.

In this guide, we walk through everything — from VLAN basics to advanced ISP-level configurations — including integration with OneRADIUS, the leading AAA RADIUS server for ISPs in India.

---

What is a VLAN and Why Do ISPs Need It?

A VLAN is a logical subdivision of a physical network. Instead of running separate cables for each network segment, VLANs use 802.1Q tagging to mark packets and route them to the correct virtual network.

Key Benefits of VLANs for ISPs

  • **Subscriber Isolation** — Prevent one subscriber from accessing another subscriber's traffic
  • **Traffic Segmentation** — Separate management, voice, video, and data traffic on the same physical link
  • **Scalability** — Add new subscriber segments without changing physical infrastructure
  • **Security** — Limit broadcast domains and reduce attack surface
  • **QoS Implementation** — Apply Quality of Service policies per VLAN
  • **Easier Troubleshooting** — Isolate problems to a specific VLAN segment
💡 Indian ISPs operating under TRAI and DOT regulations must maintain strict subscriber isolation. VLANs are the most practical way to achieve this at scale.

---

Understanding MikroTik VLAN Types

MikroTik RouterOS supports multiple methods of implementing VLANs depending on your hardware and use case.

1. Bridge VLAN Filtering (Recommended for Modern RouterOS)

Available from RouterOS v6.41+, Bridge VLAN Filtering is the modern and recommended approach. It leverages the hardware switching chip for line-rate performance and is ideal for ISP deployments.

2. VLAN Interface on Ethernet

You can add a VLAN interface directly on top of an Ethernet interface. This is simpler but does not use hardware offloading on all devices.

3. VLAN on Wireless Interfaces

For wireless ISPs (WISPs), MikroTik supports VLANs on wireless interfaces, allowing subscriber separation over wireless links.

⚠️ Do not mix Bridge VLAN Filtering with manually configured VLAN interfaces on the same bridge — this can cause unpredictable traffic behaviour.

---

MikroTik VLAN Configuration: Prerequisites

Before you begin, ensure the following:

  • MikroTik router running **RouterOS v6.41 or later** (v7.x recommended)
  • Access to the router via **Winbox, WebFig, or SSH**
  • A clear network topology plan with VLAN IDs assigned
  • Physical or virtual ports identified for each VLAN
  • RADIUS server (such as **OneRADIUS**) ready if using dynamic VLAN assignment

---

Step-by-Step MikroTik VLAN Configuration for ISPs

Step 1: Create a Bridge Interface

The first step is to create a bridge that will act as the central switching fabric.

/interface bridge add name=bridge1 vlan-filtering=no

💡 Set vlan-filtering=no initially. You will enable it after all VLAN configurations are complete to avoid locking yourself out of the router.

Step 2: Add Physical Ports to the Bridge

Add all the ports that will participate in VLAN traffic to the bridge.

/interface bridge port add bridge=bridge1 interface=ether1

/interface bridge port add bridge=bridge1 interface=ether2

/interface bridge port add bridge=bridge1 interface=ether3

Replace ether1, ether2, ether3 with your actual interface names.

Step 3: Define VLAN IDs on the Bridge

Now configure which VLANs are allowed on which bridge ports.

/interface bridge vlan add bridge=bridge1 tagged=bridge1,ether1 untagged=ether2 vlan-ids=100

/interface bridge vlan add bridge=bridge1 tagged=bridge1,ether1 untagged=ether3 vlan-ids=200

  • **Tagged ports** — Ports that carry multiple VLANs (typically uplinks)
  • **Untagged ports** — Ports assigned to a single VLAN (typically subscriber ports)

Step 4: Create VLAN Interfaces on the Bridge

To assign IP addresses or apply routing per VLAN, create VLAN interfaces on top of the bridge.

/interface vlan add interface=bridge1 name=vlan100 vlan-id=100

/interface vlan add interface=bridge1 name=vlan200 vlan-id=200

Step 5: Assign IP Addresses to VLAN Interfaces

/ip address add address=192.168.100.1/24 interface=vlan100

/ip address add address=192.168.200.1/24 interface=vlan200

These IPs will serve as the default gateways for subscribers in each VLAN segment.

Step 6: Enable VLAN Filtering on the Bridge

Once all configurations are in place, enable VLAN filtering.

/interface bridge set bridge1 vlan-filtering=yes

⚠️ Enabling VLAN filtering will immediately enforce VLAN rules. If your management IP is on a VLAN that is not correctly configured, you may lose access. Always have a console or out-of-band access ready.

Step 7: Configure DHCP Server per VLAN

Set up a DHCP server for each VLAN to automatically assign IP addresses to subscribers.

/ip pool add name=pool-vlan100 ranges=192.168.100.10-192.168.100.254

/ip dhcp-server add address-pool=pool-vlan100 interface=vlan100 name=dhcp-vlan100

/ip dhcp-server network add address=192.168.100.0/24 gateway=192.168.100.1 dns-server=8.8.8.8

Repeat for each VLAN segment.

---

Configuring Trunk and Access Ports

Trunk Ports (Uplink to Core/Distribution Switch)

Trunk ports carry traffic from multiple VLANs — typically the uplink port connecting to your core router or L3 switch.

  • Set the port as **tagged** for all required VLANs
  • No PVID (Port VLAN ID) change is needed for trunk ports

/interface bridge port set [find interface=ether1] frame-types=admit-only-vlan-tagged

Access Ports (Subscriber-Facing Ports)

Access ports connect to end subscribers and carry only one VLAN.

/interface bridge port set [find interface=ether2] pvid=100 frame-types=admit-only-untagged-and-priority-tagged

💡 Setting frame-types correctly prevents VLAN hopping attacks — a critical security measure for ISP networks.

---

Dynamic VLAN Assignment Using RADIUS

For large ISP deployments, manually assigning VLANs to ports is not scalable. The best practice is to use dynamic VLAN assignment via RADIUS.

When a subscriber authenticates using PPPoE or 802.1X, the RADIUS server returns VLAN attributes that MikroTik applies automatically.

RADIUS Attributes for Dynamic VLAN

The following standard RADIUS attributes are used:

  • **Tunnel-Type** = VLAN (13)
  • **Tunnel-Medium-Type** = IEEE-802 (6)
  • **Tunnel-Private-Group-ID** = VLAN ID (e.g., '100')

Configuring MikroTik for RADIUS Authentication

/radius add address=<RADIUS-SERVER-IP> secret=<shared-secret> service=ppp

/ppp aaa set use-radius=yes

OneRADIUS Integration for Dynamic VLANs

OneRADIUS — the AAA RADIUS server built for Indian ISPs — makes dynamic VLAN assignment simple and powerful.

  • Define VLAN IDs per subscriber or subscriber group in the OneRADIUS dashboard
  • OneRADIUS automatically pushes the correct VLAN attributes during authentication
  • Combine VLAN assignment with bandwidth policies, session limits, and data quotas — all from a single platform
  • Real-time visibility into which VLAN each subscriber is connected to
💡 Using OneRADIUS with MikroTik eliminates the need for manual VLAN-to-port mapping. Dynamic assignment scales to thousands of subscribers effortlessly.

---

MikroTik QinQ (Double VLAN Tagging) for ISPs

Larger ISPs with multiple resellers or zones often need QinQ (802.1ad), also known as double tagging or stacked VLANs.

How QinQ Works

  • The **outer VLAN** (S-Tag) identifies the zone or reseller
  • The **inner VLAN** (C-Tag) identifies the individual subscriber

This allows ISPs to reuse VLAN IDs across different reseller segments without conflicts.

Basic QinQ Setup on MikroTik

/interface vlan add interface=ether1 name=outer-vlan vlan-id=10

/interface vlan add interface=outer-vlan name=inner-vlan vlan-id=100

⚠️ QinQ requires both the MikroTik router and upstream equipment to support 802.1ad. Confirm hardware compatibility before deploying in production.

---

MikroTik VLAN for PPPoE ISP Networks

Most Indian ISPs use PPPoE (Point-to-Point Protocol over Ethernet) for subscriber authentication. VLANs and PPPoE work together seamlessly on MikroTik.

Typical ISP PPPoE + VLAN Architecture

  • OLT/DSLAM connects to MikroTik via tagged VLAN trunks
  • Each subscriber is placed in a dedicated VLAN or shared VLAN
  • PPPoE server on MikroTik handles authentication via OneRADIUS
  • RADIUS assigns IP, bandwidth, and session policies per subscriber

Setting Up PPPoE Server on a VLAN Interface

/interface pppoe-server server add interface=vlan100 service-name=ISP-PPPoE disabled=no

💡 Running PPPoE on per-subscriber VLANs provides the highest level of isolation and is the recommended architecture for fiber ISPs in India.

---

VLAN Security Best Practices for ISPs

Security is paramount in ISP networks. Follow these VLAN security practices on MikroTik:

  • **Always use VLAN filtering** — Enable vlan-filtering=yes on all bridges
  • **Disable unused ports** — Set unused bridge ports to a 'dead' VLAN with no routing
  • **Use frame-types=admit-only-vlan-tagged** on uplink/trunk ports
  • **Block inter-VLAN routing** where subscriber-to-subscriber communication is not required
  • **Apply firewall rules per VLAN interface** to control what traffic is permitted
  • **Monitor VLAN traffic** using MikroTik's traffic monitoring tools
  • **Change default VLAN IDs** — Do not use VLAN 1 as the default management VLAN
  • **Restrict management access** to a dedicated management VLAN
⚠️ VLAN 1 is the default VLAN on most network equipment and is a common target for VLAN hopping attacks. Always move management traffic to a non-default VLAN.

---

Troubleshooting MikroTik VLAN Issues

Common Problems and Solutions

  • **Subscribers cannot get IP address** — Check DHCP server is bound to the correct VLAN interface and pool is not exhausted
  • **No connectivity between VLANs when expected** — Verify inter-VLAN routing is enabled and firewall rules are not blocking traffic
  • **Traffic leaking between VLANs** — Confirm bridge VLAN filtering is enabled and port configurations (tagged/untagged) are correct
  • **Lost management access after enabling VLAN filtering** — Use console access to verify management VLAN is correctly tagged on the bridge
  • **PPPoE not working on VLAN** — Check that the PPPoE server interface matches the correct VLAN interface name

Useful MikroTik Diagnostic Commands

  • **/interface bridge vlan print** — View all configured bridge VLANs
  • **/interface bridge port print** — Verify port-to-bridge assignments
  • **/ip address print** — Confirm IP addresses on VLAN interfaces
  • **/log print** — Check system logs for VLAN-related errors
  • **/tool sniffer** — Capture packets on a specific interface for deep inspection

---

OneRADIUS and MikroTik: The Perfect Combination for ISPs

While MikroTik provides the routing and switching backbone, OneRADIUS provides the intelligence layer that makes ISP operations scalable.

What OneRADIUS Adds to Your MikroTik VLAN Setup

  • **Centralised subscriber authentication** — No need to configure accounts on each router
  • **Dynamic VLAN assignment** — VLANs are assigned per subscriber based on their plan
  • **Bandwidth control per VLAN** — Define upload/download limits returned via RADIUS attributes
  • **Session management** — Track active sessions, force disconnects, and monitor usage in real time
  • **Data quota enforcement** — Automatically disconnect or throttle subscribers when quota is exhausted
  • **Multi-NAS support** — Manage multiple MikroTik routers from a single OneRADIUS instance
  • **Billing integration** — Sync subscriber plans and expiry with your billing system
💡 OneRADIUS is purpose-built for Indian ISPs and supports all MikroTik RADIUS attributes out of the box. Visit oneradius.com to get started.

---

Conclusion

Configuring VLANs on MikroTik is a foundational skill for any ISP network engineer. Done correctly, VLANs enable subscriber isolation, traffic segmentation, improved security, and a scalable network architecture that can grow with your subscriber base.

By combining MikroTik VLAN configuration with OneRADIUS dynamic VLAN assignment, Indian ISPs can build enterprise-grade networks that are easy to manage, highly secure, and capable of handling thousands of concurrent subscribers.

Whether you are setting up a new ISP or upgrading an existing network, following the steps and best practices in this guide will ensure your VLAN deployment is solid, scalable, and production-ready.

Ready to integrate RADIUS-based dynamic VLAN assignment? [Get started with OneRADIUS](https://oneradius.com) and take your ISP network to the next level.