CAPsMAN is MikroTik’s centralized wireless management — one router configures and controls every access point on your network. Add VLANs and you get per-SSID network isolation: a work WiFi that lives on VLAN 10, a guest network on VLAN 20, and an IoT SSID on VLAN 30 — all from a single radio on each AP.
The problem is that MikroTik’s documentation for CAPsMAN with VLANs in RouterOS 7 is fragmented. The official wiki covers examples but misses the edge cases that break deployments: bridge VLAN filtering gotchas, datapath mode differences, and provisioning rules that don’t trigger.
This guide covers a complete multi-SSID CAPsMAN VLAN setup in RouterOS 7.16+, using local forwarding mode, bridge VLAN filtering, and provisioning rules that actually work.
Topology and Design Decisions
Before writing any config, understand the three forwarding modes:
| Mode | Traffic Flow | VLAN Tagging Location | Best For |
|---|---|---|---|
| Local Forwarding | CAP → Switch → Router directly | On the CAP | Most homelabs — minimal overhead |
| CAPsMAN Forwarding | CAP → CAPsMAN → Router | On the CAPsMAN router | Centralized filtering, IDS/IPS |
| 802.11v BSS Transition | Client steers between APs | Per-AP | Mesh, high-density deployments |
Use local forwarding. It’s simpler and faster. Traffic from each SSID is VLAN-tagged at the access point and switched directly toward the router — the CAPsMAN controller only manages config, it never touches data traffic.
For this guide, the setup is:
Internet — [MikroTik Router (RB5009)] — trunk port — [Switch] — trunk ports — [cAP ax / hAP ac²]
VLAN Layout:
VLAN 1 — Management (native/untagged) — 192.168.88.0/24
VLAN 10 — Staff WiFi (SSID: Office) — 192.168.10.0/24
VLAN 20 — Guest WiFi (SSID: Guest) — 192.168.20.0/24
VLAN 30 — IoT WiFi (SSID: IoT) — 192.168.30.0/24
Step 1: CAPsMAN Router — Bridge and VLAN Interfaces
The CAPsMAN controller runs on the main router. Start by creating the VLAN interfaces and enabling the CAPsMAN service.
|
|
The bridge itself becomes a VLAN trunk. Enable VLAN filtering on it so only tagged VLANs pass through:
|
|
Adjust the port names to match your router’s physical layout. The key is that ports connected to the switch (or directly to APs) only accept tagged frames. Untagged frames (VLAN 1 management) should still work on the native bridge.
Step 2: CAPsMAN Configuration — SSIDs and Security
Create a CAPsMAN configuration for each SSID. This defines the SSID name, security, and — critically — the VLAN and forwarding mode.
|
|
Key parameters explained:
local-forwarding=yes— Traffic stays local to the AP, not tunneled back to CAPsMAN. Required for the switch to handle VLANs.vlan-mode=use-tag— AP tags every client’s traffic with the specified VLAN ID before sending it out the Ethernet port.vlan-id=10/20/30— The 802.1Q VLAN tag applied to client traffic for that SSID.client-isolation— Prevents wireless clients on the same SSID from talking to each other. Enable for guest networks, disable for office/staff networks that need local discovery (printers, etc.).
Step 3: CAPsMAN Interface Binding
Restrict the CAPsMAN service to a specific interface — don’t leave it listening on all interfaces:
|
|
If you have a dedicated management VLAN, use that interface instead:
|
|
This prevents CAPsMAN discovery traffic from leaking onto client VLANs and keeps the control plane clean.
Step 4: Provisioning Rules — Attach SSIDs to APs
Provisioning rules tell CAPsMAN which configuration to push to which CAP. You can match by MAC address, radio MAC, or use a catch-all.
Catch-all rule — same SSIDs on every AP:
|
|
This creates three VAPs (Virtual Access Points) on every CAP that
connects: the master cfg-office (VLAN 10) and two slaves cfg-guest
(VLAN 20) and cfg-iot (VLAN 30).
Per-AP rules — different SSIDs per access point:
|
|
Match rules are evaluated top-to-bottom. The first matching rule wins.
Use identity-regex to match based on the CAP’s identity (set in the
CAP’s /system identity).
Step 5: CAP Configuration — Enabling the Access Points
On each MikroTik AP, enable CAP mode:
|
|
For wifiwave2 package devices (cAP ax, hAP ax³, etc.):
|
|
The bridge=bridge setting is critical — it tells the CAP to add its
wireless interfaces to the local bridge so bridged VLAN traffic flows
correctly.
After the CAP connects, verify it in CAPsMAN:
|
|
Step 6: Switch Configuration — Bridge VLAN Filtering
The switch between the CAPsMAN router and APs needs bridge VLAN filtering to pass tagged traffic.
On a MikroTik switch (CRS or CSS series):
|
|
The trunk ports (ether1-4) carry tagged VLANs 10, 20, and 30. Management traffic (VLAN 1) stays untagged on port ether5 so you can plug a laptop directly into the switch for management access.
For non-MikroTik switches, create an equivalent VLAN setup:
- Port to CAPsMAN router → trunk with tagged VLANs 10, 20, 30
- Ports to APs → trunk with tagged VLANs 10, 20, 30 (PVID 1)
- Management port → access port on VLAN 1
Common CAPsMAN VLAN Problems and Fixes
Problem 1: CAP connects but SSIDs don’t appear
|
|
If the CAP shows state=running but no dynamic interfaces appear,
check the provisioning rule:
|
|
Most common cause: the provisioning rule’s identity-regex doesn’t
match the CAP’s system identity. Use a catch-all rule first to confirm
the config works, then narrow it down.
Problem 2: Clients connect but get no IP address
The DHCP server isn’t reachable through the VLAN. Check:
|
|
If DHCP discovery packets never reach the router, the switch isn’t forwarding the VLAN. Double-check bridge VLAN filtering:
|
|
Every trunk port must appear in the tagged= list for each VLAN.
Problem 3: “CAPsMAN disconnects after a minute”
UDP ports 5246 and 5247 must be open between CAP and CAPsMAN router:
|
|
Problem 4: Guest network can reach staff network
Firewall rules must block inter-VLAN routing. On the CAPsMAN router:
|
|
Guest network should typically only have internet access. Block it from all private subnets:
|
|
Problem 5: VLAN tags stripped by switch
If your AP is connected to a dumb switch or an unmanaged switch between the trunk and the AP, VLAN tags get stripped. CAPsMAN VLAN setups require managed switches with VLAN trunk ports between the router and every AP.
If you must use an unmanaged switch, the AP must do VLAN tagging on its egress port. This works in local forwarding mode only if the AP’s Ethernet port connects directly to a router interface that understands the VLANs.
Verifying the Full Setup
After everything is configured, run through this checklist:
|
|
Maintenance and Updates
Adding a new SSID: Create a new CAPsMAN configuration with the new
VLAN ID, add it to the provisioning rule’s slave-configurations, then
ensure the VLAN interface, DHCP pool, and firewall rules exist on the
router.
Adding a new AP: Connect it to a trunk port on the switch, enable CAP mode, and CAPsMAN auto-provisions it. No per-AP configuration needed if using catch-all provisioning.
Updating RouterOS on APs: Use CAPsMAN’s built-in upgrade:
|
|
This works best if you’ve already uploaded the .npk to the CAPsMAN
router’s files directory:
|
|
For production APs, stage the upgrade: upgrade one AP, verify clients reconnect, then upgrade the rest.
Summary
MikroTik CAPsMAN with VLANs gives you proper WiFi network segmentation without per-AP management overhead. The critical rules:
- Use local forwarding — simpler, faster, and compatible with managed switches that do VLAN filtering
- Match forwarding mode everywhere —
local-forwarding=yeson every CAPsMAN configuration andvlan-mode=use-tagfor tagged egress - Bridge VLAN filtering is mandatory on the switch between CAPsMAN router and APs — trunk ports must pass the VLANs you use
- Provisioning rules can be catch-all or per-AP via
identity-regex— test with a catch-all first, then narrow - Firewall between VLANs — CAPsMAN tags traffic, but isolating VLANs is the router’s firewall job
The most common failure point is bridge VLAN filtering: a port that
isn’t listed as tagged for a VLAN silently drops that traffic. Always
verify with /interface bridge vlan print on every switch and on the
CAPsMAN router’s bridge.
Once it clicks, CAPsMAN VLANs are the cleanest way to run multi-SSID WiFi in a homelab. Add an AP: plug in, enable CAP mode, done. No SSH, no config, no per-AP tweaks. The controller handles everything.