VLANs let you segment a single physical network into multiple logical networks — separating, say, staff and guest Wi-Fi, or isolating a VoIP network from general data traffic. This example configures two VLANs on a MikroTik router with a trunk port to a managed switch.
Before You Begin
Have your physical topology mapped out first: which port is the trunk to your switch, and which VLAN IDs you’re using (this example uses VLAN 10 for staff and VLAN 20 for guest).
Step 1 — Create the VLAN interfaces
Add VLAN interfaces on the trunk port
Create VLAN interfaces tagged on your uplink/trunk interface (ether1 in this example) — see the commands below.
Step 2 — Assign IP addresses to each VLAN
Address each VLAN subnet
Give each VLAN interface its own subnet, e.g. 10.10.10.1/24 for staff, 10.10.20.1/24 for guest.
Step 3 — Configure DHCP per VLAN
Set up DHCP pools
Create a separate DHCP server and address pool for each VLAN so devices in each segment get appropriate addresses automatically.
Step 4 — Set the switch port to trunk mode
Configure the downstream switch
On the managed switch side, configure the port connecting to the MikroTik router as a trunk (tagged) port carrying both VLAN 10 and VLAN 20, and configure access ports for end devices as untagged members of the relevant VLAN.
Useful Commands
/interface vlannadd name=vlan10-staff interface=ether1 vlan-id=10nadd name=vlan20-guest interface=ether1 vlan-id=20nn/ip addressnadd address=10.10.10.1/24 interface=vlan10-staffnadd address=10.10.20.1/24 interface=vlan20-guestnn/ip poolnadd name=pool-staff ranges=10.10.10.10-10.10.10.200nadd name=pool-guest ranges=10.10.20.10-10.10.20.200nn/ip dhcp-servernadd interface=vlan10-staff address-pool=pool-staff name=dhcp-staffnadd interface=vlan20-guest address-pool=pool-guest name=dhcp-guestGuest VLANs should be isolated from internal resources with firewall rules — by default, creating a VLAN does not automatically block guest traffic from reaching your staff network.
Test each VLAN’s connectivity independently before combining changes — plug a laptop into an access port on each VLAN and confirm it receives the correct subnet via DHCP before moving on to firewall rules.
Watch the Video
Prefer watching? This tutorial covers the same steps.
A working example of configuring tagged VLANs on a MikroTik router, from interface setup to inter-VLAN routing.
Watch on YouTube →Frequently Asked Questions
Do I need a managed switch for VLANs to work?
Yes — an unmanaged switch can’t read or respect VLAN tags, so any switch between the router and your access ports needs to support 802.1Q tagging.
Can two VLANs communicate by default?
On MikroTik, VLAN interfaces are just separate Layer 3 interfaces — if both have IP addresses configured, the router will route between them unless you add explicit firewall rules to block that traffic.
Conclusion
This four-step pattern — VLAN interfaces, addressing, DHCP, and a trunk port to your switch — covers the vast majority of small-to-medium office VLAN setups on MikroTik.
Related Articles
