Manual

Recipe: putting limits on the guest network

Visitors get internet, but not your whole line and not your network.

The goal: guests can get online, cannot see each other or your equipment, and one person updating a games console does not flatten the office. The separation itself lives in Example: a guest network; this recipe is about the brake on it.

What you need

  • A network with VLANs and a guest VLAN, for instance the default row vlan20-guest.
  • Your real line speed in Mbit/s, up and down. Not the number on the brochure: measure it.
  • Some idea of how many guests at once, because that decides whether one shared limit is enough.

Step 1: separation first

  1. Mark the guest VLAN as Isolated. That produces a rule dropping new connections from guests to your other networks, with the internet as the exception.
  2. Leave Internet on. A guest network without internet has no reason to exist.
  3. Switch on Client isolation for the guest SSID so guests cannot see each other either. This is per SSID; wired ports in the guest VLAN are not covered by it.
  4. To shield the router itself as well, turn on Router manageable only from the management VLAN. WinBox and WebFig are then out of reach from the guest network.

Step 2: the bandwidth limit

This lives in the QoS / bandwidth section. In the wizard it is the Bandwidth (QoS) block, but that only asks for the method and the speeds. The per-network limit is in advanced mode.

  1. Set Method to anything other than Off. With the method off, no queues are generated at all, your per-network limits included. Fair share per host with CAKE is a good default for the whole network; Total limit if you only want a ceiling.
  2. Fill in Download and Upload at roughly 90 to 95 percent of your measured speed, so the router manages the queue instead of your ISP's modem.
  3. Add a row under Limits per host/network: Host or network 192.168.20.0/24, with the down and up speed guests may use together, and Priority 8.

That row becomes a simple queue with that network as its target. Worth knowing: it is one bucket for the whole range. Ten guests share those 20 Mbit/s between them, they do not get 20 each.

If you want a ceiling per guest rather than per network, set Method to Fair share per host with algorithm PCQ and fill in PCQ: max per host. That applies to everyone on the network though, not only to guests: the tool has no per-VLAN PCQ.

Step 3: DNS has to keep working

Without DNS the internet is broken, and that is the classic guest network mistake. In this configuration it works by itself, and it helps to know why:

  • The isolation rule sits in the forward chain and is about traffic through the router. A DNS query to the router itself is input traffic and is not touched by it.
  • The guest VLAN's DHCP server hands out that VLAN's router address as the DNS server by default.
  • If you turn on Router manageable only from the management VLAN, the tool explicitly writes rules that still allow DNS, DHCP and NTP from the LAN, and only then the drop. Management closed, DNS open.

The DNS server for DHCP clients field in the VLAN section applies to all VLANs together, not per VLAN. Put an external server there and your own networks get it too, losing the router's cache and filters.

Testing it

  1. Connect a laptop to the guest SSID and check that you get an address from 192.168.20.0/24.
  2. Run a speed test. It should land near your configured limit, not on your full line.
  3. Run a second test at the same time on another device in the same guest network. Together they should still reach that limit, not twice it.
  4. On the router, check /queue simple print stats to see the counter on the guest queue climb. If it stays at zero while traffic is flowing, another queue is catching that traffic first; the order in /queue simple decides which queue matches first, so move the guest row up.
  5. Ping a device on your own network from the guest laptop. That should fail.

What a limit does not fix

  • It does not protect your network. Speed and access are two different things. The isolation does that work, not the queue.
  • It does not share fairly among guests when you give a whole network as the target. One device with many connections can drain the bucket.
  • It does not filter content. To block ad and malware domains, turn on Adlist under DNS. It needs RouterOS 7.15 or later, and it does not stop DNS over HTTPS in browsers. The Force LAN clients through the router option redirects port 53, but that does not touch DoH either.
  • It costs throughput. As soon as QoS is active, the firewall switches FastTrack off, because fasttracked traffic bypasses queues. On a small router (hAP, hEX) that is noticeable in the top speed; the tool warns about it.
  • It does not do logins or vouchers. If guests should sign in on a portal with a limit per account, use the Hotspot / guest portal role, which has its own rate limit per user.

Related: QoS, Example: guest network and Hotspot.

Want to try it right away? Open the configurator