Over the past few weeks, I’ve rebuilt my home network from the ground up using MikroTik hardware, focusing on VLAN segmentation, improved wireless coverage, and simpler management. The new setup centers around a MikroTik hEX router, which now handles DHCP and routing duties, paired with a hAP ac² access point broadcasting multiple VLAN-tagged SSIDs.
After testing several placement options, I mounted the hAP ac² high on a wall, a change that significantly improved wireless signal strength throughout the house. The signal is now strong enough that I’ve been able to retire the older Cisco AP.
The current VLAN layout includes dedicated networks for primary household traffic, IoT devices, and guest access. This design helps isolate untrusted or low-security devices, reduces unnecessary broadcast traffic, and ensures all DNS queries are filtered through a local Pi-hole instance for ad-blocking and privacy protection. Functionally, it’s similar to my previous DD-WRT setup, but with VLANs, I now have a cleaner, more secure way to manage everything.
As a lighthearted touch, the guest network’s captive portal is themed around a fictional entity called The Eye, complete with a custom login screen, post-login landing page, and a set of “Immutable Decrees”, a playful warning to discourage bad behavior on the network.
Next Steps:
- Test the captive portal speeds and functionality on different devices and operating systems
- Refine firewall rules to tighten inter-VLAN segmentation
- Experiment with VPN options through the MikroTik router
This project has been a solid hands-on look at network architecture and MikroTik’s powerful RouterOS, and it’s laid a solid, flexible foundation for future enhancements.
