CAPsMAN by MikroTik

TL;DR ✨

After a long time, the author finally found something that fully occupied his mind for several days: the fairly old novelty called CAPsMAN from MikroTik.

In one phrase, CAPsMAN is a single place containing information about all the Wi-Fi access points spread throughout a company, from which they can be managed centrally.

From the archive

This article was first published on 2016-11-07. It is also a snapshot of its time, so some details and recommendations may no longer reflect the current situation.

After a long time, the author finally found something that fully occupied his mind for several days: the fairly old novelty called CAPsMAN from MikroTik.

In one phrase, CAPsMAN is a single place containing information about all the Wi-Fi access points spread throughout a company, from which they can be managed centrally.

✨ Theory:

When is such a solution useful?

✨ 📝 Model company:

A company has three buildings and wants Wi-Fi coverage everywhere, central administration and control of every access point, managed data flows, and protection of company assets from curious visitors.

✨ 📝 Model home:

A home has a garden, living room, toilet, and so on, all of which need Wi-Fi. Two TP-Link routers are enough in many respects, but CAPsMAN is an excellent “free” choice when separate networks are required for visitors, children, and the household, along with speed priorities and basic firewall rules.

What hardware can be used?

Almost anything made by MikroTik.

What does it cost?

Three hAP units for a home came to roughly CZK 1,800, while three TP-Link WR841N routers came to CZK 2,100.

What are the disadvantages?

Most MikroTik hardware uses integrated antennas, resulting in lower range and coverage. MikroTik's flexibility nevertheless makes it possible to connect, for example, two 5 dBi antennas to a card through pigtails, or simply buy hardware without integrated antennas. This solution is expensive for homes but cheap, and therefore attractive, for companies.

What is available on the market?

Dozens of vendors offered similar services. Cisco's solution had very good feedback and excellent management, but was a costly professional option, with a single AP starting at CZK 10,000 or more. At the cheaper SOHO end, Ubiquiti Networks presented itself as the Apple of radio manufacturers, emphasizing simplicity and attractive design. In the author's blunt assessment, Ubiquiti products suited people who did not understand networking and wanted everything to work with one click. That philosophy served ordinary users, but embarrassed him as a network engineer; asking more of Ubiquiti became genuinely painful, albeit attractively designed.

MikroTik filled the gap between professionalism and affordability.

✨ Practice:

The author demonstrated CAPsMAN's elegance using a home/SOHO deployment. Before starting, readers were directed to this video:

https://youtu.be/xVTsa59ijD4

For simplicity, the setup used two routers:

• router 1 - hAP - defined as the CAPsMAN AP
• router 2 - hAP - defined as CAP01

Configuration began with CAP01. After upgrading ROS, wlan1 and the Ethernet ports were placed in a bridge, a DHCP client was added to the bridge, and CAP was enabled in the wireless section.

CAP01 was finished. Cloning this configuration could produce even a hundred CAPs. Simple.

Next came the router acting as the CAPsMAN AP. Its incoming connectivity was defined on ether1, and a bridge was created containing all ports and wlan. The author named it LAN-Bridge, representing the internal home network.

An address was then assigned to the bridge, preferably through a DHCP client.

✨ Add NAT to LAN-Bridge

This ensured that every CAP0X was reachable from the internal network and could see the CAPsMAN AP.

✨ Enable the manager on the CAPsMAN AP

CAP also had to be enabled in the wireless section on the main router, the CAPsMAN AP.

Interfaces were then added under CAPsMAN/interfaces, where many detailed parameters—especially security—could be defined. This step was explained well in the linked video from minute 08.

The key point: the correct interfaces must be bridged together.

In the home example there were two routers: the CAPsMAN AP in the living room and CAP01 on the veranda. Both ran two Wi-Fi networks, ConnecticaPrivate and ConnecticaPublic. The CAPsMAN configuration was:

/caps-man interface
add arp=enabled configuration=Obyvak configuration.ssid=ConnecticaPrivate \
 disabled=no l2mtu=1600 mac-address=6C:3B:6B:68:E9:C5 master-interface=none \
 mtu=1500 name=Obyvak-Private radio-mac=6C:3B:6B:68:E9:C5 security=\
 ConnecticaPrivate
add arp=enabled configuration=Veranda configuration.ssid=ConnecticaPublic \
 disabled=no l2mtu=1600 mac-address=6E:3B:6B:68:E9:C5 master-interface=\
 Obyvak-Private mtu=1500 name=ObyvakPublic radio-mac=00:00:00:00:00:00 \
 security=ConnecticaPublic
add arp=enabled configuration=Obyvak configuration.ssid=ConnecticaPrivate \
 disabled=no l2mtu=1600 mac-address=6C:3B:6B:6A:BE:71 master-interface=none \
 mtu=1500 name=VerandaPrivate radio-mac=6C:3B:6B:6A:BE:71 security=\
 ConnecticaPrivate
add arp=enabled configuration=Veranda configuration.ssid=ConnecticaPublic \
 disabled=no l2mtu=1600 mac-address=6E:3B:6B:6A:BE:71 master-interface=\
 VerandaPrivate mtu=1500 name=Veranda-Public radio-mac=00:00:00:00:00:00 \
 security=ConnecticaPublic
/caps-man configuration
add country="czech republic" mode=ap name=Veranda rx-chains=0,1,2 ssid=veranda \
 tx-chains=0,1,2
add country="czech republic" mode=ap name=Obyvak rx-chains=0,1,2 ssid=obyvak \
 tx-chains=0,1,2

The bridge configuration was:

/interface bridge
add name=CAPsMAN-Bridge-Private protocol-mode=none
add name=CAPsMAN-Bridge-Public protocol-mode=none
add name=LAN-Bridge protocol-mode=none
/interface bridge port
add bridge=LAN-Bridge interface=wlan1
add bridge=LAN-Bridge interface=ether1
add bridge=LAN-Bridge interface=ether2
add bridge=LAN-Bridge interface=ether3
add bridge=LAN-Bridge interface=ether4
add bridge=CAPsMAN-Bridge-Private interface=Obyvak-Private
add bridge=CAPsMAN-Bridge-Private interface=VerandaPrivate
add bridge=CAPsMAN-Bridge-Public interface=ObyvakPublic
add bridge=CAPsMAN-Bridge-Public interface=Veranda-Public
/interface bridge port
add bridge=LAN-Bridge interface=wlan1
add bridge=LAN-Bridge interface=ether1
add bridge=LAN-Bridge interface=ether2
add bridge=LAN-Bridge interface=ether3
add bridge=LAN-Bridge interface=ether4
add bridge=CAPsMAN-Bridge-Private interface=Obyvak-Private
add bridge=CAPsMAN-Bridge-Private interface=VerandaPrivate
add bridge=CAPsMAN-Bridge-Public interface=ObyvakPublic
add bridge=CAPsMAN-Bridge-Public interface=Veranda-Public

This is one of the keys to CAPsMAN's logic: it is necessary to understand where each router is and what must run on it. In this simple home model, wherever the public Wi-Fi existed, a public bridge existed too.

The bridge-interface addresses still had to be configured:

NAT:

And DHCP servers:

That completed the setup. Finally, firewall rules could be added:

And simple queues configured:

CAPsMAN configuration grows more complex with the number of virtual APs and routers. Five machines with one AP and three VirtualAPs each produce a fairly complex structure of 20 interfaces, with a high risk of errors or omissions. Comments should be used wherever possible to make orientation faster.

The author would not call CAPsMAN completely simple to configure, but an experienced network engineer should manage it within a day or two.

✅ Conclusion:

CAPsMAN is not for everyone. It is an elegant tool likely to find a place in small and medium-sized companies, where its sophistication at a good price is attractive. At the time, readers wanting the author's company to integrate CAPsMAN could write to info@connectica.cz; prices ranged from CZK 1,000 to CZK 5,000 depending on complexity.

✨ 📝 Footnotes:

1. Before configuring all machines, upgrade to the latest ROS. This sounds trivial, but cost the author two days wondering why CAPsMAN did not work: MikroTik had two CAPsMAN versions.
2. The author could not get CAPsMAN running without NAT. He did not know why; perhaps it was simply his mistake, or the inevitable result of a day having only 24 hours.
3. When creating multiple SSIDs, do not use VirtualAP; use the CAPsMAN configuration instead.

[mailerlite_form form_id=3]