Mikrotik for Office Networks: Setup from Scratch

Why Mikrotik for Indonesian SMBs#

• Hardware locally available with plenty of resellers.
• RouterOS has all enterprise features (VLAN, BGP, MPLS, IPSec) under $300 for SMB-tier (RB5009, CCR2004).
• WinBox + WebFig + REST API — fits any admin workflow.
• Big Indonesian community — abundant tutorials and skilled technicians.

Standard setup for a 10–100 person office#

1. VLAN segmentation#

At minimum 3 VLANs:

• VLAN 10 — Office (employee laptops/desktops)
• VLAN 20 — Servers (NAS, internal apps)
• VLAN 30 — Guest WiFi (isolated from Office)

Firewall rules: Office can reach Servers, not Guest. Guest can’t reach Office or Servers — only the internet.

2. Dual-WAN failover#

Two ISPs (e.g. Telkom Astinet + Biznet) for high uptime:

/ip route add gateway=10.1.1.1 distance=1 check-gateway=ping
/ip route add gateway=10.2.1.1 distance=2 check-gateway=ping

Or use Mangle + Recursive Routing for load-balanced traffic.

3. Traffic shaping#

Prioritize VoIP and video calls (Zoom, Google Meet) over downloads:

/queue tree add name=voip parent=global priority=1 limit-at=2M max-limit=10M

Or use PCQ for fair bandwidth sharing across users.

4. VPN to remote office / WFH users#

L2TP/IPSec or WireGuard. Mikrotik 7.x supports WireGuard natively now — better performance than L2TP.

5. Firewall hardening#

/ip firewall filter
add chain=input action=drop in-interface-list=WAN
add chain=input action=accept connection-state=established,related
add chain=input action=accept src-address-list=allowed-management

Make sure WinBox / SSH don’t listen on the WAN interface.

Maintenance routine#

• Monthly RouterOS updates (security patches).
• Weekly config backup: /system backup save name=config-{date}.
• Uplink monitoring via SNMP + LibreNMS / Grafana.

Audit your office network — our team can visit on-site to set up or review.