MikroTik segmented network + firewall hardening
Turned a flat small-business and homelab network into isolated trust zones with a default-deny firewall and WireGuard administration.
- Role
- Network engineer (demo)
- Timeline
- 3-week hardening sprint (demo)
- Stack
- MikroTik RouterOS · VLANs · WireGuard · Linux · DNS filtering · Syslog
Demo case study — figures illustrative; client redacted.
What was broken
A growing office and homelab shared one flat LAN: workstations, guest devices, cameras, lab services, and router administration could all reach each other. Remote maintenance depended on exposed management access, and there was no reliable record of what the firewall allowed.
How it was fixed
Mapped device flows first, then split the network into trusted, guest, IoT, and lab VLANs. Rebuilt the RouterOS policy around default-deny inter-VLAN rules, limited management to the trusted zone and WireGuard, added explicit DNS and NTP paths, and shipped configuration exports plus a tested rollback procedure before the final cutover.
Constraints
- Cut over active devices without replacing the existing MikroTik hardware.
- Retain local recovery when remote administration is unavailable.
- Document every allowed cross-zone flow and its reason.
Tools in the system
- MikroTik RouterOS
- VLANs
- WireGuard
- Linux
- DNS filtering
- Syslog
What changed
Reduced the blast radius between device classes, removed direct internet exposure from administration, and made every permitted cross-zone flow explicit. (Figures illustrative — demo case study.)
What carries forward
- 01Inventory traffic before writing rules; segmentation fails when undocumented dependencies are discovered during cutover.
- 02Default-deny works only when accepted flows are named, logged, and owned instead of hidden in broad exceptions.
- 03A rollback export and local recovery path are mandatory before changing the network that carries remote access.