Just copy the script to winbox scripts, enable safe mode, then run the script and wait for a few seconds. For SMIPS architecture running version 7.22 MikroTik RouterOS
:log info “VLAN SCRIPT: Starting…”
:delay 1s
/interface vlan add name=vlan20-iot interface=bridge vlan-id=20
:log info “VLAN SCRIPT: vlan interface added”
:delay 1s
/ip address add address=192.168.20.1/24 interface=vlan20-iot
:log info “VLAN SCRIPT: vlan ip address added”
:delay 1s
/ip pool add name=pool-iot ranges=192.168.20.10-192.168.20.200
:log info “VLAN SCRIPT: vlan ip pool added”
:delay 1s
/ip dhcp-server add name=dhcp-iot interface=vlan20-iot address-pool=pool-iot lease-time=1d
:log info “VLAN SCRIPT: vlan dhcp server added”
:delay 1s
/ip dhcp-server network add address=192.168.20.0/24 gateway=192.168.20.1 dns-server=1.1.1.1,8.8.8.8
:log info “VLAN SCRIPT: vlan dhcp server network added”
:delay 1s
/interface bridge vlan add bridge=bridge vlan-ids=20 tagged=bridge
:log info “VLAN SCRIPT: vlan bridge added”
:delay 1s
/interface wireless security-profiles add name=sec-iot mode=dynamic-keys authentication-types=wpa2-psk wpa2-pre-shared-key=password1 unicast-ciphers=aes-ccm group-ciphers=aes-ccm
:log info “VLAN SCRIPT: vlan wireless security profile added”
:delay 1s
/interface wireless add name=wifi-iot master-interface=wlan1 ssid=”IoT-Devices” mode=ap-bridge security-profile=sec-iot disabled=no
:log info “VLAN SCRIPT: vlan ssid added”
:delay 1s
/interface bridge port add bridge=bridge interface=wifi-iot pvid=20
:log info “VLAN SCRIPT: vlan bridge port added”
:delay 1s
/interface bridge vlan set [find where bridge=bridge and vlan-ids=20] untagged=wifi-iot tagged=bridge
:log info “VLAN SCRIPT: vlan bridge edited”
:delay 1s
/interface bridge set bridge vlan-filtering=yes
:log info “VLAN SCRIPT: vlan filtering enabled”
:delay 1s
/interface list add name=IOT
:log info “VLAN SCRIPT: vlan list added”
:delay 1s
/interface list member add list=IOT interface=vlan20-iot
:log info “VLAN SCRIPT: vlan interface added to list”
:delay 1s
/ip firewall filter add chain=forward action=drop in-interface-list=IOT out-interface-list=LAN comment=”Block IoT to LAN”
/ip firewall filter add chain=forward action=drop in-interface-list=LAN out-interface-list=IOT comment=”Block LAN to IoT”
/ip firewall filter add chain=forward action=accept in-interface-list=IOT out-interface-list=WAN protocol=tcp dst-port=53,80,443 comment=”IOT to WAN (TCP DNS/HTTP/HTTPS)”
/ip firewall filter add chain=forward action=accept in-interface-list=IOT out-interface-list=WAN protocol=udp dst-port=53,443 comment=”IOT to WAN (UDP DNS/QUIC)”
:log info “VLAN SCRIPT: vlan firewall added”
:delay 1s
/interface wireless set [find where name=wifi-iot] default-forwarding=no
:log info “VLAN SCRIPT: vlan wifi isolation enabled”
:delay 1s
:log info “VLAN SCRIPT: Successful”