Six consulting rooms, an X-ray room, ultrasound, a small lab, a busy reception and a waiting room full of patients with phones. The clinic holds the most sensitive personal data there is, runs medical devices that can't be patched on your schedule, and can't stop seeing patients because the fibre is down. We build it on MikroTik from the rooms up in 11 tested steps.
Full network · all steps built
highlighted = lines added in the selected step · earlier steps shown plain · later steps hidden
This is part 5 of the Build series. The law firm had confidential files; a clinic has health data, which GDPR treats as a special category with stricter requirements. The supermarket had payment devices it couldn't trust; a clinic has medical devices it can't update, because their software is certified as part of the device. And unlike either, a clinic's network failing has a direct effect on patient care.
The design answer is the same pattern applied more strictly: put each category of device in its own small network, give each network exactly the paths it needs, keep the clinical work local so it doesn't depend on the internet, and make the internet itself redundant for the parts that live in the cloud.
wifi package (for per-device Wi-Fi keys in step 4)01
A fictional but typical private outpatient clinic: GPs and specialists, imaging on site, 20 staff, 150 patients a day.
The clinic has six consulting rooms, each with a PC and a desk phone, plus a treatment room where doctors use tablets. Reception has three desks that run the appointment system and the electronic health record (EHR), both cloud services. Imaging is a digital X-ray (detector plus acquisition workstation) and an ultrasound system, both sending images to a PACS (the image archive and viewer). The lab has two blood analyzers that send results to a LIS (lab information system) bridge, which forwards them to the EHR. There are six cameras, three printers, hosted VoIP, and a waiting room where patients expect Wi-Fi. One of the doctors is on call some nights and needs to look at images from home.
| Requirement | Where it comes from, and what it forces |
|---|---|
| R1 Health data | GDPR Art. 9 and 32: health data needs protection appropriate to the risk. Clinical systems are segmented from everything patients and visitors can reach, and access is logged. |
| R2 Unpatchable devices | X-ray, ultrasound and analyzers run vendor-certified software, often on old Windows versions, updated only by the vendor. They get a VLAN that reaches its servers and nothing else, ever. |
| R3 Imaging works offline | A doctor must see an X-ray seconds after it's taken, internet or not. So the PACS is local; the cloud only holds an archive copy. |
| R4 Reception never stops | The EHR and appointments are in the cloud. A 5G backup keeps reception, consulting rooms and phones online; patient Wi-Fi and big uploads stay off it. |
| R5 Voice and telemedicine | The phone is how patients reach the clinic, and video consultations are routine. Both are prioritised over everything else on the WAN. |
| R6 Lost tablets | Doctors' tablets get lost. Each has its own Wi-Fi key, so revoking one doesn't mean changing the password on every device. |
| R7 Vendor support | Imaging vendors need remote access for service. They get it only in agreed windows, from the device outwards, never through an open port. |
| R8 On-call | The on-call doctor views images from home through a VPN that reaches the PACS viewer and nothing else. |
02
Each of these trades a little convenience for something a clinic can't do without.
The X-ray, ultrasound and lab analyzers sit on a separate CRS326 with a 10G uplink, together with the PACS and NAS. Imaging studies are large (a CT-sized study can be hundreds of MB, even plain X-ray sets add up), so the 10G path between devices, router and PACS matters. Physically separating the device switch also means the people who service medical equipment can work on their switch without touching the one patients' and staff devices hang off.
Images go from the modality to the on-site PACS over DICOM, and doctors view them from there. A nightly encrypted copy goes to a cloud archive for retention and disaster recovery. The clinic's daily work never waits on the internet, and the archive copy means a burnt-out server closet doesn't lose years of patient images.
802.1X with a RADIUS server is the textbook answer for staff Wi-Fi, but it needs a server and a certificate setup that a 20-person clinic won't maintain. RouterOS 7's wifi access list can give each MAC address its own passphrase on the same SSID (sometimes called PPSK). A lost tablet's entry is deleted in seconds, and every other device keeps working.
Imaging vendors usually ask for "a port forward to the workstation". That would put an unpatchable Windows machine on the internet. Instead, the vendor's support agent on the workstation is allowed to connect out to the vendor's hub, and only while a scheduled firewall rule is enabled. No inbound port exists, ever.
03
Nine VLANs, 10.60.x.0/24, third octet = VLAN ID. Every device that a rule names has a reservation.
| VLAN · subnet | Who lives here · notes |
|---|---|
| 10 CLINICAL · 10.60.10.0/24 | Consulting-room PCs .21–.26, doctors' tablets .50+. EHR in the cloud, PACS viewer and LIS locally. |
| 20 RECEPTION · 10.60.20.0/24 | Reception PCs .21–.23, admin PC .31. EHR, appointments, PACS worklist UI. |
| 30 MEDDEV · 10.60.30.0/24 | X-ray workstation .11, detector .12, ultrasound .21, analyzers .41–.42. Static. No internet. |
| 35 SERVERS · 10.60.35.0/24 | PACS .10, LIS bridge .11, NAS .20. |
| 40 VOICE · 10.60.40.0/24 | Desk phones (voice VLAN behind the PCs), hosted PBX. |
| 45 PRINT · 10.60.45.0/24 | Three printers (prescriptions, labels, office). |
| 50 PATIENTS · 10.60.50.0/24 | Waiting-room Wi-Fi: internet only, client isolation, 10 Mb/s per device. |
| 60 CCTV · 10.60.60.0/24 | Six cameras and the NVR. Local only. |
| 99 MGMT · 10.60.99.0/24 | R1 .1, SW-CLINIC .11, SW-MED .12, APs .21–.23. WireGuard on-call: 10.60.200.0/24. |
04
Rows start, columns receive. Default deny. Medical devices have one green cell, and it's their server.
Read the Med devices row and column together: devices reach only the PACS/LIS, and only a scheduled vendor window reaches them. The On-call row is equally narrow: one port on one server, not "the clinic network over VPN".
04b
Every requirement from the brief, the steps that implement it, the config that does it, and the test that proves it.
| Requirement | Implemented in | Key config | Proven by |
|---|---|---|---|
| R1 Health data | step 4 · step 5 | per-device Wi-Fi keys; forward chain per VLAN; patients isolated | "Segmentation" drill, section 16 |
| R2 Unpatchable devices | step 2 · step 5 | learn=no + static hosts on SW-MED; DICOM/HL7-only rules; no internet for V30 | "Device isolation" drill |
| R3 Imaging works offline | step 2 · step 6 | local PACS on VLAN 35; 10G path; the archive is only a copy | "Imaging offline" drill |
| R4 Reception never stops | step 7 | recursive failover to 5G; NO5G list for patients and archive | "Fibre cut" drill |
| R5 Voice & telemedicine | step 8 | EF and clinical UDP in a priority-1 class with limit-at 20M | "Busy line" drill |
| R6 Lost tablets | step 4 | one wifi access-list entry per tablet, scoped to CLINIC-STAFF | "Lost tablet" drill |
| R7 Vendor support | step 9 | disabled rule + open/close schedules + connection flush | "Vendor window" drill |
| R8 On-call | step 10 | WireGuard peer per laptop; forward only to the PACS viewer | "On-call" drill |
The build
Rooms first, internet last. Every step ends with a checkpoint.
Eleven steps: the clinic switch, the medical switch with its devices and servers, the router, Wi-Fi, the firewall, imaging, the two WANs, voice-first queuing, the vendor window, on-call access, and finally backups with hardening. Use Safe Mode (Ctrl+X) for every bridge change on a remote device.
05 · Step 1 of 11
Consulting rooms, reception, printers and cameras on one PoE switch. Each desk carries a PC and, tagged, its phone.
▲ Show step 1 in the interactive topology · see what this step adds, and click any device for its config
/system identity set name=SW-CLINIC /interface bridge add name=bridge vlan-filtering=no /interface bridge port add bridge=bridge interface=ether24 frame-types=admit-only-vlan-tagged comment="uplink R1" add bridge=bridge interface=ether1 pvid=10 comment="consult room 1 (PC behind phone)" # … ether2-6 add bridge=bridge interface=ether7 pvid=20 comment="reception 1 (PC behind phone)" # … ether8-9 add bridge=bridge interface=ether10 pvid=45 comment="printer 1" # … ether11-12 add bridge=bridge interface=ether13 pvid=60 comment="camera 1" # … ether14-18 /interface bridge vlan add bridge=bridge vlan-ids=10,20,45,60 tagged=ether24 add bridge=bridge vlan-ids=40 tagged=ether24,ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9 add bridge=bridge vlan-ids=99 tagged=bridge,ether24 /ip neighbor discovery-settings set lldp-med-net-policy-vlan=40 # phones learn their voice VLAN /interface vlan add name=v99-mgmt interface=bridge vlan-id=99 /ip address add address=10.60.99.11/24 interface=v99-mgmt /ip route add gateway=10.60.99.1 /interface ethernet disable ether19,ether23 /interface bridge set bridge vlan-filtering=yes
Each desk port carries the PC untagged in its VLAN and the phone tagged in VLAN 40. The phone learns that through LLDP-MED, so no phone has to be configured by hand. Ports ether20–22 become AP trunks in step 4.
/interface bridge vlan print: 40 tagged on ether1–9, the other VLANs untagged where planned./interface ethernet poe print: phones and cameras powered.06 · Step 2 of 11
Imaging, lab and the servers they report to, on their own switch with a 10G uplink. Each device port accepts only that device.
▲ Show step 2 in the interactive topology · see what this step adds, and click any device for its config
! SW-MED — Catalyst 9200L-24T-4X: sticky MAC with "restrict", not "shutdown": ! an unknown device is dropped and logged, the modality is never err-disabled mid-exam interface range GigabitEthernet1/0/1 - 5 description MEDICAL DEVICES switchport mode access switchport access vlan 30 switchport port-security mac-address sticky switchport port-security violation restrict switchport port-security spanning-tree portfast spanning-tree bpduguard enable interface range GigabitEthernet1/0/23 - 24 description PACS + LIS / NAS switchport mode access switchport access vlan 35 interface TenGigabitEthernet1/1/1 description R1 (10G) switchport mode trunk switchport trunk allowed vlan 30,35,99
/system identity set name=SW-MED /interface bridge add name=bridge vlan-filtering=no /interface bridge port add bridge=bridge interface=sfp-sfpplus1 frame-types=admit-only-vlan-tagged comment="uplink R1 (10G)" add bridge=bridge interface=ether1 pvid=30 learn=no comment="X-ray workstation" add bridge=bridge interface=ether2 pvid=30 learn=no comment="X-ray detector" add bridge=bridge interface=ether3 pvid=30 learn=no comment="ultrasound" add bridge=bridge interface=ether4 pvid=30 learn=no comment="analyzer 1" add bridge=bridge interface=ether5 pvid=30 learn=no comment="analyzer 2" add bridge=bridge interface=ether23 pvid=35 comment="PACS + LIS server" add bridge=bridge interface=ether24 pvid=35 comment="NAS" # learning is off on device ports: only the device's own MAC may use each one /interface bridge host add bridge=bridge interface=ether1 mac-address=00:1E:8F:00:00:11 add bridge=bridge interface=ether2 mac-address=00:1E:8F:00:00:12 # … one static entry per medical device /interface bridge vlan add bridge=bridge vlan-ids=30,35 tagged=sfp-sfpplus1 add bridge=bridge vlan-ids=99 tagged=bridge,sfp-sfpplus1 /interface vlan add name=v99-mgmt interface=bridge vlan-id=99 /ip address add address=10.60.99.12/24 interface=v99-mgmt /ip route add gateway=10.60.99.1 /interface ethernet disable ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,\ ether16,ether17,ether18,ether19,ether20,ether21,ether22,sfp-sfpplus2 /interface bridge set bridge vlan-filtering=yes
Medical device vendors usually forbid changes on the device itself, including adding software, changing its firewall, sometimes even its IP address. That's why every control here lives in the network: static addressing set once by the vendor's engineer, a port that accepts only that device's MAC, and (step 5) a firewall that lets it reach only its server. Agree the addressing with the vendor before installation day; changing a modality's IP later can mean a paid service visit.
/interface bridge host print where !dynamic lists every device.07 · Step 3 of 11
An RB5009 joins both switches and becomes the gateway, DHCP server, resolver and clock for nine small networks.
▲ Show step 3 in the interactive topology · see what this step adds, and click any device for its config
/system identity set name=R1 /interface bridge add name=bridge vlan-filtering=no /interface bridge port add bridge=bridge interface=ether2 frame-types=admit-only-vlan-tagged comment="SW-CLINIC" add bridge=bridge interface=sfp-sfpplus1 frame-types=admit-only-vlan-tagged comment="SW-MED (10G)" /interface bridge vlan add bridge=bridge vlan-ids=10,20,40,45,50,60 tagged=bridge,ether2 add bridge=bridge vlan-ids=30,35 tagged=bridge,sfp-sfpplus1 add bridge=bridge vlan-ids=99 tagged=bridge,ether2,sfp-sfpplus1 /interface vlan add name=v10-clinical interface=bridge vlan-id=10 add name=v20-reception interface=bridge vlan-id=20 add name=v30-meddev interface=bridge vlan-id=30 add name=v35-srv interface=bridge vlan-id=35 add name=v40-voice interface=bridge vlan-id=40 add name=v45-print interface=bridge vlan-id=45 add name=v50-patients interface=bridge vlan-id=50 add name=v60-cctv interface=bridge vlan-id=60 add name=v99-mgmt interface=bridge vlan-id=99 /ip address add address=10.60.10.1/24 interface=v10-clinical # … .1 on every VLAN interface /ip dhcp-server add name=d-clinical interface=v10-clinical address-pool=p-clinical lease-time=1d add name=d-reception interface=v20-reception address-pool=p-reception lease-time=1d add name=d-voice interface=v40-voice address-pool=p-voice lease-time=1d add name=d-print interface=v45-print address-pool=static-only lease-time=1d add name=d-patients interface=v50-patients address-pool=p-patients lease-time=1h # MEDDEV, SERVERS and CCTV: static addresses, no DHCP server at all /ip dns set allow-remote-requests=yes servers=9.9.9.9,149.112.112.112 /system ntp client set enabled=yes servers=time.cloudflare.com /system ntp server set enabled=yes /interface bridge set bridge vlan-filtering=yes
R1 is also the clinic's time server. That matters more here than elsewhere: DICOM studies, lab results and EHR entries are timestamped by different machines, and a modality whose clock drifts by ten minutes produces records that don't line up. Every device, including the medical ones, is pointed at 10.60.x.1 for NTP.
08 · Step 4 of 11
One staff SSID where every tablet has its own key, and a patient SSID that reaches the internet and nothing else.
▲ Show step 4 in the interactive topology · see what this step adds, and click any device for its config
/interface wifi security add name=sec-staff authentication-types=wpa2-psk passphrase="unused-fallback-*****************" /interface wifi datapath add name=dp-staff bridge=bridge vlan-id=10 add name=dp-patients bridge=bridge vlan-id=50 client-isolation=yes /interface wifi configuration add name=cfg-staff ssid=CLINIC-STAFF security=sec-staff datapath=dp-staff country=Greece add name=cfg-patients ssid=CLINIC-Patients datapath=dp-patients country=Greece # each tablet: its own MAC, its own passphrase, on the staff SSID only /interface wifi access-list add ssid-regexp="^CLINIC-STAFF\$" mac-address=AA:BB:CC:00:10:01 passphrase="*****************" action=accept comment="tablet 01" add ssid-regexp="^CLINIC-STAFF\$" mac-address=AA:BB:CC:00:10:02 passphrase="*****************" action=accept comment="tablet 02" add ssid-regexp="^CLINIC-STAFF\$" action=reject comment="unknown device on the staff SSID" /interface wifi capsman set enabled=yes interfaces=v99-mgmt /interface wifi provisioning add action=create-dynamic-enabled master-configuration=cfg-patients \ slave-configurations=cfg-staff # patients: 10 Mb/s each, 100/20 in total /queue type add name=pcq-pt-down kind=pcq pcq-classifier=dst-address pcq-rate=10M add name=pcq-pt-up kind=pcq pcq-classifier=src-address pcq-rate=10M /queue simple add name=patients target=10.60.50.0/24 max-limit=20M/100M queue=pcq-pt-up/pcq-pt-down
The ssid-regexp on every entry is essential: the access list applies to all SSIDs, and without it the final reject would also block every patient. Tablets need a fixed MAC on this SSID (turn off MAC randomization for it in the device management profile), otherwise the access-list entry won't match. Per-device keys need WPA2-PSK. On SW-CLINIC, ether20–22 become AP trunks: management VLAN 99 untagged, VLANs 10 and 50 tagged.
09 · Step 5 of 11
Medical devices reach their servers on their protocols. Clinical PCs reach the viewers. Everyone else reaches only what the matrix says.
/ip firewall address-list
add list=PACS address=10.60.35.10
add list=LIS address=10.60.35.11
add list=NVR address=10.60.60.10
/interface list
add name=LAN
add name=WAN
add name=MGMT
add name=ONLINE comment="zones that may use the internet"
/interface list member
add list=ONLINE interface=v10-clinical
add list=ONLINE interface=v20-reception
add list=ONLINE interface=v40-voice
add list=ONLINE interface=v50-patients
add list=MGMT interface=v99-mgmt
# … every v* interface into LAN
/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked
add chain=input action=drop connection-state=invalid
add chain=input action=accept protocol=icmp
add chain=input action=accept in-interface-list=MGMT
add chain=input action=accept in-interface-list=LAN protocol=udp dst-port=53,67,123
add chain=input action=accept in-interface-list=LAN protocol=tcp dst-port=53
add chain=input action=drop log=yes log-prefix=IN-DROP
add chain=forward action=accept connection-state=established,related,untracked
add chain=forward action=drop connection-state=invalid
add chain=forward action=accept in-interface=v30-meddev dst-address-list=PACS protocol=tcp dst-port=104 \
comment="DICOM store + worklist"
add chain=forward action=accept in-interface=v30-meddev dst-address-list=LIS protocol=tcp dst-port=2575 \
comment="HL7 lab results"
add chain=forward action=accept in-interface=v10-clinical dst-address-list=PACS protocol=tcp dst-port=443 \
comment="PACS web viewer"
add chain=forward action=accept in-interface=v10-clinical dst-address-list=LIS protocol=tcp dst-port=443
add chain=forward action=accept in-interface=v20-reception dst-address-list=PACS protocol=tcp dst-port=443 \
comment="worklist UI"
add chain=forward action=accept in-interface=v20-reception dst-address-list=NVR protocol=tcp dst-port=443
add chain=forward action=accept in-interface=v10-clinical out-interface=v45-print protocol=tcp dst-port=9100
add chain=forward action=accept in-interface=v20-reception out-interface=v45-print protocol=tcp dst-port=9100
add chain=forward action=accept in-interface-list=ONLINE out-interface-list=WAN
add chain=forward action=accept in-interface-list=MGMT
add chain=forward action=drop log=yes log-prefix=FWD-DROPThe DICOM standard port is 104, but many PACS products listen on 11112 instead (104 is a privileged port on Linux), and some modalities use a second port for the worklist. Take the AE titles, IPs and ports from the PACS vendor's install sheet and write each one as its own rule from the specific modality's address. Watch /log print where message~"FWD-DROP" during the first study: a DICOM echo that times out almost always means a port the install sheet didn't mention.
10 · Step 6 of 11
An X-ray taken in room 7 should be on the screen in room 3 before the patient has walked back.
The path is entirely local: modality → SW-MED → 10G → R1 (one routing hop between VLAN 30 and 35) → back down the same 10G link → PACS. The doctor's viewer pulls the study from the PACS over HTTPS. A single X-ray study is a few tens of MB and moves in under a second; even a large ultrasound clip set doesn't strain a 10G uplink. The overnight archive copy (step 11) runs at 02:00, when nobody's waiting for images and the fibre is quiet.
| DICOM node | AE title · address · port (example) |
|---|---|
| PACS | CLINIC_PACS · 10.60.35.10 · 104 (store, query, worklist) |
| X-ray workstation | DR_ROOM7 · 10.60.30.11 · sends to CLINIC_PACS, queries the worklist |
| Ultrasound | US_ROOM8 · 10.60.30.21 · sends to CLINIC_PACS |
| LIS bridge | 10.60.35.11 · HL7 MLLP 2575 from the analyzers, HTTPS out to the EHR |
11 · Step 7 of 11
The EHR lives in the cloud, so reception's uptime is the internet's uptime. Two lines, recursive failover, and a backup reserved for patient care.
▲ Show step 7 in the interactive topology · see what this step adds, and click any device for its config
/ip address add address=203.0.113.50/29 interface=ether1 comment="fibre" /ip dhcp-client add interface=ether8 default-route-distance=2 use-peer-dns=no comment="5G passthrough" /interface list member add list=WAN interface=ether1 add list=WAN interface=ether8 /ip route add dst-address=1.1.1.1/32 gateway=203.0.113.49 scope=10 comment="probe via fibre" add dst-address=0.0.0.0/0 gateway=1.1.1.1 target-scope=11 check-gateway=ping distance=1 comment="main: fibre" /ip firewall nat add chain=srcnat action=masquerade out-interface-list=WAN # the 5G line is for patient care /interface list add name=NO5G /interface list member add list=NO5G interface=v50-patients add list=NO5G interface=v35-srv /ip firewall filter add chain=forward action=reject reject-with=icmp-network-unreachable \ in-interface-list=NO5G out-interface=ether8 place-before=0 comment="patients and archive uploads never use 5G" # the archive upload may leave via the fibre /ip firewall filter add chain=forward action=accept in-interface=v35-srv out-interface=ether1 protocol=tcp dst-port=443 \ place-before=[find log-prefix=FWD-DROP] comment="PACS/NAS archive to the cloud"
The pattern is the one from the coffee shop: recursive probe on the primary, a DHCP route at distance 2 on the backup, and whole zones rejected on the backup at the top of the forward chain. Here the rejected zones are the patients and the servers' archive traffic. An outage at 02:00 shouldn't push a night's worth of images over a metered 5G line; the PACS retries on the fibre once it's back.
12 · Step 8 of 11
A patient calling to cancel and a doctor on a video consultation must never stutter because the waiting room is streaming.
! R1 — C8200L: LLQ under a shaper on the fibre ip access-list extended TELEMED permit udp 10.60.10.0 0.0.0.255 any class-map match-any REALTIME match dscp ef match access-group name TELEMED policy-map WAN-CHILD class REALTIME priority 20000 class class-default fair-queue policy-map WAN-OUT class class-default shape average 95000000 service-policy WAN-CHILD interface GigabitEthernet0/0/0 service-policy output WAN-OUT
/ip firewall mangle
add chain=forward action=mark-packet new-packet-mark=rt-up out-interface=ether1 dscp=46 passthrough=no \
comment="phones mark EF"
add chain=forward action=mark-packet new-packet-mark=rt-up out-interface=ether1 in-interface=v10-clinical \
protocol=udp passthrough=no comment="video consultations (WebRTC/UDP)"
add chain=forward action=mark-packet new-packet-mark=bulk-up out-interface=ether1 passthrough=no
add chain=forward action=mark-packet new-packet-mark=rt-down in-interface=ether1 out-interface=v40-voice passthrough=no
add chain=forward action=mark-packet new-packet-mark=rt-down in-interface=ether1 out-interface=v10-clinical \
protocol=udp passthrough=no
add chain=forward action=mark-packet new-packet-mark=bulk-down in-interface=ether1 passthrough=no
/queue type add name=fq kind=fq-codel
/queue tree
add name=UP parent=ether1 max-limit=95M
add name=up-rt parent=UP packet-mark=rt-up priority=1 limit-at=20M max-limit=95M queue=fq
add name=up-bulk parent=UP packet-mark=bulk-up priority=8 max-limit=95M queue=fq
add name=DOWN parent=global max-limit=475M
add name=down-rt parent=DOWN packet-mark=rt-down priority=1 limit-at=20M max-limit=475M queue=fq
add name=down-bulk parent=DOWN packet-mark=bulk-down priority=8 max-limit=475M queue=fqThe phones mark their packets EF themselves. Video consultations from the clinical VLAN are WebRTC over UDP, so "UDP from a clinical PC" is a good enough match for this network. limit-at=20M guarantees real-time traffic its share even if bulk traffic was there first, and shaping 5% under the line rate keeps the queue in R1, where it can be managed. As in the gaming center, there's no FastTrack rule, because fast-tracked packets skip the queue tree.
/queue tree print stats: drops in the bulk queues, none in the real-time queues.13 · Step 9 of 11
The X-ray vendor's engineer gets Wednesday afternoons, through the device's own outbound support agent, and nothing at any other time.
! R1 — a time-range on the inbound ACL of the device subinterface. ! A stateless ACL is checked on every packet, so the session stops at 17:00 by itself. time-range VENDOR-XRAY periodic Wednesday 14:00 to 17:00 object-group network VENDOR-HUB 203.0.113.200 255.255.255.255 ip access-list extended MEDDEV-IN 25 permit tcp host 10.60.30.11 object-group VENDOR-HUB eq 443 time-range VENDOR-XRAY log
/ip firewall address-list
add list=VENDOR-HUB address=support.vendor.example comment="from the vendor's remote-service guide"
/ip firewall filter add chain=forward action=accept src-address=10.60.30.11 dst-address-list=VENDOR-HUB \
protocol=tcp dst-port=443 log=yes log-prefix=VENDOR disabled=yes comment=VENDOR-XRAY \
place-before=[find log-prefix=FWD-DROP]
/system scheduler
add name=vx-open start-date=2026-11-04 start-time=14:00:00 interval=7d on-event={
/ip firewall filter enable [find comment=VENDOR-XRAY]
:log warning "vendor window OPEN (X-ray)"
}
add name=vx-close start-date=2026-11-04 start-time=17:00:00 interval=7d on-event={
/ip firewall filter disable [find comment=VENDOR-XRAY]
/ip firewall connection remove [find src-address~"^10.60.30.11:"]
:log warning "vendor window CLOSED (X-ray)"
}Closing the window takes two actions: disabling the rule stops new connections, and removing the workstation's tracked connections ends the one already open (otherwise the established/related accept would keep an engineer's session alive past 17:00). For an emergency call-out, the practice manager asks the IT contractor to run vx-open by hand, and the warning log lines on the monitoring box record when it happened.
14 · Step 10 of 11
A WireGuard tunnel to one port on one server: the PACS viewer.
▲ Show step 10 in the interactive topology · see what this step adds, and click any device for its config
/interface wireguard add name=wg-oncall listen-port=13231
/interface wireguard peers add interface=wg-oncall public-key="<on-call laptop public key>" \
allowed-address=10.60.200.2/32 comment="on-call laptop 1"
/ip address add address=10.60.200.1/24 interface=wg-oncall
/ip firewall filter
add chain=input action=accept in-interface=ether1 protocol=udp dst-port=13231 \
place-before=[find log-prefix=IN-DROP] comment="WireGuard on the fibre address"
add chain=forward action=accept in-interface=wg-oncall dst-address-list=PACS protocol=tcp dst-port=443 \
place-before=[find log-prefix=FWD-DROP] comment="on-call: PACS viewer only"The tunnel proves the laptop's identity (each laptop has its own key, removed if the laptop is lost); the PACS viewer still requires the doctor's own login with MFA, so a stolen laptop alone isn't enough. The tunnel listens only on the fibre's static address. During a fibre outage the 5G line is behind carrier NAT and can't accept connections, so on-call viewing pauses. If that's not acceptable, use the dial-out hub design from the coffee shop.
15 · Step 11 of 11
Patient images and records must survive ransomware, theft and fire. The network's part is making sure the backups are unreachable from everything a user touches.
| What | Where it goes · how |
|---|---|
| PACS images | Nightly encrypted copy to the cloud archive (step 7 rule, 443, fibre only). Object lock on the archive bucket. |
| PACS + LIS databases | The NAS pulls them hourly from VLAN 35 with a read-only service account; it then pushes a nightly encrypted copy to an immutable cloud bucket. |
| Router + switch configs | Each device runs a nightly /export and uploads it to the NAS with /tool fetch over SFTP. The devices start the connection, so the NAS never needs a path into the MGMT VLAN. |
| The EHR | Backed up by the EHR provider; check the contract states retention and restore time. |
No clinical, reception, patient or medical-device VLAN has any rule allowing traffic to the NAS (10.60.35.20). The NAS reaches out; nothing reaches in except management. Hardening is the same baseline as in the other MikroTik builds: management services only from the MGMT list, MAC-Winbox and neighbour discovery limited to MGMT, the default admin account disabled, DHCP snooping on both switches with the uplinks trusted, and remote logging to the monitoring box (see hardening and backups).
16
Each drill maps to a requirement. Keep the results: they belong in the clinic's GDPR record of technical measures.
| Drill (requirement) | What must happen |
|---|---|
| Segmentation (R1) | From the patient Wi-Fi, a scan of 10.60.0.0/16 finds only 10.60.50.1. From reception, only the PACS viewer, NVR, printers and the gateway answer. |
| Device isolation (R2) | From the X-ray workstation, everything except the PACS on its DICOM port and R1's DNS/NTP is unreachable, including the internet. |
| Imaging offline (R3) | With both WAN cables unplugged, an X-ray reaches a consulting room's viewer within seconds. |
| Fibre cut (R4) | Reception, EHR and phones continue over 5G in ~15–20 s; patients are refused; the archive waits. |
| Busy line (R5) | A saturating upload plus streaming doesn't degrade a test call or video consultation. |
| Lost tablet (R6) | Deleting one access-list entry disconnects only that tablet. |
| Vendor window (R7) | The support agent connects only inside the scheduled window; the log records open and close. |
| On-call (R8) | The tunnel reaches the PACS viewer and nothing else. |
17
What the network can't fix on its own, and what covers each gap.
18
Everything except the radios and PoE runs on free CHR images.
| This post | In the lab |
|---|---|
| R1 RB5009 | A CHR with two WAN interfaces (two upstream CHRs as ISPs), one trunk to each "switch". Firewall, failover, queues, schedulers and WireGuard all work. |
| SW-CLINIC / SW-MED | CHR bridges with VLAN filtering; the learn=no + static host trick works on a software bridge too. |
| PACS and modalities | An Orthanc container as the PACS, and the dcmtk tools (echoscu, storescu) on a Linux VM in VLAN 30 as the "modality" for testing the DICOM rules. |
| Wi-Fi | Skip it, or place VMs in VLANs 10 and 50. |
19
Indicative EU street prices, late 2026, excluding VAT. The PACS, LIS and medical devices come from their vendors.
| Item | Indicative (EUR, ex VAT) |
|---|---|
| R1 · RB5009UG+S+IN | 200 – 240 |
| SW-CLINIC · CRS328-24P-4S+ | 420 – 520 |
| SW-MED · CRS326-24G-2S+ | 180 – 230 |
| 2× 10G DAC / SFP+ modules | 40 – 80 |
| 3× cAP ax | 300 – 380 |
| 5G router (passthrough) + business SIM | 300 – 450, plus ~20–30/month |
| NAS (4-bay) + disks | 900 – 1,500 |
| UPS for the server closet | 400 – 700 |
| Network + backup total | ≈ 2,700 – 4,100, plus ~40 cable runs |
Appendix
Same clinic, same VLANs and matrix on Catalyst switches and a branch router. The Cisco tabs on the config blocks above show the key steps side by side; this appendix covers what changes underneath.
| Role | This post → Cisco |
|---|---|
| R1 | RB5009 → C8200L-1N-4T (router-on-a-stick to both switches) |
| SW-CLINIC (PoE) | CRS328-24P-4S+ → Catalyst 9200L-24P-4G |
| SW-MED (10G uplink) | CRS326-24G-2S+ → Catalyst 9200L-24T-4X |
| Wi-Fi | 3× cAP ax + CAPsMAN → 3× C9115AXI with the embedded controller |
| Indicative total (network only) | ≈ 1,400 – 1,900 → ≈ 8,000 – 11,000 EUR ex VAT |
| Feature | This post → Cisco |
|---|---|
| Device port lock | learn=no + static host → sticky MAC with violation restrict |
| Per-device Wi-Fi keys | wifi access list → Identity PSK on the controller, which needs a RADIUS server |
| Inter-VLAN policy | stateful forward chain → ACLs per subinterface, or ZBF for stateful inspection |
| Vendor window | disabled rule + scheduler + flush → time-range on the ACL |
| Voice / telemedicine | mangle + queue tree → LLQ under a shaper |
| Failover | recursive routes → IP SLA + track |
| On-call access | WireGuard → IKEv2 remote access (FlexVPN), as in the law-firm build |
Per-device Wi-Fi keys need a server on Cisco. Identity PSK works the same way for the user, but the controller asks a RADIUS server for each tablet's key, which is the server this design avoided. The vendor window is simpler: a time-range on a stateless ACL ends the session at closing time without any flush. Medical ports use "restrict" so an unknown device is logged and dropped without taking a modality offline.
The rest translates one to one. The cost difference is about five to six times for the network hardware.
Takeaways
This is part 5 of the Build series. Earlier: the law firm, the gaming center, the coffee shop, the supermarket. Next: the holiday villa.
I design and build clinic networks like this one: medical devices isolated the way vendors can live with, imaging that never waits on the internet, and documentation you can put in your GDPR records.
Book a Discovery Call →