Providing secure internet access for office visitors, cafe customers, or friends on your home network is of the utmost importance. By granting guests access to your main LAN segment, you risk the integrity of your data, printers, and NAS storage. MikroTik RouterOS provides powerful tools to solve this problem, allowing you to create a completely isolated environment in minutes.
Unlike simple home routers, where the guest network is often just a copy of the main one with a different password, the equipment MikroTik Allows flexible traffic management. You can limit speeds, block access to local resources, set session timers, and even redirect users to the login page. This turns your router into a fully-fledged enterprise-grade access point.
In this article, we will look at two main approaches: creating a simple isolated access point and deploying a full-fledged HotSpot with authorization. Both methods are effective, but the choice depends on your specific security and user experience needs. We'll cover interface settings, firewall rules, and the intricacies of working with a DHCP server.
Network architecture planning and preparation
Before making any configuration changes to a running router, it's important to clearly understand the logical structure of the future network. The guest segment should be separated from the main one. LAN At the IP addressing level. Guests are typically assigned a separate subnet, for example, 192.168.88.0/24, if the main network uses 192.168.1.0/24. This segmentation simplifies the creation of traffic filtering rules.
It's important to consider the capabilities of your hardware. Older models with limited RAM may not be able to handle heavy authorization scripts or complex rules. NAT with a large number of simultaneous connections. For small offices or apartments, any will do. MikroTik, but for public hotspots it is better to use devices of the series hAP ac or RB750Gr3 and above.
It's also worth deciding on the access policy in advance. Will it be open Wi-Fi, a network with a shared password (WPA2), or a system requiring SMS/voucher code entry? This will determine the implementation method you choose: simple Bridge with limitations or a full-fledged server HotSpot.
⚠️ Important: Before beginning setup, ensure you have physical or wired access to the router. Errors in firewall rules may block your access to the control device.
Creating an isolated interface and DHCP server
The first step is to create a logical separation. In MikroTik, this is often accomplished by creating a new Bridge interface for the guest network. Go to the menu Bridge and create a new bridge, naming it, for example, bridge-guestA physical port (if a separate cable is used) or a virtual interface must be added to this bridge. WLAN, which will broadcast the guest network.
Next, you need to assign IP addressing. Go to the section IP → Addresses and add a new address for the created bridge. For example, 192.168.88.1/24This is the gateway address for all guest devices. After this, you need to configure the DHCP server so that clients automatically receive IP addresses. In the menu IP → DHCP Server Run the setup wizard or create a server manually, specifying the address pool (Pool) and gateway.
Don't forget to configure the wireless interface itself. In the section Wireless create a new access point or edit an existing one by changing SSID with a recognizable name (for example, "Guest_WiFi") and setting the security mode WPA2 PSKThe key point here is to bind this WLAN interface specifically to the guest bridge. bridge-guest, and not to the main one.
☑️ Checking the basic settings
Setting up Firewall rules to isolate your network
The most critical step is ensuring security. By default, devices can see each other even on different subnets. To prevent guests from accessing your personal files, you need to create rules in FirewallGo to . IP → Firewall → Filter Rules and add a new rule to the chain forward.
The rule should deny traffic from the guest network (Src. Address: 192.168.88.0/24) to the main local network (Dst. Address: 192.168.1.0/24). It's important to place this rule above the rules allowing internet access. It's also worth denying access to the router itself (Dst. Address: router address) to prevent guests from trying to brute-force the administrator password.
To implement Internet access, a rule is required NAT. In the section IP → Firewall → NAT Create a rule that will mask traffic from the guest subnet under the router's external IP address. Action should be masquerade, and in the Out. Interface field, specify your WAN port (for example, ether1).
| Rule parameter | Significance for the guest network | Description |
|---|---|---|
| Chain | forward | Processing chain for passing traffic |
| Src. Address | 192.168.88.0/24 | Guest address range |
| Dst. Address | 192.168.1.0/24 | Protected core network |
| Action | drop | Connection blocking |
Why is the order of rules important?
MikroTik rules are processed from top to bottom. If an "Allow all" rule is placed above a "Deny LAN access" rule, the block will not be applied. Always place specific blocks above general allow blocks.
HotSpot implementation with portal authorization
For a more advanced scenario, such as in a cafe or hotel, a mechanism is ideal HotSpotIt intercepts all user HTTP requests and redirects them to the authorization page. To configure it, go to the menu IP → HotSpot and start the server. Select the interface on which the hotspot will operate (your guest bridge or WLAN).
The system will prompt you to configure the address space and address pool. Pay special attention to the user profile. You can set limits in the profile: for example, rate-limit to limit the speed (download/upload) and uptime-limit To limit session time. This will prevent a single user from clogging up the entire channel with torrents.
The login page can be customized. Template files are located in the router's file system. You can replace the standard MikroTik logo with your company logo and add welcome text. For the portal to work, the router must be properly configured. DNS, since the redirection works by substituting DNS responses.
Speed limiting and traffic management
Bandwidth control is a mandatory element of guest access. Without restrictions, one active user could completely exhaust the bandwidth, leaving the rest of the office without internet. MikroTik implements this through Simple QueuesGo to . Queues → Simple Queues and create a new queue.
In the field Target Specify the guest subnet address (192.168.88.0/24). In the fields Max Limit Set your desired values for Download and Upload. For example, 10M/5M will provide comfortable surfing but won't allow you to download large files at high speeds. If you use HotSpot, similar settings can be applied in the user profile, which will apply individually to each connected device.
For more fine-tuning you can use PCQ (Per Connection Queue)to dynamically distribute the bandwidth equally among users. However, for most guest Wi-Fi use cases, a simple subnet-wide queue or limits in the HotSpot profile are sufficient.
⚠️ Note: Interfaces and menu layout may vary slightly depending on the RouterOS version (v6 or v7) and device type (ARM, MIPSBE, Tile). Always consult the official documentation for your specific model.
Diagnostics and connection monitoring
After setting up, you need to make sure that everything works correctly. In the section Wireless You can see a list of connected clients (Registration Table). For HotSpot, active sessions are displayed in IP → HotSpot → ActiveHere you can see who is authorized, how much traffic has been used, and how long the session lasts.
For in-depth diagnostics, use the built-in packet sniffer. Torch (Tools → Torch). Select the guest interface and monitor the traffic in real time. This will help you understand if anyone is trying to bypass restrictions or scan ports. It's also helpful to enable logging (System → Logging) to track authorization events.
Check your CPU usage regularly (ResourcesIf the CPU load reaches 100% when guests connect, it's possible that your firewall rules aren't configured optimally or your bandwidth is overloaded. In such cases, it's worth reviewing the complexity of the rules or upgrading your hardware.
Is it possible to create a guest network without creating a separate VLAN?
Yes, you can. Simply create a separate Bridge and assign it a different IP subnet. However, using VLANs (802.1Q) is considered best practice, as it provides isolation at the Ethernet frame level, which is more secure and professional.
How do I restore access if I've blocked myself with firewall rules?
If you don't have physical access to the console, try connecting via Safe Mode in WinBox before applying the rules. If Safe Mode wasn't enabled, the only solution is to reset the configuration using the Reset button on the router (usually by holding it down while turning it on).
Does guest Wi-Fi work on all MikroTik models?
Basic functionality is available on all devices. However, creating complex login portals with heavy scripting may not be possible on older or low-end models with limited memory (less than 32 MB of RAM).