Setting Up a MikroTik as a Wi-Fi Access Point: A Complete Guide

Router transformation MikroTik Turning a router into a full-fledged access point is one of the most common tasks faced by system administrators and advanced users. It often happens that the main router already performs routing functions, but its wireless coverage is insufficient for a large office or multi-story building. In such a situation, the use of specialized equipment MikroTik When paired with a primary gateway, it becomes an ideal solution for expanding coverage without sacrificing performance.

The main advantage of this procedure is the flexibility of radio channel configuration. Unlike consumer devices, where capabilities are often limited to simple channel selection, RouterOS Allows fine-grained control over signal strength, channel width, and security protocols. This is especially relevant in densely populated areas where the airwaves are clogged with neighboring networks and where careful engineering setup is required to ensure stable client operation.

In this article, we'll walk you through the hardware configuration process from scratch, focusing on security and wireless connection optimization. You'll learn how to properly reset your device, configure a bridge for transparent traffic flow, and protect your network from unauthorized access. A critical step is to choose the correct frequency range (2.4 GHz or 5 GHz) depending on the physical characteristics of the room and the presence of interference.

Preparing hardware and resetting the configuration

Before beginning any work with network equipment, ensure you have physical access to the device and Ethernet cable. If the device has been used previously, it may still have old settings that will conflict with the new network setup. To get started, connect your computer to any LAN port. MikroTik Using a patch cord. Make sure your PC's network card is set to obtain an IP address automatically, as the router assigns addresses via DHCP by default.

The most reliable way to start from scratch is to perform a full reset (Reset Configuration). On most models MikroTik there is a button Reset or RESThe reset process may vary depending on the model, but the classic algorithm is universal: with the power off, hold down the button, apply power, and hold the button until the indicator light flashes. ACT or USRAfter this, the device will reboot with factory settings.

⚠️ Attention: After the reset, all passwords, including access to WinBox and the web interface, will be deleted. The default login admin, and the password field remains blank. Don't leave a device with a blank password on an open network, even for a second.

For initial setup, it is most convenient to use the utility WinBox, which can be downloaded from the manufacturer's official website. It allows you to connect to the device even without a configured IP address, using the MAC address. Open the program and go to the tab Neighbors, find your device by MAC address and click ConnectIf the connection is successfully established, you will see a welcome window with the current version. RouterOS.

Basic interface setup and bridge creation

The logic of the access point operation in the environment MikroTik This means that the wireless interface and the wired port through which the internet comes must be in the same broadcast domain. To do this, a virtual switch, or Bridge, is created. Go to the menu Bridge and create a new bridge, naming it, for example, bridge-localThis action will combine the logical ports into a single network.

The next step is to add ports to the created bridge. Tab Ports Within the Bridge menu, you can select physical interfaces. You need to add a port. ether1 (or the one where the cable from the main router will be plugged in) and the wireless interface wlan1 (or wifi1 (in new models). After both interfaces are added to the bridge's port list, traffic between them will begin to flow at the second layer of the OSI model.

Now you need to configure IP addressing. Go to the menu IP -> Addresses and add a new address. If there is a primary DHCP server on the network, select the option to obtain the address automatically by going to IP -> DHCP Client and running the client on the interface bridge-localIf you prefer a static IP, enter the address from the main router's subnet to enable future access point management.

Wi-Fi wireless interface configuration

Configuring the radio module is the heart of access point configuration. Go to the menu Wireless (or WiFi (for new AX chips). Double-click on your card's interface to open its properties. On the first tab Wireless make sure that the operating mode (Mode) is set to the value ap bridgeThis mode allows the device to accept connections from clients and transmit them to the wired network.

In the field SSID Enter the name of your network that users will see. This name should be clear and unique so as not to conflict with neighboring networks. Pay special attention to the frequency selection (Frequency). In the 2.4 GHz band, it is recommended to use channels 1, 6, or 11, as they do not overlap. For the 5 GHz band, there is a wider choice, and it is better to use the scan or a built-in tool Frequency Usage to find the least loaded channel.

It is important to set the channel width (Channel Width). For 2.4 GHz the standard is 20mhz, which provides better range and less interference. Installation 40mhz In this range, it often leads to unstable operation in apartment buildings. For 5 GHz, you can safely choose 40mhz, 80mhz or even 160mhz, if the airwaves noise level and supporting clients allow it.

Setting up WPA2 security and encryption

Wireless network security is a top priority. Never leave a hotspot open or with outdated encryption. WEPIn the wireless interface properties, go to the tab Security ProfileClick the button to add a profile or edit an existing one. defaultIn the field Mode choose dynamic keys or, more reliably for static settings, use the mode dynamic keys with checkboxes enabled WPA2 PSK.

In the field WPA2 Pre-Shared Key Set a complex password. It must contain at least 12 characters, including mixed-case letters, numbers, and special characters. RouterOS supports various encryption algorithms, but for maximum compatibility with all devices (from smartphones to IoT gadgets), it is recommended to use a combination TKIP And AES CCMP, although in modern conditions it is clean AES CCMP is the de facto standard.

⚠️ Attention: Wi-Fi interfaces are sensitive to overheating. If you're setting up an access point in a closed metal enclosure or in direct sunlight, make sure the equipment model is rated for these temperatures, otherwise constant reboots may occur.

After entering the password, click Apply And OK. Make sure that in the main wireless interface window, in the field Security Profile the profile you created is selected. Also, make sure the checkbox is checked. Enable active. If everything is done correctly, the wireless network indicator on the device should light up, and clients will be able to connect by entering the specified password.

Signal optimization and client management

After the basic setup, it's time to fine-tune the settings to improve service quality. In the menu Wireless table available Registration Table, where all connected clients are displayed. Here you can see the signal strength (Signal Strength) of each device. If the signal is too weak (below -75 dBm), consider moving the access point or installing a repeater.

To control the load, you can use the function Access ListIt allows you to create rules that deny or allow connections to specific devices based on their MAC address. This is useful if you want to restrict access to trusted devices, creating a kind of "whitelist." You can also prioritize traffic for critical clients.

What is the 802.11r protocol?

The 802.11r (Fast BSS Transition) protocol allows client devices to quickly switch between access points on the same network (roaming). This is critical for VoIP telephony and video calls while roaming around the office, but requires support from client devices.

Don't forget about the transmitter power (Tx PowerSetting the maximum power isn't always beneficial: a client device (e.g., a smartphone) may "see" the access point perfectly, but its own weak signal won't reach the router, resulting in a disconnected connection. Optimally, adjust the power so that coverage matches the physical area needed without creating unnecessary interference.

Network diagnostics and monitoring

Understanding the network status is key to stable operation. MikroTik There are powerful monitoring tools. Menu Tools -> Graphing allows you to create interface load graphs in real time. You can see how much traffic each client is consuming and whether the channel is overloaded. For a quick check, use Torch on the menu Tools, which shows passing packets in real time with details by protocol and port.

An important aspect is logging. In the section Log You can track client connection and disconnection events, as well as authentication errors. If a user complains of constant disconnections, the logs will help determine the cause: interference, weak signal, or authentication failure.

Frequently Asked Questions (FAQ)

Is it possible to use MikroTik as an access point if the main router is also MikroTik?

Yes, of course. The operating principle will be identical. The main thing is to disable the DHCP server on the access point (if it's enabled by default) and ensure that the devices' IP addresses are assigned by the main router. It's also important that the access point's IP address doesn't conflict with the clients' addresses.

Why is Wi-Fi speed so much slower than cable speed?

Wireless media is half-duplex, meaning data is transmitted sequentially rather than simultaneously in both directions, which theoretically reduces throughput by half. Furthermore, speed is affected by interference, distance, the number of connected clients, and the selected standard (N, AC, AX). Actual speed is typically 50-70% of the theoretical link speed.

How to update RouterOS firmware via an access point?

Go to the menu System -> Packages, press the button Check for UpdatesIf the version is new, download and install it. After updating, the device must be rebooted after System -> RebootIt is recommended to backup your configuration before updating.

Does the device support Mesh networks?

Depends on the model and RouterOS version. Old protocols WDS or NV2 allowed the organization of bridges, but modern standards EasyMesh or proprietary CapSMAN (for managing multiple points) require specific hardware and licenses. For a simple connection between two points, the mode Station Bridge or WDS.