Setting up a wireless network in your office or home requires reliable equipment and devices MikroTik They are often the choice of professionals due to their flexibility and stability. However, the standard factory configuration does not always include active Wi-Fi, posing a challenge for the administrator during initial setup. Unlike consumer routers, they lack simple quick setup wizards, but this does provide complete control over every radio signal parameter.
The process of activating an access point requires an understanding of the operating system's logic. RouterOS, which underlies all of the manufacturer's devices. You'll need to not only turn on the radio, but also properly configure the bridge, assign IP addresses, and, crucially, secure the network with modern encryption protocols. Errors at this stage can lead to either a lost connection or a vulnerability in corporate data.
In this article, we'll walk you through a detailed process that will allow you to deploy a stable wireless network from scratch. We'll cover working with a graphical interface. WinBox, as this is the most convenient tool for initial configuration. Be prepared to carefully navigate the settings, as precision in entering parameters is crucial here.
Preparing equipment and entering the control system
The first step is to physically connect the device to the computer for initial configuration. Since Wi-Fi is disabled by default, you'll need a cable. Ethernet, which should be connected to any available LAN port on the router and the PC's network card. Make sure the software is installed on the computer. WinBox, which can be downloaded for free from the manufacturer's official website.
After connecting the cable, run WinBox and go to the tab NeighborsYour device should appear in the list, even if it hasn't yet acquired an IP address automatically. To log in, use the default credentials: login admin and an empty password field (if the device is new and has never been used). If the device has been previously configured, a factory reset may be required.
⚠️ Important: If you are setting up the device on a work network with an existing DHCP server, ensure that the MikroTik's IP address does not conflict with the existing network. It is best to perform the initial setup on an isolated computer without a connection to the global network.
Once inside the system, you'll see a complex menu with numerous options. Don't be intimidated by the abundance of options; for our purposes, only a few sections are needed. The main work will be done in the menu. Wireless, Bridge And IP.
Creating a Bridge and Configuring Interfaces
Logic of work RouterOS involves combining ports and wireless interfaces into logical groups. In order for Wi-Fi clients to access the local network and the internet in the same way as those connected via cable, it is necessary to create BridgeThis is a virtual switch that will connect a physical LAN port and a virtual wireless network interface into a single broadcast domain.
Go to the menu Bridge and click on the plus (+) to create a new bridge. In the window that opens, you can leave the default name (for example, bridge1) and click OK. Then go to the tab Ports inside the Bridge menu and add your physical port there (usually ether2 or ether1(depending on the model) and a future wireless interface. Until the Wi-Fi interface is created, we'll only add a cable port.
Next, you need to configure the router itself to obtain an IP address within the created bridge. Go to the section IP -> Addresses and add a new address. In the Address field, enter the gateway of your network (for example, 192.168.88.1/24), and in the Interface field, select the one created earlier bridge1This will allow you to manage the router over the network after combining the interfaces.
Another critical step is setting up a DHCP server, which will automatically assign addresses to connected devices. In the menu IP select DHCP Server and use the button DHCP SetupThe setup wizard will prompt you to select an interface (specify bridge1), address range (pool), and gateway address. Complete all steps of the wizard, accepting the default values unless you have specific requirements.
☑️ Setting up a basic network
Wireless interface configuration
Now let's get to the heart of the matter—configuring the radio module. In the main menu, select Wireless. You will see a list of available radio interfaces (for example, wlan1 for 2.4 GHz or wlan2 for 5 GHz). Double-click on the desired interface to open its properties. On the tab Wireless in the field Mode select a value ap bridgeThis mode turns the router into an access point, allowing multiple clients to connect simultaneously.
In the field SSID Enter a name for your network that users will see when scanning the space. It is recommended to use a descriptive name without special characters, although MikroTik supports UTF-8. Frequency (Frequency) it's better to leave it in the mode auto or manually select the least loaded channel if you have conducted a preliminary analysis of the broadcast.
After setting the basic parameters, go to the tab Security Profiles (Available via the three-dot button or a separate menu on the left). Create a new profile or edit default. In security mode (Mode) be sure to select dynamic keysIn the fields Unicast Keys And Group Keys check the boxes WPA2 PSK and enter a strong password. Using an outdated protocol WEP or an open network is unacceptable in modern conditions.
⚠️ Note: When choosing a channel and channel width, consider your surroundings. Width
20/40MHz CeThis can provide a speed boost, but in apartment buildings it often leads to interference. For maximum stability in noisy environments, it's better to choose a fixed width.20 MHz.
Don't forget to check the box Enabled in the wireless interface settings window. If everything is done correctly, the status indicator will change, and the network will become visible to external devices. However, for clients to work, the interface must be added to the previously created bridge.
Why choose AP Bridge mode?
AP Bridge mode allows the access point to accept connections from wireless clients and forward them to the wired network. Unlike Station mode, which is used for Wi-Fi reception, AP Bridge creates a network. Bridge mode also allows you to connect multiple MikroTik access points into a single infrastructure if WDS is used, but for simple internet sharing, a standard AP Bridge is sufficient.
Adding Wi-Fi to the Bridge and Checking Connectivity
After enabling the radio interface, you need to return to the menu Bridge -> PortsClick on the plus (+) to add a new port. In the field Interface select your wireless interface (eg wlan1), and in the field Bridge please indicate bridge1, which we created earlier. This action will logically "weld" the wireless network to the wired one.
Now try connecting to the network from your mobile phone or laptop. Enter the password you specified in the security profile. If the connection is successful, the device should receive an IP address from the range specified in DHCP Setup. Check internet access and the ability to ping the gateway.
If there is a connection, but the Internet does not work, check the settings NAT (Masquerade). Go to IP -> Firewall -> tab NAT. Add a new rule: in the field Chain select srcnat, V Out. Interface Specify the port through which the Internet comes (usually ether1), and in action (Action) select masqueradeWithout this rule, the router will not broadcast local network addresses to the external network.
Signal optimization and frequency range selection
The quality of a wireless network directly depends on the correct choice of frequency and transmitter power. In the menu Wireless There is a parameter in the interface properties Tx PowerAvoid setting it to maximum unless absolutely necessary, as this can lead to module overheating and increased noise levels. The optimal value for small rooms is between 17 and 20 dBm.
Particular attention should be paid to the choice between the 2.4 GHz and 5 GHz ranges. Range 2.4 GHz has better penetration ability through walls, but is heavily polluted by neighboring networks and household appliances. Range 5 GHz Provides high speeds and clear air, but has a shorter range and is less able to pass through obstacles.
You can use the built-in tool to analyze channel load. Tx/Rx Tickets or third-party apps on your smartphone. The table below compares the range characteristics to help you make a decision:
| Parameter | 2.4 GHz | 5 GHz |
|---|---|---|
| Maximum speed | Up to 150-300 Mbps | Up to 867 Mbps and higher |
| Penetration ability | High | Medium/Low |
| Number of channels | 3 non-intersecting | Many (up to 25+) |
| Range of action | Up to 50 meters | Up to 20-30 meters |
The ideal strategy is to use both bands simultaneously if your equipment MikroTik Dual-Band. Name the networks the same or add the suffix "_5G" so users can choose the optimal connection. Modern devices will automatically switch to a faster frequency when they get closer to the router.
Advanced Security Settings and Access List
Basic WPA2 password protection may not be sufficient in a corporate environment or if you want to restrict access to specific devices. For this purpose, MikroTik there is a powerful tool Access ListIt is located in the menu. Wireless -> tab Access ListHere you can create rules that allow or deny connections by MAC address.
For example, you can create a rule that will reject (reject) all connections except those on the allowed list. To do this, create a rule with the action accept for specific MAC addresses of your devices, and below a rule with the action is added reject for all others (with an empty MAC address field). Rules are processed from top to bottom, so the order is critical.
It's also recommended to disable SSID broadcasting (hide the network) if increased privacy is desired, although this isn't a foolproof security measure. To do this, uncheck the box in the wireless interface settings. Default Authenticate and use only Access List, or just uncheck the box SSID BroadcastPlease note that a hidden SSID may cause connection issues for some mobile devices and increase battery drain.
⚠️ Note: MAC address filtering (Access List) does not encrypt traffic. It merely controls access. Data is still transmitted over the air, so using WPA2/WPA3 encryption remains a mandatory security requirement.
Frequently Asked Questions (FAQ)
Why does the phone see the network but not connect to it?
Most often, the problem lies in an incorrect security profile. Make sure that in the settings Security Profiles mode selected dynamic keys and the flag is set WPA2 PSK. Also check if the wireless interface is added in Bridgeso that the DHCP server can issue an IP address.
How to increase the Wi-Fi range on a MikroTik?
First of all, check the parameter antenna-gain And tx-power in the wireless interface settings. However, physical laws limit the options: it's best to reduce the channel width to 20 MHz to increase reception sensitivity and choose a center frequency that avoids interference. Antenna placement also plays a key role.
Is it possible to distribute Wi-Fi with guest access?
Yes, you need to create a second one for this Bridge (For example, bridge-guest), add a wireless interface (or virtual AP) to it and configure a separate pool of IP addresses. Then in the menu IP -> Firewall It is necessary to create rules that prohibit the transfer of traffic from the guest network to the main local network.
Do I need to update RouterOS before setup?
Recommended. New firmware versions contain fixes for security vulnerabilities and improvements to wireless driver stability. The update can be performed through the menu. System -> Packages -> Check for Updates, if the router has Internet access.