Equipment setup from Mikrotik While this often intimidates beginners, it actually opens the door to a world of professional traffic management. Unlike home solutions, where the interface is simplified to the bare minimum, here you have complete control over every bit of data. With proper configuration, you can transform a regular router into a powerful gateway with content filtering, channel balancing, and complex security rules.
Before you begin, it's important to understand that you're dealing with an operating system. RouterOSThis isn't just firmware, but a fully-fledged OS that controls the hardware. For initial setup, you'll need a computer with a network card and an Ethernet cable. Using a wireless connection for initial configuration is not recommended, as you may lose access to the device while changing security settings.
There are two main ways to manage: via the web interface QuickSet or through a specialized utility WinBoxWe'll use the second option, as it provides access to all system functions and operates more reliably during network outages. Download the latest version of the program from the manufacturer's official website and ensure that your antivirus software isn't blocking it.
⚠️ Attention: The RouterOS interface is subject to update. The location of some menu items in newer versions (v7 and higher) may differ from screenshots in older manuals. Always consult the official documentation for your software version.
Connection and initial login
To begin, physically connect your computer to any of the LAN ports (usually numbered 2 through 5), avoiding the port labeled Internet or WAN At this stage, make sure your computer's network card is configured to obtain an IP address automatically. By default, the router assigns addresses from the 192.168.88.0/24 pool.
Run the utility WinBoxIn the window that opens, go to the tab NeighborsIf the device is working properly and connected via cable, you'll see its MAC address in the list. Click on it to automatically fill in the connection address. In the field Login the user is specified by default admin, and leave the password field blank if the device is new or reset.
After successful login, the system will prompt you to update the configuration. Accept the update if the firmware version is significantly older than the current one. Immediately after the first login, you should change the default password, as open ports on the local network may be vulnerable to man-in-the-middle attacks.
Setting up a WAN connection and Internet access
The next critical step is establishing access to the external network. Providers use different connection types: dynamic IP (DHCP), static IP, or PPPoE/L2TP. Let's look at the setup for the most common scenario: PPPoE, which is often required by providers for subscriber authorization.
Go to the menu PPP and click the plus sign to add a new interface. In the window that opens, select the tab PPPoE ClientIn the field Interface Select your physical WAN port (usually it is ether1). Enter the login and password provided by your provider. Make sure the box is checked. Add Default Routeso that the router knows where to send requests to the external network.
- 🌐 Interface: Select the port into which the provider's cable is plugged.
- 🔑 User/Password: data from the contract with the Internet provider.
- 🛣️ Add Default Route: Be sure to enable this option for the Internet to work.
If your ISP uses a dynamic IP (DHCP), setup is even easier. Go to the menu IP → DHCP Client, click plus and select interface ether1The status should show the value bound, which means the address has been successfully received. Check your internet connection by opening any website in your browser.
☑️ Checking WAN connection
WiFi wireless network configuration
Setting up the wireless module is key to comfortable network use. Go to the menu Wireless. If the interface wlan1 off (red cross is on), press the button EnableIn the settings window that opens, go to the tab Wireless.
In the field Mode select ap bridge, which will turn the router into an access point. In the field Band Select the standard supported by your devices, for example, 5GHz-only-N or 2GHz-b/g/n. For the field Frequency better to choose superscanso that the router itself finds the least noisy channel, or set a fixed channel number if you have analyzed the airwaves in advance.
Next, let's move on to security. Go to the tab Security Profiles (available via the profile button in the wireless network window or a separate menu). Create a new profile, set Mode as dynamic keysIn the fields WPA Pre-Shared Key And WPA2 Pre-Shared Key Enter a strong password. Use encryption. WPA2 or WPA3 is the required security standard today.
| Parameter | Recommended value | Description |
|---|---|---|
| Mode | ap bridge | Access point mode |
| Security Profile | wpa2-psk | Traffic encryption type |
| WMM Support | Enabled | Multimedia traffic prioritization |
| Installation | indoor | Power limitation by regulator |
Why is indoor installation important?
The Installation parameter determines the maximum radiated power according to country legislation. Selecting "indoor" limits the power, reducing interference to neighbors and complying with indoor regulations.
Setting up a DHCP server for a local network
To ensure that devices connecting to the router automatically receive IP addresses, you need to configure DHCP server. Go to the menu IP → DHCP Server. Click on the button DHCP SetupThis will launch the Quick Setup Wizard, which automates the creation of an address pool and issuance rules.
The wizard will prompt you to select an interface. Select your bridge (usually bridge-local or bridge), to which the LAN and WiFi ports are connected. The system will then suggest an address range. By default, this is 192.168.88.0/24You can change it if it conflicts with your provider's network, although modern routers do this automatically.
In the Pool configuration step, leave the default values or specify a specific range, for example, from 192.168.88.10 to 192.168.88.200. This will reserve addresses for static assignment. In the Gateway for DHCP Network The IP address of the router itself in the local network must be specified.
An important step is to specify DNS servers. Select the option Use Peer DNS, so that the router broadcasts the provider's DNS, or manually enter reliable servers, for example, from Google (8.8.8.8) or Cloudflare (1.1.1.1). This will speed up page loading and improve fault tolerance.
Basic Security and Firewall
Network security is built on good rules. Firewall. Go to the menu IP → Firewall, tab Filter Rules. By default, Mikrotik has no deny rules, meaning all router services are open to the internet. This is a critical vulnerability.
Create a new rule by clicking the plus sign. On the tab General in the field Chain select inputIn the field Connection State select established,relatedIn the field Action select acceptThis rule will allow response packets to already established connections without disrupting the internet.
Then create a deny rule. Again Chain: input, Action: dropPlace this rule at the very bottom of the list. However, it must be preceded by rules allowing access from trusted interfaces (LAN). The firewall's logic is linear: the first match is executed, the rest are ignored.
⚠️ Attention: Don't apply a block all incoming connection rule without first creating an allow rule for your local subnet. You could end up blocking yourself from accessing the router.
Guest network and client isolation
To protect the main network from guests or IoT devices, it makes sense to create a separate guest network. This can be accomplished by creating a second bridge or using VLANA simple way is to create a separate WiFi interface with a different SSID.
On the menu Wireless Create a new interface (or virtual AP). Name it something like wlan1-guestIn the security settings, set a different password. Then in the menu IP → DHCP Server create a second DHCP server for this interface with a different subnet, for example, 192.168.99.0/24.
To prevent guests from accessing your files, you need to configure Firewall rules. IP → Firewall → Filter Rules create a rule: Chain: forward, In-Interface: wlan1-guest, Out-Interface: bridge-local (your main network), Action: dropThis will prevent packets from being transmitted from the guest network to the main network.
- 📶 SSID: guest network name, for example "Home_Guest".
- 🔒 Security: a separate password, different from the main one.
- 🚫 Firewall: rule for blocking access to LAN resources.
📊 What type of network are you planning to set up?Main homeGuest networkNetwork for the officeNetwork for IoT devices
Saving configuration and backup
After completing all settings, you need to save the configuration to permanent memory. In Mikrotik, changes are applied immediately, but may be lost upon reboot if the save command is not executed. In the menu System press the button Backup.
You can create a binary backup (.backup), which restores settings only on an identical device, or text export (.rsc), which contains the script commands. For reliability, it is recommended to use both methods. Save the backup file to your computer.
For automation, you can configure sending a backup to an FTP server or by email upon download, but this requires additional configuration of scripts in the section System → SchedulerRegular backups will save you hours of reconfiguration in the event of hardware failure.
How to reset Mikrotik to factory settings?
If the settings have been lost or the router is unavailable, find the button Reset on the case. With the power off, press and hold it, turn on the router, and hold until the LED starts blinking. ACT or USRRelease the button and the device will reset.
Where can I download WinBox for different operating systems?
The official version is only available for Windows. For macOS and Linux, use Wine or the native version. WinBox-mac (for macOS), which can be found on the Mikrotik community forum or in the repositories.
What to do if you forgot your password?
Without physical access to the device and the Reset button, it's impossible to recover the password for security reasons. The only option is a full reset using the Reset button and then reconfiguring.