Modern home and office networks rarely exist without wireless access, but there is often a need for devices connected via Wi-Fi, and devices sitting in local network via cable, were in the same broadcast domain. For MikroTik routers, this is a standard task, solved by creating a bridge. This mechanism allows software to "stitch" the physical Ethernet port and the virtual wireless network interface, making them transparent to each other.
The default RouterOS configuration, especially in newer firmware versions, often comes with a quick setup wizard that automatically pairs ports. However, when manually setting up or migrating from older configurations, administrators may encounter a situation where wireless clients are isolated from wired ones. Understanding the operating principles Bridge is critical for proper traffic management.
In this article, we'll cover in detail the process of creating a bridge, adding interfaces, and configuring the services required to distribute IP addresses. We'll also cover important security aspects, as network bridging requires careful attention to firewall rules. Proper configuration will ensure the stable operation of printers, network storage devices, and smart home systems.
How Bridge Works in RouterOS
Technology Bridge (bridge) works at the data link layer of the OSI model, connecting network segments so that they appear as a single unit. When you add an interface ether1 And wlan1 In a single bridge, data packets arriving on the wireless interface can be forwarded to the wired port without changing their IP addressing. This is a fundamental difference from routing, where packets pass through the router's processor and have their headers changed.
Using a bridge avoids double network address translation (NAT) within the local network. All devices, whether a laptop connected via cable or a smartphone over the air, will receive addresses from the same subnet. This simplifies file and peripheral sharing. It's important to note that bridging increases the load on the router's CPU, as packet switching between interfaces is now performed by software unless hardware offloading is enabled.
⚠️ Attention: When an interface is added to a bridge, its IP address becomes irrelevant. Once the bridge is created, the router should be managed using the bridge's IP address (usually a bridge-local or interface bridge), not the physical port address.
Modern MikroTik models, such as the series hAP or RB750Gr3, support hardware offloading. This means that even when bridging WiFi and LAN, traffic between ports can be switched at the switch chip level, without loading the CPU. However, for wireless interfaces, traffic still goes through the CPU, so WiFi performance remains the limiting factor.
Preparing for setup and resetting the configuration
Before manipulating network interfaces, it is highly recommended to create a backup of the current configuration. This will allow you to quickly restore the device to working order if an error occurs. If you are setting up a router from scratch, it is best to start with a clean configuration, removing any default settings that may conflict with the bridge you are creating.
To log in, use WinBox or the web interface. Go to the menu System → Backup and save the configuration file to your computer. If you plan to completely reconfigure, you can use the No Default Configuration at boot or run a reset command via the terminal. This ensures that old firewall rules or DHCP servers don't interfere with the new network structure.
☑️ Check before starting setup
Make sure your computer is connected directly to the router via a cable to the port you plan to use for management (usually any port other than the WAN port, unless configured otherwise). After a reset, the router may not have an IP address, and initial setup will require using a protocol. MAC-Telnet or MAC-Winbox, which operate at the second OSI layer and do not require IP addressing.
Creating a bridge and adding interfaces
The main step in merging networks is creating a logical bridge interface. In the terminal, this is done with the command /interface bridge add name=bridge-local, but it's more convenient to use the WinBox graphical interface. Go to the section Bridges (or Bridge in new versions of RouterOS v7) and click the button +In the window that opens, specify a name, for example, bridge1, and make sure the option is enabled Hardware Offloading, if your hardware model supports it.
After creating the bridge itself, you need to add physical and logical interfaces to it. In the list of bridge interfaces (tab Ports) add your LAN ports (eg. ether2, ether3) and wireless interface (wlan1).
| Interface | Type | Add to Bridge? | Comment |
|---|---|---|---|
| ether1 | Physical | No | Used as WAN (Internet) |
| ether2-5 | Physical | Yes | Local wired network |
| wlan1 | Wireless | Yes | 2.4 GHz wireless network |
| wlan2 | Wireless | Yes | 5 GHz wireless network (if available) |
When adding interfaces to a bridge, ensure that VLAN settings do not conflict. If you don't use VLAN tagging, ports should be added as is. In RouterOS v7, the port addition process has become more flexible, allowing you to set priorities and learning settings for each port individually, which is useful in complex corporate networks.
What is Master Port in older versions?
RouterOS versions prior to 6.4x had the concept of a Master Port, which allowed port aggregation at the driver level. Modern versions have abandoned this concept in favor of software-based Bridges, which offer greater flexibility but require proper hardware offloading configuration to maintain performance.
Setting up IP addressing and a DHCP server
Once the bridge is created and the interfaces are added, you need to assign an IP address to the bridge itself. This address will become the default gateway for all clients on the local network. Go to the menu IP → Addresses, click + and in the Address field enter the address, for example, 192.168.88.1/24In the Interface field, select the one created earlier. bridge1Now the router is "visible" on the network via this address.
To automatically assign addresses to clients, you need to configure a DHCP server. RouterOS has a convenient setup wizard. IP → DHCP Server → DHCP SetupSelect interface bridge1 and follow the wizard's prompts. It will automatically suggest an address range (pool), lease time, and gateway address. Make sure the address pool is in the same subnet as the bridge IP address.
A critical point is the DNS configuration. In the DHCP server settings (tab Networks) in the field DNS Servers Enter your router's address (if caching DNS is enabled) or public DNS, for example, 1.1.1.1 And 8.8.8.8Without correct DNS servers, clients will be able to connect to the network, but will not be able to open websites using domain names.
⚠️ Attention: If the DHCP server isn't assigning addresses, check if another DHCP server is running on the network (for example, on another router or ISP modem). A conflict between two DHCP servers will cause chaos on the network and prevent devices from connecting.
Setting up a wireless network and security
Network merging is impossible without proper WiFi configuration. Go to the section Wireless, select your interface (wlan1) and open its settings. Make sure that the operating mode (Mode) is installed in ap bridgeThis mode allows the interface to act as an access point and participate in a bridge. If the mode is selected station or bridge (without ap), the functionality will be different.
Tab Security Profiles is responsible for encryption. Create a new profile or edit an existing one. For a home network, it is optimal to use WPA2 or WPA3 with encryption algorithm aes cc. Set a strong password in the field WPA Pre-Shared KeyAvoid using the outdated WEP protocol, as it can be cracked in seconds.
After applying the settings, check the wireless connection status. In the client list (Registration Table) devices should appear. If clients connect but don't receive an IP address, check whether the WLAN interface has been added to the bridge and whether the DHCP server is running on the bridge interface. Also, make sure the Wireless option is enabled in the settings. Default Authenticate.
Setting up Firewall and NAT for Internet access
Even if WiFi and LAN are combined, there may be no internet access without firewall rules. Go to IP → FirewallYou need a rule that allows traffic from the local network (bridge) to the external network. Typically, this rule chain=forward, Where in-interface-list=LAN (or specifically bridge1) And out-interface-list=WAN, action accept.
You also need to configure NAT (Masquerade) to hide internal addresses behind the provider's external IP. In the section IP → Firewall → Nat create a new rule. Tab General: chain=srcnat, out-interface-list=WAN. Tab Action: select masqueradeThis rule will allow all devices in the unified network to access the global network.
Don't forget about the rule allowing installed and linked packages (connection-state=established,related) in the chain forwardWithout this response, internet servers will not return to your clients. These rules are often already included in the default MikroTik configuration, but when manually setting up a network, you need to create them manually.
Diagnostics and typical problems
If after setting up the devices in WiFi and LAN they do not “see” each other, first check the ARP table (IP → ARP). The MAC addresses of all clients and their IP addresses should be displayed there. If there are no entries, then the packets aren't reaching the router, and the problem is most likely in the interface settings or a physical break.
A common problem is "separation" of networks due to different subnets. Make sure that the static IP addresses on the computers (if used) are within the DHCP range, or add them to the exceptions. Also, check if client isolation is enabled (Default Forward (in the Wireless settings). If this option is disabled, WiFi clients won't be able to communicate with each other, let alone with LAN.
⚠️ Attention: RouterOS interfaces and settings may vary depending on the firmware version. In RouterOS v7, the menu structure and some parameters (for example, the wireless package has been replaced with wifi-qcom for new devices) have changed. Always consult the official documentation for your specific model and firmware version.
For in-depth diagnostics, use the tool Torch (Tools → Torch). Select the bridge interface and start capturing traffic. You'll see packets passing in real time. If you see DHCP Discover requests but no Offers, the server isn't responding. If you see ICMP echo requests but no responses, the problem is with routing or a firewall.
Why did I lose access to the router via the old IP address after adding it to Bridge?
After adding a port to the Bridge, control is transferred to the IP address of the Bridge interface itself. The old IP address assigned to the physical port is no longer processed for incoming connections, as the port now functions as a switch. You must either assign a new static IP address to a computer in the bridge subnet or find the router using the MAC address in WinBox.
Does network consolidation affect internet speed?
Bridging itself on modern routers with hardware offloading support has virtually no impact on speed. However, if your router is underpowered and doesn't support hardware switching, the processor may struggle to handle the packet flow between WiFi and LAN, resulting in reduced speed and increased latency (ping).
Is it possible to separate guest WiFi and home LAN?
Yes, to achieve this, the guest WiFi interface isn't added to the main Bridge. Instead, a separate Bridge is created for guests, assigned to a different subnet, and firewall rules are configured to deny access from the guest network to the main network but allow internet access.