Administering a network infrastructure often requires flexible access control, and in some scenarios it may be necessary to completely or temporarily disable a wireless interface. Mikrotik routersRouterOS-based routers offer extensive control over radio modules, allowing administrators to instantly stop signal transmission. This may be necessary to improve security at night, perform maintenance, or eliminate interference in dense radio environments.
Unlike consumer solutions, where pressing a physical button is sufficient, professional equipment requires software configuration to control the radio channel. Wireless package The operating system's built-in driver allows you to not only turn off the network, but also fine-tune interface accessibility settings. Understanding how drivers and interfaces work wlan is a key skill for any network engineer.
In this guide, we'll cover detailed steps for disabling a wireless network using various methods. You'll learn how to use the graphical interface. WinBox, command line Terminal and automated scripts. Completely disabling the radio module reduces the device's power consumption and eliminates the possibility of unauthorized over-the-air connections.
Using the WinBox GUI
The most common tool for equipment management Mikrotik is a utility WinBoxIt provides convenient visual access to all system settings, including the wireless network section. To get started, you need to log in to the device using an account with administrator rights, usually the user admin.
After logging in, go to the left menu and select WirelessA window will open with a list of all available wireless interfaces. If your router has multiple radio modules installed or virtual access points (APs) configured, they will be displayed in separate rows. To disable a specific channel, simply double-click the desired interface.
In the interface properties window that opens, find the button Disable, located in the upper left corner. Clicking this button will change the interface's status to "disabled," which will immediately stop broadcasting the SSID and terminate all active client connections. In the interface list, the interface icon will turn red, indicating its inoperative state.
⚠️ Important: Disabling the primary Wi-Fi interface will cause all wirelessly connected devices to lose access to the local network and internet. Make sure you have an alternative control channel (Ethernet cable) to avoid losing access to the router.
To reactivate the network, simply open the interface properties again and click the button EnableYou can also use the context menu called by right-clicking on the list of interfaces where commands are available. Disable And Enable to quickly switch states without opening properties windows.
Control via the Terminal command line
For experienced administrators and remote management scenarios via SSH or Telnet, the most effective method is to use command line. Terminal Mikrotik Allows you to execute commands quickly and create complex scripts. The basic command syntax in RouterOS is based on navigating through a configuration tree.
To disable the wireless interface, you need to go to the appropriate configuration section. Command /interface wireless switches the context to the wireless card management menu. Next, using the command disable and the interface name (eg wlan1), we stop it. The entire process takes a few seconds and doesn't require a graphical shell.
/interface wireless disable wlan1If you need to disable all wireless interfaces at once, you can use the selector [find]This command will apply the action to all found objects of this type, which is convenient for mass reconfiguration of equipment. To re-enable it, use a similar command, replacing the action with enable.
☑️ Check before disabling Wi-Fi
It's important to note that terminal commands are case-sensitive to interface names. If your interface is named Wlan1, then the team with wlan1 may not work unless you use auto-completion on the key TabAlways check the exact interface name with the command print before making changes.
Setting up a Wi-Fi schedule
Often, the need arises not only to turn off Wi-Fi permanently, but to limit its operation to certain hours, for example, at night or on weekends. To do this, RouterOS there is a powerful tool - SchedulerIt allows you to run scripts at a specified time or interval, automating the process of enabling and disabling interfaces.
First, you need to create a script that will execute the shutdown command. In the menu System -> Scripts create a new script with a name like "wifi_off" and in the field Source write the command /interface wireless disable wlan1A second script, "wifi_on," is created in a similar manner, containing the enable command. This allows for a separate logic flow.
Then we go to the menu System -> SchedulerHere we'll create two tasks. The first task will run the "wifi_off" script daily at 11:00 PM, and the second will run the "wifi_on" script at 8:00 AM the following day. In the Interval you can specify 1d (one day), and in the field Start Time set a specific time of day.
| Parameter | Value for disable | Value to include | Description |
|---|---|---|---|
| Name | night_off | morning_on | Scheduler task name |
| Start Date | jan/01/1970 | jan/01/1970 | Start date (default) |
| Start Time | 23:00:00 | 08:00:00 | lead time |
| Interval | 1d 00:00:00 | 1d 00:00:00 | Repetition period |
| On Event | /system script run wifi_off | /system script run wifi_on | Action to be performed |
Using the scheduler requires that the system time on the router be set correctly. Be sure to configure it NTP Client on the menu System -> Clockto ensure the device synchronizes its time with the internet. Without an accurate time, the schedule will be reset after each device reboot.
What to do if the time is out of order?
If the router does not have internet access for NTP synchronization, you can use relative intervals in the scheduler, running the script a certain number of seconds after the device is turned on, but this is less reliable for linking to the actual time of day.
For the schedule to work accurately, the router must be set to the correct time. Use the command /system ntp client set enabled=yes primary-ntp=pool.ntp.org for automatic synchronization.
For the schedule to work accurately, the router must be set to the correct time. Use the command /system ntp client set enabled=yes primary-ntp=pool.ntp.org for automatic synchronization.
Disabling via API and third-party systems
In large networks, equipment management is often centralized. Mikrotik API allows you to send control commands directly from external monitoring or orchestration systems such as The Dude, Zabbix or custom Python scripts. This makes it possible to integrate Wi-Fi enabling and disabling into overall business processes.
To work through the API, the service must api was included in the menu IP -> ServicesThe connection is made to the standard port 8728 (or 8729 for SSL). Using libraries for your programming language, you can send commands similar to those entered in the terminal, for example: /interface/wireless/disable with an interface number argument.
This approach allows for the implementation of complex scenarios. For example, when detecting an attack like Deauth flood The security system can automatically disable the wireless interface for 5 minutes to prevent further damage, then enable it again. This increases network resiliency.
⚠️ Warning: Opening the API port for external management creates a potential vulnerability. Be sure to restrict access to the API service using the trusted IP addresses list in the section IP -> Services and use complex passwords.
Physical disconnection and interface security
Software disabling isn't the only method. On some router models Mikrotik with the RouterOS v7 operating system and higher, as well as on devices with SwOS, a software lock at the driver level or even a physical shutdown of the module's power supply is possible, if supported by the hardware platform. However, the "physical" method is most often understood to mean using a button. RST or switches on the body, if they are programmed.
Security issues when disabling Wi-Fi are particularly pressing. When you disable an interface, it stops broadcasting its SSID, but the settings remain in memory. Rebooting the router may reactivate the network. To ensure Wi-Fi is disabled for security reasons (for example, when transferring the device to another office), it's best to delete the wireless interface configuration or set a security policy that prevents it from running.
You can create a rule in Firewall, which will block all traffic on the wireless interface, even if it's enabled. This will create a "black hole" for wireless clients. However, the most reliable method remains disable interface in combination with configuration saving.
Common problems and their solutions
When managing wireless networks, administrators may encounter situations where an interface won't shut down or behaves unpredictably. One common issue is driver freezing. ath9k or mt76In such cases, a simple software switch disable/enable may not help, and a complete reboot of the device or reflashing is required.
It is also worth considering that when disabling the main interface wlan1, virtual interfaces (wlan1-virt), created on its base for guest access, will also cease to function, as they depend on a physical radio. Attempting to enable the virtual interface while the physical one is disabled will result in an error.
If you are using the mode CAPsMAN (Centralized Access Point System Manager), management is performed from the controller. Local interface disabling on the access point can be overridden by the controller's configuration. In such cases, changes to the configuration profile on the CAPsMAN server itself are required.
Another issue is client behavior. Some devices (smartphones, laptops) may take a long time to reconnect to a lost network, putting a strain on the airwaves or router log files. It's recommended to use client notification mechanisms or gradually reduce power before a complete shutdown, if such functionality is required.
Is it possible to turn off Wi-Fi using the button on the router body?
Most professional Mikrotik models (RB, hAP, cAP series) don't have a physical button for quick Wi-Fi toggling by default. However, starting with RouterOS v7, it's now possible to assign actions to the button. Reset or other hardware buttons via scripts. You can write a script that will toggle the interface status with a short press of the button.
Does turning off Wi-Fi affect wired network speed?
Theoretically, disabling the wireless module frees up the router's CPU resources, which would otherwise be spent on interrupt processing and radio control. On low-end devices (such as the RB750r2), this may result in a boost in routing performance. On modern, powerful models (RB4011, RB5009), the difference will be negligible, as the resources are already shared.
Will the "Disabled" setting persist after a reboot?
Yes, the interface state (up or down) is part of the configuration. If you disabled the interface via disable and immediately after that saved the configuration (command save If you set the interface to "automatically upon change," the interface will remain disabled after rebooting the router. If you don't save your changes, they may be lost.
How to disable only 5 GHz, leaving 2.4 GHz?
On dual-band routers (e.g. hAP ac²), the 2.4 GHz and 5 GHz radios are often presented as separate physical interfaces (e.g. wlan1 And wlan2). You can disable only one of them by using the command disable specifically to the interface wlan2 (or the one that corresponds to 5 GHz), leaving the second one active.
Is it safe to turn Wi-Fi on and off frequently?
Frequent software interface switching (thousands of times per day) is not recommended, as it places a strain on the client reconnection process and can lead to accumulated errors in logs or temporary driver freezes. For a regularly scheduled operation (once per day), this is completely safe and is considered standard operating mode.