The need to extend wireless network coverage or provide internet to a remote building without installing cables is a common occurrence. Equipment usage MikroTik When paired with another router, it allows you to create a reliable signal repeater system. Users often wonder how to make a powerful hardware platform work in client mode, receiving a signal from another device.
Unlike consumer routers, where the repeater function is often implemented with a single button, RouterOS requires manual configuration of interfaces and security profiles. This provides flexibility, but can be daunting for beginners. Proper configuration allows you to turn the second router into a transparent bridge or create a separate subnet with its own traffic filtering rules.
We'll take a detailed look at the connection process, potential NAT issues, and solutions. We'll cover configuration via both the WinBox graphical interface and the terminal, so you can choose the most convenient management method. Understanding the logic behind wireless profiles will be key to ensuring your network remains stable.
Equipment preparation and compatibility testing
Before you begin setting up, you need to make sure that your equipment is MikroTik Supports wireless client operation. Not all models have a built-in Wi-Fi module, and some older chipsets may have limitations in the encryption standards they support. It's important to ensure your device is running the latest version of RouterOS, as the wireless interface menu structure has undergone significant changes in newer versions (v7 and higher).
The second router, which will distribute the internet, must be configured and operating in access point mode. Make sure you know the network's SSID and connection password. If you plan to use the 5 GHz channel, make sure both devices support this range and the selected channel width.
⚠️ Note: When updating firmware to RouterOS v7, the wireless configuration structure changed significantly. Old scripts and settings may not work automatically; reconfiguring profiles is required.
For a successful connection, you will also need a computer with the utility installed. WinBox or access WebFig via a browser. A direct cable connection to the MikroTik during the initial setup is required, as the wireless interface will be reconfigured at this point.
- 📡 Make sure the antennas on both devices are securely screwed in and in a vertical position.
- 🔌 Check the MikroTik power supply—unstable voltage can cause the Wi-Fi module to malfunction under load.
- 📶 Find out the MAC address of the MikroTik wireless interface in advance if address filtering is enabled on the receiving router.
Compatibility of security standards also plays a critical role. If the main router only operates in wireless mode WPA3If your MikroTik is an older model, the connection may fail without lowering the security level, which is not recommended on public networks.
Configuration reset and initial access
It's best to start setting up a complex network infrastructure with a clean slate. Old firewall rules or conflicting IP addresses can complicate diagnostics. If the device is used or has previously been used in a different configuration, perform a full reset. This can be done physically by holding down the button. Reset on the body until the indicator ACT it will start blinking, or programmatically through the menu System → Reset Configuration.
After rebooting, the device will receive the factory IP address, usually 192.168.88.1Connect your computer to any LAN port (or PoE port, depending on the model) using a cable. In the PC's network card settings, enter a static address from the same subnet, for example, 192.168.88.2, if the DHCP server on the router does not start immediately for some reason.
What to do if the IP address is unknown?
Use the WinBox utility and go to the Neighbors tab. It will display all MikroTik devices on the local network, even if they are on a different subnet, and allow you to connect by MAC address.
Log in using your login admin and a blank password (or the one on the sticker on the bottom of the device). It is recommended to immediately change the password and update the package. system And wireless to the latest stable version. This will patch known vulnerabilities and ensure support for the latest encryption protocols.
| Parameter | Default value | Recommended action |
|---|---|---|
| IP address | 192.168.88.1 | Change to network-unique |
| User | admin | Create a new user with rights |
| WebFig Port | 80 / 443 | Restrict access by IP |
| SSH | On | Use keys instead of passwords |
After successfully logging in, first disable any unnecessary services that won't be used. This will reduce CPU load and reduce the attack surface. It's especially important to check that the DHCP server isn't running on interfaces where it's not needed to avoid address conflicts in the future.
Setting up the wireless interface in Station mode
The central element of the configuration is switching the wireless interface to client mode. In MikroTik terminology, this is called mode station. Unlike the regime ap-bridge, which gives out a signal, mode station allows the device to connect to another access point as a regular client (laptop or phone).
Open the menu Wireless and double-click on the interface wlan1 (or wifi1 in new versions). In the field Mode select a value stationPlease note that when changing the mode, the interface may temporarily lose connection, so it is better to configure it via cable. You must also specify SSID the network you are connecting to, if it is not hidden, or enter the MAC address of the access point manually.
☑️ Checking Wireless Settings
An important aspect is setting the frequency and channel width. If you leave the frequency in mode scan or 0The router will attempt to find the network automatically, but this may take some time to load. It's best to hard-code the frequency of the main router, for example, 2437 for channel 6 or 5180 for channel 36 in the 5 GHz band. This will speed up reconnection during failures.
Don't forget to enable the interface by unchecking the box. DisabledIf all parameters are correct, the status indicator should change to connected, and a record about the association with the access point will appear in the logs. If the status registering or searching, check that the password and encryption type are correct.
- 🔐 Use the mode
station-bridgeonly if you need to forward the MAC addresses of clients behind the router, but remember that this requires support from the provider. - 📡 For the 5 GHz band, be sure to specify your country in the wireless interface settings to unblock the allowed channels.
- ⚙️ Tab
Data RatesAllows you to limit the maximum connection speed, which is sometimes useful for load balancing.
⚠️ Note: In station mode, the interface cannot simultaneously broadcast Wi-Fi (AP mode) on the same radio frequency. To broadcast the signal, use a second radio module or wired ports.
Configuring security and encryption profiles
The most common cause of connection issues is mismatched security settings. The security profile must exactly match the settings of the main router. Go to the Security Profiles and create a new profile or edit defaultIn the field Mode select dynamic keys, if WPA is used, or the corresponding static mode.
In the section Unicast Keys And Group Keys You must specify the encryption types. Modern networks use aes-ccm (for WPA2/WPA3) or tkip (for old WPA). If the main router is configured for mixed mode TKIP+AES, select both options from the list of supported ciphers on MikroTik to ensure compatibility.
In the field WPA Pre-Shared Key Enter the Wi-Fi network password. Make sure there are no extra spaces and the password is case-sensitive. For corporate networks with RADIUS authentication, you will need to set up a separate profile specifying the authentication server and secret key.
After applying the settings, the profile must be assigned to the wireless interface. This is done in the main settings. wlan in the field Security ProfileIf the connection is not established within a few seconds after applying the settings, check the logs (Log), there will be a specific reason for the refusal, such as "invalid credentials" or "unsupported cipher".
| Type of protection | Unicast | Group | Recommendation |
|---|---|---|---|
| WPA2 Personal | aes-ccm | aes-ccm | Standard for home |
| WPA3 Personal | aes-ccm | aes-ccm | Maximum protection |
| WPA/WPA2 Mixed | tkip, aes-ccm | tkip, aes-ccm | For older devices |
| Open (no) | none | none | Not recommended |
Pay special attention to the protocol version. If you're using RouterOS v7, it adds support for WPA3, but older devices may not see the network or be able to connect to it unless compatibility mode is enabled. For home use, it's best to stick with the WPA2-AES standard for maximum compatibility.
Network, NAT, and Routing Configuration
After a successful Wi-Fi connection, you need to configure the network layer. There are two main configurations: when the MikroTik simply acts as a bridge (Bridge) and when it creates a separate subnet (NAT). The latter configuration is more secure and isolates your local network from the main one.
For NAT to work, you need to create a masking rule. Go to the menu IP → Firewall → NAT. Add a new rule: tab General — Out. Interface select your wireless interface (wlan1). Tab Action — choose masqueradeThis will allow MikroTik devices to access the internet via the IP address received from the main router.
Next, configure the DHCP client on the wireless interface so that MikroTik automatically receives an IP address from the main router. Menu IP → DHCP Client, add a new interface wlan1, check mark Add Default Route must be active. This will create a default route to the internet.
Don't forget to set up your own DHCP server on your MikroTik to distribute addresses to your devices (computers, phones) if they are connected to its LAN ports or the second Wi-Fi module. The address pool should be different from the main router's pool to avoid conflicts. For example, if the main router distributes 192.168.1.x, set up MikroTik for distribution 192.168.2.x.
- 🌐 Check that in
IP → Routesa route with the status appearedAS(Active, Static) via wlan1 interface. - 🔥 Make sure that in the firewall (
IP → Firewall → Filter) traffic from the local network to the Internet is allowed (Forward chain). - 📶 If the internet doesn't work, try entering DNS servers manually in
IP → DNS, For example,8.8.8.8And1.1.1.1.
⚠️ Note: If you use a NAT setup, devices behind the MikroTik will be in "double NAT." This can cause issues with online gaming or port forwarding. For gaming, it's best to use bridged mode.
Connection diagnostics and signal optimization
Even with proper configuration, stability issues may still occur. The first diagnostic tool is the built-in wireless network scanner. In the menu Wireless press the button Scan. It will show all available networks, their signal strength (signal strength) and noise (noise floor). The optimal signal level is considered to be better than -70 dBm.
If the signal is weak, try repositioning the antennas or elevating the device. Using directional antennas instead of the standard "sausage antennas" can dramatically improve the connection between buildings. It's also worth experimenting with the channel width: narrowing the channel from 40 MHz to 20 MHz often improves stability in the noisy airwaves of an apartment building.
To monitor connection quality in real time, use the command in the terminal:
/interface wireless monitor wlan1In the system logs (Log) you can track the causes of breaks. Frequent reports of disconnected, received disassoc These may indicate that the main router is dropping the connection due to timeouts or overload. In this case, you can try increasing the polling intervals or adjusting the transmitter power settings.
Regularly check your MikroTik's CPU usage. If the CPU usage reaches 100% when the channel is fully loaded, the device may be unable to encrypt traffic at high speeds. In this case, you should reduce the maximum speed in the wireless interface settings or upgrade to a more powerful model.
Why doesn't MikroTik see the 5 GHz network?
Most likely, the wrong country or frequency is selected in the wireless interface settings. In some countries, certain 5 GHz channels are prohibited. Make sure the field Country your country is selected and the frequency is manually set to one of the allowed channels (for example, 36, 40, 44, 48).
How to increase speed via Wi-Fi bridge?
Use the 5 GHz band with a channel width of 40 or 80 MHz. Make sure you are using AES (CCM) encryption, as TKIP limits the speed to 54 Mbps. Also, make sure the Wireless Mode is set to any or 802.11ac, and not in legacy modes.
Is it possible to connect MikroTik to public Wi-Fi with authorization?
Yes, but it's difficult using standard tools. You'll need to set up a script that automatically sends a POST request to the provider's authorization page, or use WDS mode if the access point supports it. It's easier to use a phone with Wi-Fi hotspot functionality.
What should I do if the internet connection disappears after setup?
Check for the presence of a default route in IP → RoutesMake sure the NAT (Masquerade) rule is active. Check if the router itself receives an IP address in the menu. IP → DHCP ClientThe problem is often solved by recreating the DHCP client on the WLAN interface.
Does cable length affect Wi-Fi speed?
For an Ethernet cable (twisted pair) up to 100 meters long, the impact on speed is minimal if the cable is of high quality (CAT5e or CAT6). However, a poor connection or damage to the cable can cause the link to drop to 100 Mbps instead of 1 Gbps, which will become a bottleneck for fast Wi-Fi.