Situations requiring the connection of two remote devices without running cables arise quite frequently. For example, it may be necessary to transfer internet from the main router to a second router located in another room or even in a neighboring building. In such cases, MikroTik is an ideal solution thanks to its flexible RouterOS operating system.
There are several usage scenarios, but the most popular is client mode, where the router connects to an existing wireless network like a regular device. This allows you to extend the coverage area or connect devices without their own Wi-Fi module to the network. It's important to understand that proper configuration of interfaces and security profiles is key to stable operation.
In this article, we'll take a detailed look at the setup process, highlighting nuances often overlooked by beginners. You'll learn about the differences in operating modes, security features, and methods for diagnosing connection issues. A thorough understanding of these processes will help you avoid common mistakes when building wireless bridges.
Selecting equipment and preparing for setup
Before starting the configuration, you must ensure that your hardware supports the required functionality. Not all models MikroTik They're all the same: some have built-in radio modules, while others require a separate card. To operate in client mode, you'll need a device that supports the 802.11 standard and has the appropriate RouterOS license.
Antennas deserve special attention. If you plan to connect devices over a distance, even a short one, using the built-in antennas may not be sufficient. External directional antennas will significantly improve signal quality and channel stability. It's also important to check frequency compatibility: the equipment must support the same frequency as the target access point.
⚠️ Important: Make sure the frequency you're using is permitted for use in your region without a special license. Violating the frequency plan may result in fines from the regulator.
Preparation begins with physical connection. For initial setup, it's best to use an Ethernet cable, connecting your computer to any MikroTik LAN port. This ensures access to the device even if there are any errors in the wireless interface settings. After connection, you'll need to reset the router to factory settings if it's been used before.
Setting up the wireless interface in Station mode
The main configuration step involves switching the wireless interface to client mode. In MikroTik terminology, this is called client mode. station. Unlike the regime ap-bridge, which gives out a signal, mode station Allows the device to connect to another access point. To switch to this mode, open the menu. Wireless and select the desired interface.
In the settings window that opens, find the parameter Mode and change its value. By default, it may contain ap-bridge or bridgeYou need to choose stationIf your goal is simply to access the internet via someone else's Wi-Fi, this is often sufficient. However, for more complex setups, such as VLAN forwarding or working with multiple SSIDs, you may need to use the following modes: station-bridge or station-pseudobridge.
After selecting the mode, you must specify the network name (SSID) to which you will connect. This is done in the section Scan or by manual entry in the field SSIDWhile scanning, you'll see a list of available networks and their signal strength. Select the desired network and click the button. ConnectIf all parameters are correct, the interface status will change to running And connected.
/interface wireless set wlan1 mode=station ssid="Target_Network" disabled=no☑️ Checking Wi-Fi interface settings
Security and profile configuration
Modern networks are rarely open, so setting up encryption is a critical step. MikroTik uses the concept of security profiles (security-profiles). You need to create a new profile or edit an existing one (usually default), specifying the appropriate encryption settings, such as WPA2 or WPA3.
In the created profile, you must specify the password (Pre-Shared Key) and encryption modes group-key-update. Make sure that the selected algorithms (e.g. tkip, ccmp) match the settings of the primary access point. A mismatch of even one parameter will result in successful association, but authorization will fail, and an IP address will not be obtained.
⚠️ Caution: Avoid using the outdated WEP protocol, as it is easily cracked. Try using WPA2-PSK with AES encryption (ccmp) for maximum compatibility and security.
Once a profile is created, it must be assigned to a wireless interface. This is done either through the graphical interface in the properties wlan1, or through the command line. It's also worth checking if the firewall is blocking it (firewall) service packets required to establish a connection. In a standard configuration, rules typically allow traffic, but strict security policies may require exceptions.
Encryption compatibility nuances
Some older devices may not support WPA3 or certain group key update methods. If the connection fails, try temporarily lowering the security level to WPA2-PSK (AES) to test. If this doesn't help, check if MAC address filtering is enabled on the access point. In this case, you'll need to whitelist the MAC address of the MikroTik interface on the main router. You can find the MAC address in the interface status or on the device's label (unless it's been changed via software).
Setting up a network and obtaining an IP address
After a successful connection at the physical layer (Link Up), you need to configure the network layer. Most often, the MikroTik client should obtain an IP address automatically from the main network's DHCP server. To do this, on the interface wlan1 (or the created virtual interface), you need to start the DHCP client. Without this step, the router will not be able to forward traffic.
In some cases, such as when creating a bridge between a wired and wireless segment, the settings may differ. If you are using the station-bridge, the IP address will be obtained on the bridge interface itself. If routing (NAT) is used, the DHCP client runs directly on the wireless interface, and the local network is configured with its own address pool and DHCP server.
| Parameter | Value for Station | Importance for AP-Bridge | Description |
|---|---|---|---|
| Mode | station | ap-bridge | Radio card operating mode |
| SSID | Target network name | Name of your network | Network ID |
| Security | Client profile | Access profile | Encryption parameters |
| IP Config | DHCP Client | Static / DHCP Server | Setting up IP addressing |
Don't forget to check the default route (default route). When receiving an address via DHCP, the router often automatically adds a gateway. If this doesn't happen, or if the gateway is entered incorrectly, you won't be able to access the internet. You can check the routing table in the menu IP → RoutesThe active route must go through the wireless network interface.
Diagnosing and troubleshooting connection problems
Even with proper setup, problems can still occur. The first diagnostic tool is the window Wireless → Interfaces → Status. This displays the current connection status, signal strength (signal strength) and noise (noise floor). If you see the status searching, which means the device doesn't see the network or can't associate. Status associating indicates security issues or incompatibility of settings.
For deeper analysis, use MikroTik's built-in tools such as torch or snifferThey allow you to see packets passing through and understand at what point the connection is lost. For example, if you see DHCP requests but no responses, the problem may be with filtering on the ISP's side or the primary access point.
A common problem is low connection speed. This can be caused by a weak signal, interference, or using a narrow channel (20 MHz instead of 40/80 MHz). It's also worth checking the negotiated rate in the interface status—the actual data transfer rate is usually around 50-60% of the theoretical connection rate (PHY rate).
Features of WDS and Station Bridge modes
To create a transparent bridge, when devices behind the client router must be in the same subnet as the main network, WDS modes are used (Wireless Distribution System) or station-bridgeWDS mode requires support from both access points and adds a small overhead per frame. It allows for the forwarding of broadcast traffic, which is necessary for some network services.
Mode station-bridge (or pseudobridge) is a proprietary MikroTik solution. It emulates a transparent bridge, even if the remote access point doesn't support WDS. This is achieved by spoofing the MAC addresses of passing packets. However, this mode has limitations: it may not work correctly with certain types of traffic, such as IPv6 or specific neighbor discovery protocols.
⚠️ Warning: When using a pseudobridge, functions that depend on the client's actual MAC address (for example, speed limiting on the provider's side or static IP allocation by MAC) may not work correctly, since all requests will come from the MAC address of the MikroTik router itself.
The choice between these modes depends on the specific task. If you need maximum compatibility and transparency, and your primary access point is also MikroTik, choose WDS. If you need to connect to someone else's router whose settings you don't know, station-bridge is often the only way to obtain a transparent bridge.
Optimizing wireless channel performance
Once the connection is established, it's important to ensure its stability. In congested environments (such as apartment buildings or office buildings), frequency selection is key. Use a frequency scanner to find the channel with the lowest noise level. For the 2.4 GHz band, non-overlapping channels 1, 6, and 11 are preferred. For 5 GHz, there's a wider choice, and it's best to use a channel width of 40 or 80 MHz, depending on the noise level.
It is also worth paying attention to the transmitter power (tx-power). Setting maximum power isn't always beneficial: it can "jam" the receiver on the other end of the link or create unnecessary interference. The optimal power is determined experimentally to ensure the signal level (RSSI) is in the range of -50 to -65 dBm.
The Impact of Distance on Performance
The Distance parameter in the wireless interface settings determines the ACK timeout. For short distances (up to 1 km), the value can be left at auto or 0. For longer distances, an incorrect Distance setting will result in a sharp drop in speed or connection interruptions, as packets will be lost before they receive an ACK.
Regularly monitoring your link status will help you detect signal degradation early. Built-in graphs in WinBox or third-party monitoring systems (Zabbix, The Dude) allow you to track CCQ (Client Connection Quality). A drop in CCQ below 70-80% indicates issues with the broadcast or settings.
How to reset wireless interface settings?
To reset the settings, go to the Wireless menu, highlight the desired interface, and press the Disable button, then Enable. To completely reset the router, use the physical Reset button on the case or the command system reset-configuration in the terminal. Be careful, this will delete all device settings.
Why does the router see the network but not connect?
The most likely cause is an incorrect password or encryption type in the security profile. Also, check if MAC address filtering is enabled on the access point. Ensure that the frequency and channel width match your provider's settings.
Is it possible to distribute Wi-Fi while receiving it?
Yes, this is possible. To do this, you need to create a virtual interface (Virtual AP) on the same physical card or use a second card. However, the channel bandwidth will be split in half, since the radio module cannot simultaneously transmit and receive data on the same frequency (half-duplex).
What is the maximum range for Station mode?
The range depends on the antennas and their power. With standard antennas, the range indoors is 10-30 meters through walls. With directional antennas (such as SXT or LHG), the range can reach several kilometers with a direct line of sight. The key is to ensure sufficient signal strength and a Fresnel zone.