Changing the wireless network access key is one of the basic operations that administrators perform to maintain security local infrastructure. In the equipment ecosystem MikroTik This process has its own specifics, different from setting up standard consumer routers. Proper access point configuration protects against unauthorized connections and traffic interception by attackers.
RouterOS management interfaces such as WinBox or WebFig, provide flexible tools for managing wireless profiles. Understanding the interface logic Wireless Allows you to not only change the characters in the password field but also optimize encryption parameters. This is especially relevant when old security protocols are no longer reliable.
In this article, we'll detail the steps for different operating system versions. You'll learn where the necessary settings are hidden and how to avoid common configuration errors. A smart approach to authentication users are the key to the stable operation of your network.
Preparing to change security settings
Before making any configuration changes, you must ensure a stable connection to the device being managed. It is best to perform configuration via cable connection Ethernet to avoid connection interruptions when applying new security settings. If you're changing your password remotely via Wi-Fi, be prepared for the connection to be interrupted immediately after the settings are applied.
To work you will need a utility WinBox, which is the de facto standard for hardware administration MikroTikAn alternative is the web interface accessible via the gateway's IP address, but it may be slower and less functional in older versions of RouterOS. Make sure you have administrator rights (login admin or another user with full rights).
⚠️ Attention: Before making changes to the Wireless section, we recommend backing up your configuration. If an error occurs, you can quickly restore the access point to working order.
It's also worth determining in advance which encryption standard will be used. Modern requirements dictate the use of a protocol WPA2 or WPA3, as legacy WEP can be easily cracked in minutes. Choosing the right encryption algorithm is critical to data security.
Setup via WinBox: Step-by-Step Algorithm
Run the utility WinBox and connect to the router by entering its MAC address or IP address. After successful authorization, the main interface window will open. Find the section in the left menu Wireless and left-click on it. A window will open with a list of all wireless interfaces present on the device.
In the list that opens, select the required interface (usually it is designated as wlan1 or wifi1). Double-click on the line with the interface or click the button with the pencil image (Edit) to open the properties window. Go to the tab Security ProfileThis is where the key security settings for your network are located.
In the field Security Profile a profile may be selected by default defaultYou can change the settings in an existing profile or create a new one by clicking the button + in the Security Profiles window. To create a new key in the field WPA Pre-Shared Key Enter the desired character combination. Make sure the modes WPA2 PSK And WPA2 EAP (if necessary) activated.
- 🔑 Select encryption type AES CCMP for maximum compatibility and security.
- 📶 Make sure the checkbox is checked
Enabledis installed in the interface properties window, otherwise Wi-Fi will not work. - 💾 Click the button
OKand thenApply, so that the changes take effect immediately.
After applying the settings, all connected devices will be disconnected from the network. You will need to re-enter the new password on each device. If the connection fails, check whether your devices are blocked by a firewall or MAC address filter.
☑️ Check WinBox settings
Changing your password via the WebFig web interface
Web interface WebFig Provides convenient access to settings without the need to install additional software. Open a browser and enter the router's IP address. After entering your username and password, go to the menu. WirelessThe interface may differ depending on the RouterOS version, but the logic remains the same.
Find the table with interfaces and click on the name of your wireless module (for example, wlan1). In the menu that opens, select the tab SecurityHere you will see a field Passphrase, where you must enter the new access key. The system may require confirmation of the password in the second field.
Please note the drop down list Authentication TypesFor a home network, the optimal choice would be WPA2 PSKIf you're using a guest network, you can consider client isolation, but that's a more complex configuration. Don't forget to click the button Save or Apply at the bottom of the page.
⚠️ Attention: When working through a web interface, your session may expire before you can complete the configuration. Save your changes frequently to avoid losing your input.
In newer versions of RouterOS (v7 and above), the interface has become more user-friendly, but additional tabs for managing frequencies and power have been added. Make sure you're editing the security profile, not the radio module settings. Incorrectly changing the frequency can result in clients simply not seeing the network.
What should I do if WebFig won't open?
If the web interface is unavailable, check whether the www or www-ssl service is enabled in the IP -> Services section. Also, make sure your IP address is in the same subnet as your router.
Selecting an encryption protocol and security version
Wireless network security directly depends on the selected protocol. In the interface MikroTik you may come across abbreviations WEP, WPA, WPA2 And WPA3Using WEP is strongly discouraged, as this standard was cracked two decades ago and provides no real security.
Protocol WPA2 (Wi-Fi Protected Access 2) is currently the gold standard for most devices. It uses an encryption algorithm AES, which is considered reliable. In the security profile settings MikroTik you should choose a combination WPA2 PSK with encryption AES CCMPThis will provide the best balance between speed and protection.
The latest standard WPA3 Appears in the latest hardware models and versions of RouterOS. It protects against brute-force attacks and provides improved encryption on open networks. However, if you have older devices (printers, smart plugs), they may not connect to a network with WPA3 enabled.
| Protocol | Algorithm | Security | Compatibility |
|---|---|---|---|
| WEP | RC4 | Critically low | Obsolete devices |
| WPA | TKIP | Low | Old gadgets |
| WPA2 | AES | High | All modern devices |
| WPA3 | SAE/AES | Maximum | The latest devices |
When selecting a mixed mode (for example, WPA + WPA2) The router allows both old and new devices to connect. However, this may slightly reduce overall network performance. If all your clients support WPA2, it's best to disable support for legacy protocols.
Setting up guest access and isolation
There is often a need to provide Internet access to guests without giving them access to your main local network. MikroTik This is implemented by creating a separate virtual interface or using the function AP IsolationThis allows us to separate traffic flows and improve the security of personal data.
To create a guest network, you can add a new security profile with a different password. In the wireless interface settings (Wireless -> Security Profiles) create a new profile, name it, for example, Guest, and set a separate WPA Pre-Shared KeyThis profile must then be bound to a virtual interface or used in the main configuration with the appropriate firewall rules.
- 🛡️ Turn on the option
Hide SSID, if you want the network to be hidden from regular scanning. - 🚫 Use
Default Forward= no for complete isolation of clients from each other. - 🔌 Set up a separate subnet (VLAN) for guest traffic if strict separation is required.
Use tools to control the load Queue Tree or Simple QueuesThis will prevent a situation where one guest overloads the channel with torrents, leaving everyone else without internet access.
⚠️ Attention: Interfaces and menu item names may vary depending on the RouterOS version. In version 7, the menu structure has been significantly redesigned compared to version 6.
Solving common connection problems
After changing a password, users often encounter devices that "don't see" the network or refuse to connect, returning an authentication error. First, try "forgetting" the network on the client device. Smartphones and laptops often cache old security settings and attempt to apply them to the updated configuration, which causes conflicts.
If the error persists, please check your region settings (Country). IN MikroTik requires you to select the country you're in so that the router uses the permitted frequencies and power levels. Selecting the wrong region may result in some channels being unavailable or devices being unable to connect.
It is also worth paying attention to the channel width (Channel Width). Setting the value 20/40MHz Ce or 20/40/80MHz may increase the speed, but in noisy air conditions (many neighboring networks) it is better to force it 20MHzThis will increase the stability of the connection, even if the maximum speed drops.
In complex cases, a complete reset of the wireless module's configuration and a new profile can help. Configuration files sometimes accumulate errors or debris from previous settings, preventing proper operation. A clean profile often resolves mysterious client dropout issues.
Additional wireless network security measures
Changing your password is just the first step. For professional network security, MikroTik recommends implementing a MAC address filter. While it can be bypassed, it creates an additional barrier to unauthorized access. See the section Wireless -> Access List You can allow connections only to trusted devices.
Don't forget to update your firmware (System -> Packages). Developers MikroTik regularly releases patches to fix vulnerabilities in encryption protocols. Running an outdated version of RouterOS can ruin all your efforts to set up strong passwords.
Use monitoring of connected clients (Wireless -> Interfaces -> button Connect List). Periodically reviewing this list allows you to quickly identify unauthorized users. If you see an unfamiliar device, change the password immediately and check the logs.
How often should I change my Wi-Fi password?
For a home network, changing the password every 6-12 months or when tenants change is sufficient. In the corporate sector, account credentials should be changed more frequently, in accordance with the company's security policy, especially after employee departures.
Is it possible to recover a forgotten password on a router?
If you haven't written down your password, it can't be "remembered" through the router, as it's stored in hashed form. However, if you have physical access and administrator rights, you can easily view the current password in the security profile settings in WinBox or WebFig.
Does changing your password affect your internet speed?
Changing the password itself doesn't affect speed. However, if you change the encryption protocol (for example, from AES to TKIP) or the channel during setup, speed may change. AES is the most efficient protocol.
What should I do if my router stops responding after changing the password?
You've likely blocked yourself with firewall rules or misconfigured your IP settings. Try connecting with a cable. If that doesn't help, you'll need to perform a hard reset (press the Reset button on the device) and reconfigure the device from scratch.