How to Set Up Guest Wi-Fi on a MikroTik: A Secure Network for Visitors

Creating a separate guest Wi-Fi network on equipment MikroTik — is not a luxury, but a necessity for protecting the main local network from unauthorized access, viruses, or accidental data leaks. Unlike home routers with simplified settings, MikroTik RouterOS Offers flexible tools for fine-tuning guest access: from isolating clients from each other to limiting bandwidth and redirecting to the authorization page.

In this article you will find step-by-step instructions taking into account the features of the latest versions RouterOS 7.x, relevant for models hAP ac², RB4011, CCR2004 and others. We'll look at two scenarios: a simple guest network with a password and an advanced configuration with HotSpot- authorization, time limits, and blocking of unwanted sites. All commands are given in the format CLI and with visual screenshots from WinBox.

Why do you need guest Wi-Fi on MikroTik?

The core network of your office or home contains sensitive data, such as access to NAS storage, IP cameras, printers, or corporate resources. Connecting unauthorized devices to this network poses the following risks:

• 🔍 Data leaks — a guest can accidentally or intentionally scan the local network and access shared folders.
• 🦠 Spread of viruses — an infected visitor's device can infect other gadgets on the network.
• 🚫 Violation of security policy — in corporate networks, connecting third-party devices is often prohibited by internal regulations.
• 🐢 Channel overload — guests can consume the lion's share of traffic, slowing down the work of primary users.

Guest Wi-Fi on MikroTik solves these problems by:

• 🔒 Traffic isolation — guest devices do not see the main network and each other (AP Isolation).
• 📉 Speed ​​limits - You can allocate a fixed bandwidth to guests (for example, 5 Mbps per device).
• ⏱️ Access time control — automatic shutdown according to a schedule (for example, only during working hours).
• 🌐 Redirects to the consent page — mandatory acceptance of the terms of use before connection.

Bonus: Guest network can serve marketing toolFor example, in a cafe or hotel, you could redirect users to a promotions page or require a like on social media to join.

Preparing the router: checking hardware and versions

Before setting up, make sure that your equipment supports the creation of multiple Wi-Fi networks (Multiple SSID). This is possible on all devices. MikroTik with wireless module, including:

• hAP ac² (RB962UiGS-5HacT2HnT)
• RB4011iGS+5HacQ2HnD
• Audiences (RBcAPGi-5acD2nD)
• CCR2004-1G-12S+2XS (with connected Wi-Fi module)

Also check:

1. RouterOS version — minimum recommended version: 6.48.6 (stable) or 7.1+ (for new features). You can check the version with the command:

   /system resource print

2. Availability of free IP addresses — the guest network will require a separate range (for example, 192.168.90.0/24).
3. Free Wi-Fi interface — If you have a single-frequency router (for example, only 2.4 GHz), the guest network will operate in the same range, which may reduce performance.

⚠️ Attention: If your MikroTik used as CAPsMAN- controller (centralized management of access points), guest network configuration is performed through Datapath And Security profiles. The instructions for this scenario are different - please refer to the section Guest Wi-Fi at CAPsMAN.

Method 1: Simple Guest Network with Password (without HotSpot)

This method is suitable for home use or small offices where portal authentication is not required. We'll create a separate SSID with client isolation and speed limiting.

Step 1: Create a bridge for the guest network

We will route guest traffic through a separate bridge (bridge) to isolate it from the main network:

/interface bridge add name=guest-bridge
/interface bridge port add bridge=guest-bridge interface=ether2 # Replace ether2 with your physical port if needed

Step 2: Setting up the Wi-Fi interface

Let's add a virtual Wi-Fi interface for the guest network. If you have a dual-band router (2.4 + 5 GHz), repeat the steps for both bands:

/interface wireless security-profiles add name=guest-security wpa2-pre-shared-key=YourPassword123
/interface wireless add name=guest-wifi master-interface=wlan1 security-profile=guest-security ssid=GuestWiFi

Where:

• wlan1 - your primary Wi-Fi interface (check in /interface wireless print).
• GuestWiFi — guest network name (can be changed).
• YourPassword123 — connection password (minimum 8 characters).

Step 3: Bind Wi-Fi to the Bridge

Now let's connect the guest Wi-Fi to the created bridge:

/interface wireless set guest-wifi master-interface=wlan1 disabled=no
/interface bridge port add bridge=guest-bridge interface=guest-wifi

Step 4: Configure DHCP and Firewall

Let's assign guests a separate IP range and prohibit access to the local network:

/ip pool add name=guest-pool ranges=192.168.90.2-192.168.90.254
/ip dhcp-server add name=guest-dhcp interface=guest-bridge address-pool=guest-pool lease-time=1h
/ip dhcp-server network add address=192.168.90.0/24 gateway=192.168.90.1 dns-server=8.8.8.8,1.1.1.1

Blocking guest access to the main network
/ip firewall filter add chain=forward src-address=192.168.90.0/24 dst-address=192.168.88.0/24 action=drop comment="Block guest to LAN"
/ip firewall filter add chain=forward src-address=192.168.90.0/24 dst-address=192.168.90.0/24 action=drop comment="Block guest to guest"

Step 5: Speed ​​Limit (Optional)

To prevent guests from consuming the entire bandwidth, we'll limit their speed to 5 Mbps per device:

/queue simple add name=guest-limit target=192.168.90.0/24 max-limit=5M/5M

Done! You now have an isolated guest network with a password. Connect to it from your phone and verify that:

• 📶 Internet access is available.
• 🚫 No access to devices on the main network (for example, to the router via 192.168.88.1).
• 📉 Speed ​​is limited (if limit is set).

Method 2: Guest Wi-Fi with HotSpot (Capture Portal)

If you need users to accept terms of use or enter a login/password (for example, in a hotel or cafe), use the built-in HotSpot server MikroTikThis method is more complicated, but provides more control.

Step 1: Create a bridge and Wi-Fi interface

Repeat Steps 1-3 from the previous methodto create a bridge guest-bridge and Wi-Fi interface guest-wifi. The Wi-Fi password can be made simple (for example, guest123), since the main authorization will be through the portal.

Step 2: Setting up the HotSpot server

Let's install HotSpot on the guest bridge:

/ip hotspot setup
Select the guest bridge interface
Set the IP address for the HotSpot (e.g. 192.168.90.1)
Specify a range for clients (e.g. 192.168.90.2-192.168.90.254)
Enter DNS servers (8.8.8.8, 1.1.1.1)
Create a user for the test (e.g. login: user, password: 123)

Once configured, edit the HotSpot profile to add a consent page:

/ip hotspot profile set [find default=yes] login-by=cookie,http-chap html-directory=flash/hotspot

Step 3: Customizing the Login Page

By default MikroTik Shows the standard login page. To replace it with your own (with a logo, rules, or advertising):

1. Download the page template from official website.
2. Edit the files (eg. login.html) in any text editor.
3. Upload files to the router:

   /file print # Check free space
   /tool ​​fetch url=http://your-server/login.html dst-path=flash/hotspot/login.html

<div>
<h3>Wi-Fi Usage Guidelines</h3>
<p>By connecting to the network, you agree not to distribute illegal content or attempt to hack the network.</p>
<label><input type="checkbox" id="accept" required>I accept the terms and conditions</label>
</div>

Step 4: Configure the Firewall for HotSpot

We will only allow guests access to the HotSpot portal and the Internet:

/ip firewall filter add chain=forward src-address=192.168.90.0/24 dst-port=80,443,53 action=accept comment="Allow HotSpot and DNS"
/ip firewall filter add chain=forward src-address=192.168.90.0/24 out-interface=pppoe-out1 action=accept comment="Allow Internet"
/ip firewall filter add chain=forward src-address=192.168.90.0/24 action=drop comment="Drop all other guest traffic"

Step 5: Testing

Connect to the guest network GuestWiFiYou should see:

1. Authorization page instead of internet access.
2. A field for entering login/password (if configured) or the "Accept rules" button.
3. After authorization, you have full access to the Internet, but without the ability to see local devices.

⚠️ Attention: If you use MikroTik in a public place (cafe, hotel), be sure to set up connection logging:

/ip hotspot user profile set [find default=yes] shared-users=10 idle-timeout=5m keepalive-timeout=2h

This will automatically disable inactive users and limit the number of devices per account.

Additional settings: restrictions and security

A basic guest network setup may not be enough to protect against intruders or optimize traffic. Let's look at advanced options.

1. Blocking unwanted websites

To block access to torrents, social networks or adult content, use Layer7 filter or DNS blocking:

/ip firewall layer7-protocol add name=torrent regexp="^.(BitTorrent|peer_id=|announce.php?|torrent)." regexp="^.(xunlei|XLLiveUD).$"
/ip firewall filter add chain=forward src-address=192.168.90.0/24 layer7-protocol=torrent action=drop comment="Block Torrent"

To block by DNS, add a rule:

/ip dns static add name=vk.com address=0.0.0.0 disabled=no
/ip dns static add name=facebook.com address=0.0.0.0 disabled=no

2. Time limit

For example, let's allow guest access only from 9:00 to 18:00:

/ip firewall filter add chain=forward src-address=192.168.90.0/24 time=09:00:00-18:00:00,mon,tue,wed,thu,fri,sat,sun action=accept comment="Allow guests only in working hours"
/ip firewall filter add chain=forward src-address=192.168.90.0/24 action=drop comment="Drop guests outside schedule"

3. Client Isolation (AP Isolation)

By default, devices on the guest network can communicate with each other. To disable this:

/interface wireless set guest-wifi hide-ssid=no security-profile=guest-security default-authentication=yes \
default-forwarding=no # This disables communication between clients

4. Monitoring connections

To see who is connected to the guest network, use:

/ip hotspot active print # For HotSpot
/ip dhcp-server lease print # For a simple guest network

Guest Wi-Fi in CAPsMAN mode (for managed access points)

If your MikroTik manages multiple access points via CAPsMAN, guest network setup is performed centrally. Key steps:

1. Create a separate one Datapath:

   /caps-man datapath add bridge=guest-bridge local-forwarding=yes name=guest-datapath

2. Set up Security profile:

   /caps-man security add name=guest-security encryption=aes-ccm authentication-types=wpa2-psk passphrase=YourPassword123

3. Add the guest SSID to the configuration:

   /caps-man configuration add country=russia datapath=guest-datapath name=guest-config security=guest-security ssid=GuestWiFi

4. Bind the configuration to the access points:

   /caps-man provisioning add action=create-dynamic-enabled master-configuration=guest-config slave-configurations=guest-config

The remaining settings (firewall, DHCP, HotSpot) are performed similarly to the previous sections, but apply to the bridge guest-bridge.

Troubleshooting

If the guest network is not working, check:

• 🔌 Physical connection: Make sure the Wi-Fi module is turned on (/interface wireless print must show running=yes).
• 📡 Signal: Check the signal strength on the client device. If it is weak, reduce the transmission power (/interface wireless set wlan1 tx-power=20).
• 🔒 Firewall: Temporarily disabling all firewall rules will help identify blocking:

  /ip firewall disable [find]

• 🔄 DHCP: Make sure clients are receiving an IP address. Check the log:

  /log print | find "dhcp"

Typical mistakes:

• Guests do not receive an IP: Verify that the DHCP server is bound to the correct interface (guest-bridge).
• No internet access: Make sure your firewall has a rule that allows WAN access for the range 192.168.90.0/24.
• HotSpot does not show the page: Please check that it is specified in your profile settings. login-by=http-chap and HTML files are uploaded to /flash/hotspot.

⚠️ Attention: If you use VLAN For a guest network, make sure the port the access points are connected to is configured as trunk and passes tagged traffic. Example of setup for ether2:

/interface bridge port set [find interface=ether2] pvid=100 # Where 100 is the VLAN ID for guests
/interface bridge vlan add bridge=guest-bridge tagged=guest-bridge,ether2 untagged=guest-wifi vlan-ids=100

FAQ: Frequently Asked Questions about Guest Wi-Fi on MikroTik

/ip hotspot user profile set [find default=yes] shared-users=5

/system scheduler add name=guest-wifi-off start-time=23:00:00 interval=1d on-event="/interface wireless disable guest-wifi"
/system scheduler add name=guest-wifi-on start-time=07:00:00 interval=1d on-event="/interface wireless enable guest-wifi"