How to Make a Hidden WiFi Router on Mikrotik: A Complete Guide

Hiding your wireless network identifier (SSID) is a popular method for enhancing the basic security and privacy of your Wi-Fi infrastructure. When your network becomes invisible to standard scanning by surrounding devices, it won't show up in your neighbors' or passersby's list of available connections. However, it's important to understand that the operating system Mikrotik RouterOS This process has its own technical nuances that differ from setting up regular home routers.

Administrators should be aware that simply hiding a username doesn't encrypt traffic or provide a cure-all against hacking, but it does significantly reduce the level of "digital noise" and interest from curious individuals. In this article, we'll discuss how to properly implement this feature using WinBox, command line, and mobile app, and discuss potential compatibility issues with client devices.

Before making changes, make sure you have physical or wired access to the device, as applying the settings will disconnect the wireless connection to the current access point. Proper interface configuration wlan1 or wifi1 will allow you to create a closed environment accessible only to those who know the exact network name and password.

How does a hidden SSID work in RouterOS?

In the ecosystem Mikrotik There are two main approaches to implementing network invisibility, depending on the operating system version and the type of wireless interface. Legacy wireless interfaces use a mechanism for ignoring Probe Requests, while the newer package wifiwave2 or wifi (for current models with Wi-Fi 6) the operating logic may differ due to the requirements of WPA3 security standards.

When you enable hidden network mode, the router stops broadcasting the network name in beacon frames. Client devices wishing to connect must initiate the connection themselves by sending requests with a specific network name. This creates additional bandwidth consumption, as client devices constantly "shout out" the network name in search of the router.

⚠️ Warning: Hiding the SSID is not an encryption method. Attackers using traffic sniffers (e.g., Airodump-ng) will still be able to detect the presence of the network and intercept handshakes to guess the password.

It is important to distinguish between the concepts of "hidden network" and "closed network". In terminology Mikrotik A hidden network means no name broadcasting, while a closed network means no connection without prior authorization (MAC filtering or a portal). For maximum effectiveness, these methods should be combined.

Setting up a hidden access point via WinBox

The most convenient way to configure equipment Mikrotik is the use of the utility WinBoxThis method provides a visual interface that allows even an inexperienced user to quickly find the necessary parameters.

To get started, connect to your router via cable or your current Wi-Fi network. Open WinBox and go to the menu. Wireless (for older versions) or Wifi (for new users) Double-click on your interface, usually labeled as wlan1 or wifi1to open the properties window.

In the window that opens, find the tab Wireless or basic settings. Here you are interested in the parameter Hide SSID (or simply the "Hide SSID" checkbox depending on the firmware version). Setting this option to yes or activating the checkbox will immediately hide the network from normal scanning.

• 🔹 Go to the section Wireless → double-click on the interface.
• 🔹 Find the field Hide SSID and select a value yes.
• 🔹 Click Apply And OK to save changes.
• 🔹 Check the list of networks on your smartphone - your network name should disappear.

After applying the settings, currently connected clients may not lose their connection immediately, but new devices will not see the network in the list. You will need to manually enter the network name (SSID) on each device you want to connect.

Configuration via the command line (CLI)

For experienced administrators and automation scripts, the command line is an indispensable tool. TerminalThe CLI allows you to manage wireless network settings with precision, using syntax understood by the router's operating system.

The command for hiding the SSID depends on the driver package used. For the standard package wireless the command is used set with the interface name. If you are using modern routers with Wi-Fi 6 support and a package wifi, the syntax will be slightly different, since the configuration is located in a separate menu.

# For legacy wireless (old routers)
/interface wireless set wlan1 hide-ssid=yes

For the new wifi package (RouterOS v7, new models)
/wifi access-point set [ find name="wifi1" ] hide-ssid=yes

Once you enter the command, the changes are applied immediately. You can check the current status of the setting by using the command print in the corresponding menu. This is useful if you've forgotten whether hiding is currently enabled.

Using the CLI is especially effective when configuring multiple access points in bulk, where using identical scripts saves a significant amount of time. Don't forget to save the configuration with the command saveso that the settings are not lost after reboot.

Control via the Mikrotik mobile app

Modern administrators often use a mobile application Mikrotik (available for Android and iOS) for quick network management. This allows you to change Wi-Fi settings from anywhere in the office or home, without having to carry a laptop.

The app interface is adapted for touchscreens, so key features, including hiding the SSID, are prominently displayed. After connecting to the router through the app (via local IP or via the cloud), Mikrotik ID), go to the section Wi-Fi or Wireless.

Here you'll see a list of active interfaces. Clicking on the one you want will take you to the editing menu. Find the switch Hide SSID and activate it. The changes will take effect almost immediately, but the app may lose connection to the router if you're connected via Wi-Fi.

What should I do if the app has lost connection?

If you change your Wi-Fi settings while connected to a wireless network, your connection will be lost. You'll need to reconnect to the network by manually entering the SSID or switch to a wired connection to continue setup.

Mobile management is convenient for quickly testing hypotheses or temporarily enabling/boosting the network. However, for in-depth security configuration, such as complex firewall rules or MAC filtering, it is still recommended to use the desktop version. WinBox.

Compatibility issues and client connection

Hiding the SSID creates certain difficulties for client devices. Smartphones based on Android, iOS, as well as laptops running Windows And macOS React differently to the absence of a broadcast network name. Some devices may not even prompt the user to manually enter the network name.

To connect to a hidden network, on most gadgets you need to select the "Other network" or "Enter SSID manually" option. The user must be careful about the case of the letters (Case Sensitive), as MyWiFi And mywifi These are two different networks. A single character error will result in an inability to connect.

⚠️ Warning: Devices with Randomized MAC enabled may have trouble reconnecting to hidden networks if MAC address filtering is configured on the router.

Furthermore, hidden networks can cause increased battery drain on mobile devices. Since the router's presence is invisible, the phone is forced to constantly broadcast Probe Requests into the air, trying to find a familiar network, which increases the radio's power consumption.

Additional network security measures

Hiding the network name is just one layer of protection, often referred to as "security by obscurity." To build a truly secure infrastructure on hardware Mikrotik A comprehensive approach that includes encryption and access control is required.

First of all, make sure that you are using a modern encryption protocol. WPA2-AES or WPA3. Obsolete protocols WEP And TKIP They can be easily hacked in minutes, regardless of whether the network is hidden or not. In RouterOS, these settings are located in the Security Profile.

It is also recommended to disable the function WPS (Wi-Fi Protected Setup) if it is enabled, as it is a known vulnerability. For corporate networks, the ideal solution would be to implement authentication via RADIUS server, which will allow issuing individual access keys for each employee.

• 🔒 Use complex passwords longer than 12 characters.
• 🔒 Disable WPS in your wireless network settings.
• 🔒 Regularly update RouterOS to the latest stable version.
• 🔒 Consider using a separate guest network (Guest VLAN).

The combination of a hidden SSID, strong encryption, and MAC address filtering (though the latter method isn't perfect either) creates a fairly high barrier to entry for an amateur attacker or simply a nosy neighbor.

FAQ: Frequently Asked Questions

Will my Wi-Fi speed decrease after hiding the SSID?

Hiding the network name itself doesn't reduce channel throughput. However, because client devices are forced to constantly send Probe Requests, the overall airtime load may increase slightly. In very densely populated areas, this could theoretically impact stability, but not speed.

Is it possible to hack a hidden network?

Yes, a hidden network can be detected. Specialized software (for example, Kismet or Airodump-ng) ignores the absence of a name in packet headers and waits for a legitimate client to connect to the network. At this point, the network name (SSID) is transmitted in cleartext, and the attacker records it.

What to do if the phone does not see the hidden network?

On Android and iOS, select "Add network manually" or "Other." Enter the exact name (SSID) and select the security type (usually WPA2/WPA3). Make sure you don't make any capitalization errors.

Does hiding the SSID affect smart home functionality?

Many IoT devices (light bulbs, sockets) have simplified Wi-Fi modules that may not work properly with hidden networks or take a long time to connect when turned on. If you have a lot of smart devices, hiding the SSID can create additional connection issues.