Establishing a wireless connection between two remote points often becomes the only reasonable solution when laying fiber optic or twisted pair cables is physically impossible or economically impractical. Mikrotik For many years, it has held a leading position in this segment thanks to the flexibility of the RouterOS operating system and a wide range of hardware models. A properly configured link can provide throughput comparable to wired channels, provided there is a clear line of sight.
Unlike simple consumer routers, devices from MikroTik Allows detailed configuration of every radio channel parameter, from bandwidth to transmitter power. This gives the network administrator complete control over connection stability, even in noisy environments. However, such flexibility requires a thorough understanding of the operating principles of 802.11 wireless networks.
In this article, we'll walk you through the process of creating a stable bridge step by step, focusing not only on command entry but also on the physical aspects of antenna installation. You'll learn which operating mode to choose for your application and how to avoid common mistakes that reduce speed. Having the right equipment and a basic understanding of network topology will ensure a successful setup.
Equipment selection and line planning
The first step is always selecting compatible devices, as bridging between different manufacturers often results in reduced performance or complete failure of the link. To build a reliable system, it's best to use equipment from the same series, for example, SXT, LHG or NetMetal, which are optimized for operation in various frequency ranges. It's important to determine the distance between points and the presence of obstacles in advance, as this determines the frequency selection: 2.4 GHz is better at avoiding obstacles, while 5 GHz provides higher speeds in a direct beam.
When planning a communication line, it's crucial to consider the Fresnel zoneβan ellipsoidal space around the line of sight that must be clear of obstacles to ensure a high-quality signal. Even if you can visually see a distant antenna, trees or buildings can block the lower part of this zone, causing reflections and signal attenuation. Antennas It is necessary to install them on masts of such a height as to ensure a clear beam, otherwise no software settings will save the link from constant breaks.
Connecting two network segments typically requires one point in mode AP Bridge (access point), and the second one is in the mode Station Bridge (client). If it is necessary to connect more than two points or provide redundancy, the scheme may become more complex, requiring the use of a protocol WDS or NV2In most point-to-point scenarios, the classic AP and Station combination demonstrates the best stability and ease of debugging.
β οΈ Attention: Please ensure that the frequency you select is license-free in your area, as radio spectrum regulations may vary.
Lightning protection should also be considered, especially if the antennas are located on a roof or a tall mast. Lightning discharges can damage not only the radio module but also the switches in the server room via the Ethernet cable. The use of high-quality grounded masts and specialized lightning arrestors is a mandatory requirement for outdoor installations.
Basic RouterOS setup
Before configuring the wireless interface, you should reset the router's basic configuration by resetting any unnecessary settings if the device is not new. Connect to the device via WinBox or the web interface and ensure the operating system is up to date, as older versions may contain errors in the wireless card drivers. It is recommended to reset the configuration via the menu. System β Reset Configuration, by selecting the option No Default Configto start from scratch.
The next step is to assign each device a unique IP address from the same subnet so they can "see" each other via a cable or temporary wireless connection. For example, you could set the address for an access point (AP) to 192.168.10.1/24, and for a client station (Station) to 192.168.10.2/24. Don't forget to create a rule in IP β Firewall, allowing input connections if you plan to control the device wirelessly.
Time synchronization is important, as event logs and security certificates depend on the correct time. Configure the client NTP on the menu System β NTP Client, specifying the address of a public time server so that both devices keep the same clock. This will make it easier to diagnose problems in the future when analyzing connection logs.
βοΈ Preparing to set up the bridge
After the basic setup, you can move on to the actual radio interface configuration. Make sure you're working with the correct interface, especially on dual-band devices, where it's important not to mix them up. wlan1 And wlan2.
Access Point (AP Bridge) Configuration
Setting up an access point begins with selecting the correct operating mode for the wireless interface. In the menu Wireless Double click on your card interface and in the field Mode select a value ap-bridgeThis mode allows the device to accept connections from client stations and transmit traffic to the wired network.
Next, you need to set the radio channel parameters. In the field Frequency Specify the specific frequency on which the link will operate, avoiding the mode auto, which can lead to instability when rebooting. Channel width (Channel Width) should be selected depending on the noise level of the air: 20/40 MHz Ce or 20/40 MHz eC will provide maximum speed, but in crowded air it is better to limit yourself to 20 MHz for stability.
For security and network identification, set a name SSID and enable encryption. In the section Wireless Security Profile create a new profile or edit an existing one, selecting the encryption mode WPA2 PSK and setting a complex password. Using older encryption protocols, such as WEP, is strongly discouraged due to their low security.
It is also worth paying attention to the settings Advanced Mode in the wireless interface window. Here you can limit the maximum transmitter power (TX Power) to avoid jamming neighboring networks and complying with health and safety regulations. For short distances, reducing power often improves signal quality by reducing noise and interference.
Setting up a client station (Station Bridge)
On the client side, the algorithm is similar, but there are critical differences in the operating mode selection. In the wireless interface settings, select the mode station-bridge, if you need to create a transparent bridge (L2) so that devices behind the client router are on the same subnet as those on the server side. If the mode station-bridge is not supported by your card model, you will have to use station with VLAN forwarding or NAT, which will complicate the topology.
In the field SSID Enter the name of the network created on the access point or use the button Scan to search for available networks. Once your network is found, click Connectto have the device attempt to associate with the access point. Make sure the security profile contains the same encryption settings and password as the server.
Pay special attention to the parameter WDS Mode. For the transparent bridge to operate in the mode station-bridge Enabling WDS is often required. Set the value dynamic or static depending on your setup, but in most cases, standard bridge settings without explicitly specifying WDS are sufficient for a simple connection between two devices if the mode is used station-bridge.
Why isn't station-bridge working?
Station-bridge mode is a proprietary MikroTik extension. It only works between MikroTik devices. If you try to connect a smartphone or router from another manufacturer to such an access point, the connection will fail, as standard clients don't understand the specific packet headers of this mode.
After successful connection in the list Wireless β Registration Table The client device's MAC address should appear on the access point with the "authorized" status. If the status is "associating," check the passwords and encryption mode compatibility.
Organizing a transparent bridge
A configured interface alone doesn't forward traffic between ports. To combine the wireless connection and wired Ethernet ports into a single network, you need to create a software bridge. Go to the menu Bridge and add a new bridge (usually bridge1), if it is not already created automatically.
In the created bridge, you need to add ports. Add your wireless interface (for example, wlan1) and the necessary wired ports (eg ether2, ether3). Now, traffic coming over the air will be transparently transmitted to wired ports and vice versa, as if the devices were connected by a switch.
Configuring the DHCP server is crucial. In a transparent bridge configuration, the DHCP server should only be enabled on one device (usually the main router or access point) to avoid address conflicts. A client device in bridge mode should not enable its own DHCP server for client ports, otherwise, chaos will arise with IP address assignment.
| Parameter | Access point (AP) | Client (Station) |
|---|---|---|
| Opening hours | ap-bridge | station-bridge |
| Frequency | Fixed (Master) | Matches AP |
| WDS | Disabled / Dynamic | Disabled / Dynamic |
| DHCP Server | Enabled (on Bridge) | Turned off |
The bridge's functionality is checked by the command ping From the device connected to the client port to the gateway or any node on the server network. If the ping is lossless, the L2 connection is established correctly.
Link optimization and diagnostics
After the initial launch, fine-tuning is required to achieve maximum performance. In the menu Wireless go to the tab Registration Table, select the connected client and look at the parameters Signal Strength And CCQThe signal should be in the range of -45 to -65 dBm for ideal operation, and CCQ (Client Connection Quality) should be close to 100%.
If you see a low CCQ with a good signal strength, this indicates high noise or interference. In this case, it might be worth changing to a less crowded frequency or reducing the channel width. Using the tool Tools β Wireless Tables β Snooper will help you analyze the airwaves and choose the optimal frequency.
To protect against accidental connections from third-party devices, use the MAC address filter. In the menu Wireless β Access List Create a rule that allows connections only to your station's specific MAC address and denies all other connections. This will add an extra layer of security on top of WPA2 encryption.
Don't forget to monitor CPU load. At high wireless connection speeds, the router's processor may struggle to handle packet processing, especially if heavy firewall or encryption features are enabled. Monitor the load in the menu. System β Resources.
Common errors and how to fix them
One of the most common problems is time desynchronization or a wireless card driver glitch, which can be resolved by rebooting the radio interface. If the link is lost, try using the menu. Wireless press the button Disable, and then Enable on the interface without rebooting the entire router.
A common mistake is ignoring antenna polarization. If one antenna is installed vertically and the other horizontally, you'll lose up to 20 dB of signal, rendering the link inoperable. Always check the physical orientation of the antennas and the markings on the connectors before final installation.
β οΈ Attention: Never look directly into the transmitting antenna, especially in the 5 GHz band and above, as this can be hazardous to your health. Perform all alignment work remotely or with the transmitter turned off.
Problems can also arise due to MTU (Maximum Transmission Unit) mismatches. If packets are fragmented, speeds drop. Make sure the interface settings on both ends of the bridge are correct. Bridge parameter MTU set to 1500 or less if required by your provider.
Frequently Asked Questions (FAQ)
Is it possible to create a bridge between MikroTik and equipment from another brand?
In mode station-bridge - No, it's a proprietary protocol. However, you can use the mode station (client) on the MikroTik side and set up tunnels or NAT, or use the universal WDS mode if the partner's equipment also supports it, but the stability of such a connection is not guaranteed.
What is the maximum range possible for a WiFi bridge?
Theoretically, with directional antennas (eg, Dish or Parabolic) can reach ranges of 50-80 km. However, in practice, everything depends on the terrain, the curvature of the Earth, and the presence of interference. For distances over 20 km, professional link calculations and possibly a frequency license are required.
Why is the speed in real-world testing lower than stated in the specifications?
The wireless channel is half-duplex, meaning a device cannot transmit and receive data simultaneously on the same frequency. The actual speed will always be 50-60% of the theoretical link speed due to protocol overhead, packet delivery acknowledgements (ACKs), and airtime contention.
Should the Ethernet cable going to the antenna be shielded?
Yes, using a U/FTP or S/FTP cable with high-quality shielding and properly crimped connectors is critical. A poorly designed cable acts as an antenna, picking up interference and introducing noise into the radio module's sensitive receiver, dramatically reducing connection quality.