Configuring wireless network security is one of the first steps an administrator should take after installing the equipment. Open internet access not only allows outsiders to use your traffic but also compromises the privacy of the data you transmit. In the ecosystem MikroTik This process requires a more detailed approach than in home solutions, since there is no automatic quick setup wizard.
You will be working with professional tools, where every parameter matters. Setting a password — this is only part of a comprehensive network perimeter security measure. Incorrect configuration can leave the network vulnerable to man-in-the-middle attacks even with a password.
In this guide, we'll walk you through the process from connection to final encryption verification. You'll learn how to create robust security profiles and manage access lists. This knowledge is essential for ensuring the stable operation of a corporate or home network running RouterOS hardware.
Preparing to set up security
Before making any configuration changes, ensure a stable connection to the device. It is recommended to use a wired connection via the Ethernet port, as the Wi-Fi connection may be interrupted during wireless setup. If you are working remotely, ensure you have a backup connection.
To manage your router, you will need a utility. WinBoxThis is a native tool that provides full access to all operating system functions. A web interface is also available, but it is less informative when debugging complex security scenarios.
Make sure you know the device's IP address and have administrator rights. Default credentials often change during initial setup, so check the documentation or the sticker on the device. If access is lost, a factory reset may be necessary.
WinBox interface and menu navigation
After launching the program and successfully connecting to the router, the main window will open. The interface may seem cluttered, but for our purposes, only a few sections are needed. Navigation is via the left vertical menu or the top menu bar. Wireless.
We need to go to the section WirelessThis is where all the parameters related to the radio modules are located. In the window that opens, you will see a list of available interfaces, for example, wlan1 or wifi1, depending on the model of your equipment.
⚠️ Note: Interfaces may have different names depending on the installed card. Do not confuse the access point interface with the client or bridge interface.
Double-click the interface name to open its properties window. Here you'll find tabs for configuring the frequency, signal strength, and, most importantly for us, security settings. The tab Wireless Contains the main operating mode switches.
Creating a security profile and selecting encryption
In the wireless interface properties window, find the field Security ProfileBy default, the value may be selected there. defaultWe need to create a new profile or edit an existing one to set specific encryption parameters. Click the three-dot button next to the selection field.
In the security profiles window that opens, click the button + to create a new rule. Give it a descriptive name, for example, home-secure or office-wpa2This will help you quickly identify settings in the future if there are several of them.
The key point is to select the encryption mode in the field ModeFor maximum compatibility and security in today's environment, it is recommended to choose dynamic keysThis mode allows you to use the WPA2 or WPA3 protocols, which provide reliable traffic encryption.
In the field Authentication Types make sure they are selected WPA2 PSK or WPA3 PSKAvoid using the outdated WEP standard, as it can be cracked in seconds using any available software. It's also worth disabling WPA1 support unless your network includes very old devices.
What is the difference between WPA2 and WPA3?
WPA3 is a more modern standard that protects against brute-force attacks even with weak passwords. However, some older devices (post-2018) may not support this protocol and will not be able to connect to the network.
Generating and setting a complex password
After selecting the encryption mode, the field becomes active. PassphraseThis is where you enter the access key that clients will use to connect. The password must be at least 8 characters long, but for true security, it's recommended to use strings between 12 and 20 characters.
Use a combination of uppercase and lowercase letters, numbers, and special characters. Avoid dictionary words and obvious sequences. Password Pre-Shared Key (PSK) is the only barrier between your network and an unauthorized user in home network mode.
- 🔒 Use at least 12 characters to ensure reliable protection against brute-force attacks.
- 🔑 Include special characters in your password: !, @, #, $, %.
- 🚫 Do not use birth dates, phone numbers, or simple sequences like 123456.
After entering the password, click OKto save the profile. Then, in the interface properties window, make sure that the Security Profile The profile you created is selected. Apply the changes by clicking the button. Apply And OK.
☑️ Check security settings
Setting up access lists (Access List)
To increase the level of security, it is not enough to simply set a password. RouterOS There is a powerful tool called Access ListIt allows you to create rules that allow or deny connections to specific devices based on their MAC address.
Go to the tab Access List in the wireless interface window. Here you can add a rule that will block all devices except those on the whitelist. This is especially useful for office networks or networks with limited access.
| Parameter | Meaning | Description |
|---|---|---|
| MAC Address | 00:00:00:00:00:00 | Address of the device that is allowed access |
| Interface | wlan1 | The interface to which the rule applies |
| Allow | Yes | Allow connection |
| Comment | Admin Phone | Description of the device for convenience |
To deny all unknown devices access, create a rule with a blank MAC address and set the flag Allow in meaning NoPlace this rule at the very bottom of the list. This way, specific permissions are checked first, and then a general denial is applied.
Hiding the SSID and additional security measures
One popular measure, although not 100% guaranteed, is to hide the network name (SSID). In the interface settings Wireless uncheck the box Default Authenticate and set the flag Hide SSID V YesThe network will no longer be visible in the list of networks available to regular users.
However, it's important to understand that a skilled attacker can still detect a hidden network by analyzing service packets. Therefore, this measure is more of a preventative measure, protecting against accidental connections from neighbors simply looking for an available network.
⚠️ Note: Hiding the SSID may cause connection issues on some mobile devices and IoT devices. These devices may constantly scan the air for known networks, which increases battery drain.
Also, don't forget to check your DHCP server settings. Make sure the address pool is sufficient but not excessive. Limiting the number of connecting clients (Max Station Count) also helps prevent association table overflows during attacks like Deauth flood.
Saving the configuration and checking the operation
After making all the changes, you need to make sure that the settings are saved. MikroTik The changes are applied instantly, but to save them after rebooting the device, you need to press a key combination Ctrl+S or select a menu item Files -> Save Backup.
Check the network from the client device. Find your network in the list of available networks. If you've hidden the SSID, try adding the network manually by entering the name and password. Make sure the device receives an IP address and has internet access.
Use terminal commands to make a final status check. Enter the command /interface wireless printto see the interface status. Status running indicates normal operation.
[admin@mikrotik] > /interface wireless print
Flags: X - disabled, R - running
NAME MTU MAC ADDRESS ARP
0 R wlan1 1500 4C:5E:6C:XX:XX:XX enabled
Update your router's software regularly. Developers RouterOS Patches are constantly released to address vulnerabilities in encryption protocols. An up-to-date software version is essential for the stable operation of the entire security system.
What should I do if I forgot my set password?
If you've lost your Wi-Fi password but have access to the router via cable, you can view it in the security profile settings in WinBox. The password is displayed in the Passphrase field, but hidden. Click the "Show Password" button (the eye) or copy the field to see the characters. If you can't access the router, the only solution is to reset it using the physical button on the router.
Is it possible to use the same password for both guest and main networks?
Technically, this is possible, but not recommended from a security standpoint. It's best to create a separate interface (Virtual AP) for the guest network with a separate security profile and client isolation (Client-to-Client Forwarding = No). This will prevent guests from accessing your personal devices on the local network.
Does a complex password affect Wi-Fi speed?
The password itself and the encryption process (WPA2/WPA3) have virtually no impact on data transfer speed in modern routers. Hardware encryption is handled by the router's processor. However, if you're using very old devices with TKIP encryption instead of AES, the speed may be limited to the standard 54 Mbps.