Expanding wireless network coverage is a common concern for owners of country houses or offices with complex layouts. The signal from the main router may not reach remote rooms, resulting in dropped connections and slow speeds. Using the equipment MikroTik This elegant solution allows you to solve this problem without running unnecessary cables. You can transform any compatible router of this brand into a powerful device that will receive and distribute internet over the air.
There are several implementation scenarios for this setup, and the choice depends on your speed and stability needs. You can set up a transparent bridge, where all devices are on the same subnet, or use routing, logically separating the networks. WDS mode (Wireless Distribution System) is the most flexible tool for creating such connections. It allows a device to simultaneously receive and broadcast a signal while preserving the clients' MAC addresses.
In this article, we'll cover the configuration process in detail so you can create a reliable repeater system yourself. We'll cover security issues, frequency ranges, and common mistakes when configuring interfaces. Proper configuration Wireless Interface quality is the key to high performance for your entire local network. Below are step-by-step instructions to help you achieve your desired results.
Selection of equipment and connection schemes
Before you begin setup, you need to make sure your hardware supports the required features. Not all models MikroTik The same applies: some only operate in the 2.4 GHz range, while others support the 802.11ac or ax (Wi-Fi 6) standard. For a high-quality communication channel, it's best to use dual-band devices, such as the hAP or wAPThey will allow data streams to be separated and interference to be avoided.
There are three main ways to establish communication between routers. The first is Station mode, where the router connects as a regular client and distributes internet through LAN ports. The second is WDS Station mode, which allows you to create bridges and store broadcast packets. The third option is using a protocol. CAPsMAN for centralized management of multiple access points, which is relevant for large offices.
⚠️ Important: When choosing equipment, consider the transmitter power. If you plan to transmit a signal over a long distance, models with an external antenna (e.g. SXT or LHG) will be more efficient than the built-in antennas of home routers.
It's also important to determine the network topology. If you simply need to extend an Ethernet cable over the air, transparent bridging will do. However, if you need to isolate clients of a remote access point, NAT routing is better. Transparent bridging only works if both devices support the same encryption protocols and are on the same frequency channel.
Preparing the basic configuration
Before configuring wireless interfaces, you need to clean up the underlying system. Access your device's WinBox or WebFig interface. First, we recommend updating RouterOS to the latest stable version, as older firmware may contain bugs in the Wi-Fi drivers. After updating, reset the configuration to factory settings to eliminate the impact of old rules.
Configure the system time and time zone; this is important for proper event logging. Next, change the user password. admin Complex and unique. Network security begins with access to equipment management. Do not leave management ports open to access from the external network (WAN) unless absolutely necessary.
☑️ Basic MikroTik training
Now you need to create a bridge that will connect the wireless interface and the wired LAN ports. This will allow devices connected via cable to access the network as if they were connected via Wi-Fi. In the menu Bridges create a new bridge, add ports to it ether2-ether5 and your wireless interface wlan1. Make sure the protocol STP (Spanning Tree Protocol) is enabled to avoid network loops.
Why do we need Bridge?
A bridge combines multiple physical ports into a single logical network segment. This allows devices to directly see each other, exchange broadcast packets, and operate within the same subnet without complex routing.
Setting up Station (WiFi Client) mode
To enable your MikroTik to receive a signal from another router, you need to change the wireless interface mode. Go to the menu Wireless, select the interface (usually wlan1) and double-click on it. In the field Mode change the value from ap bridge on station or station-bridge. Mode station-bridge necessary if you want to bridge over a wireless connection.
After changing the mode, go to the tab Wireless (or Scan in the interface window) and click the button ScanIn the window that opens, you'll see a list of available networks. Find your primary network, select it, and click ConnectThe device will attempt to connect. If the network is password-protected, the system will prompt you to enter it.
Enter the security key (WPA2-PSK or WPA3) in the appropriate field. Once the connection is successful, the status in the interface list will change to running, and an association entry will appear in the logs. Your router is now receiving an IP address from the default gateway. Make sure that the interface bridge-local or ether1 (if it is not in a bridge) it is worth getting an address via DHCP.
⚠️ Attention: In mode
station(without the bridge prefix) the device operates as a regular network adapter. Broadcast packets (for example, to search for printers or Chromecast) may not pass through the connection. For complete transparency, usestation-bridgeorwds-station.
If the connection fails, check if the wireless standards match. For example, if the main router only works in wireless mode 802.11n, and the client is configured to 802.11ac only, there will be no connection. Also, make sure that the channel and channel width (20/40/80 MHz) are supported by both devices.
Setting up a WDS bridge for a transparent network
WDS technology allows you to expand your wireless network while preserving client MAC addresses. This is critical if you use MAC address filtering on the main router or need a single broadcast domain. To configure WDS on the receiving end (client), select the "WDS" mode in the wireless interface settings. wds-station.
On the transmitting router (Access Point), you also need to enable WDS support. In the menu Wireless on the tab WDS make sure the box is checked Default Authenticate And Default ForwardYou also need to add the client's MAC address to the WDS list or allow dynamic addition. This creates a trusted connection between the devices.
| Parameter | AP (Main) value | Value on Client (Second) |
|---|---|---|
| Mode | ap bridge | wds-station |
| SSID | MyHomeNetwork | MyHomeNetwork |
| Frequency | 2437 (Channel 6) | 2437 (Channel 6) |
| WDS Mode | dynamic | dynamic |
| Security Profile | profile1 (WPA2) | profile1 (WPA2) |
After configuring WDS, the interfaces on both ends of the link should show the status running And connected. In the table Wireless -> Registration Table The MAC address of the remote device will appear on the main router with a flag W (WDS) This means the bridge has been successfully installed.
Configuring DHCP and NAT to separate networks
If your goal is not just to extend the cable, but to create a separate subnet (for example, for guests or IoT devices), you will need routing. In this case, the mode station (without a bridge) is better. On the client MikroTik router, you need to configure a DHCP client on the interface wlan1so that it receives an IP address from the main network.
Then configure the DHCP server on the local interface (LAN bridge) of this router. Specify a pool of addresses different from the main network. For example, if the main network 192.168.88.0/24, then the local one can be 192.168.99.0/24This will ensure isolation of devices: they will have access to the Internet, but will not be able to see devices on the main network.
/ip dhcp-clientadd disabled=no interface=wlan1
/ip pool
add name=local-pool ranges=192.168.99.10-192.168.99.254
/ip dhcp-server
add address-pool=local-pool disabled=no interface=bridge-local name=local-dhcp
/ip dhcp-server network
add address=192.168.99.0/24 gateway=192.168.99.1 dns-server=8.8.8.8
Don't forget to enable NAT (Masquerade) so that devices on the local subnet can access the internet through the WLAN interface. Without this rule, the internet won't work. In the menu IP -> Firewall -> NAT create a new rule: Chain: srcnat, Out. Interface: wlan1, Action: masquerade.
Optimizing speed and security
Once the connection is established, it's important to optimize it. Wireless channel speed is highly dependent on noise levels and frequency congestion. Use the built-in tool Torches or Wireless -> Registration Table -> Signal Strength to monitor signal quality. A level higher than this is considered optimal. -65 dBm.
Choose the least crowded channel. In the 2.4 GHz band, channels 1, 6, or 11 are recommended, as they don't overlap. Channel Width 20 MHz often provides more stable communication over longer distances than 40 MHz, due to less interference.
- 🔒 Encryption: Always use WPA2-AES or WPA3The WEP and WPA-TKIP protocols are considered obsolete and insecure.
- 📡 Frequency: If possible, use the 5 GHz band for the link between routers. It's less noisy and provides faster speeds, but has less penetration power.
- 🛡️ Control protection: Disable unnecessary services (Telnet, FTP, WWW) on the WAN interface. Enable only HTTPS and SSH, preferably with IP address restrictions.
⚠️ Note: Interfaces and menus may differ depending on the RouterOS version (v6 or v7). In version 7, the wireless package was rewritten (wifi-qcom), and some commands may have different names. Always consult the official documentation for your software version.
Regularly check your device logs for unauthorized access attempts. If you notice many connection attempts with incorrect passwords, you may want to change the security key or enable SSID hiding (although this offers weak protection). It's also a good idea to limit the transmit power (Tx Power) if the routers are close to each other to avoid interference.
What is MCS Index?
MCS (Modulation and Coding Scheme) is an index that determines the data transfer rate. The higher the index, the higher the speed, but it requires better signal quality. You can see the MCS the client is using in the logs.
Frequently Asked Questions (FAQ)
Is it possible to use MikroTik as a repeater without losing speed?
It's impossible to achieve a completely loss-free speed because the radio channel is half-duplex. However, using dual-band routers (one band for receiving, one for transmitting) or a dedicated 5 GHz link minimizes losses. WDS mode also helps maintain efficiency.
Why is the Wi-Fi speed via MikroTik lower than via cable?
Wireless networks are susceptible to interference, reflections, and logging overhead. Actual Wi-Fi speeds are typically 50-70% of the theoretical speed. It's also important to consider the router's processor power: cheaper models may not be able to handle higher speeds with firewall features enabled.
Does MikroTik support Mesh networks?
Yes, MikroTik supports the protocol. 802.11s (Mesh) and its proprietary protocol CAPsMAN for network management. However, a classic WDS or Station-Bridge setup is often more stable and easier to debug for small networks of 2-3 points.
How do I reset my settings if I've lost access?
Most MikroTik routers have a button on the body. Reset. With the power on, press and hold it for about 10-15 seconds until the indicator ACT It won't blink. Once released, the device will reboot to factory settings.
Do I need to purchase a license to work in client mode?
No, the basic functionality of RouterOS, including Station and WDS modes, is available in all license levels (Levels 3, 4, 5, and 6). A license is only required to limit the number of connecting clients or to use advanced tunneling features at scale.