Managing wireless interfaces in routers Mikrotik is a critical task for system administrators and advanced users. Situations often arise where it's necessary to temporarily or completely disable the radio module to prevent unauthorized access or simply reduce electromagnetic radiation levels at night. Unlike consumer routers, where pressing a physical button is sufficient, RouterOS requires software configuration.
The disabling process depends on whether you are using the graphical interface. WinBox, web configurator or command line. Correct setting Allows you to not only turn off the signal but also automate this process, creating flexible network operation scenarios. In this article, we will examine in detail all available methods for managing the wireless interface state.
It's worth noting that there are different ways to simply "turn off" WiFi, and each has its own consequences for the entire network. For example, completely disabling the interface will immediately terminate all active client connections, while blocking it through a firewall may leave the interface visible but unavailable for connection. The choice of method depends on your needs. security goals and the current network architecture.
Disabling the wireless interface via WinBox
The most common and visually understandable way to manage the router configuration is the utility WinBoxThis tool provides full access to all system parameters, including fine-tuning wireless modules. To get started, connect to the device and log in with an account with administrator rights.
Once logged in, go to the menu WirelessA list of all available wireless interfaces will open, including physical radio cards and virtual access points. Find the interface you want to disable and double-click it to open the properties window.
In the window that opens, find the button Disable, located in the upper left corner, or uncheck the "Enabled" option depending on your interface version. Once clicked, the interface status will change to disabled, and the signal transmission will stop immediately. Clients who were online will lose their connection.
It's important to understand that disabling an interface doesn't delete its configuration. All settings, such as the SSID, channel, and encryption type, are saved in the device's memory. When reactivated, the network will operate with the previous settings, which is convenient for temporary maintenance operations.
Management via terminal and CLI commands
For experienced administrators who prefer speed and remote management, the command line is the best option. The CLI (Command Line Interface) allows for faster, script-less execution. The terminal can be accessed via SSH, Telnet, or the built-in console. WinBox.
The basic command to disable the interface is simple and executed in the context of the menu. /interface wirelessFirst, you need to navigate to the appropriate configuration section so that the commands are applied specifically to the wireless modules, not the Ethernet ports.
/interface wireless
disable [find name="wlan1"]
Here [find name="wlan1"] is a selector that finds an interface by name. If the interface name is different, replace wlan1 to the current value. To turn it back on, use the command enable with a similar syntax. This allows for quick state switching via scripts.
- 🔌 Disable — a command that puts the interface into an inactive state, stopping packet processing.
- ⚡ Enable — a command that returns the interface to working mode with loading saved settings.
- 👀 Print — a command to display a list of all interfaces and their current status before making changes.
Using the command line is especially useful for mass configuration of multiple devices or for creating automated maintenance scripts. You can write a script that will poll the network status and disable WiFi under certain conditions, such as high channel load.
Hidden monitoring commands
Use the /interface wireless monitor wlan1 command to see the current frequency, noise level, and number of registered clients in real time, even if the interface is temporarily down for diagnostics.
Scheduled shutdown automation (Scheduler)
One of the most popular features in corporate networks and hotels is automatic WiFi shutdown at night. Mikrotik there is a powerful tool for this System SchedulerIt allows you to run any commands at a specified time or at a certain interval.
To implement night mode, you need to create two entries in the scheduler: one to disable the interface in the evening and one to enable it in the morning. This ensures network stability during business hours and security during off-hours.
Let's create a task to turn off at 23:00. In the menu System -> Scheduler Add a new entry. In the field On Event Enter the shutdown command discussed in the previous section. Make sure the interval is set to 1d (one day) so that the task is repeated daily.
/system scheduler
add name="wifi-off-night" start-time=23:00:00 interval=1d on-event="/interface wireless disable wlan1"
Similarly, a task is created to turn on at 8:00 AM. It is important to synchronize the time on the router via the protocol. NTPOtherwise, the schedule will be reset after a device reboot. Without a precise time, automation will not function correctly.
☑️ Setting up night mode
Blocking client connections through a firewall
There's an alternative approach to disabling WiFi that doesn't affect the radio module itself. You can leave the interface enabled but prevent all devices from transmitting data through it. FirewallThis is useful if you want the network to be visible but unusable, or for testing filtering rules.
To implement this method, go to the menu IP -> Firewall -> Filter RulesCreate a new rule that will block all traffic originating from the wireless interface. This is an effective way to isolate traffic without changing the radio's state.
| Parameter | Meaning | Description | Action |
|---|---|---|---|
| Chain | forward | Processing chain for passing traffic | - |
| In. Interface | wlan1 | The interface from which the request comes | - |
| Action | drop | Action on a package | Blocking |
| Comment | Block WiFi | Rule description for admin | - |
The advantage of this method is that clients can connect to the access point and obtain an IP address (unless DHCP is specifically blocked), but will not have access to the internet or the local network. This creates the effect of an "empty" network.
However, it's important to remember that the radio channel remains active and occupies the airwaves in this case. If your goal is to free up frequency bands or reduce emissions, this method is not suitable. It is intended solely for logical access restriction.
Hiding the network (SSID) as a pseudo-disconnection method
A common misconception is that hiding the network name (SSID) is the same as disabling it. In reality, the router continues to actively broadcast beacon frames, but it simply doesn't include the network name. This isn't a complete shutdown, but it can serve as a temporary security measure against unauthorized users.
To hide the network, in the wireless interface settings (Wireless -> Security Profiles or directly in the interface properties) you need to change the parameter Hide SSID on yesAfter this, the network will disappear from the list of available networks on smartphones and laptops.
To connect to a hidden network, the user must manually create a new connection profile and enter the exact network name (SSID) and password. This creates a barrier for inexperienced users, but it doesn't provide reliable protection, as traffic is easily intercepted by sniffers.
- 📡 Beacon Frames — service packets that continue to be broadcast even when the SSID is hidden.
- 🔍 Discovery - a hidden network can be easily detected using active scanning methods.
- 🛡️ Security — this method does not replace WPA2/WPA3 encryption and complex passwords.
Use this method only as an additional security measure in conjunction with other methods. Completely disabling the interface or using MAC filtering will be much more effective at restricting access.
⚠️ Note: Hiding the SSID may cause connection issues with some smart devices (IoT) that cannot search for hidden networks and require an explicit name.
Diagnostics and interface status check
After making changes to the configuration, you need to make sure that the commands were applied correctly. Mikrotik There are several ways to check the current state of wireless interfaces and make sure that WiFi is actually disabled.
In the graphical interface WinBox the status is displayed in the column RunningIf the interface is disabled programmatically, the flag R (Running) will disappear and a check mark will appear. D (Disabled). The status indicator will also turn red or gray, depending on the theme.
In the terminal, use the command print with a brief output to quickly assess the status of all interfaces. Note the column disabled: meaning true indicates that the interface is administratively closed.
[admin@mikrotik] > /interface wireless printFlags: X - disabled, R - running
0 R name="wlan1" mtu=1500 mac-address=...
1 X name="wlan2" mtu=1500 mac-address=...
In the example above, you can see that wlan1 works (flag R), and wlan2 disabled (flag X). It is also useful to check the system logs (Log), where messages about interface state changes or client connection attempts during idle time may be displayed.
Frequently Asked Questions (FAQ)
Is it possible to physically disable WiFi on Mikrotik?
Physical switch on most models Mikrotik No. However, if the device is powered via PoE, you can programmatically disable power to the port where the WiFi module is connected (if it's an external module). However, integrated radio cards cannot be disabled this way—only through software, via the OS.
Will disabling the interface reset the settings?
No, team disable Changes only the operational state of the interface. The configuration (password, network name, channel) is saved in the configuration file and will be restored after a reboot unless you delete the interface itself with the command remove.
Why can't clients connect after disconnecting WiFi?
Because the interface stops responding to association requests. To the client, it appears as if the router has disappeared from range. If you simply need to block access but keep the network visible, use firewall rules.
Does turning off WiFi affect the operation of a wired network?
No, disabling the wireless interface wlan1 does not affect the operation of Ethernet ports in any way (ether1-ether5) and wired clients. Routing and NAT will continue to function normally for the wired segment.
⚠️ Note: Interfaces and available commands may vary slightly depending on the RouterOS version (v6, v7) and installed license (Level 3, 4, 5, 6). Always consult the official documentation for your specific model.