Hiding the wireless network name, or SSID, is one of the basic methods for increasing the security level of a home or office perimeter. When you hide the network on the equipment MikroTik, it no longer appears in the list of available connections on smartphones and laptops of random passersby. This creates an effect of "invisibility" for the average user simply looking for a free Wi-Fi connection.
However, it's important to understand that this method isn't a panacea and doesn't replace the use of reliable encryption protocols. A hidden network still emits a radio signal, and its existence can be detected using specialized traffic analysis software. However, this measure significantly reduces the number of automatic connection attempts and reduces "digital noise" in the airwaves.
In this guide, we'll cover the technical aspects of implementing this feature on MikroTik devices running RouterOS. We'll cover both the WinBox graphical interface and the command line, so you can choose the most convenient configuration method for your device.
Hidden network concept and security level
Many users mistakenly believe that hiding SSID makes their network completely invisible and invulnerable to hacking. In fact, the access point continues to transmit control frames containing information about the network's existence, even if the name isn't broadcast in all packets. Client devices, knowing the network's name, begin actively searching for it on the airwaves, which can even facilitate the work of attackers using traffic sniffers.
However, for home or small office use, this feature is useful as an additional barrier. It removes your network name from the public list, reducing social engineering and neighbors' curiosity. On routers MikroTik The implementation of this mechanism occurs by disabling the broadcast of the network name in Beacon frames.
⚠️ Note: Hiding the SSID does not encrypt transmitted data. Be sure to use a secure protocol. WPA2 or WPA3 with a complex password, since hiding the name is only a measure of concealment, and not of protection of the contents of the packages.
It's also worth noting the impact this setting has on mobile device battery life. When a phone doesn't see a known network in the list, it begins constantly polling the airwaves for its presence, which can lead to accelerated battery drain. Therefore, implementing this feature should be done carefully, balancing convenience with the desired level of privacy.
Configuration via the WinBox graphical interface
The most popular way to configure MikroTik equipment is the utility WinBoxIt provides convenient access to all wireless module parameters. To get started, you must connect to the router via cable or an open network to avoid losing access during setup.
After authorization, go to the menu on the left and select the item WirelessIn the window that opens, you'll see a list of wireless interfaces if you have multiple (for example, 2.4 GHz and 5 GHz). Double-click the desired interface to open its properties. The tab you're interested in is Wireless, where the main parameters of the radio module are located.
In the list of settings, find the parameter Mode. Make sure the mode is selected. ap bridge, since it is this that allows the device to function as an access point. Below, in the field SSID, enter the desired name for your network. This name will need to be entered manually on all connected devices, as it will not be detected automatically.
The key is to set the flag hide-ssidIn the WinBox interface this field is often called Hide SSID or presented as a drop-down list with options yes / no. Set value yesAfter applying the settings, the network will disappear from the list of available ones, but will continue to work.
☑️ Check WinBox settings
Configuration via terminal (CLI)
For experienced administrators and those who prefer speed, using the command line is ideal. The terminal can be accessed through the New Terminal in WinBox or via SSH connection. Command interface RouterOS Allows you to make changes instantly and script processes.
To view the current configuration of the wireless interface, use the command:
/interface wireless printIn the output you will see a list of interfaces with their names, usually it is wlan1, wlan2 or wifi1 in new models. To hide the network, you need to set the parameter hide-ssid in meaning yesThe command syntax requires a specific interface to be specified.
Follow the instructions below, replacing wlan1 to the name of your interface:
/interface wireless set wlan1 hide-ssid=yes ssid="MySecretNetwork"Note that we also specified the network name in this same line. If you only want to change the hiding option while leaving the name unchanged, simply specify the flag:
/interface wireless set wlan1 hide-ssdi=yes⚠️ Warning: When working via the CLI, pay attention to the case of letters in parameter and value names. Syntax errors may result in the command not executing or being interpreted incorrectly.
Once the command is executed, the changes take effect immediately. You can check the results by re-running the command. print and making sure that in the column hide-ssid the value is displayed true or yes.
A script for quickly hiding all networks
If you have multiple access points configured and want to hide them all at once, you can use a loop: :foreach i in=[/interface wireless find] do={ /interface wireless set $i hide-ssid=yes }
Connecting client devices to a hidden network
After you have hidden the network on the router side MikroTik, the connection process from client devices (smartphones, laptops, tablets) will change. The device will no longer be able to scan for your network and prompt you to enter a password. You will have to create a new connection manually.
On devices running Android or iOS An option to "Add network" or "Other" will appear in the list of available networks. You'll need to enter the network name (SSID) accurately, taking care to ensure proper case-correct lettering, select the security type (usually WPA/WPA2 Personal), and enter the password.
On computers with an operating system Windows the process looks like this:
- 📡 Click on the WiFi icon in the tray and select "Hidden network".
- 🔑 Enter the exact network name (SSID) and click Next.
- 🛡️ Enter the security key (WiFi password).
- ✅ Confirm the connection, and the system will remember this network for future automatic connections.
It's important to understand that after the first successful connection, the device will store the profile of that network. When in range, it will attempt to connect by broadcasting requests with your network name, which theoretically makes it visible to traffic analyzers, even if the router is hiding it.
Comparison of tuning methods and parameters
To better understand the differences between configuration methods and the impact of these settings on network performance, consider the comparison table. It will help you choose the optimal approach based on your skills and needs.
| Parameter | WinBox (GUI) | Terminal (CLI) | Impact on the network |
|---|---|---|---|
| Complexity | Low (visually) | Intermediate (requires knowledge of syntax) | No influence |
| Speed of setup | Average | High | No influence |
| The hide-ssid parameter | yes / no | yes / no | Hides the name from Beacon frames |
| Risk of error | Minimum | Average (typos) | Loss of access is possible |
| Audience | Beginners, visual learners | Pro, remote administration | Depends on the user |
Usage WinBox It's preferable for initial setup, when all parameters can be visually monitored, including channel frequency, spectrum width, and transmitter power. The terminal is indispensable for large-scale deployments or fine-tuning, where every second counts.
Additional wireless network security measures
Hiding the SSID is just one layer of security. To create a truly secure network using MikroTik A comprehensive approach is needed. First and foremost, stop using the outdated encryption protocol. WEP and even WPA in favor of WPA2-AES or WPA3, if your client devices support this standard.
Setting up a guest network is also highly recommended. This will isolate visitors from your main local network, where files, printers, and CCTV cameras may be located. On MikroTik, this is accomplished by creating virtual AP interfaces and configuring firewall rules.
⚠️ Note: Interfaces and menu names may vary slightly depending on the RouterOS version (v6 or v7) and device model. Always consult the official documentation for your specific software version before making critical changes.
Don't forget to update your router firmware regularly. MikroTik regularly releases updates that patch security vulnerabilities. Keeping your router up-to-date RouterOS And RouterBOOT — basic security hygiene for any network administrator.
Frequently Asked Questions (FAQ)
Will hiding the SSID slow down my internet speed?
No, the data transfer rate will not change. Hiding the network name only affects service frames (Beacons), which make up a negligible portion of traffic. The channel's throughput remains the same.
Is it possible to restore access if I forgot the name of a hidden network?
Yes, if you have physical access to the router. You can connect your computer via cable or connect via an open network (if available), open WinBox, and view or change the SSID in the Wireless menu. You can also reset the router to factory settings using the Reset button.
Will WPS work if the network is hidden?
Generally, no. The WPS protocol relies on network discovery to initiate the pairing process. If the network is hidden, WPS is often unavailable or doesn't work correctly. It's recommended to disable WPS for security reasons in any case.
Is the hidden network visible to security professionals?
Yes, a hidden network is easily detected by professionals. As soon as a legitimate client connects to the network, it broadcasts the network name (SSID) in open association frames. Traffic sniffers immediately capture this name, so "hiding" is only effective against ordinary users.