MikroTik as a Wi-Fi Switch: A Complete Guide to Setup and Use

In the era of smart homes and offices with dozens of connected devices, classic Wi-Fi routers often become network bottlenecks. MikroTik — a Latvian brand of network equipment — offers a flexible solution: using its devices not only as routers, but also as managed Wi-Fi switches with advanced features. This allows you to offload the main router, segment the network, and fine-tune wireless client traffic management.

Unlike household "boxed" solutions, MikroTik gives access to professional tools: VLAN, QoS, CAPsMAN for centralized management of access points, as well as support 802.11ac/ax on models with Wi-Fi modules. However, this approach requires a deep understanding of network protocols and configuration nuances. In this article, we'll look at how to transform a device MikroTik into a powerful Wi-Fi switch, which models are suitable for this, and where such solutions are more profitable than traditional approaches.

Why is MikroTik better than a regular Wi-Fi switch?

Traditional "smart" switches (for example, from TP-Link or Netgear) offer basic traffic management features, but are limited by the manufacturer. MikroTik it works on the base RouterOS — a full-fledged operating system with an open API, which provides:

• 🔧 Flexible configuration each port and Wi-Fi client (speed limiting, traffic prioritization, MAC blocking).
• 📡 Multiple SSID support with different security settings and VLANs on the same physical device.
• 🛡️ Advanced protection: filter by Layer 2, detection of attacks of the type ARP spoofing, integration with Firewall.
• 📈 Real-time monitoring through Winbox, WebFig or SNMP with the ability to log all events.

For example, the model MikroTik hAP ac³ For $100-150, it can replace three devices at once: a router, a managed switch, and a Wi-Fi access point controller. And if you take RB4011iGS+5HacQ2HnD-IN (around $300), you'll get 10-gigabit ports, dual-band Wi-Fi 5, and hardware acceleration for rules processing. Firewall.

But there are also pitfalls:

⚠️ Attention: Setting up MikroTik in Wi-Fi switch mode requires disabling the function NAT and routing, if the device shouldn't distribute IP addresses. Otherwise, conflicts with the main router on the network are possible.

Which MikroTik models are suitable for use as Wi-Fi switches?

Not all devices MikroTik are equally useful as Wi-Fi switches. Key selection criteria:

1. Availability of a Wi-Fi module (models with the suffix ac, ax, H or Hn).
2. Number of Ethernet ports (minimum 4-5 for connecting wired clients and uplink).
3. Support CAPsMAN (for managing multiple access points).
4. CPU performance (for processing rules Firewall And QoS).

For most home users it is optimal hAP ac³ - It combines 5 ports, dual-band Wi-Fi and support CAPsMANIn offices it is better to look at RB4011 or CRS3xx series with 10-gigabit ports if large numbers of clients need to be processed.

Step-by-step setup of MikroTik in Wi-Fi switch mode

To transform MikroTik To use a Wi-Fi switch, you need to complete three key steps: disable unnecessary router features, configure ports as a switch, and configure the Wi-Fi network. Winbox (graphical interface) or CLI (command line).

Reset your device to factory settings (System → Reset Configuration)

Update RouterOS to the latest stable version

Connect via Ethernet to port 1 (DHCP server is active by default)

Disconnect all wireless clients from the device-->

1. Disable routing and DHCP

Go to IP → DHCP Server and delete all servers. Then in IP → Firewall → NAT disable the rule masquerade (if any). This will prevent conflicts with the main router on the network.

/ip dhcp-server remove [find]
/ip firewall nat disable [find]

2. Combining ports into a switch

IN Bridge create a new bridge (eg bridge-local) and add all Ethernet ports to it, except the one that will be used for uplink (connection to the main router).

/interface bridge add name=bridge-local
/interface bridge port add bridge=bridge-local interface=ether2
/interface bridge port add bridge=bridge-local interface=ether3
Repeat for all ports except ether1 (uplink)

3. Setting up Wi-Fi networks

IN Wireless Create new interfaces for each SSID. Specify:

• 🔒 Security: WPA2-PSK or WPA3 (for compatibility with new devices).
• 📶 Frequencies: for 2.4 GHz, select channels 1, 6 or 11 (least interference), for 5 GHz - DFS channels (if supported by clients).
• 📦 VLAN: Bind the SSID to the desired VLAN ID if you are using network segmentation.

/interface wireless security-profiles add name=home-wifi mode=dynamic-keys authentication-types=wpa2-psk,wpa3-psk unicast-ciphers=aes-ccm group-ciphers=aes-ccm wpa2-pre-shared-key=Your Password
/interface wireless add name=wifi-2ghz master-interface=wlan1 security-profile=home-wifi band=2ghz-g/n channel-width=20/40mhz-Ce frequency=auto ssid=MyHomeWiFi

After applying the settings, connect the uplink port (ether1) to the main router, and the remaining ports and Wi-Fi networks will become part of the local network without routing.

Centralized Access Point Management (CAPsMAN)

If you have multiple access points on your network MikroTik, they are convenient to manage through CAPsMAN (Controlled Access Point system Manager). This allows:

• 🔄 Sync settings all access points from one console.
• 📊 Balance the load between APs automatically.
• 🔍 Track clients in real time, linked to a specific point.

To configure:

1. Turn on CAPsMAN V Wireless → CAPsMAN.
2. Create Configuration with security parameters and SSID.
3. Add Provisioning rules so that new points automatically receive the configuration.
4. On the access points themselves (cAP ac, wAP etc.) turn on the mode CAP and specify the IP address CAPsMAN servers.

/caps-man manager set enabled=yes
/caps-man security add name=capsec authentication-types=wpa2-psk,wpa3-psk encryption=aes-ccm passphrase=Your Password
/caps-man datapath add name=capdp local-forwarding=yes
/caps-man interface add master-interface=wlan1 datapath=capdp security=capsec

⚠️ Caution: When using CAPsMAN all access points must be connected to the network to enable mode CAPOtherwise, they will not be able to receive the configuration and will become unavailable.

Optimizing Wi-Fi network performance

Even with the correct Wi-Fi settings on MikroTik There may be speed or stability issues. Here are the key parameters for optimization:

1. Selecting a channel and bandwidth

In densely populated areas (apartment buildings, office centers), 2.4 GHz channels are often overloaded. Use a Wi-Fi scanner (e.g., WiFi Analyzer (for Android) to find the least crowded channel. For 5 GHz:

• 📶 Channels 36–48 And 149–165 usually freer.
• 🔄 Channel width 80 MHz provides maximum speed, but may interfere with neighboring networks. In conditions of interference, it is better to use 40 MHz or 20 MHz.

2. Transmission power

Too high power (Tx Power) leads to interference for neighboring networks, while too low a value leads to poor coverage. Optimal values:

• 🏠 In the apartment: 17–20 dBm (enough for 2-3 rooms).
• 🏢 In the office: 23–27 dBm (depending on the layout).

/interface wireless set wlan1 tx-power=20

3. QoS settings for traffic prioritization

To ensure that video calls and streaming don't slow down due to downloads, set up Queue Tree:

/queue simple add name=VoIP target=192.168.88.0/24 dst-port=5060,5061,16384-32768 max-limit=50M/50M priority=1
/queue simple add name=Streaming target=192.168.88.0/24 dst-port=80,443 max-limit=100M/100M priority=2

Security: How to protect your Wi-Fi switch from attacks?

MikroTik devices are often targeted by hackers due to vulnerabilities in older versions of RouterOS (especially before v6.48). To minimize risks:

• 🔐 Disable unused services:

  /ip service disable telnet,ftp,api,api-ssl

• 🛡️ Set up a firewall To block port scanning:

  /ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="Port scan detect"

• 🔄 Update RouterOS and disable automatic updates (it may break the configuration).
• 📛 Change default usernames (admin) and passwords.

To protect your Wi-Fi clients:

• 🔒 Use WPA3 instead of WPA2 (if all devices support it).
• 🚫 Turn it off WPS (vulnerable to brute force attacks).
• 📡 Hide your SSID only if you really need to (this is not security, but just a slight complication for accidental connections).

⚠️ Note: If you have devices with older firmware on your network (such as older printers or IP cameras), they may not support WPA3In this case, create a separate SSID with WPA2 and isolate it via VLAN.

Comparing MikroTik with traditional Wi-Fi switches

To understand whether it is worth switching to MikroTik, let's compare it with popular alternatives:

When to choose MikroTik?

• ✅ You need advanced features (QoS, Firewall, VLAN) without monthly subscription.
• ✅ Are you ready? configure manually and understand network protocols.
• ✅ Budget is limited, but required scalability (add access points without replacing the controller).

When to choose alternatives?

• ❌ It is necessary simple out-of-the-box solution (for example, for non-technical personnel).
• ❌ Important official support and guarantees (MikroTik only provides support through forums and partners).
• ❌ Required Wi-Fi 6E (there are still few MikroTik models with 6 GHz support).

FAQ: Frequently asked questions about using MikroTik as a Wi-Fi switch

/interface bridge add name=bridge-switch
/interface bridge port add bridge=bridge-switch interface=ether2-ether5
/ip address add address=192.168.2.1/24 interface=bridge-switch