Setting up Mikrotik in access point and Wi-Fi Bridge mode

Establishing a wireless connection between remote buildings or extending the coverage of a home network often requires flexible solutions that go beyond standard consumer routers. Mikrotik In this context, a network gateway is a powerful tool that allows you to transform ordinary network equipment into a professional access point or transparent bridge. Using such devices makes it possible to combine multiple local area networks into a single infrastructure without the need for expensive fiber optic or copper cable.

Unlike consumer routers, where bridging features are often limited or hidden, the hardware Mikrotik Based on RouterOS, it provides full control over the radio channel and frame switching logic. You can configure the device to operate as a classic access point for clients, or as Station Bridge, transparently transmitting traffic from a remote router to the main gateway. This is especially relevant for WISP providers and owners of private homes with outbuildings.

The main difficulty for beginners is understanding the difference between interface operating modes and routing logic. The key point is that running in transparent bridging mode (Layer 2) often requires disabling NAT and using WDS or Station Bridge rather than the standard Station mode. In this article, we'll walk you through the step-by-step configuration process so you can create a stable and secure wireless connection that harnesses the full potential of your devices.

Equipment selection and topology planning

Before you begin setting up, you need to decide on the architecture of your future network and select the appropriate hardware. Not all models Mikrotik Both are equally well suited for wireless bridging, especially when long distances or high speeds are involved. It's important to consider not only the stated transmitter power, but also the antenna type and supported standards. Wi-Fi.

To build a trunk communication channel between two points (Point-to-Point), devices of the series are usually used LiteBeam or SXT, which have highly directional antennas. If your goal is to create an access point for multiple clients or connect a network in Point-to-Multipoint mode, then you will need sector-type models or omnidirectional antennas, such as OmniTIKIn home environments, universal routers of the series are often used. hAP or cAP, which can operate in any of the modes.

When planning, be sure to consider line-of-sight. Obstacles such as trees or buildings are critical for stable bridge operation at 5 GHz frequencies. Penetration at 2.4 GHz is higher, but the airwaves are typically heavily polluted by neighboring networks.

• 📡 Point-to-Point: Connecting two remote buildings, line of sight and narrow beam required.
• 🏠 Point-to-Multipoint: One base station distributes the Internet to several remote subscribers.
• 🔄 Repeater: Increasing coverage area by retransmitting the signal (requires careful configuration to avoid speed drops).

⚠️ Attention: When using devices with powerful transmitters, ensure that the signal level does not exceed the permissible limits for your region to avoid interference with other services and to comply with laws.

Basic preparation of RouterOS for work

Before proceeding to fine-tune the wireless interface, it is necessary to put the device's operating system in order. Standard configuration RouterOS Often contains demo data or settings that may conflict with your new setup. The first step should always be updating the firmware to the latest stable version, as new releases often fix security vulnerabilities and wireless card driver bugs.

After updating, it is recommended to perform a factory reset, especially if the device has been previously used in other projects. This will avoid IP address conflicts and unnecessary firewall rules. Go to the menu System → Reset Configuration and select the "No Default Configuration" option if you want to configure everything manually, or leave the default if you plan to use basic scripts.

It is important to change the user's password immediately. admin and disable unnecessary access services such as Telnet, FTP or WWW, leaving only the protected one SSHDevice management security is the foundation of a stable network, as a compromised access point can give attackers access to the entire internal infrastructure.

Don't forget to give the device a unique name in the field IdentityThis will help you easily identify the access point in the neighbor list (Neighbor Discovery) and when monitoring the network via WinBox.

Wireless interface and frequency configuration

Setting up the radio interface is the heart of your wireless network. In the menu Wireless You need to select the correct operating mode. To create an access point, select the mode ap-bridge, which allows you to connect clients and simultaneously support bridges (WDS). If the device receives a signal from another point, the mode changes to station-bridge (for transparent bridge) or station (if the access point will route the traffic itself).

A critical parameter is the choice of frequency (frequency) and channel width (channel-width). In the 2.4 GHz band, a 20 MHz bandwidth is recommended, as 40 MHz in this range often leads to interference and instability. For the 5 GHz band, 40 or 80 MHz can be safely used, providing high throughput but over a shorter range.

You should also pay attention to the security protocol. For modern networks, the standard is WPA2 or WPA3Using outdated encryption WEP or an open network is unacceptable, as traffic can be easily intercepted. In the settings Security Profile set a complex password and select the encryption mode TKIP+AES or just AES.

The secret to stability at 2.4 GHz

If you're forced to use the 2.4 GHz band in an apartment building, use the scanning tools (Scanner) directly in the WinBox interface. Find the clearest channel (usually 1, 6, or 11) and lock the frequency, disabling automatic selection. This will reduce reconnections and packet loss.

To reduce the influence of noise, you can also experiment with the parameter antenna-gain, specifying your antenna's actual gain in dBi. This will help the system more accurately calculate the signal level and transmit power.

Organizing a transparent bridge (WDS and Station Bridge)

Transparent bridging mode allows you to connect two network segments as if they were connected by a single cable. In this case, all devices behind the remote access point will receive IP addresses from the main router while being on the same subnet. To implement this scenario, Mikrotik most often a combination of modes is used ap-bridge (on the main side) and station-bridge (on the client side) with mandatory inclusion of the protocol WDS (Wireless Distribution System).

Without WDS or its analogs (for example, CAPsMAN in new versions) standard mode station It prevents clients' MAC addresses from being forwarded over the wireless channel, breaking the connection at Layer 2. Therefore, if you need to forward VLANs, IP telephony, or simply have a single flat network, enabling WDS in the security profile and on the interface itself is a mandatory step.

On the client side (Station), you need to specify the MAC address or SSID of the base station you want to connect to in the wireless interface settings. In the mode station-bridge The device will behave like a transparent pipe. It's important that the SSID names, frequencies, and encryption keys on both ends of the channel match.

⚠️ Attention: When using WDS, channel throughput can drop to 50-60% of the theoretical value due to protocol overhead. For high-speed backbone links, consider using NV2 or specialized TDMA protocols.

Configuring a bridge and DHCP client

Once the wireless interface is configured, it needs to be logically combined with the LAN ports. To do this, Mikrotik the mechanism is used Bridging. Create a new bridge (for example, bridge1) and add it as a wireless interface (wlan1), and physical Ethernet ports (ether2-ether5), to which computers or switches will be connected.

In station mode (remote building), IP address configuration is different than on the main router. Here, the device should operate as a simple switch with Wi-Fi functionality. Therefore, on the bridge interface itself bridge1 needs to be created DHCP Client, which will automatically receive an IP address from the main router. This will provide access to network management of the access point.

If you are setting up the main access point (AP), the DHCP server must be running on this device (or on the upstream router if the bridge is transparent). Make sure that the address pool (IP Pool) is sufficient for all connecting clients, and the rules NAT (Masquerade) are configured correctly to access the Internet if the access point is a gateway.

You can check the work with the command /ping to the gateway or any device on the network. If ping works, then Layer 2 is up, and the problem may only be in the IP or DNS settings.

Signal optimization and interference elimination

Even a properly configured network can become unstable due to external factors. First, use the built-in frequency scanner (Scan (in the Wireless menu) to assess the airborne noise level. If you see multiple networks on your frequency with a signal strength above -85 dBm, it's time to change the channel to a clearer one.

An important parameter is TX Power (transmission power). Many users mistakenly set it to maximum (0 dBm or higher), which leads to receiver overload and signal distortion (the "jammer effect"). The optimal power is determined experimentally: reduce it until the CCQ (Client Connection Quality) remains high and the speed is acceptable.

It is also worth paying attention to the parameter distance (in some versions ack-timeout). It determines the time to wait for a packet acknowledgement. If the devices are far apart and this parameter is set to "auto" or has a small value, packets will be lost and speed will drop. For longer distances (more than 1 km), this value should be increased manually.

Connection diagnostics and monitoring

To monitor the link status, use real-time monitoring tools. Window Wireless → Registration Table will show all connected clients, signal level (signal strength) and connection quality (CCQ). A signal level from -40 to -65 dBm is considered normal; values ​​below -75 dBm indicate unstable operation.

Built-in tool Torch (Tools → Torch) allows you to see passing traffic in real time, filtering it by protocol and port. This is an indispensable tool when searching for bottlenecks or suspicious activity on the network. It's also useful to set up logs to be sent to a remote server or simply check periodically. Log for authentication errors or association breaks.

Don't forget about the graphs (Graphing). Setting up statistics collection for CPU, memory, and interface bandwidth usage will help identify long-term trends and plan hardware upgrades before users start complaining about speed.

How do I choose between Station and Station Bridge modes?

Mode Station used when a remote device should operate as a regular router: it receives one IP address from the provider, implements NAT, and distributes its addresses to clients. Station Bridge It is needed to “forward” the provider’s network further, preserving all MAC addresses and allowing devices behind the client to be visible on the general network.

Why isn't WDS working?

The most common issue is a misalignment of security settings. Make sure both devices have identical encryption types, passwords, protocol versions (WPA2/WPA3), and, crucially, WDS support is enabled in the security profile. The interface modes must also be compatible (ap-bridge + station-bridge).

What is the maximum range for Mikrotik?

Theoretically, using highly directional antennas (parabolic or array) and the 5 GHz band, distances of 30-50 km or more can be achieved. However, such distances require a perfect line of sight and consideration of the Earth's curvature. For home use and distances of up to 1-3 km, standard panel antennas are suitable.