Router transformation MikroTik Converting a router into a full-fledged access point is one of the most common tasks when expanding wireless coverage in a home or office. Users often have an old but powerful device they don't want to throw away, or they need to create a single, seamless network with multiple signal sources. Unlike cheap consumer routers, this brand's equipment offers extremely flexible settings, but this is precisely what often intimidates beginners.
In this article, we will look at the process of converting a router to the mode Access Point (AP) from scratch. You'll learn how to properly configure bridges, disable unnecessary routing services, and organize secure client connections. Proper configuration will help you avoid IP address conflicts and ensure stable data transfer rates.
To get started, you will need a computer with the utility installed. WinBox, a network cable and, actually, the router itself MikroTikWe'll be using the latest version of the RouterOS v7 operating system, although the basic principles also apply to older v6 versions. Keep in mind that a factory reset will restore the device to factory settings, so all changes will be made to a clean configuration.
Preparing hardware and resetting the configuration
Before performing any modifications, it's crucial to restore the device to its factory default state. This will eliminate the effects of old firewall rules, configured DHCP servers, or static routes that may conflict with your primary network. If you've just purchased the device, you can skip this step, but for used equipment, it's mandatory.
Connect your computer to any LAN port (usually numbered 2 through 5; port 1 is often reserved for WAN, but after a reset, all ports are bridged). To reset, find the button Reset on the case. Depending on the model, it may be combined with the power button or be separate. Press and hold it for 5-10 seconds until the indicator ACT will start blinking.
After rebooting, the device will be accessible by default. This is usually the IP address 192.168.88.1, login admin without a password. Connect to it via WinBox, by going to the tab NeighborsIf the connection is successful, you will see the MAC address of the device. Click on it and press Connect.
⚠️ Attention: If you're setting up a device that's already been used on another network, make sure its IP address doesn't conflict with your main router's. For example, if both devices have the address 192.168.88.1, a conflict will occur and the network will stop working.
Now you need to clear the configuration of unnecessary elements. Go to the menu System → Reset ConfigurationIn the window that opens, make sure the checkbox is checked. No Default Configuration NOT installed (if you want to keep the basic drivers), but it is best to choose a full reset. After clicking the button Reset Configuration The device will reboot.
☑️ Check before setup
Basic interface and bridge setup
The key to turning a router into an access point is creating a transparent bridge. In router mode, the device divides the network into WAN and LAN, but we need it to function as a switch with WiFi functionality. To achieve this, all Ethernet ports and the wireless interface must be combined into a single logical interface— Bridge.
Go to the menu BridgeIf there is no list of bridges, create a new one by clicking the plus sign. +. Call it, for example, bridge-localIn the bridge settings, make sure that the protocol Protocol Mode set to value none (if you don't have a complex topology with other MikroTik switches), this will speed up network convergence at startup.
Next, go to the tab Ports inside the menu Bridge. Here you need to add all the physical ports that will work. Usually this is ether2 to ether5. Click +, select the interface, and add it to the created bridge. Repeat this procedure for each port you plan to use for internet sharing via cable.
Pay special attention to the port into which the cable from the main router (Uplink) will be plugged. Unlike in router mode, it doesn't matter which port you connect the cable from the provider or the main router to—all ports in the bridge are equal. However, for the sake of order, it's often used ether1 as an input port.
After adding the ports, we move on to configuring the wireless module. In the menu Wireless Double click on the interface (usually wlan1 or wifi1 in new models). On the tab Wireless in the field Mode select ap bridgeIn the field SSID Enter your network name. It may be the same as your primary roaming network or different.
Now you need to add a wireless interface to the bridge. Go back to Bridge → Ports and add wlan1 (or wifi1) to the list of bridge ports bridge-localFrom this point on, traffic between WiFi clients and wired ports will be transmitted at the second layer (L2) of the OSI model.
Why is AP Bridge mode important?
"AP bridge" mode allows the device to accept connections from clients and forward them to the bridge. If you select "bridge" alone, the device may not assign IP addresses or may behave incorrectly as an access point to end users. "Station" mode is used for receiving Wi-Fi, not distributing it.
Configuring IP addressing and DHCP client
Once the bridge is created, the device ceases to be a router and becomes a transparent channel. However, for you to manage this access point (access it via IP), it needs its own address. Important: this address must be in the same subnet as your main router, but it must not conflict with it.
Go to the menu IP → Addresses. Add a new address. Let's say your main router has the address 192.168.88.1Then the access point can be assigned a static address, for example, 192.168.88.2/24. Specify the interface you created earlier. bridge-localThis will allow you to access the device at the address 192.168.88.2 from anywhere on the network.
The next critical step is setting up an IP address for the device itself, if you don't want to manually assign a static address each time. To do this, go to the menu IP → DHCP Client click +In the field Interface select bridge-local. Make sure the checkbox is checked. Add Default Route installed in No (or remove the route later) to prevent the access point from trying to become the default gateway for your network.
Now you need to disable the built-in DHCP server if it is enabled by default. In access point mode, only the main router should be distributing addresses. Go to IP → DHCP ServerIf there are active servers there, turn them off (button with a red cross or DisableHaving two DHCP servers on the same network will cause chaos and loss of internet access for clients.
| Parameter | Importance for the Main Router | Value for Access Point (MikroTik) | Comment |
|---|---|---|---|
| Opening hours | Router / NAT | Bridge / AP | AP works transparently |
| DHCP Server | Enabled (distributes IP) | Turned off | There must be only one server. |
| IP Address | 192.168.88.1 (Gateway) | 192.168.88.2 (Static) | Addresses in the same subnet |
| NAT (Masquerade) | On | Not needed | The broadcast is done by the main one |
⚠️ Attention: If you forget to disable the DHCP server on your access point, devices on the network will start receiving incorrect settings (for example, the access point itself, which has no internet access, will be set as the gateway). All connected clients will lose internet access.
To check if your IP settings are correct, try pinging the new access point address (192.168.88.2) from a computer connected to the main router. If ping works, then IP connectivity is ensured.
WiFi Security and Encryption Configuration
Wireless network security is a top priority. An open network or outdated encryption WEP are unacceptable. Modern standards require the use of WPA2 or WPA3. In the interface MikroTik the setting is made in the menu Wireless → tab Security Profiles.
Create a new profile or edit an existing one defaultIn the field Mode select dynamic keys. In the section Unicast Keys And Group Keys check the box WPA2 PSK (or WPA3 if your clients support it). In the field WPA2 Pre-Shared Key Enter a complex password. We recommend using a mixture of letters, numbers, and symbols, at least 12 characters long.
After creating the security profile, return to the wireless interface settings (Wireless → double click on wlan1). On the tab Wireless in the field Security Profile Select the profile you created. Click Apply And OKNow, when trying to connect, devices will ask for a password.
An additional layer of protection is hiding the SSID, although security experts consider this a weak measure (the SSID is still visible in the packet headers). More effective use Access List. In the menu Wireless → Access List You can create rules that allow connections only to specific devices with specific MAC addresses. All others, even with the password, will be unable to connect.
It's also worth paying attention to the transmitter power. In the menu Wireless → Interfaces → wlan1 (tab TX Power) you can adjust the power. It doesn't always make sense to set the maximum value (0 dBm or max), as this can create excessive disturbance to neighbors and yourself, especially in apartment buildings.
Optimizing wireless signal and channels
WiFi quality depends not only on the password, but also on the correct choice of frequency and channel width. In the 2.4 GHz band, only three non-overlapping channels are available: 1, 6, and 11. Using automatic mode (scan-list) often results in the router choosing a noisy channel.
Use the built-in tool Torches or third-party applications on your smartphone (for example, WiFi Analyzer) to see which channels are occupied by neighbors. In the interface settings wlan1 in the field Frequency Manually specify the least loaded channel (for example, 2437 for the 6th channel). Channel width (Channel Width) in the 2.4 GHz range it is better to leave 20MHz for stability, even if 40MHz promises greater speed.
The situation is different for the 5 GHz band. There are many non-overlapping channels, and the width 40MHz or 80MHz It's perfectly reasonable for high speeds. However, the 5 GHz signal penetrates walls less effectively. If the access point is located in a distant room, it might make sense to sacrifice speed for coverage by choosing a narrower channel width.
An important parameter is Country in the wireless interface settings. Make sure your country is selected (e.g. latvia or united_states). This determines the permitted transmission power and available channels. Setting the wrong country may result in violation of laws and interference with intelligence services.
⚠️ Attention: Legislation in various countries strictly regulates frequency ranges and transmission power. Using unverified country profiles can result in fines from communications regulators.
Additional features: VLAN, Guest Network and CAPsMAN
Advanced users may want to segment their network. For example, to separate guest WiFi from the home network with printers and NAS. This is achieved using VLAN. IN MikroTik This is implemented through the creation of virtual interfaces (VLAN Interface) on top of the physical wlan1 and adding them to different bridges.
To create a guest network, create a new bridge. bridge-guest, add a virtual WiFi interface to it (created via the button + on the menu Wireless, type virtual). Then set up a separate security profile with a different password. The main thing is not to add this bridge to the main bridge's ports and to isolate it through the settings. Bridge → Settings → Use IP Firewall.
If you have multiple access points MikroTik, it makes sense to consider the technology CAPsMAN (Controlled Access Point System Manager). It allows for centralized configuration management of all access points, firmware updates, and fast client roaming between them without connection interruptions.
For small networks of 2-3 devices, CAPsMAN may be overkill; simply setting up identical SSIDs and passwords on different channels (1, 6, 11) is sufficient. Client devices will automatically switch to the stronger signal, albeit with a brief connection interruption.
Frequently Asked Questions (FAQ)
Can I use MikroTik as an access point if my main router is not MikroTik?
Yes, absolutely. In access point mode (Bridge) MikroTik It is transparent to upstream equipment. It doesn't care which router is distributing IP addresses—it could be TP-Link, Keenetic, ASUS or the provider's equipment. The main thing is that they are connected by cable and are on the same IP subnet.
Why doesn't the access point distribute the Internet after setup?
The problem is most likely in one of three places: 1) The access point has its own DHCP server enabled (conflict). 2) A bridge has not been created between the WiFi and LAN ports. 3) The cable from the main router is plugged into a port that is not added to the bridge, or the WAN port is being used (if it is physically separate and not added to the bridge).
How do I reset my access point password if I forgot my access point settings?
You will need physical access to the device. Find the hole. Reset. With the power on, press it with a paper clip and hold for about 10-15 seconds until the indicator ACT The light won't flash. The device will return to factory settings, and you'll be able to connect to it as if you were connecting for the first time.
Do I need to configure NAT on my access point?
No, it is absolutely not necessary. Regime NAT Masquerade should only be enabled on the main router, which connects to the internet. The access point operates at the data link layer (L2) and simply forwards Ethernet frames without performing address translation.
Does MikroTik support seamless roaming (802.11r/k/v)?
Yes, modern models and RouterOS v7 support the 802.11r/k/v standards, which are necessary for fast switching between access points. However, for full functionality, it is recommended to use the unified ecosystem. MikroTik with CAPsMAN configuration, as compatibility with roaming from other vendors may be limited.