Modern router Mikrotik — is a powerful tool that may not have a wireless interface enabled by default. Many users who purchase equipment from this brand encounter a situation where the cable works, but the wireless connection is nonexistent. This is due to the specifics of the pre-installed configuration. RouterOS, where the emphasis is on wired security and stability.
Turning on Wi-Fi Requires more than just pressing a button; it requires creating a fully-fledged access point with encryption settings. The process involves working with interfaces, bridges, and security profiles. Understanding these processes will allow you to not only distribute internet over the air but also do so as efficiently as possible.
In this article, we'll walk you through all the steps to activate a wireless network. We'll cover how to use the utility. WinBox, as this is the most professional and convenient way to control the equipment MikrotikYou will learn how to create bridges, configure frequency ranges, and secure your local network from unauthorized connections.
Preparing equipment and accessing settings
Before you begin working with the software, you must ensure the physical connection is secure. Your computer or laptop must be connected to the router. Mikrotik A patch cord is used through one of the LAN ports. Using a wireless connection for initial setup is not possible, as the module is not yet activated.
To manage the configuration, you will need specialized software. WinBoxThis is a lightweight utility that allows you to interact with the router's operating system at a deep level. You can download it from the manufacturer's official website or find it in the Files folder of an already connected device if it provides DHCP.
Launch the program and find your device in the Neighbors list. It is usually displayed by MAC address or name, unless previously changed. The default login is admin, and the password field is often left blank if you didn't change the credentials when you first installed it.
⚠️ Note: If you're setting up a previously used router and you don't know the password, the only way to gain access is to perform a full reset (Reset Configuration). This will delete all current firewall and routing rules.
After successful authorization, you will see the program's main window. The interface may seem overloaded with numerous menu items, but for our purposes, we only need a few sections. Focus on these sections. Wireless, Bridge And IP.
Activating the wireless interface in the Wireless menu
The first step in the activation process is to turn on the radio module itself. Go to the menu Wireless on the left side of the window WinBoxHere you will see a list of available physical interfaces. On single-board models, such as hAP or RB951, the interface is usually denoted as wlan1 or wifi1.
If there's a red circle or the letter "R" next to the interface name, it's disabled. To activate it, simply highlight the line and click the blue up arrow button in the toolbar or use the keyboard shortcut. The indicator should then turn green, indicating the module is physically ready for use.
However, simply enabling the interface doesn't create an access point. You need to configure its operating mode. In the interface properties window that opens, find the field ModeBy default, there may be a value there station (client) or ap-bridgeTo create an access point, we need to select the mode ap-bridge.
In this same window, you should pay attention to the field BandModern standards allow you to choose between 2ghz-b/g/n, 5ghz-a/n/ac or mixed modes. The choice of a specific range depends on the frequencies supported by your hardware. Mikrotik. If you're using a dual-band router, you'll have two separate interfaces for configuration.
Creating a bridge to connect networks
In architecture Mikrotik It's common to combine wired ports and a wireless interface into a single logical network segment, called a bridge. This allows devices connected via Wi-Fi to "see" devices connected via cable and receive IP addresses from the same subnet. Without creating a bridge, you'll have to configure complex routing between subnets.
Go to the menu Bridge and create a new bridge by clicking on the plus sign. Name it, for example, bridge-localIn the bridge settings window that appears, go to the tab PortsHere you need to add all the physical LAN ports that you want to combine, as well as your newly activated wireless interface.
Adding ports occurs sequentially. Click the plus sign in the field Interface select wlan1 (or the name of your WiFi interface). Repeat the procedure for the ports ether2, ether3 and so on, if you want them to be on the same network. Port ether1 It is usually left separately as WAN (Internet input), although in simple scenarios it can also be added to the bridge.
An important point is the protocol setup STP (Spanning Tree Protocol)In home networks without cable loops, it's often disabled to speed up client connections. However, in office networks with multiple switches, its presence is critical to prevent broadcast packet storms.
☑️ Checking Bridge settings
Setting up a DHCP server to distribute addresses
To ensure that connected smartphones and laptops automatically receive IP addresses, you need to configure a DHCP server. Mikrotik There is a convenient setup wizard that automates this process. Go to the menu IP -> DHCP Server and press the button DHCP Setup.
The wizard will prompt you to select the interface to service. Select the one you created earlier. bridge-localNext, the system will ask for the network address space. By default Mikrotik uses a subnet 192.168.88.0/24If your provider does not use this range to issue addresses, you can leave the default value.
In the next step, the wizard will prompt you to specify the gateway address. This will be the IP address of the router itself on the local network, usually 192.168.88.1Next, you need to specify the range of addresses (Address Pool) that will be issued to clients. The standard pool covers addresses from .2 to .254, which is more than enough for home use.
The final step is to specify the DNS servers. You can enter public DNS addresses, such as those from Google (8.8.8.8) or Yandex (77.88.8.8), or leave the field blank to have the router broadcast DNS received from the ISP. After the wizard completes, devices connected via Wi-Fi will begin receiving IP addresses automatically.
| Parameter | Recommended value | Description |
|---|---|---|
| Interface | bridge-local | Logical port aggregation |
| Network | 192.168.88.0/24 | Local network address range |
| Gateway | 192.168.88.1 | The address of the router itself |
| Address pools | 192.168.88.10-192.168.88.254 | Addresses for clients |
WPA2 Security and Encryption
An open wireless network poses a serious security threat. Anyone within range can intercept your traffic or use your internet connection for illegal activities. Therefore, setting up a security profile is essential. In the menu Wireless go to the tab Security Profiles.
Create a new profile or edit an existing one (usually default). In the field Mode select dynamic keysThis will allow the use of individual encryption keys for each client. In the fields WPA2 Pre-Shared Key Enter a complex password consisting of letters, numbers, and symbols. The password must be at least 8 characters long.
It is important to choose the right encryption algorithm. In the field Authentication Types make sure the box next to it is checked wpa2-pskIn the field Encryption select aes-ccmOld algorithms like tkip or wep are considered obsolete and unsafe, and their use is not recommended even for compatibility with very old devices.
⚠️ Warning: Never use WEP encryption. It can be cracked in seconds with specialized software. If you have a device that only supports WEP, it's best to replace it, as it poses a security hole for the entire network.
Once you've created a security profile, you need to apply it to your wireless interface. Return to the menu. Wireless, open the interface properties wlan1 and in the field Security Profile Select the profile you created with the WPA2 key. Now, when you try to connect, the device will ask for a password.
What to do if you forgot your Wi-Fi password?
If you've lost your password, you can find it in your router settings. Log in to WinBox and open Wireless -> Security Profiles. The password will be displayed in the WPA2 Pre-Shared Key field, but it will be hidden by asterisks. To view it, you'll need to temporarily disable masking or use third-party sniffers if you already have access to the network with the saved password on another device.
Advanced settings: frequencies and signal strength
To optimize network performance in apartment buildings where the airwaves are cluttered with neighbors' signals, it's important to select the correct frequency (channel). There's a field in the wireless interface properties Frequency. Meaning 0 means automatic selection, but the router may choose a congested channel.
It is recommended to analyze the broadcast. In the menu Wireless there is a button ScanRun a scan, and the router will display a list of all visible networks, along with their frequencies and signal strength. Select the frequency with the fewest competitors or the weakest signal.
It is also worth paying attention to the channel width (Channel Width). For the 2.4 GHz band, 20 MHz is the standard. Setting 40 MHz in this range often results in significant packet loss due to interference. For the 5 GHz band, 40 or 80 MHz is safe to use, which will significantly increase data transfer speeds.
Transmitter power (TX Power) is also adjustable. Maximum power isn't always a good thing, as it can "jam" neighboring access points and create nonlinear distortion. If the router is located in the center of the apartment, try reducing the power to -10...-15 dBm relative to the maximum.
Diagnostics and troubleshooting
After applying all the settings, clients may not see the network or be unable to connect to it. First, check the interface status. If the green indicator is on but there is no connection, check the event log (Log). There may be messages about authentication errors or protocol mismatches.
A common issue is mismatched security standards. If the router only has WPA2 enabled and the client device attempts to connect via WPA, the connection will fail. Make sure compatible modes are selected in the security profile.
Another important aspect is the presence of firewall rules. If you are setting up a router from scratch, make sure that the menu IP -> Firewall There is no rule blocking incoming connections on port 53 (DNS) or 67 (DHCP), or allowing traffic only from certain MAC addresses.
If nothing helps, try updating the firmware RouterOS to the latest stable version. Older versions may have bugs affecting the wireless module of certain chipsets. The update often resolves compatibility issues with new smartphones.
Why doesn't my Mikrotik router detect 5 GHz networks?
This may be due to regional restrictions. Select your country in the Wireless -> Country menu. Some channels in the 5 GHz band are only available if you select the correct regulatory domain. Also, make sure your router model physically supports 5 GHz (usually models with the ac or ax prefix).
How to increase Wi-Fi range?
In addition to adjusting transmitter power, antenna positioning is important. Vertical antenna placement provides a better horizontal radiation pattern. Using an external antenna with a higher gain (dBi) instead of the standard antenna can also significantly improve coverage.
Is it possible to create a guest network on Mikrotik?
Yes, to do this, you need to create a second virtual interface (Virtual AP) on the same physical card, assign it a different SSID, and add it to a separate bridge with its own DHCP server. To isolate guests from the main network, you need to configure firewall rules to block traffic from the guest subnet to the main network.
Is it safe to use WPS on Mikrotik?
Using WPS (Wi-Fi Protected Setup) on Mikrotik routers is possible, but not recommended for security reasons. The protocol has vulnerabilities that allow the PIN code to be brute-forced. It's better to use QR codes for connection or enter a complex password.