Setting up a wireless network on equipment Mikrotik This often raises questions among users accustomed to the simplified interfaces of consumer routers. Unlike home routers, where entering a password is sufficient, this one opens up a whole world of fine-grained radio channel settings, power management, and security. Proper configuration allows you to do more than just "share the internet"; you can build a fault-tolerant architecture capable of operating even in densely populated areas.
Before you begin, it's important to understand that the basic installation often contains template parameters that don't take into account the specifics of your space. Signal interference and the wrong choice of channel width can negate the benefits of even the most expensive equipment. In this article, we'll look at how to turn your Mikrotik from a simple router to a professional access point, eliminating typical configuration errors.
It is worth noting that the interfaces WinBox and WebFig may differ depending on the version RouterOSHowever, the radio module's operating logic remains the same: we need to ensure clear airwaves and reliable encryption. We'll cover everything from the physical placement of antennas to complex encryption protocol settings to ensure you get maximum connection speed and stability.
Initial preparation and entry into the control interface
The first step is always connecting to the device. For professional setup, using the web interface is often not functional enough, so experienced administrators prefer the utility. WinBoxIt allows you to see more detailed statistics and access hidden parameters that aren't always visible in the browser. Connect to the router via its MAC address or IP address, which is usually the default. 192.168.88.1.
After authorization (login admin(The default password is usually empty) you should change your credentials immediately. Security begins with protecting the control interface itself. Go to the menu System → Users and set a complex password for the user admin or create a new administrator, blocking the standard account.
⚠️ Warning: Never leave a Mikrotik router with open access to the WinBox (8291) or WebFig port from the external network (WAN) without reliable protection. This is the most common reason for devices to end up in botnets.
Next, you need to make sure that the device has the latest wireless technology package installed. In the menu Wireless You will see a list of available interfaces. If an interface is missing or marked with a red cross, check if the package is installed. wifiwave2 or standard wireless in the section System → PackagesOlder models with Atheros chips use the standard software package, while newer AX series models may require an updated software version.
Basic configuration of the wireless interface
Double-click the desired wireless interface (usually wlan1 or wifi1). Tab Wireless contains the main parameters of the radio operation. Field Mode must be set to value ap bridge, if you are creating an access point for clients to connect to. Mode station is used to receive the signal, and bridge allows you to connect network segments.
In the field SSID Enter the name of your network that users will see. Hiding the SSID is common for corporate networks, but in a home environment, this only creates unnecessary inconvenience when connecting new devices without adding any real security. Below is a critical setting. Frequency, responsible for the channel frequency.
Do not leave the frequency value in the mode auto In a densely populated apartment building, the router may select a congested channel, resulting in a drop in speed. It's best to manually scan the airwaves using the button. Scan and choose the least noisy frequency. For the 2.4 GHz band, channels 1, 6, and 11 are considered optimal, as they don't overlap.
Parameter Band determines the operating range. For older devices, leave 2GHz-B/G/N or 2GHz-Only-NIf your equipment supports 5 GHz, the setup is similar, but the channel selection is wider and the signal penetration is lower, which is sometimes a plus for isolating neighboring networks.
Setting up security and encryption protocols
Let's go to the tab SecurityThis is where you configure protection against unauthorized access. In the field Security Profile the profile is selected by default defaultClick the ellipsis (...) next to the title to edit it or create a new one.
In the window that opens, make sure the checkboxes are checked. Authentication Types: WPA PSK And WPA2 PSKUsing the outdated WEP protocol or only WPA1 makes your network vulnerable to hacking in minutes. WPA Pre-Shared Key Enter a complex password containing letters of different upper and lower case, numbers and special characters.
| Parameter | Recommended value | Description |
|---|---|---|
| Mode | dynamic keys | Using dynamic keys for each session |
| Group Key Update | 5m | Group encryption key update interval |
| Unicast Keys | Enabled | Encryption of traffic between the client and the access point |
| WPA Mode | WPA2 only | Disabling vulnerable WPA/WPA3-mixed protocols |
To increase security, you can enable the option Disable PMKID, which prevents certain types of brute-force attacks. It's also worth noting Group Key UpdateSetting a value of, say, 5 or 10 minutes forces the router to regularly change encryption keys for group traffic, making data interception more difficult, although it creates minimal additional load on the processor.
⚠️ Note: WPA3 is the most modern protocol, but older devices (such as cameras and smart plugs) may stop connecting. If compatibility is required, use WPA2/WPA3 mixed mode, but be aware of the potential risks.
Channel width and signal power control
One of the biggest mistakes is setting the maximum channel width without taking the surrounding environment into account. Parameter Channel Width in the 2.4 GHz range it is better to keep it at the level 20MHz. Installation 40MHz in this range will almost certainly result in overlapping of all available frequencies and a drop in communication quality due to interference.
In the 5 GHz band, the situation is different. Here, you can safely use the width 40MHz, 80MHz and even 160MHz (If your router model and air quality allow it). A larger channel width directly impacts the maximum data transfer rate but reduces the number of non-overlapping channels.
Transmitter power (Tx Power) also requires attention. Intuitively, it's tempting to crank it up to maximum (for example, 30 dBi), but this often leads to signal distortion and overheating of the module. The optimal value for an apartment is between 15 and 20 dBi. If the client device is located far away, it's better to improve reception at the client end or install a repeater than to "shout" at high volume, creating noise for yourself.
Why is full power bad?
At maximum transmitter power, the signal can "overlap" with itself (echo effect), especially in rooms with many reflective surfaces. This reduces the actual speed (throughput), despite a high signal level (RSSI).
There is also a parameter Supported Rates And Basic Rates. Disabling low speeds (e.g. 1Mbps, 2Mbps) on the tab Data Rates Forces devices that are far away and operating at low speeds to shut down, freeing up airtime for faster clients. This is called "pushing" slower clients.
Creating a guest network and isolating clients
To secure your main network, it is recommended to set up guest access. This is done by creating a second virtual interface (Virtual AP) on the same physical map. Go to the menu Wireless, click "+" and select the interface type Virtual AP. Specify the same Master Interface, but ask a new one SSID (for example, "Guest_WiFi").
The key here is isolation. In the settings of the created virtual interface, you need to check the box Default Authenticate (in some versions Default Forward requires separate firewall configuration, but basic isolation is often done through Bridge or Firewall). However, the easiest way is not to include the guest network in the main bridge (Bridge), and give it a separate IP address via DHCP Server.
- 📡 Create a separate pool of addresses for guests in
IP → Pool. - 🔒 Set up
IP → DHCP Serverfor the guest interface, so that guests receive IP from a separate range. - 🚫 In
IP → Firewall → Filter RulesCreate a rule that prohibits entry (Forward) from the guest subnet to the main one.
This configuration ensures that even if a guest device is infected with a virus, it won't be able to attack your personal computers or NAS on the main network. The guest will only have internet access.
☑️ Checking the guest network
WiFi diagnostics and optimization
After setting up, you need to test the network performance. Mikrotik has excellent tools for this. In the menu Wireless select the interface and click the button RegistrationHere you will see a list of all connected clients, their signal strength (Signal Strength) and connection speed.
Pay attention to the meaning Tx Rate And Rx RateIf a client located a meter away from the router has a connection speed of 54 Mbps or 65 Mbps instead of the expected 300+ Mbps, there are issues with interference or channel width settings. This tool is also useful. Sniffer or Torch for real-time traffic analysis.
If you notice frequent connection breaks, check the logs in LogsAssociation or deauthentication errors may indicate issues with client device drivers or overly aggressive timeout settings. In severe cases, resetting the radio settings and reconfiguring with a different frequency may help.
⚠️ Note: Interfaces and item names may vary slightly depending on the RouterOS version (v6, v7) and the type of card installed (Cisco, Mikrotik, Ubiquiti). Always consult the official documentation for your specific model.
FAQ: Frequently Asked Questions
Why can't my phone see the 5GHz network?
Make sure that in the settings Wireless the correct one was chosen CountrySome countries prohibit certain channels in the 5 GHz band. If, for example, the US is selected and you are in an area where these channels don't work, or vice versa, your device may not display the network. Also, check whether the device itself supports the 802.11ac/ax standard.
How to increase the WiFi range on Mikrotik?
Physically, it's impossible to increase the power beyond the standard without losing quality. The best way is to properly position the antennas (vertically), use an external antenna with a high gain (dBi), or build a mesh network with additional access points connected via cable.
Is it possible to combine several Mikrotik devices into a single WiFi network?
Yes, this can be done using the function Wireless Distribution System (WDS) or by configuring routing protocols (OSPF/BGP) and a single SSID on different access points. However, seamless roaming (802.11r/k/v) requires support from client devices and proper configuration of CAPsMAN (Controlled Access Point System Manager).
What to do if the wlan1 interface is missing?
Check if the interface is enabled (click the Enable button). If it's not listed, the package may not be installed. wireless or wifiwave2 in the section System → PackagesAlso make sure that the card is not disabled physically or in the BIOS (for integrated solutions).