In dense urban areas or large offices, the standard capabilities of a provider's built-in router are often insufficient. The signal struggles to penetrate concrete walls, speeds drop over distances, and the number of connected devices overloads budget equipment. The solution is to expand the network with professional equipment, and this is where wireless broadband comes into play. MikroTikTransforming this device into a fully-fledged access point allows you to create a single, seamless infrastructure with a high level of control.
Setting up MikroTik In access point mode, the configuration is fundamentally different from that of a typical home router. There's no "magic button," but there is flexibility. You get a tool that lets you manage radio channels, configure client isolation, create guest zones, and implement corporate security standards. This isn't just "sharing the internet"; it's building a reliable foundation for your local network.
In this article, we will look at the process of converting a router. RouterOS into a powerful access point. We'll go from physically connecting cables to fine-tuning the wireless interface. wlan1You'll learn how to avoid common mistakes, such as IP address conflicts, and understand how to properly distribute the load. The result will be a stable network that covers all required areas.
Preparing hardware and resetting the configuration
Before performing any modifications, ensure the device is clean. If the router was previously used, the old configuration may contain firewall or routing rules that will interfere with the new mode. The ideal option is to perform a full reset (No Defaults) or clear the configuration via the terminal if you're already familiar with the CLI.
The physical connection also plays a critical role. For setup, you'll need a computer connected to the MikroTik via a patch cord. Unlike router mode, where the WAN port is dedicated, in access point mode we often use all ports as part of a single bridge. Make sure the cable is working properly and the port indicators are lit or blinking appropriately.
⚠️ Note: When resetting the configuration on some MikroTik models (e.g., the hAP ac series), you may need to hold the Reset button while powering on for about 10-15 seconds until the ACT indicator flashes. Please check the specifications for your model to ensure you don't miss this step.
To access the device, use the utility WinBoxIt allows you to connect using a MAC address, even if the device's IP address is unknown to you or differs from your subnet address. key advantage MikroTik's ecosystem stands out from the competition. After connecting, immediately create a backup of the clean system to ensure you have a point of return in case of an error.
☑️ Preparing MikroTik for setup
Basic Network Configuration and Bridging
The foundation of any RouterOS-based access point is proper BridgeUnlike simple routers, where ports are often rigidly assigned to VLANs or WAN/LAN, at MikroTik we create a logical bridge that connects the physical port (through which the internet comes) and the wireless interface. All these components become part of a single broadcast domain.
First, you need to remove the default DHCP client if it was created automatically upon initial startup and is directed to the WAN. We want the access point to receive its IP address from the primary router, which is located "higher" in the hierarchy. To do this, go to the menu IP -> DHCP Client We delete unnecessary entries or disable them.
Next, we create a new bridge. In the menu Bridges we add Bridge1. Then we go to the tab Ports and add the necessary interfaces there: a physical port (for example, ether1, if the cable from the main router is plugged into it) and the wireless interface wlan1Important: The order in which ports are added to the bridge can affect the operation of Spanning Tree Protocol (STP), so it is best to leave the local interface as the bridge master.
/interface bridgeadd name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=wlan1
After creating the bridge, you need to assign an IP address to the interface itself. bridge1This is done through the menu. IP -> AddressesThe address must be static and on the same subnet as the main router, but not the same as any other device on the network. For example, if the main router has the address 192.168.88.1, the access point can be assigned 192.168.88.2. Also, don't forget to specify the gateway and DNS servers in the appropriate menu sections. IP.
Setting up a wireless interface (Wireless)
The most important step is configuring the radio interface. Go to the menu Wireless and double click on wlan1. Here you will find the parameters that determine the stability and speed of the connection. Tab Wireless contains a field Mode, which needs to be switched to ap bridgeThis turns the device from a client or scanner into a full-fledged base station.
In the field SSID Enter a name for your network. To separate frequency bands (if you have a dual-band device), you can make the names similar but specify the band, for example, OfficeWiFi_2.4 And OfficeWiFi_5GIn the field Frequency select a specific channel. Using the mode auto Not recommended for fixed access points, as the device may choose a channel that is noisy due to neighbors when rebooting.
| Parameter | Recommended value | Description |
|---|---|---|
| Mode | ap bridge | Access point mode |
| Band | 2GHz-b/g/n or 5GHz-a/n/ac | Data transmission standard |
| Channel Width | 20/40mhz Ce (for 2.4), 40/80mhz (for 5) | Channel width affects speed |
| Security Profile | profile1 | Security profile (encryption) |
Pay special attention to the parameter WPS ModeIn professional settings it should be disabled (disabled), as this protocol is vulnerable. Also in the advanced settings (Advanced Mode) it's useful to check InstallationFor outdoor antennas it is installed outdoor1, for indoor use - indoorThis affects the emission power limitation in accordance with the regulations of your country.
⚠️ Note: Interfaces and menu item names may vary slightly depending on the RouterOS version (v6 or v7) and the specific device model (hAP, cAP, wAP). Always consult the official documentation for your firmware revision.
Security and access profiles
Wireless networks are broadcast over the air, so data security is paramount. MikroTik uses Security Profiles to ensure this. Go to the menu Wireless -> Security Profiles. By default it is already created there profile1. Open it and make sure the mode is Authentication Types includes wpa2 psk (or wpa3, if your clients support this modern standard).
In the field WPA2 Pre-Shared Key Set a complex password. It should be at least 12 characters long and contain mixed-case letters, numbers, and special characters. Avoid using dictionary words. AES encryption (CCMP) is the de facto standard, while TKIP is considered obsolete and reduces the overall network speed to 54 Mbps.
Why is WPA3 better but not always necessary?
The WPA3 protocol provides protection against brute-force attacks even with weak passwords, thanks to the SAE mechanism. However, older devices (IoT light bulbs, older smartphones) may simply not detect a network with WPA3 enabled.
For guest networks or corporate segments, you can create additional profiles and bind them to virtual interfaces (VAPs), but for basic setup, one trusted profile is sufficient. Don't forget to check the box Group Key Update to a value such as 1 hour (3600 seconds) so that the encryption keys are changed periodically, increasing cryptographic strength.
Managing DHCP and Services
One of the most common setup mistakes is running a second DHCP server where it's not needed. If your MikroTik is operating as an access point rather than the main router, the network's default gateway should be distributing IP addresses. Check the menu. IP -> DHCP ServerIf there are active servers there, they need to be disabled or deleted.
The access point should obtain an IP address automatically. To do this, go to the menu IP -> DHCP Client create a new client, select the interface bridge1 and put a tick Add Default Route (or enter the route manually). This will provide internet access for device management and time synchronization.
It is also critical to check your DNS settings. In the menu IP -> DNS Specify the addresses of public servers (for example, 1.1.1.1 or 8.8.8.8) and be sure to enable the option Allow Remote Requests only if necessary, but in pure access point mode it is better to rely on the DNS of the main router, registering its IP as a DNS server for clients via the DHCP options of the main router.
Signal optimization and additional features
After the basic setup, the network will work, but for maximum performance, fine-tuning is required. This primarily concerns channel selection. Use the built-in tool Wireless -> Interface -> Scan (or Sniffer) to analyze the broadcast. Find the channels with the lowest noise floor and the fewest neighbors.
For the 2.4 GHz band, use only channels 1, 6, and 11, as they do not overlap. Channel width 20 MHz often provides a more stable signal in apartment buildings than 40 MHz, due to less interference. For 5 GHz, you can safely set the bandwidth to 40 or 80 MHz if there are no powerful radars nearby.
You can further configure Access List (Access list). In the menu Wireless -> Access List You can create rules that deny connections to specific devices based on their MAC address or, conversely, allow only certain ones. This is a powerful filtering tool that works faster than firewall rules.
How to set up a guest network (VAP) on MikroTik?
To create a guest network, create a virtual interface: Wireless -> + (Add New) -> Mode: AP VirtualEnter a new SSID (e.g., "Guest"). In the settings for this virtual interface, select the same Master Interface (wlan1), but create a separate Security Profile with a different password. Then add this virtual interface to Bridge (if you want guests to have access to the LAN) or leave it isolated, configuring firewall rules to block access to local resources.
What to do if devices don't see the 5 GHz network?
Check your Country settings. In the menu System -> Country Your country must be selected. Some channels (e.g., 36-48 or 149-165) may be blocked or have limited power depending on the selected region. Also, make sure that in the Wireless Interface settings, the Band field is set to a mode that supports the A/N/AC standard, not just B/G/N.
FAQ: Frequently Asked Questions
Do I need to disable NAT on my access point?
Yes, it is required. In Access Point mode, the device operates at Layer 2 of the OSI model (data link). NAT (Network Address Translation) is a Layer 3 function that should only be implemented on the main router. Enabling NAT on the access point will create a "double NAT," which will cause connection issues for games, video calls, and torrents.
Can MikroTik be used as an access point and a router at the same time?
Technically, it's possible by setting up traffic forwarding, but this is bad practice. It's better to use the device for its intended purpose: either as a smart router (with NAT, PPPoE) or as a dumb access point (Bridge mode). Combining these functions complicates diagnostics and reduces performance.
Why is WiFi speed lower than cable speed?
WiFi is a half-duplex medium. A device cannot simultaneously receive and transmit data; it shares the airtime. Interference, distance, wall material, and the number of connected clients also play a role. Actual WiFi speed is typically 50-60% of the theoretical interface speed.