How to set up the MikroTik cAP Lite as a Wi-Fi access point: a detailed guide

• Click +to create a new security profile.
• Field Name: enter a profile name, for example MyWiFiSecurity.
• Field Mode: select dynamic keys.
• Field Authentication Types: leave only WPA2 PSK.
• Field WPA2 Pre-Shared Key: Enter a strong password (at least 8 characters, with numbers and letters).

After saving the settings, go to the tab IP → DHCP Client and add a client for the interface bridge-local (if you plan to receive an IP address automatically from the main router).

4. Setting up a bridge and distributing IP addresses

MikroTik cAP Lite by default creates a bridge interface bridge-local, which combines all ports (including Wi-Fi). However, for the access point to function correctly, it is necessary:

1. Go to Bridge → Ports and make sure that the interfaces wlan1 (Wi-Fi) and ether1 (Ethernet) added to the bridge.
2. On the menu IP → Addresses assign a static IP address to bridge-local (For example, 192.168.1.2/24), if DHCP from the main router is not used.
3. To distribute IP addresses to clients:
   • Go to IP → DHCP Server.
   • Create a new server for the interface bridge-local.
   • Please specify a range of addresses (e.g. 192.168.1.100–192.168.1.200).
   • In the field Gateway Enter the IP address of your main router (e.g. 192.168.1.1).
   • In the field DNS Servers add 8.8.8.8 And 1.1.1.1 (Google and Cloudflare).

Critical detail: If your main router is already distributing DHCP, disable the DHCP server on cAP Lite to avoid conflicts. In this case, in the menu IP → DHCP Server Delete the created server or mark it as inactive.

5. Optimize Wi-Fi performance

By default cAP Lite uses conservative settings that don't always provide maximum speed and stability. We recommend making the following changes:

• 📶 Channel selection: Manually set the channel in the menu Wireless → wlan1 → FrequencyAvoid channels 1, 6, and 11 if they are occupied by neighboring networks. Channels 3 or 9 (if free) are optimal.
• 🔄 Opening hours: If all your devices support 802.11n, disable outdated standards B And G in the settings Wireless → wlan1 → WirelessThis will increase throughput.
• 📊 Channel width: For maximum speed, select 40MHz, but only if there are no other networks on adjacent channels. In apartment buildings, it's best to leave 20MHz.
• 🔋 Transmission power: Reduce to 17–18dBm on the menu Wireless → wlan1 → AdvancedThis will reduce interference to neighboring access points and reduce power consumption.

To check the speed, connect to the network from a laptop and use the service SpeedtestIf the speed is lower than expected:

• Check that the Ethernet cable is connected to the port. Ether1 (and not Ether2, which is disabled by default).
• Make sure that your main router does not limit speed based on MAC address.
• Update the firmware cAP Lite to the latest version (menu System → Packages → Check For Updates).

/interface wireless registration-table print

6. Security: protection from hacking and unauthorized access

Devices MikroTik are often targeted by attacks due to default settings. To protect your network:

1. Change the administrator password:
   • Go to System → Users.
   • Select a user admin and press Password.
   • Set a complex password (example: k7#pL9!mT2@qR).
2. Disable unnecessary services:
   • On the menu IP → Services turn it off ftp, telnet And api.
   • Leave only winbox (port 8291) And ssh (port 22).

• On the menu Wireless → Security Profiles → [your profile] → Access List Add allowed MAC addresses of devices.
• Install Action: accept for your devices and Action: reject for the rest.
• Enable client isolation (for guest networks):

  /interface wireless access-list
  add interface=wlan1 mac-address=00:00:00:00:00:00/00:00:00:00:00:00 \
  forwarding=no

  This command prevents devices from exchanging traffic with each other (Internet access only).

⚠️ Note: If you have enabled MAC address filtering, new devices will be unable to connect to the network. To add a new device, temporarily disable filtering or manually whitelist its MAC address.

For additional protection we recommend:

• 🔄 Update the firmware regularly (every 3–6 months).
• 🔒 Use WPA3 instead of WPA2, if all client devices support it.
• 📡 Disable broadcast SSID (hide the network name) in settings Wireless → wlan1 → General (field Hide SSID).

7. Advanced Scenarios: VLANs and Multiple Networks

For office networks or home laboratories cAP Lite Supports traffic segregation by VLAN. For example, you can create:

• 🏠 The main network for employees (VLAN 10) with access to all resources.
• 👥 Guest network (VLAN 20) only with internet access.
• 📦 Network for IoT devices (VLAN 30) with limited bandwidth.

Steps to configure VLAN:

1. Create VLAN interfaces:

   /interface vlan
   add interface=bridge-local name=vlan10 vlan-id=10
   add interface=bridge-local name=vlan20 vlan-id=20

2. Configure a DHCP server for each VLAN (menu IP → DHCP Server → Networks).
3. Create separate Wi-Fi networks for each VLAN:
   • Add a second virtual AP to Wireless.
   • In the interface settings, specify Master Interface: wlan1 And VLAN ID: 20 (for guest network).

/ip firewall filter
add chain=forward in-interface=vlan20 out-interface=vlan10 action=drop

This command prevents guest devices (VLAN 20) access the main network (VLAN 10).