Setting up MikroTik as a Wi-Fi client

Router transformation MikroTik A wireless client opens up wide possibilities for expanding a home or office network. This feature allows the device to connect to an existing access point and forward the internet to the LAN ports, creating a bridge or separate subnet. This scenario is often referred to as "bridge mode." Station or Wireless Client, and it is indispensable where it is impossible to lay a cable, but a stable wired connection is required.

Unlike a simple repeater, which simply repeats the signal, MikroTik As a client, it can handle complex routing, traffic filtering, and priority management tasks. You get a fully functional router at a remote site, hidden behind a wireless link. This solution is ideal for connecting remote buildings, garages, or individual floors where the cable infrastructure is missing or damaged.

Before beginning configuration, it's important to understand that operating in client mode places certain hardware requirements. Not all models support simultaneous operation as a client and access point on the same frequency band without performance loss. However, if your goal is simply to get internet access to your router's ports from a neighbor's Wi-Fi network or a backbone provider, this method is one of the most reliable and flexible in the industry.

Hardware requirements and model selection

The first step is always to select the appropriate hardware, as not every card is capable of operating in this mode. Station. In the world MikroTik There's a distinction between devices that only support access point (AP) mode and those that can act as clients. This typically depends on the chipset and the installed RouterOS license. To create a stable communication channel, dual-band models are preferable, with one radio module receiving the signal and the other distributing it locally.

Particular attention should be paid to antennas and their polarization. If you plan to receive a signal from a long distance, the built-in antennas may not be sufficient. In such cases, external directional antennas or specialized devices of the series are used. hAP And SXT.

When choosing a model, it's also worth considering support for security standards. Older devices may not support WPA3 or modern encryption methods, which will make connecting to secure networks impossible. Ensure the selected board has sufficient processor power to handle NAT and traffic encryption at the expected speeds, otherwise the wireless channel will become a bottleneck for the entire system.

⚠️ Note: The RouterOS L3 license limits the number of simultaneously connected clients, but in Station mode (client), this limitation is usually not critical, as the router acts as a single device. However, WDS functionality may require a higher license.

Basic RouterOS setup

Before configuring the wireless interface, you must clean the system to avoid configuration conflicts. A factory reset is recommended if the device has been previously used in other projects. This can be done using the button. Reset on the case or programmatically through the menu System → Reset ConfigurationAfter rebooting, make sure you can access the device via cable through WinBox or the web interface.

The next step is to update the software to the latest version. In the menu System → Packages Check for updates and install them. This ensures that the wireless module drivers are working correctly and support all required security features. After updating, reboot the device again to apply all kernel changes.

Now you need to create a bridge to combine the wireless interface and Ethernet ports. This will allow the device to act as a transparent switch, passing traffic between Wi-Fi and cable without complex routing, unless you need separate subnets. In the menu Bridges create a new bridge, for example, bridge1, and add ports to it ether2-ether5 and your wireless interface (usually wlan1).

It's important to configure IP addressing correctly. If you're configuring client mode, it's best to assign a static IP address to the bridge interface or use a DHCP client to automatically obtain an address from the main network. This will ensure you have access to the management interface after switching to a wireless connection. Go to IP → DHCP Client, select the interface bridge1 and check the box Use Peer DNS And Add Default Route.

Wireless Interface Configuration (Station Mode)

Configuring the radio interface itself is a key step. Go to the menu Wireless and open the properties of your wireless interface (for example, wlan1). In the field Mode select a value station (or station-bridge, if you are not using a common bridge, but want the device to work as a transparent bridge at the MAC address level, but for most cases the DHCP mode is sufficient station).

Next, you need to specify the parameters of the network you will be connecting to. In the field SSID Enter the exact network name of your ISP or main router. Pay attention to the case of letters and special characters. Frequency (Frequency) it is better to set it to mode scan or select manually if you know the exact channel frequency to speed up the connection and avoid searching in a wide range.

/interface wireless set wlan1 mode=station ssid="Provider_WiFi" frequency=2437 disabled=no

Pay special attention to the section Wireless Security Profile. Create a new profile or edit an existing one, selecting the correct security mode (usually wpa2-psk). In the field Passphrase Enter your Wi-Fi network password. If you're using WPA2-Enterprise security, you'll need to configure the EAP and Supplicant tabs, which is less common in home environments.

What is WDS and should it be enabled?

WDS (Wireless Distribution System) allows for the transmission of service frames between access points. In Station mode, enabling WDS is necessary if you want broadcast packets to pass through the client or if you're building a complex bridge chain. WDS is often not necessary for simply accessing the internet on ports, but enabling it (station-wds mode) can improve connection stability with some access points.

After entering all the parameters, click the button Apply And OKIf the settings are correct, the connection status in the interface list will change to running, and in the logs (Log) a message will appear indicating successful association with the access point. You should see the assigned IP address in the menu. IP → DHCP Client and access the Internet through connected LAN ports.

Setting up security and WDS

Connection security in client mode is critical, as all your traffic is routed through a foreign wireless network. Ensure encryption is selected in the security profile. AES (CCMP), as the old standard TKIP It's considered vulnerable and reduces connection speed. In the security profile settings, disable the use of older protocols if the main access point supports modern standards.

Mode WDS (Wireless Distribution System) requires separate consideration. If you use the mode station-wds, you need to create a WDS interface for your wireless connection. This is done in the menu Wireless → WDSAdd a new interface, bind it to wlan1 and add this new WDS interface to your Bridge. Without this step, traffic will not flow through the LAN ports in station-wds mode.

To improve connection stability, it is recommended to fix the MAC address of the access point. In the menu Wireless → Scan Find the network you need, click on it and select Connect or copy the MAC address manually into the field Connect ListThis will prevent you from connecting to rogue access points with the same name (Evil Twin) that may appear on the air.

⚠️ Important: When using Station mode with NAT (routing), ensure that the subnets of the main router and your MikroTik are not the same. If the main network is 192.168.88.0/24, change the MikroTik's local network to 192.168.89.0/24 to avoid routing conflicts.

Speed ​​and stability optimization

Once a connection is established, it's important to ensure the channel is working effectively. First, check the signal strength (Signal Strength) and signal-to-noise ratio (SNR) in the menu Wireless → Interfaces → StatusThe optimal signal strength is considered to be between -50 and -65 dBm. If the signal is weaker than -75 dBm, the speed will be unstable, and an external antenna should be considered.

Channel width (Channel Width) also plays an important role. In a congested environment (with many neighboring networks), using a channel width of 40 MHz or 80 MHz can lead to interference. Try reducing the channel width to 20 MHz. This will reduce the maximum theoretical speed, but will significantly improve connection stability and reduce the number of packet retransmissions.

Don't forget to check your MTU (Maximum Transmission Unit) settings. On wireless networks, the default MTU of 1500 can cause packet fragmentation due to header overhead. Try setting the MTU on your wireless interface to 1400 or 1300 bytes. This often resolves issues with loading certain heavy web pages or dropping VPN connections.

To monitor the channel quality, use the built-in tool Sniffer or TorchThey allow real-time monitoring of the traffic volume passing through the interface and the presence of errors (FCS errors). A large number of errors indicates physical interference, problems with the antenna path, or heavy noise pollution from industrial equipment.

Diagnostics and troubleshooting

If the connection fails, first check the system logs. Go to Log and filter messages by word wirelessMessages of the type "disconnected, received disassoc: sending station leaving" indicate that the access point itself is disconnecting, possibly due to an incorrect password or incompatible security modes.

A common problem is a mismatch in operating modes. Make sure that your MikroTik and access point are operating in the same standard (for example, both in 802.11n or 802.11ac). If the access point only works in wireless mode Greenfield (N-only), and the client allows mixed modes, conflicts may arise. Force Wireless Mode to a value that meets the provider's requirements.

If you're having problems with DHCP (the router isn't receiving an IP address from your ISP), try cloning the MAC address. Some ISPs restrict access to a specific device. In the menu Wireless In the interface properties, find the field MAC Address (or use the cloning function in the DHCP client settings) and specify there the MAC address of a device that has previously worked successfully with this provider.

If all else fails, test from another device. Try connecting your laptop to the same Wi-Fi network. If the laptop works but the MikroTik doesn't, the issue is with the router's compatibility settings. If it doesn't work on either device, the issue is with the signal source or the range.

⚠️ Note: Interfaces and menu names may differ slightly between different RouterOS versions (v6, v7). In v7, the Wireless menu structure has been significantly redesigned, and some options have been moved to the "Configuration" section or require the use of a terminal for full compatibility.

Additional features and use cases

Client mode on MikroTik — it's not just a way to get internet. It's a platform for creating smart solutions. For example, you can set up Failover (redundancy): If the primary cable internet connection fails, the router will automatically switch to the client's Wi-Fi, ensuring uninterrupted connection. This is accomplished by checking the gateway availability in the menu. IP → Route with parameter check-gateway=ping.

Another scenario is creating a guest network. You can receive internet access via Wi-Fi and distribute it through a separate VLAN or guest profile with limited speed and access to web resources only. This allows you to securely provide access to visitors while isolating them from your main local network where your files and printers are located.

It's also possible to use the device as a signal-boosting repeater, although this isn't technically the correct term for MikroTik's architecture. Using two radio modules (if the device has them), one can be configured as a client (UpLink) and the other as an access point (DownLink) to distribute the signal indoors. This overcomes the limitations of a single antenna and provides coverage in areas where the provider's signal is only present at one point.

Is it possible to use MikroTik as a client and an access point at the same time on the same frequency?

Technically, this is possible in AP Bridge + Station mode, but it will reduce the overall channel throughput by approximately half, as the radio is half-duplex. The device will be forced to alternately receive and transmit data, which will increase latency (ping).

Usage MikroTik As a client, Wi-Fi offers flexibility unavailable to typical consumer routers. Proper configuration allows for a reliable connection comparable in stability to a wired connection, provided the radio signal is strong.

Why doesn't MikroTik see 5 GHz networks?

Most likely, your Country settings are set to a region where certain 5 GHz channels are prohibited, or your card doesn't support the 802.11ac/ax standard. Check your license and set the correct regulatory domain.

How to increase transmitter power in client mode?

Increasing the client power (Tx Power) only makes sense if the access point "can't hear" your response signal. Typically, 20-23 dBm is sufficient. Exceeding this value can result in signal distortion and overheating of the card.

Is it possible to connect to two Wi-Fi providers at the same time?

Yes, if you have a dual-band router (e.g., hAP ​​ac²). Configure one module (2.4 GHz) for the first provider, the second (5 GHz) for the second, and combine them using the IP → Hotspot or Routing menu to balance the load.

What to do if the speed is cut in half?

This is normal for a single-band connection, where receiving and transmitting take turns. To increase speed, use dual-band models, where one band receives and the other transmits, or switch to a wired connection.

Do I need a static IP for setup?

For initial setup via cable—yes, or use a DHCP client. After switching to Station mode, your computer should automatically obtain an IP from the main network, or you'll need to assign a static IP in the same subnet as the main network to access the web interface.