Setting Up Mikrotik as a Wi-Fi Switch: A Complete Guide

Transforming a MikroTik router into a simple yet functional wireless switch is a great solution for expanding your local network. Users often have old devices left over after upgrading, which they hate to throw away, but can give them a second life. RouterOS as Switch allows you not only to add ports, but also to organize centralized management of clients through the main router.

Unlike cheap unmanaged switches, MikroTik Provides complete control over traffic, VLANs, and priorities, even when operating in bridge mode. This is especially relevant for office networks or large apartments, where a single Wi-Fi router isn't enough to cover all rooms. You get the flexibility and stability of corporate equipment for home use.

In this article, we'll walk you through the device conversion process step by step, focusing on key security and performance settings. You'll learn how to disable unnecessary services, configure Bridge and organize seamless (or simply unified) Wi-Fi. This will allow you to build a reliable network infrastructure without the need to invest in new equipment.

Preparing hardware and resetting the configuration

Before starting any manipulations, it is critical to clear the device of previous settings. Standard configuration MikroTik assumes operation in router mode with the router enabled NAT And DHCP server, which in our case will cause network conflicts. If you connect the configured device to the main network without resetting it, all clients may experience internet disruptions due to dual IP address allocation.

First, connect your computer directly to any port. LAN devices (usually these are ports 2 through 5, but it's best to use all but the first if you don't plan on sharing). Open your browser and enter the address 192.168.88.1 or use the utility WinBox, which will automatically find the device by MAC address. The default login is admin, the password is usually empty.

After logging in, you need to perform a full reset. This will remove all firewall rules, address lists, and user scripts. In the interface WinBox go to the menu System and select the item Reset ConfigurationIn the window that opens, make sure the box is checked. No Default Configuration, if you want to start from scratch, or leave the default one if you plan to manually remove unnecessary parts.

⚠️ Attention: After resetting the configuration, the device will lose its IP address if you selected the "No Default Configuration" option. You will have to search for it again using the MAC address in WinBox or use the address 192.168.88.1 if the default configuration was saved.

It is also recommended to update the firmware RouterOS to the latest stable version before starting setup. New versions contain security fixes and improvements to the wireless module. Go to the menu System → Packages and press the button Check for Updates, then Install.

Creating a Bridge and Connecting Ports

The basis of the device's operation in switch mode is the creation of a virtual second-level switch, or BridgeIn terminology MikroTik This is the unification of all physical ports into a single logical group. All devices connected to the bridge ports will see each other as if they were connected to a single cable.

Create a new bridge in the menu Bridge. Call it, for example, bridge-local. Once created, you need to add all the physical interfaces that will act as switch ports. Typically, this is ether2 – ether5. Go to the tab Ports inside the menu Bridge and add each port separately.

The important point is the setting Hardware OffloadingThis feature allows the switch to process traffic at the hardware level without overloading the router's CPU. Without offloading enabled, data transfer speeds between ports may drop, especially when a Wi-Fi connection is active. Make sure the switch is set to [unspecified]. H (Hardware) flag is set for all added ports.

Don't forget to add the wireless interface to the bridge. wlan1 (or wifi1 (in newer models). This will connect the wired and wireless parts of the network. If you plan to use the port ether1 To connect to the main router (client mode), it must also be included in the bridge.

Setting up a wireless network and security

Setting up Wi-Fi in hotspot mode requires careful attention to security settings. Go to the menu Wireless (or WiFi (in newer OS versions). Select your interface and open its settings. In the field Mode select ap bridge, which means operation in access point mode with the ability to connect clients to each other.

Tab Security Profiles — this is where you create a security profile. Click the ellipsis button (...) and create a new profile. Name it something like home-wpa2. As an authentication mode (Authentication Types) select wpa2 psk, and for encryption (Unicast & Group Ciphers) — aes ccmThis will ensure a modern level of protection for your network.

Create a complex password for Pre-Shared KeyAvoid simple combinations and dictionary words. After creating the profile, return to the wireless interface settings and select the created profile in the field. Security Profile. Also set the network name (SSID), which will be seen by users.

For stable operation, it is recommended to manually select the channel and bandwidth, especially if there are many neighboring networks nearby. Use a wireless network scanner (Wireless → Interfaces → button Scan) to find the least congested channel. In the 2.4 GHz band, it's better to use channel width. 20 MHz to minimize interference, or 40 MHz, if the ether is pure.

⚠️ Attention: Wireless interfaces don't support hardware acceleration (Hardware Offloading) to the same extent as wired ports. Under heavy Wi-Fi load, the device's processor may become more heavily loaded, affecting overall switching speed.

Disabling router services (DHCP and NAT)

To ensure the device functions exclusively as a switch, all routing functions must be disabled. The most important task is to disable DHCP server. If on your MikroTik If DHCP remains active, it will start to conflict with the main router, giving clients incorrect addresses and depriving them of Internet access.

Go to the menu IP → DHCP Server. If there are active servers there (usually they are called dhcp1 or similar), select them and press the button Disable or delete it completely. Also check the settings in the menu IP → Pool and delete address pools if they are no longer needed.

The next step is to delete the rules. NAT And FirewallIn switch mode, traffic filtering is usually not required or is performed on the main gateway. Go to the menu IP → Firewall → tab NAT and delete all the rules (usually there is a masquerade rule). Then go to the tab Filter Rules and clear the lists, leaving only the basic rules, if they do not block the necessary traffic.

It's also worth disabling unnecessary services that may consume resources or pose a security threat. In the menu IP → Services turn it off telnet, ftp, www (if you don't need a web interface), leaving only ssh And winbox for administration. This will reduce the attack surface of the device.

/ip service disable telnet
/ip service disable ftp
/ip service disable www

After completing these steps, the device will stop issuing IP addresses and routing traffic, turning into a transparent switch. All IP requests will pass through it to the main router.

Setting up an IP address for management

Even though the device now functions as a switch, you still need a way to access its management interface. To do this, you need to assign a static IP address from your primary network subnet. This address must not conflict with the address of the main router or other devices.

For example, if your main router has the address 192.168.1.1, ask MikroTik address 192.168.1.254. Go to the menu IP → Addresses, click + and enter a new address with a mask 255.255.255.0 (or /24). In the field Interface select the one created earlier bridge-local.

Make sure to set up the correct gateway (Gateway). Without specifying a gateway, the device will not know where to send packets if you want, for example, to synchronize time via NTP or update. In the menu IP → Routes add a default route (0.0.0.0/0) with a gateway equal to the IP address of your main router.

What if I forgot the IP address after setup?

If you've forgotten the static IP you set, use the WinBox utility. It scans the network by MAC address and will find devices even without an IP address. Simply click on the MAC address in the neighbors list, and you'll be taken to the interface.

Now you can disconnect your computer from the device and connect to it using the new IP address through a browser or WinBox from any device on the network. Make sure you can ping the new address successfully.

Additional settings and optimization

To improve ease of use, you can customize the function Cloud (if the device has internet access via uplink). This will allow you to connect to the device via its domain name. mikrotik.cloud, even if the dynamic IP address changes. The setting is in the menu IP → Cloud.

If you use multiple access points MikroTik If you're using a single network, it makes sense to configure them so they don't interfere with each other. Use different channels for adjacent access points (for example, 1, 6, and 11 for 2.4 GHz) and reduce the transmitter power (Tx Power) to an optimal level so that the coatings do not overlap too much, causing interference.

It's also worth paying attention to the logs. In the menu Log You can configure messages to be sent to a remote server or simply check them periodically for errors. This will help quickly diagnose client connection issues or channel congestion.

⚠️ Attention: Menus and item names may vary depending on the RouterOS version (v6 or v7) and device model (e.g., hAP, cAP, or RB series). In v7, the Wireless menu structure was significantly restructured and renamed to WiFi.

Be sure to check the device's temperature periodically, especially if it's installed in a closed enclosure or poorly ventilated area. Overheating can cause the Wi-Fi module to become unstable and reboot.

Frequently Asked Questions (FAQ)

Can MikroTik be used as a switch if it has RouterOS v7?

Yes, you can. The principle of creating a Bridge remains the same. However, in version v7, the Wi-Fi setup menu has changed (it's now called WiFi instead of Wireless) and improved hardware acceleration. The logic for disabling DHCP and NAT remains identical.

Will my internet speed decrease when using MikroTik as a switch?

With proper configuration (Hardware Offloading enabled), speed loss on wired ports will be minimal or nonexistent. This may have a greater impact on Wi-Fi speeds, as the radio module is the bottleneck, but this depends on the device model and the level of interference.

Do I need to configure VLAN if I use the device as a switch?

Not necessarily. If you're happy with a single flat network, VLANs aren't necessary. However, if you want to separate guest Wi-Fi from your home network, you'll need to configure VLANs on the bridge and the corresponding settings on the main router.

What should I do if I lose access to the interface after setup?

Make sure your computer is on the same subnet as the specified static IP. Make sure you're connected to the port added in Bridge. If all else fails, use the button. Reset on the device body (hold for 5-10 seconds when turning on) to reset.