Setting up MikroTik as a Wi-Fi access point without DHCP: A complete guide

Setting up MikroTik as Wi-Fi access points without a DHCP server — a popular solution for expanding an existing network without IP address conflicts. This scenario is relevant when the main router is already distributing addresses, and MikroTik It should operate as a "transparent" bridge, forwarding traffic without additional NAT translation. This avoids double routing, simplifies network management, and reduces the load on equipment.

Unlike the standard router mode, where MikroTik It distributes IP addresses to clients itself, here the device acts solely as wireless switchAll clients receive addresses from the primary DHCP server (for example, from the ISP router or domain controller), and MikroTik It simply "transparently" transmits their traffic. This is especially convenient for office networks that require centralized IP address management, or for home networks with multiple access points.

In this article we will go through the step-by-step setup MikroTik (using models as an example) hAP ac², RB4011, RB951Ui-2HnD) in mode Wi-Fi bridge without DHCP, we'll look at typical errors and optimizations for stable operation. All commands are provided for RouterOS v7.13+, but taking into account the features of earlier versions.

1. Preparing the equipment and network: what to check before setting up

Before you start configuring MikroTik, make sure your network is ready to integrate the new access point. Key requirements:

• 🔌 Main router already distributes IP addresses via DHCP and has free ports for connection MikroTik.
• 📡 Wi-Fi channels do not overlap with neighboring networks (use 2.4 GHz channels 1, 6, 11 or 5 GHz with DFS, if supported).
• 🔄 Network topology: MikroTik must connect to the main router via Ethernet (Gigabit port recommended).
• ⚡ Nutrition: for models with PoE (For example, RB960PGS) check compatibility with the injector.

If your MikroTik previously used in a different mode (for example, as a primary router), Be sure to reset it to factory settingsThis will eliminate configuration conflicts. The reset is performed:

/system reset-configuration no-defaults=yes skip-backup=yes

⚠️ Attention: After the reset, all previous settings (including passwords and firewall rules) will be lost. If the device is used in a production network, export the current configuration first using the command /export file=backup.

Also check that on the main router MAC address filter disabled (if used) or add MAC address MikroTik to the allowed list. Otherwise, clients will not be able to obtain IP addresses through the new access point.

2. Basic interface setup: bridge and IP address

The first step is creation bridge, which will combine the Ethernet port and Wi-Fi interface into a single network. This will allow traffic to flow transparently between wired and wireless clients without NAT.

Connect to MikroTik through WinBox or SSH and run the following commands:

1. Create a bridge and add an Ethernet port to it (usually ether1):

   /interface bridge add name=LocalBridge
   /interface bridge port add bridge=LocalBridge interface=ether1

2. Assign an IP address to the bridge from the subnet of the main router (for example, if the main router has the address 192.168.1.1, appoint 192.168.1.2):

   /ip address add address=192.168.1.2/24 interface=LocalBridge

3. Disable the DHCP client on the bridge (if it was activated earlier):

   /ip dhcp-client disable [find interface=LocalBridge]

After that MikroTik will be accessible at the assigned IP address. Make sure you can connect to it from another device on the network (e.g. ping 192.168.1.2).

⚠️ Attention: If you use MikroTik in a network with VLANs, create a separate bridge for each VLAN or configure VLAN filtering on the primary port. Otherwise, traffic from different networks will mix.

To check if the settings are correct, do the following:

/ping 192.168.1.1 count=3

If pings to the main router are successful, the bridge is configured correctly.

3. Setting up the Wi-Fi interface: frequency, channel, and security

Now let's move on to configuration. wireless interface. Depending on the model MikroTik You may have one or more Wi-Fi modules (for example, hAP ac² has two radio modules: wlan1 For 2.4 GHz And wlan2 For 5 GHz).

Basic parameters for configuration:

Example setup for 2.4 GHz:

/interface wireless set [find default-name=wlan1] band=2ghz-onlyn channel-width=20/40MHz-Ce \
frequency=2412 disabled=no

/interface wireless security-profiles add name=Office_WiFi mode=dynamic-keys \
authentication-types=wpa2-psk,wpa3-psk unicast-ciphers=aes-ccm group-ciphers=aes-ccm \
wpa2-pre-shared-key="YourComplexPassword123"

/interface wireless set [find default-name=wlan1] security-profile=Office_WiFi \
ssid="Office_WiFi_2G" disabled=no

For 5 GHz replace band=5ghz-onlyn and select a channel from the list 5180-5825 (for Russia). To see available channels, run:

/interface wireless info country-info

4. Adding Wi-Fi to the Bridge: Linking Wireless and Wired Traffic

To allow Wi-Fi clients to communicate with wired devices (and vice versa), you need to add a wireless interface to the bridge you created earlier. LocalBridgeThis is done with the command:

/interface bridge port add bridge=LocalBridge interface=wlan1

After this, all devices connected to the Wi-Fi network will receive IP addresses from the network's primary DHCP server, as if they were connected via cable. To test connectivity, connect to the new Wi-Fi network from your phone or laptop and run:

1. Check that the IP address is received from the main router's subnet (for example, 192.168.1.x).
2. Make sure you have internet access (eg. ping 8.8.8.8).
3. Check connectivity with other devices on the network (eg. ping 192.168.1.1).

If clients are not receiving IP addresses, check:

• 🔗 Physical connection: cable between MikroTik and the main router must be in a working port.
• 🔄 DHCP settings On the main router: Make sure that the address pool is not exhausted.
• 🚫 Firewall: on MikroTik there should be no rules blocking DHCP (ports 67 And 68).

⚠️ Attention: If you use MikroTik in a network with multiple VLANs, you need to configure VLAN filtering on the bridge and add the Wi-Fi interface to the required VLANs. Without this, clients will not be able to obtain IP addresses from the correct subnet.

5. Performance Optimization: Power, Roaming, and QoS

To ensure stable Wi-Fi network operation, especially under high load conditions (many clients or streaming video), it is recommended to configure additional settings.

1. Transmit Power (Tx Power)

By default MikroTik uses maximum power, which can cause interference to neighboring networks. Optimal values:

• 📶 For 2.4 GHz: 17-20 dBm (enough to cover an average apartment).
• 📶 For 5 GHz: 20-23 dBm (higher signal attenuation).

Set the power with the command:

/interface wireless set [find default-name=wlan1] tx-power=17

2. Roaming (802.11r/k/v)

If you have multiple access points MikroTik, set up fast roaming for a smooth transition between them:

/interface wireless set [find default-name=wlan1] \
mobility-domain="1234" \
fast-framing=yes \
wmm-support=enabled

Where mobility-domain — a unique identifier for all points in the network (must be the same on all devices).

3. Traffic prioritization (QoS)

To prioritize voice traffic (VoIP) or video conferencing, create a queue (Queue Tree):

/queue tree add name=VoIP parent=LocalBridge packet-mark=VoIP \
limit-at=10M max-limit=20M priority=1
/queue simple add name="VoIP Priority" target=192.168.1.0/24 \
dst-port=5060,10000-20000 packet-mark=VoIP

6. Security: Protection from unauthorized access

Setting up MikroTik Access points without DHCP do not eliminate the need to secure the network. Key measures:

1. Disable unnecessary services

By default MikroTik opens access to WinBox, SSH And WebFig on all interfaces. Restrict access to the local network only:

/ip service disable "telnet,ftp,tftp,api,api-ssl"
/ip service set "ssh,winbox,www,www-ssl" address=192.168.1.0/24

2. Set up a firewall

Add rules to block unwanted traffic:

/ip firewall filter add chain=forward action=drop protocol=tcp \
dst-port=135-139,445,3389 comment="Block SMB/RDP exploits"
/ip firewall filter add chain=forward action=drop protocol=udp \
dst-port=1900 comment="Block UPnP attacks"

3. Enable password guessing protection

Limit the number of Wi-Fi connection attempts:

/interface wireless set [find default-name=wlan1] \
security-profile=Office_WiFi \
authentication-types=wpa2-psk,wpa3-psk \
group-key-update=1h \
disable-running-check=no

4. Update RouterOS regularly

Check if your firmware is up to date:

/system package update check-for-updates
/system package update install

⚠️ Attention: If you use MikroTik on a public network (for example, in a cafe or hotel), additionally configure HotSpot With SMS or social media authentication. This will prevent unauthorized access and allow connection logging.

7. Troubleshooting: Why Clients Won't Connect to Wi-Fi

If after setup, clients cannot connect to Wi-Fi or do not receive an IP address, please perform the following diagnostic steps:

1. Check the Wi-Fi interface status

Run the command:

/interface wireless registration-table print

If there are no connected clients in the table, the problem may be:

• 🔑 Incorrect password or security-profile.
• 📡 Incorrect channel or channel width (for example, the client does not support 40MHz).
• 🚫 Blocking MAC addresses on the main router.

2. Check the bridge connectivity

Make sure the bridge LocalBridge active and includes both interfaces:

/interface bridge port print

If wlan1 is not in the list, please add it again.

3. Log analysis

Check the system logs for errors:

/log print

Pay attention to messages like could not connect to AP or authentication failed.

4. Test from another device

Try connecting to Wi-Fi from a different phone or laptop. If the problem persists, there's a settings error. MikroTikIf only one device connects, the problem is on the client side (for example, an outdated Wi-Fi driver).

8. Alternative scenarios: guest network and multiple SSIDs

If you need to split your traffic (for example, create a guest network with Internet access only), use virtual APs And VLAN.

Scenario 1: Two SSIDs on one radio module

Create a second virtual interface for the guest network:

/interface wireless add master-interface=wlan1 name=wlan1-guest \
security-profile=Guest_WiFi ssid="Guest_WiFi" disabled=no

/interface wireless security-profiles add name=Guest_WiFi mode=dynamic-keys \
authentication-types=wpa2-psk unicast-ciphers=aes-ccm \
wpa2-pre-shared-key="GuestPassword123"

Scenario 2: Isolating a Guest Network via VLAN

If guests only need internet access, without access to the local network:

1. Create a VLAN on the bridge:

   /interface vlan add interface=LocalBridge name=GuestVLAN vlan-id=10

2. Add guest Wi-Fi to VLAN:

   /interface bridge port add bridge=LocalBridge interface=wlan1-guest pvid=10

3. Configure a firewall to block access to the local network:

   /ip firewall filter add chain=forward action=drop in-interface=GuestVLAN \
   dst-address=192.168.1.0/24

For a guest network, it is also recommended:

• 🔒 Use a separate pool of DHCP addresses (e.g. 192.168.10.0/24).
• ⏱ Limit speed through Queue (For example, 5M/5M per client).
• 📊 Keep a connection log using /tool sniffer.

⚠️ Attention: When using VLANs, ensure that the primary router supports tagged traffic. Otherwise, the guest network will not have internet access.

FAQ: Frequently asked questions about setting up MikroTik without DHCP

:local bestChan 0
:local bestRssi -100
:foreach i in=[/interface wireless scan duration=300ms] do={
:if ([$i "rssi"] > $bestRssi) do={
:set bestRssi [$i "rssi"]
:set bestChan [$i "channel"]
}
}
/interface wireless set [find default-name=wlan1] frequency=$bestChan

/interface wireless connect ssid="Main_WiFi" security=wpa2-psk \
password="MainPassword" [find default-name=wlan1]

/interface wireless add master-interface=wlan1 name=wlan1-ap \
security-profile=Repeater_WiFi ssid="Repeater_WiFi" disabled=no