Router transformation MikroTik Turning this device into a full-fledged access point allows you to significantly expand your wireless network coverage without sacrificing connection speed or stability. Unlike consumer devices, this manufacturer's equipment offers flexible traffic and radio channel management tools, making it an ideal choice for complex network infrastructures. Proper configuration requires an understanding of how bridges and wireless interfaces operate, but the results are well worth it.
Usage MikroTik As an access point, it gives the administrator complete control over each connected client. You can configure complex firewall rules, prioritize traffic, and isolate guest networks at the hardware level. This is especially relevant for office spaces, hotels, and large private homes, where standard solutions are insufficient.
The setup process ranges from simply switching the operating mode to deploying a centralized management system. CAPsMANThe specific method you choose depends on the size of your network and your security requirements. In this guide, we'll cover the key configuration steps that will ensure stable operation of your Wi-Fi.
Preparing hardware and resetting the configuration
Before integrating a new device into an existing network, it's necessary to restore it to its factory default state. This will eliminate IP address conflicts and any residual rules that may have been left over from previous owners or testing. Connect the computer to any LAN port (usually numbered 2 through 5) using an Ethernet cable.
To reset the settings, find the button on the case ResetWith the power off, press and hold the button, apply voltage to the device and hold it for about 10-15 seconds until the indicator flashes. ACT or USRAfter releasing the button, the device will reboot with a clean configuration. Make sure your PC has a network connection set to obtain an IP address automatically.
⚠️ Attention: After a configuration reset, the device may not have a default password or use the default login.
adminWithout a password. Do not connect the access point to the main network until the initial setup is complete to avoid DHCP server conflicts.
The interface is accessed via a browser at the address 192.168.88.1 or through a utility WinBox, which automatically detects the device on the local network. WinBox is preferred, as it works even with mismatched subnets. Make sure your RouterOS version is up to date to avoid errors in the wireless module.
☑️ Check before setup
Basic wireless interface setup
The first step in creating an access point is to configure the radio interface. Go to the menu Wireless and double-click on the interface that corresponds to your frequency (usually wlan1 for 2.4 GHz or wlan2 for 5 GHz). In the window that opens, first check the box Enabledto activate the module.
Tab Wireless contains the main operating parameters of the radio channel. In the field Mode select a value ap bridge, which means the device operates in access point mode with the ability to bridge clients. Field Band better to leave it as is 2GHz-b/g/n or 5GHz-a/n/ac depending on the supported standards to ensure compatibility with all devices.
Pay special attention to the parameter FrequencyTo minimize interference in the 2.4 GHz band, it is recommended to use channels 1, 6, or 11. In the 5 GHz band, there is a wider choice, and you can use automatic mode or select the least crowded channel after scanning the environment with the button. Scan.
Setting the channel width (Channel Width) also affects performance. For 2.4 GHz, the optimal value is often 20/40MHz Ce, which allows the device to dynamically switch between channel widths depending on the noise level in the air. For 5 GHz, you can safely set 20/40/80MHz for maximum data transfer speed.
| Parameter | Recommended value (2.4 GHz) | Recommended value (5 GHz) | Description |
|---|---|---|---|
| Mode | ap bridge | ap bridge | Interface operating mode |
| Frequency | 2412, 2437, 2462 | Auto / 5180-5700 | Channel operating frequency |
| Channel Width | 20/40 MHz | 20/40/80 MHz | Channel bandwidth |
| Country | your_country | your_country | Country to comply with |
Security and encryption organization
Wireless network security is a critical aspect that cannot be ignored. Go to the tab Security Profiles on the menu WirelessBy default there may be a profile there. default, but it is better to create a new one by clicking the button +. Call it, for example, home-secure.
In the security profile settings, select the mode WPA2 PSK or, if the equipment and clients support it, WPA3 PSKThis will ensure reliable encryption of traffic. In the field WPA2 Pre-Shared Key Enter a complex password consisting of mixed-case letters, numbers, and special characters. The password must be at least 12 characters long.
For additional protection, you can enable the option Disable PMKID, which will prevent some types of brute-force attacks. It is also recommended to disable WPS (Wi-Fi Protected Setup), as this protocol often contains vulnerabilities that allow attackers to access the network.
⚠️ Attention: Using outdated encryption
WEPor regimeWPA1makes your network vulnerable to hacking in minutes. Always use WPA2 or WPA3 with AES encryption.
After creating the profile, return to the wireless interface settings (Wireless -> double click on the interface) and in the field Security Profile Select the profile you created. Don't forget to apply the changes by clicking the Apply button. OK or Apply.
Creating a bridge to connect networks
To make the access point function not as a separate router distributing its own IP addresses, but as a transparent extension of the main network, you need to create a bridge. Go to the menu Bridge and press the button +You don't need to change anything in the window that opens, just click OK, will be created bridge1.
Now you need to add ports to the bridge. Go to the tab Ports and add all the necessary interfaces: physical Ethernet ports (eg. ether2...ether5) and wireless interface (wlan1). This will combine them into one logical network segment.
An important step is to configure the bridge itself. Open the tab Bridge, double click on bridge1 and go to the tab Protocol Mode. Make sure the mode is selected. RSTP or NoneIf you have a simple network without loops, this is fine. If your main router is also a MikroTik, make sure the bridge priorities are configured correctly.
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=wlan1
After adding ports to the bridge, the IP address of the access point itself must be assigned not to the physical port, but to the interface bridge1To do this, go to IP -> Addresses, add a new address from the subnet of your main network and specify the interface bridge1This will allow you to manage the access point even if it is connected to any port.
Configuring CAPsMAN for Centralized Management
If you plan to deploy multiple access points, manually configuring each one becomes inefficient. Technology CAPsMAN (Controlled Access Point system Manager) allows you to manage all access points from a single device. To do this, one router is designated as the controller, and the others are configured as CAPs.
On your controller, go to the menu CAPsMAN. In the section Interfaces Specify the interface through which the points will communicate (either a bridge or a specific port). Then, in the section Channel Create a channel configuration where you specify the frequencies, width and signal power.
Next, create a security configuration (Security) and the main configuration (Configuration). In the last item, you associate the security profile, channel, and set the network name (SSID). In the field Mode select ap, and in Master Configuration Specify the name of the created configuration.
What does the CAP mode provide?
In CAP mode, the access point doesn't store its configuration locally. When rebooting, it requests settings from the controller, allowing for instant password and configuration updates across all access points.
To turn the device itself into a controlled access point (CAP), you need to enable CAP mode. This is done through the menu. System -> CAP. Check the box. Enabled and enter the controller's address (or leave "broadcast" to search on the local network). After rebooting, the access point will download the settings from the controller.
Signal optimization and interference elimination
Correct setting of transmitter power (Tx Power) is often more important than maximizing it. An overly strong signal can clog the airwaves and interfere with other devices, as well as cause roaming issues when the client gets stuck on a distant point instead of switching to a nearby one.
Use the built-in tool Wireless -> Scan To analyze the surrounding airwaves, select the least crowded channel. If you're using the 2.4 GHz band, avoid placing access points on the same channel too close to each other.
To improve the stability of the connection, you can experiment with the parameter InstallationIf the point hangs high on the wall or ceiling, choose indoor or outdoor Accordingly, this changes the signal processing algorithms. Also, enable the option Hide SSID only if it is really necessary, as it creates additional service traffic.
⚠️ Attention: Interfaces and customization options may vary depending on the installed license. RouterOS (Level 3, 4, 5, or 6) and your specific device model. Check your model's specifications on the official website before purchasing additional licenses.
Be mindful of the physical placement of the antennas. If using external antennas, position them perpendicular to each other (one vertical, one horizontal) to cover the different polarities of client devices. This is especially important for mobile phones and tablets.
Frequently Asked Questions (FAQ)
Can MikroTik be used as a Wi-Fi repeater (amplifier)?
Yes, it is possible, but it requires configuration in mode station or station-bridgeHowever, using a wired backhaul (a cable connection between points) is always preferable for stability and speed. Using an over-the-air repeater mode cuts the speed by approximately half.
Why can't devices see the 5 GHz network?
Check the parameter Country In the wireless interface settings. Some countries prohibit certain channels or require DFS (dynamic frequency selection). If you select a channel prohibited in your region or not supported by the client, the network will not be displayed. Also, make sure the channel width isn't too wide for older devices.
How to reset an access point if you forgot the password?
Physical reset with a button Reset (described at the beginning of the article) will erase all settings, including IP addresses and passwords, restoring the device to its factory defaults. After this, you can connect without a password or with the default credentials.
Do I need a license to operate in access point mode?
Basic license (Level 3), which comes with most devices hAP or cAP, fully supports operation in both access point and client modes. Higher-level licenses (Levels 4, 5, and 6) are required for multi-user routing, tunneling, or CAPsMAN controller mode.