Compact router MikroTik hAP mini (model RB931) is an excellent solution for creating a small home network or setting up an access point in the office. Despite its miniature size, this device is equipped with a powerful operating system. RouterOS, whose functionality often exceeds that of many bulky competitors. Users appreciate this model for its reliability, low power consumption, and configuration flexibility, making the setup process engaging but requiring careful attention.
Before you begin, it is important to understand that the interface RouterOS It's significantly different from the simplified menus found on consumer routers. There are no "magic buttons" that automatically solve all provider issues, so you have to manually configure your connection parameters. However, this approach gives you complete control over network traffic, allowing you to fine-tune priorities, filters, and security.
In this guide, we'll walk you through the entire process, from turning on the device for the first time to establishing a stable wireless connection. We'll cover connecting to your ISP, configuring LAN and WAN ports, and we'll also pay special attention to security, as MikroTik's default passwords have long been a target for automated vulnerability scanners.
Preparing for the first launch and entering the interface
Initial setup MikroTik hAP mini This can be done in two main ways: via a web browser (WinBox) or via a cable interface. For beginners, the most convenient and informative option remains using a utility. WinBox, which can be downloaded from the manufacturer's official website. The program allows you to see the device even if its IP address differs from your computer's subnet.
The physical connection also has its nuances. The rear panel of the device has five Ethernet ports, numbered 1 through 5. By default, after a reset, all ports function as a bridge, but for proper internet operation, it is recommended to use port 1 as the WAN port, and the others for connecting local devices.
⚠️ Attention: When connecting for the first time, make sure the internet service provider's cable is plugged into port 1 unless you plan to change the switch's operating logic. Some factory firmware versions may bridge all ports, creating a potential security hole if the provider assigns IP addresses via DHCP without authorization.
To log in, you will need to know the MAC address of the device, which is located on the sticker on the bottom of the case. Run WinBox, go to the "Neighbors" tab and wait for your router to appear in the list. Click on the MAC address and enter the login admin and leave the password field blank (if the device is new), then click Connect.
Basic interface setup and connection to the provider
After successful authorization, the main configuration window will open. First, you need to update the software to the latest version to eliminate known vulnerabilities. Go to the menu System → Packages, press the button Check for Updates and if a new version is found, perform the installation and then reboot.
The next critical step is setting up an internet connection. The connection type depends on your provider's terms and conditions: it can be a dynamic IP (DHCP), a static address, or PPPoE. To set up PPPoE, which is common with many providers, create a new interface by going to PPP and adding a new client.
In the window that opens, enter the login and password provided by your provider. In the field Interface select port ether1, which we reserved for WAN. Don't forget to check the box. Add Default Routeso that the router knows where to direct traffic to the external network.
☑️ Checking your connection to your ISP
If your ISP uses MAC address binding, you may need to clone the address. This is done in the section Network → Interfaces, where in the interface properties ether1 You can change the MAC address to the one registered with your service provider.
Setting up a local network with DHCP and NAT
To enable your devices (computers, smartphones, TVs) to automatically obtain IP addresses and access the Internet, you need to set up a DHCP server. RouterOS There is a convenient setup wizard for this purpose Quick Set, but we will consider the manual method for a better understanding of the processes.
First, create an address pool in the menu IP → Pool. Call it, for example, local-pool and specify the address range, for example, 192.168.88.10-192.168.88.254. Next, go to IP → DHCP Server and run DHCP Setup, selecting the bridge interface (usually bridge-local or bridge).
Follow the wizard steps: select the created address pool, specify the gateway - usually this is the address of the router itself, for example, 192.168.88.1, and set the DNS servers. You can use your ISP's addresses or public DNS servers, such as 8.8.8.8 from Google.
The most important element is the setting NAT (Network Address Translation), which allows devices on a local network to access the Internet through a single external IP. Go to IP → Firewall → NAT, add a new rule (+) and in the General tab select the chain srcnatThe Action tab must contain the parameter masquerade.
Setting up a wireless Wi-Fi network
Model MikroTik hAP mini supports the standard 802.11b/g/n in the 2.4 GHz band. To set up a wireless network, go to the section Wireless. If the interface wlan1 missing, click the add button and select the appropriate driver.
In the interface settings window that opens, go to the tab WirelessHere you need to specify the network name (SSID) in the field SSID. Operating mode (Mode) must be installed in ap bridge, which means the router is operating as an access point. Also, select the country in the field Countryto ensure local signal strength regulations are met.
Security is key. Go to the tab Security Profile and create a new profile or edit an existing one. In the field Mode select dynamic keys, and in Authentication Types mark only WPA2 PSK. Encryption (Unicast & Group Ciphers) install in aes ccm. Think of a complex password and enter it in the field. WPA2 Pre-Shared Key.
⚠️ Attention: Avoid using the outdated WEP protocol or TKIP mode, as they are easily cracked. If your older devices don't support WPA2-AES, it's better to replace them than to weaken the security of your entire network.
After applying the settings, enable the interface by unchecking the red blocking icon or clicking the blue launch arrow. Your network should now be visible on smartphones and laptops.
Strengthening security and access control
MikroTik's factory settings allow it to be open to a trusted network, but in today's internet environment, this isn't enough. The first step should be changing the administrator password. Go to System → Users, select a user admin and set a complex password.
Next, you need to restrict access to router management from the external network. In the section IP → Services disable or restrict access to services telnet, ftp, www (if you don't use the web interface from outside). For winbox And ssh It is recommended to enter in the field Address only IP address ranges of your local network, for example, 192.168.88.0/24.
It's also worth disabling unused discovery services. In the menu Neighbors (or Discovery Interfaces (In newer versions), uncheck the interfaces facing the external network so that your neighbors on the provider's network cannot see your device.
For additional protection, you can configure a simple firewall that blocks all incoming connections that are not in response to an outgoing request. This is a standard practice and prevents most external port scans.
List of ports to close
For maximum security, ensure ports 21 (FTP), 23 (Telnet), 80 (HTTP), and 8291 (WinBox) are closed for the WAN interface. Access to these ports should only be permitted from trusted administrator IP addresses.
Additional features and monitoring
RouterOS provides powerful monitoring tools. In the section Tools → Graphs You can configure graphs to display CPU, memory, and network interface loads. This helps diagnose performance issues or abnormal traffic patterns.
Also useful is the function Quick Set, which allows you to quickly switch between router operating modes. For example, you can turn hAP mini into Bridge or Repeater mode if the main Internet distribution device is located elsewhere.
For advanced users, QoS (Quality of Service) settings are available through the menu. QueuesHere you can limit the speed for specific devices or, conversely, guarantee a minimum bandwidth for critical applications such as IP telephony or video conferencing.
| Parameter | Default value | Recommended value | Where to change |
|---|---|---|---|
| Router IP address | 192.168.88.1 | 192.168.X.1 (any) | IP → Addresses |
| Login | admin | admin (password required) | System → Users |
| Wi-Fi mode | ap bridge | ap bridge | Wireless |
| Encryption | No / TKIP | WPA2 AES-CCM | Wireless Security |
| WinBox Access | The whole world (0.0.0.0/0) | Local area network | IP → Services |
Regularly backing up your configuration is a time-saving habit. In the menu Files you can press the button Backupto save the current binary settings file. Keep this file in a safe place so you can quickly restore network functionality in the event of a reset or failure.
What should I do if my router stops responding after setup?
If after making changes access to MikroTik hAP mini If the error message is gone, try performing a hard reset. To do this, turn off the power, press and hold the Reset button on the case, and then turn on the power. Keep holding the button until the ACT indicator flashes (usually 5-10 seconds), then release. The router will return to factory settings.
Can hAP mini be used as the main router for an apartment?
Yes, you can, but with limitations. This model's processor isn't designed for gigabit speeds with encryption enabled and multiple firewall rules. It's fine for plans up to 100 Mbps, but at speeds above 200-300 Mbps, the processor can become a bottleneck, and actual speeds will drop.
How to renew RouterOS license?
MikroTik licenses are tied to the device and don't require activation keys in the traditional sense. The license level is determined upon purchase. Upgrading the level (for example, from Level 3 to Level 4) can be done programmatically through the menu. System → License, by paying for an upgrade key if the functionality of the current version is not sufficient.