Connecting a MikroTik router to an existing wireless network of a provider or another device is not a common occurrence, but it is critical in certain situations. For example, you live in a rented apartment where the provider only provides Wi-Fi, or you need to set up a backup connection via a mobile router. In such cases, the MikroTik should act not as an access point distributing the internet, but as a client, receiving the signal and rebroadcasting it further down the wire or creating its own local network.
Technically this process is called mode tuning. Station (Client) or Station BridgeUnlike conventional home routers, where mode switching is often hidden in a single button, in RouterOS this requires creating a separate wireless network interface. RouterOS It provides flexibility by allowing one radio interface to be used for distributing Wi-Fi to clients, and the second (if available) to receive a signal from the provider, but even on single-board models, complex circuits can be implemented.
Before you begin, make sure your equipment supports the required frequencies. If your ISP offers 5 GHz internet and your MikroTik only has a 2.4 GHz radio, you won't be able to connect them directly. It's also important to understand that the speed in client mode will always be lower than the theoretical maximum due to protocol overhead and signal quality.
Equipment preparation and frequency testing
The first step is to physically check the compatibility of your equipment with the provider's network. You need to know the exact SSID (network name), encryption type, and password. Knowing the frequency range is also crucial. If you try to set up a 2.4 GHz connection to a 5 GHz network, the connection simply won't establish, and you'll waste time troubleshooting non-existent issues.
In modern MikroTik models, such as the series hAP ac or LHG, there are often two radio interfaces. This allows you to use one interface (e.g., wlan1) in client mode to connect to the ISP, and the second (wlan2) to distribute the internet to your devices. If there's only one radio interface, you have to choose: either receive Wi-Fi, distribute it, or use a complex, rapid channel switching scheme, which reduces speed.
⚠️ Attention: When you configure the interface to Station mode, the wireless card stops broadcasting its network. If you're connected to the MikroTik via Wi-Fi when the mode is switched, you'll immediately lose connection to the device. Always perform initial setup via an Ethernet cable.
You can use the terminal to check the supported frequencies and operating modes of your card. Enter the command /interface wireless printto see a list of available interfaces. Pay attention to the column band And supported-rates. If there is no supported mode in the list station or station-bridge, then your card is operating in access point (AP) only mode, which happens on some specific or limited models.
Creating and customizing the Station interface
The main work takes place in the wireless interfaces menu. You need to create a new virtual interface or reconfigure an existing one. Unlike in AP mode, where we specify the SSID of our network, here we need to specify which network we will connect to. Open the menu Wireless and select the desired interface (for example, wlan1).
In the interface properties, change the parameter Mode on station or station-bridgeThe difference between them is significant: the regime station creates a routed connection (NAT), meaning the provider's router will see your MikroTik as a single device, and all clients behind it will be hidden behind NAT. station-bridge attempts to forward clients' MAC addresses to the ISP, which is often required for MAC address authentication, but may not work with some ISPs that block multiple MAC addresses.
What is the difference between Station and Station-Pseudobridge?
Station-Pseudobridge is a bridge emulation. It allows for forwarding client MAC addresses, but can cause issues with ARP requests and is not supported by some ISP access points. Classic Station is more stable for standard NAT connections.
After selecting the mode, go to the tab Wireless (or Scan (in older versions of WinBox). Click the button Scanto find available networks. In the list that appears, find your provider's network. Double-clicking it will automatically fill in the fields. SSID And FrequencyAll that remains is to enter the password in the field. Wireless Security Profile.
Don't forget to set up a security profile. If the network is open, select default or create a new profile without encryption. If you are using WPA2, create a profile with the type dynamic keys and enter the password in the field WPA2 Pre-Shared KeyAfter applying the settings, the interface should go into the state running And connected.
IP and routing settings
After a successful Wi-Fi connection, your MikroTik needs to obtain an IP address from your ISP. ISPs most often use a DHCP server. You need to create a DHCP client on the newly created Station interface. Go to the menu. IP → DHCP Client, click the plus sign and select your wireless client interface.
An important point is setting the flags. Be sure to check the box. Use Peer DNS, if you want to automatically obtain your provider's DNS server addresses. It is also recommended to check the box Add Default Routeso that MikroTik knows where to send all internet traffic. Without this step, the internet will not work on connected devices, even if a Wi-Fi connection is established.
☑️ Checking WAN connection
If your ISP requires a static IP, go to IP → Addresses and add the address manually to the Station interface. In this case, the default route (0.0.0.0/0) will have to be entered manually in the menu IP → Routes, specifying the gateway provided by the provider.
Internet distribution (NAT)
The internet connection itself isn't yet available to your devices. MikroTik doesn't route traffic between interfaces without a masquerade rule by default. You need to configure NAT. Go to the menu. IP → Firewall and open the tab NAT.
Create a new rule. In the field Chain select srcnatIn the field Out. Interface Specify your wireless interface (for example, wlan1). In the field Action select masqueradeThis rule will replace the addresses of all internal devices with the address received from the provider.
⚠️ Attention: Make sure it's in the menu
IP → ServicesWinBox or SSH access from the external network (Station interface) is not open. In client mode, this interface is considered external (WAN), and opening ports can expose your router to attacks from the ISP network.
Now you need to set up your internal network. If you haven't done so yet, go to IP → Pool and create a pool of addresses for your clients (for example, 192.168.88.10-192.168.88.254). Then in IP → DHCP Server Run the Setup wizard on your local interface (for example, ether1 or wlan2), specifying the created pool and gateway (the address of the MikroTik itself).
Troubleshooting MTU Conflicts and Issues
One of the most common issues when setting up Wi-Fi as a WAN is an incorrect packet size (MTU). The Wi-Fi protocol adds its own headers, which reduces the usable space for data. If the MTU on the client is too large, packets will become fragmented or broken, leading to slow internet performance and problems accessing certain websites.
It's recommended to reduce the MTU on the wireless interface. Go to the Station interface properties and set the MTU value manually, for example, 1400 or even 1350Also, check your TCP MSS settings. MikroTik has a convenient automatic correction feature, but sometimes manual adjustments are more reliable.
It's also worth paying attention to the MAC address. Some providers bind the subscriber to a specific MAC address of the device. If you previously connected the computer directly, the provider may not assign an IP address to your MikroTik. In this case, find the field in the wireless interface settings. MAC Address Clone or simply copy the MAC address of your computer into the Station interface settings (parameter mac-address), so that the router “pretends” to be your computer.
Connection diagnostics and monitoring
After setting up, it is important to ensure the connection is stable. In the menu Wireless there is a tab Registration (or Registration Table). There you should see your connection to the provider's access point. Pay attention to the parameter RX/TX Rate — this is the actual link speed. Signal strength is also important. RX SignalFor stable operation, it is desirable to have a signal no worse than -70 dBm.
For continuous monitoring, use the tool Torches (menu Tools → Torch). Select the Station interface and start monitoring. You'll see traffic in real time. If there's traffic but websites aren't loading, the issue is DNS or MTU. If there's no traffic at all, the problem is at the link or authorization level.
| Parameter | Normal value | Critical value | Action |
|---|---|---|---|
| Signal Strength | -40... -65 dBm | Below -75 dBm | Move the antenna or router |
| SNR (Signal/Noise) | Above 25 dB | Below 15 dB | Change channel or frequency |
| CCQ (Link Quality) | Above 60% | Below 40% | Checks, reduce distance |
| TX/RX Rate | Depends on the standard | Falls to a minimum | Check the ether loading |
Don't forget about logs. In the menu Log You can see the reconnection history. If you see constant messages disconnected, lost connection or authentication failure, this will indicate the cause of instability: either a weak signal, or an incorrect password, or security settings.
Wireless Client Security
Using public or third-party Wi-Fi networks carries risks. Even if the connection is encrypted, the Wi-Fi provider can see your traffic. MikroTik has a powerful built-in firewall, but the basic settings are often insufficient. Make sure you don't use your provider's network to manage the router itself.
On the menu IP → Services disable unnecessary services (telnet, ftp, www) or restrict access to them only from addresses on your local network (192.168.88.0/24). This will prevent hacking attempts from an external Wi-Fi network. It is also recommended to disable Discovery on the external interface so that your router does not appear in the list of neighboring devices.
⚠️ Attention: Interfaces and menu names may vary depending on the RouterOS version (v6, v7) and the specific device model (hAP, RB, LHG). Always consult the official documentation for your software version, as the menu structure may change.
For enhanced security, you can configure a VPN client (OpenVPN or WireGuard) directly on the MikroTik. This will encrypt all traffic going to your ISP's network and route it through your trusted server. This is especially important if you use public hotspots in cafes or hotels with a MikroTik adapter.
FAQ: Frequently Asked Questions
Is it possible to receive and distribute Wi-Fi on the same card at the same time?
Technically, this is possible in AP Client Bridge mode, but it significantly reduces performance, as the radio must constantly switch between receiving and transmitting on different channels or timeslots. Speed will drop by at least half, and ping will increase. It's better to use a dual-band router: one band (5 GHz) for receiving, the other (2.4 GHz) for transmitting.
Why doesn't the router see the provider's network when scanning?
There could be several reasons: a frequency mismatch (look for 2.4 versus 5 GHz), an incompatible standard (for example, trying to connect to Wi-Fi 6 only with devices of the older standard, even though backward compatibility usually works), or an excessively weak signal. Also, check if your provider's SSID is hidden—in that case, you'll need to enter it manually.
How to increase speed in Station mode?
Use the 5 GHz band, as it's less noisy and supports wider channels (40, 80 MHz). Make sure the channel widths on the provider and client side match. Disable legacy modes (b/g), leaving only n/ac/ax. Also, reduce the MTU to 1400 to avoid packet fragmentation.
Does IPv6 work in Wi-Fi client mode?
Yes, it works, but it requires separate configuration. You'll need to configure the DHCPv6 Client on the Station interface and obtain a prefix. This prefix must then be distributed to the internal network via RA (Router Advertisement). The standard DHCP Client in RouterOS v7 can request a prefix, but often requires manual adjustment of firewall rules to allow ICMPv6.