WiFi Basic Setup

WiFi Basic Setup

Version Info

RouterOS 7.16 | Min: v6.0+ | :clock1: 10 minutes | :green_circle: Beginner

Tested on: 7.16 7.14

Version-specific notes

• v7.13+: New wifi package for Wi-Fi 5 wave2 and Wi-Fi 6 hardware
• v7.18+: Improved WPA3 SAE anti-clogging handling
• v6.x: Legacy wireless package only; no WPA3 or 802.11ax support

TL;DR (Quick Start)

For the impatient: create a basic WiFi access point.

WiFi Package (RouterOS 7.13+, Wi-Fi 6 hardware):

/interface/wifi/security add name=home-sec authentication-types=wpa2-psk passphrase="YourPassword123"
/interface/wifi set wifi1 configuration.ssid=MyNetwork configuration.country=UnitedStates security=home-sec disabled=no

Legacy Wireless Package:

/interface/wireless/security-profiles set default mode=dynamic-keys authentication-types=wpa2-psk wpa2-pre-shared-key="YourPassword123"
/interface/wireless set wlan1 mode=ap-bridge ssid=MyNetwork country=united_states disabled=no

Verify with:

/interface/wifi/registration-table/print
# or for legacy:
/interface/wireless/registration-table/print

Overview

What this does: Configures your MikroTik router as a WiFi access point, allowing wireless devices to connect to your network.

When to use this:

• Setting up home or office wireless network
• Providing guest WiFi access
• Extending network coverage with additional APs
• Replacing existing access points

Prerequisites:

• MikroTik device with WiFi radio hardware (not CHR)
• Appropriate WiFi package installed (wifi-qcom, wifi-qcom-ac, or wireless)
• Bridge configured for LAN traffic (typical home setup)

Which Package Do I Have?

/system/package/print where name~"wifi"

Package	Hardware Support	RouterOS Version
wifi-qcom	Wi-Fi 6 (802.11ax)	7.13+
wifi-qcom-ac	Wi-Fi 5 wave2 (802.11ac)	7.13+
wireless	All older wireless	6.x and 7.x

Configuration Steps (WiFi Package)

Use these steps for Wi-Fi 6 hardware (hAP ax series, Audience, etc.) on RouterOS 7.13+.

Step 1: Check Available Interfaces

View your WiFi radio interfaces.

/interface/wifi/print

Expected output:

Flags: X - disabled; R - running
 0 X  name="wifi1" mac-address=AA:BB:CC:DD:EE:FF arp=enabled ...
 1 X  name="wifi2" mac-address=AA:BB:CC:DD:EE:F0 arp=enabled ...

Typically wifi1 is 5 GHz and wifi2 is 2.4 GHz.

Step 2: Create Security Profile

Create a WPA2 security profile with your password.

/interface/wifi/security add name=home-security \
    authentication-types=wpa2-psk \
    passphrase="YourSecurePassword123" \
    wps=disable

For WPA2/WPA3 mixed mode (better security, broader compatibility):

/interface/wifi/security add name=home-security \
    authentication-types=wpa2-psk,wpa3-psk \
    passphrase="YourSecurePassword123" \
    encryption=ccmp \
    wps=disable

Step 3: Configure and Enable Interface

Apply settings and enable the WiFi interface.

/interface/wifi set wifi1 \
    configuration.ssid=MyNetwork \
    configuration.country=UnitedStates \
    security=home-security \
    disabled=no

Important: Always set the correct country code for regulatory compliance and optimal channel selection.

Step 4: Add Interface to Bridge

Ensure WiFi clients can reach your LAN.

/interface/bridge/port add bridge=bridge interface=wifi1

Step 5: Verify Configuration

Check that the interface is running.

/interface/wifi/print

Expected output:

Flags: X - disabled; R - running
 0  R name="wifi1" ... configuration.ssid=MyNetwork ...

The R flag indicates the interface is running.

Configuration Steps (Legacy Wireless Package)

Use these steps for older wireless hardware or RouterOS 6.x.

Step 1: Check Available Interfaces

/interface/wireless/print

Step 2: Configure Security Profile

Modify the default security profile with WPA2.

/interface/wireless/security-profiles set default \
    mode=dynamic-keys \
    authentication-types=wpa2-psk \
    wpa2-pre-shared-key="YourSecurePassword123"

Step 3: Configure and Enable Interface

/interface/wireless set wlan1 \
    mode=ap-bridge \
    ssid=MyNetwork \
    band=2ghz-b/g/n \
    channel-width=20/40mhz-XX \
    country=united_states \
    security-profile=default \
    disabled=no

Step 4: Add Interface to Bridge

/interface/bridge/port add bridge=bridge interface=wlan1

Common Scenarios

Scenario: Dual-Band Setup (5 GHz + 2.4 GHz)

Configure both radios with the same SSID for seamless roaming.

WiFi Package:

# Create shared security profile
/interface/wifi/security add name=dual-band-sec \
    authentication-types=wpa2-psk,wpa3-psk \
    passphrase="SecurePassword123" \
    encryption=ccmp wps=disable

# Create channel profiles
/interface/wifi/channel add name=ch-5ghz \
    frequency=5180,5200,5220,5240 width=20/40/80mhz band=5ghz-ax
/interface/wifi/channel add name=ch-2ghz \
    frequency=2412,2437,2462 width=20mhz band=2ghz-ax

# Apply to interfaces
/interface/wifi set wifi1 \
    configuration.ssid=HomeNetwork \
    configuration.country=UnitedStates \
    channel=ch-5ghz security=dual-band-sec disabled=no
/interface/wifi set wifi2 \
    configuration.ssid=HomeNetwork \
    configuration.country=UnitedStates \
    channel=ch-2ghz security=dual-band-sec disabled=no

# Add both to bridge
/interface/bridge/port add bridge=bridge interface=wifi1
/interface/bridge/port add bridge=bridge interface=wifi2

Scenario: Guest Network with Isolation

Create a separate guest network that isolates clients from each other and the main LAN.

WiFi Package:

# Create guest security
/interface/wifi/security add name=guest-sec \
    authentication-types=wpa2-psk passphrase="GuestAccess2024" wps=disable

# Create datapath with client isolation
/interface/wifi/datapath add name=guest-dp client-isolation=yes

# Create virtual AP on wifi1
/interface/wifi add master-interface=wifi1 name=wifi1-guest \
    configuration.ssid=GuestNetwork \
    security=guest-sec datapath=guest-dp disabled=no

Then configure firewall rules to restrict guest network access to internet only.

Scenario: Station Mode (WiFi Client)

Connect your MikroTik as a client to an existing WiFi network.

WiFi Package:

/interface/wifi/security add name=upstream-sec \
    authentication-types=wpa2-psk passphrase="UpstreamPassword"

/interface/wifi set wifi1 \
    mode=station \
    configuration.ssid=UpstreamNetwork \
    security=upstream-sec disabled=no

Legacy Wireless:

/interface/wireless/security-profiles add name=upstream \
    mode=dynamic-keys authentication-types=wpa2-psk \
    wpa2-pre-shared-key="UpstreamPassword"

/interface/wireless set wlan1 \
    mode=station \
    ssid=UpstreamNetwork \
    security-profile=upstream disabled=no

Scenario: Hidden SSID

Hide your network name from broadcast (security through obscurity - not recommended as primary security).

WiFi Package:

/interface/wifi set wifi1 configuration.hide-ssid=yes

Legacy Wireless:

/interface/wireless set wlan1 hide-ssid=yes

Scenario: Limit Maximum Clients

Restrict number of connected devices.

WiFi Package:

/interface/wifi/configuration add name=limited-config \
    ssid=LimitedNetwork max-clients=10 country=UnitedStates
/interface/wifi set wifi1 configuration=limited-config

Verification

Confirm your WiFi setup is working correctly.

Check 1: Verify Interface is Running

WiFi Package:

/interface/wifi/print where running=yes

Legacy Wireless:

/interface/wireless/print where running=yes

Expected: Interface shows with R flag (running).

Check 2: View Connected Clients

WiFi Package:

/interface/wifi/registration-table/print

Legacy Wireless:

/interface/wireless/registration-table/print

Expected: Lists MAC addresses, signal strength, and connection info for connected devices.

Check 3: Scan for Your Network

From another device, scan for WiFi networks and verify your SSID appears.

From the router (WiFi package):

/interface/wifi/scan wifi1 duration=5s

Check 4: Test Client Connectivity

Connect a device to the WiFi network, then verify it received an IP address and can reach the gateway.

Troubleshooting

Symptom	Cause	Solution
Interface won’t enable	Package not installed	Check /system/package/print; install appropriate wifi package
Interface won’t enable	Wrong package for hardware	Use wifi-qcom for Wi-Fi 6, wifi-qcom-ac for Wi-Fi 5 wave2
Clients can’t see network	SSID hidden or wrong country	Verify hide-ssid=no; set correct country code
Clients can’t connect	Wrong password	Verify passphrase matches exactly (case-sensitive)
Clients can’t connect	WPA3 incompatibility	Use WPA2-only or WPA2/WPA3 mixed mode
Connected but no internet	Not in bridge	Add WiFi interface to bridge port
Clients disconnect every 10-15 min	WPA3 SAE anti-clogging	Disable SAE anti-clogging (see Community Tips)
Intel laptops fail with WPA3	Intel driver limitation	Use CCMP encryption, not GCMP
Poor signal/speed	Wrong channel width	Reduce width in congested environments
Station mode won’t connect	Security mismatch	Verify security type and password match AP

Common Mistakes

• Don’t forget the country code - Required for regulatory compliance and affects available channels/power
• Don’t use GCMP encryption with Intel WiFi - Intel drivers only support CCMP for WPA3-Personal
• Don’t forget to add interface to bridge - Clients won’t reach the network without bridge membership
• Don’t use WPA3-only for mixed environments - Older devices won’t connect; use WPA2/WPA3 mixed mode
• Don’t enable WPS in production - WPS has known security vulnerabilities

Community Tips

WPA2/WPA3 Mixed Mode Disconnects: If clients disconnect every 10-15 minutes with mixed mode, disable SAE anti-clogging:

/interface/wifi/security set [find] sae-anti-clogging-threshold=disabled

Intel WiFi Compatibility: Use CCMP encryption for WPA3-PSK networks with Intel WiFi cards:

/interface/wifi/security set [find] encryption=ccmp

Channel Selection: For best results:

• 2.4 GHz: Use channels 1, 6, or 11 only (non-overlapping)
• 5 GHz: Use lower UNII bands (5180-5320) for best client compatibility

Signal Debugging: Check client signal strength in registration table:

/interface/wifi/registration-table/print detail

Look for signal values; -65 dBm or better is good, below -75 dBm may cause issues.

Scan Before Configuring: Check RF environment to choose best channel:

/interface/wifi/frequency-scan wifi1 duration=10s

Channel Width Reference

Environment	2.4 GHz	5 GHz
Dense urban/many neighbors	20 MHz	40-80 MHz
Suburban/moderate interference	20 MHz	80 MHz
Rural/isolated	20/40 MHz	80-160 MHz
Long distance links	20 MHz	20-40 MHz

Wider channels = faster speeds but more susceptible to interference.

Security Recommendations

Scenario	Recommended Security
Home network	WPA2-PSK + WPA3-PSK (mixed mode)
Guest network	WPA2-PSK with client isolation
High security	WPA3-PSK only with MFP required
Enterprise	WPA2-EAP or WPA3-EAP with RADIUS
Legacy devices present	WPA2-PSK only (avoid TKIP)

Related Topics

Prerequisites

• Bridge Configuration - bridge configuration for LAN connectivity
• IP Address Configuration - addressing fundamentals

Multiple Access Points

• CAPsMAN - centralized wireless management for 3+ access points

Network Segmentation

• VLAN Configuration - VLAN tagging for guest networks
• Firewall Basics - restrict guest network access

Related Wireless Topics

• WiFi Security (WPA2/WPA3) - advanced security configuration

Reference

• MikroTik WiFi Documentation
• MikroTik Wireless Documentation
• Version changes:
  • v7.13: Introduced wifi package for Wi-Fi 5 wave2 and Wi-Fi 6 hardware
  • v7.18: Improved WPA3 SAE anti-clogging handling

Package Comparison

Feature	wifi Package	wireless Package
Hardware	Wi-Fi 5 wave2, Wi-Fi 6	All older wireless
RouterOS Version	7.13+	6.x and 7.x
Configuration Model	Profile-based	Direct properties
WPA3 Support	Yes	No
802.11r/k/v Roaming	Yes	Limited

Key Properties Reference

WiFi Package Security Properties

Property	Type	Default	Description
authentication-types	list	-	wpa2-psk, wpa3-psk, wpa2-eap, wpa3-eap
passphrase	string	-	8-63 characters for WPA2
encryption	list	ccmp	ccmp, gcmp, tkip
management-protection	enum	allowed	disabled, allowed, required
wps	enum	push-button	push-button, disabled

WiFi Package Interface Properties

Property	Type	Default	Description
mode	enum	ap	ap, station, station-bridge
configuration.ssid	string	-	Network name
configuration.country	string	-	Regulatory domain (required)
configuration.hide-ssid	bool	no	Hide SSID in beacons
channel.frequency	MHz list	-	Operating frequencies
channel.width	enum	-	20mhz, 20/40mhz, etc.
security	profile	-	Security profile reference