A Complete Guide to Configuring MikroTik for Office and Home

MikroTik routers are valued by system administrators for their configuration flexibility.
A budget home hAP lite and a corporate router that costs thousands of dollars run the same operating system — RouterOS.

This means that once you learn to configure one device, you can manage any hardware from the brand.
This article covers the main steps to set up a MikroTik from scratch to operational state. What MikroTik is and how it differs from ordinary routers, and who it is suitable for, is explained in the review “MikroTik: what is this router and why it is convenient for small business”.

1. Connecting and updating the system

The first step is to access the device and bring its software up to date.

Management tool

For configuration it is highly recommended to use the Winbox utility.
Download it from the official site mikrotik.com.

First connection

1. Connect your computer via cable to any router port (except the first, if this is the default configuration).
2. Run Winbox and go to the Neighbors tab.
3. Click on the device MAC address (this is important because the IP may be 0.0.0.0).
4. Login: admin
   Password: (empty) or from the sticker on the device.

Update (two-step process)

In Mikrotik it’s important to update not only the system but also the bootloader.

Updating RouterOS

1. Go to System → Packages.
2. Click Check for Updates.
3. It is recommended to choose a branch:
   • Long-term — for stability
   • Stable — for new features
4. Download and install the update.

Updating the bootloader (Routerboard)

1. After reboot go to System → Routerboard.
2. Compare the Current Firmware and Upgrade Firmware versions.
3. If they differ — press the Upgrade button and reboot the router again.

💡 Notes and clarifications

Most new MikroTik devices (hAP lite, hAP ac, RB, etc.) ship with a preinstalled default configuration (defconf):

• ether1 — WAN with DHCP-client
• other ports + Wi-Fi — in a bridge
• IP 192.168.88.1/24
• DHCP server
• NAT (masquerade)
• basic firewall

If the device is new, many of the steps below are already done — check with the command:

/system default-configuration print

As of 2026-09-16 the current versions are 7.24.4 (stable) and 7.23.7 (long-term). Update to the latest version in the chosen branch: new releases close vulnerabilities.

2. Internet setup (WAN)

Assume you are configuring a static IP (if the provider issues settings automatically via DHCP, this step is done by a DHCP Client on the first port).

We need to perform three actions in the IP menu.

IP address

1. Go to IP → Addresses.
2. Click + and enter the address provided by the provider.
3. Be sure to specify the subnet mask (for example, /24), otherwise the router will treat this address as a single host.
4. Specify the interface (usually ether1).

Default route (gateway)

1. Go to IP → Routes.

2. Create a route:

   • Dst. Address: 0.0.0.0/0
   • Gateway: the provider’s gateway IP address

DNS servers

1. Go to IP → DNS.
2. In the Servers field specify public DNS (for example, 8.8.8.8, 1.1.1.1).
3. The Allow Remote Requests checkbox turns the router into a caching DNS server.
   Enable it only if the firewall is configured, otherwise the router may be used in DDoS attacks.

3. Local network (LAN) and DHCP

Now let’s configure the internal network by combining ports and assigning addresses to devices.

Bridge setup

A bridge lets you combine physical ports into a single logical network (like a regular switch).

1. Open the Bridge menu and create a new interface (usually bridge1).
2. Go to the Ports tab and add the required interfaces there (for example, ether2, ether3, wlan1).

DHCP server setup

The simplest way is to use the setup wizard.

1. Go to IP → DHCP Server.
2. Click DHCP Setup.
3. Select the bridge interface (not an individual port).
4. Click Next until the end, agreeing with the suggested settings.

💡 Notes and clarifications

In the default configuration the bridge, IP on the bridge and DHCP are already configured.
If you reset while keeping defconf:

/system reset-configuration keep-users=yes no-defaults=no

— everything will be restored automatically.

4. NAT and Firewall (security)

Without these settings the internet in the local network won’t work, and the router will be vulnerable.

NAT (Masquerade)

So that devices from the local network can access the internet via a single external IP:

• IP → Firewall → NAT

• rule:

  • Chain: srcnat
  • Out. Interface: ether1
  • Action: masquerade

Firewall Filter (protection)

The Mikrotik protection logic is built on chains (Chains).
We need Input (traffic to the router) and Forward (traffic through the router).

Basic “gentleman’s set”:

1. FastTrack — connection-state=established,related
2. Drop invalid
3. Drop Input from WAN — in-interface=ether1

💡 Notes and clarifications

The default firewall already includes FastTrack, accept established/related/untracked and blocking input from WAN.

Recommended basic set:

• interface-list: LAN, WAN
• Input: accept established → accept ICMP → accept LAN → drop everything else
• Forward: FastTrack → accept established → drop invalid → drop WAN

Always change the admin password:

/user set admin password=strongpassword

And disable unnecessary services.

5. Wireless network (Wi-Fi)

In RouterOS 7 there are two different menus for Wi-Fi, and which one you have depends on the model:

• Wireless (package wireless) — older devices: hAP lite, hAP ac lite, models with MIPS chips.
• WiFi (packages wifi-qcom and wifi-qcom-ac) — this menu appeared in RouterOS 7.13 and manages Wi-Fi 6 (802.11ax) and Wi-Fi 5 wave2 (802.11ac on ARM: hAP ac², hAP ac³, cAP ac, etc.). Interfaces in it are named wifi1, wifi2.

If Winbox shows WiFi, configure via it; if only Wireless is available — use the old scheme.

Devices with the WiFi menu (Wi-Fi 6 and Wi-Fi 5 wave2)

It’s convenient to set common security settings, the network name and bridge binding once and apply them to both bands:

/interface wifi security
add name=common-auth authentication-types=wpa2-psk,wpa3-psk passphrase="strong-password"

/interface wifi datapath
add name=lan bridge=bridge1

/interface wifi configuration
add name=common-conf ssid=MyOffice country=<country> security=common-auth datapath=lan

/interface wifi
set wifi1 configuration=common-conf disabled=no
set wifi2 configuration=common-conf disabled=no

The combination wpa2-psk,wpa3-psk allows older clients (WPA2) and newer ones (WPA3) to connect. The datapath parameter with bridge adds the Wi-Fi interface to the local network bridge — without this, clients will not receive an address from the DHCP server on the bridge. Replace the bridge name with yours (in default configuration — bridge), and instead of <country> specify the country from the list suggested by Winbox: allowed channels and transmit power depend on it.

Devices with the Wireless menu (older models)

1. Go to Wireless.

2. In the Security Profiles tab create a profile:

   • Mode: dynamic keys
   • WPA2-PSK
   • strong password

3. Open wlan1:

   • Mode: ap bridge
   • SSID
   • Security Profile
   • Enable

💡 Notes and clarifications

WPA3 is available in the WiFi menu; in the old Wireless menu stick to WPA2-PSK with a strong password. In both cases the Wi-Fi interface must be in the local network bridge.

6. Bandwidth management (QoS)

If one user saturates the channel:

• Queues → Simple Queues
• Target: IP or subnet
• Max Limit: for example 10M/10M
• Place VIP users higher in the list

💡 Notes and clarifications

For complex scenarios use Queue Tree, PCQ or CAKE.

7. Backups

Mikrotik has two types of saving configurations (Files):

💡 How it all connects

The basic MikroTik scheme consists of four elements: IP address, default route, DNS and NAT. If at least one of them is missing, the internet in the local network will not work.

Therefore, when troubleshooting check these elements in order.

💡 Final note: security

After the basic setup be sure to:

• change the admin password
• create a separate user
• regularly update RouterOS
• monitor logs and traffic (Tools → Torch, Netwatch)