Wireless Configuration in MikroTik: Setting Up AP Mode

Setting Up a Wireless Access Point on MikroTik RouterOS

MikroTik devices with built-in wireless (like the hAP ac series) can act as a Wi-Fi access point. This lesson covers how to configure basic wireless on RouterOS v7, including SSID, security (WPA2), frequency selection, and connecting to a bridge.

Checking Available Wireless Interfaces

First, see what wireless interfaces are available:

/interface wireless print

Output example on an hAP ac2:

 #    NAME      TYPE       ACTUAL-MTU  L2MTU  MAX-L2MTU  MAC-ADDRESS
 0    wlan1     wlan       1500        1600   2290       AA:BB:CC:DD:EE:01
 1    wlan2     wlan       1500        1600   2290       AA:BB:CC:DD:EE:02

• wlan1 is usually the 2.4 GHz radio
• wlan2 is usually the 5 GHz radio

Understanding Wireless Modes

RouterOS wireless interfaces can operate in different modes:

• ap-bridge — Access Point mode (allows multiple clients to connect) — this is what you want for a standard AP
• station — Client mode (connects to another AP, like a Wi-Fi adapter)
• bridge — Point-to-point bridge mode
• station-bridge — Client mode with bridging support

For a standard access point, use ap-bridge.

Step 1: Create a Security Profile (WPA2)

Before configuring the wireless interface, create a security profile with your Wi-Fi password:

/interface wireless security-profiles add name=my-wpa2 authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key=MySecurePassword123

Parameters:

• name=my-wpa2 — name for this profile
• authentication-types=wpa2-psk — WPA2 with Pre-Shared Key (standard home/office Wi-Fi)
• mode=dynamic-keys — required for WPA2
• wpa2-pre-shared-key=MySecurePassword123 — your Wi-Fi password (8 to 63 characters)

View security profiles:

/interface wireless security-profiles print

Step 2: Configure the Wireless Interface

Now configure the wireless interface to use AP mode with your settings:

/interface wireless set wlan1 mode=ap-bridge ssid=MyNetwork band=2ghz-b/g/n channel-width=20/40mhz-XX frequency=auto security-profile=my-wpa2 disabled=no

Parameters explained:

• mode=ap-bridge — Access Point mode (allow multiple clients)
• ssid=MyNetwork — your Wi-Fi network name (visible to devices)
• band=2ghz-b/g/n — support 802.11b, g, and n clients (most compatible)
• channel-width=20/40mhz-XX — allow 20 or 40 MHz channel width (40 MHz gives better speed)
• frequency=auto — let RouterOS pick the best channel automatically
• security-profile=my-wpa2 — use the profile you created
• disabled=no — enable the interface

For the 5 GHz radio (wlan2):

/interface wireless set wlan2 mode=ap-bridge ssid=MyNetwork-5G band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX frequency=auto security-profile=my-wpa2 disabled=no

Step 3: Add the Wireless Interface to a Bridge

For your Wi-Fi clients to communicate with your wired LAN clients (and share the same subnet), add the wireless interface to the same bridge as your LAN ports:

/interface bridge port add interface=wlan1 bridge=bridge
/interface bridge port add interface=wlan2 bridge=bridge

Now wired devices on ether2–ether5 and wireless devices on wlan1/wlan2 are all on the same Layer 2 network and will get IPs from the same DHCP server.

Verifying the Wireless Interface

Check the interface status:

/interface wireless print

Check connected clients:

/interface wireless registration-table print

This shows all devices currently connected to your access point, including their MAC address, signal strength (dBm), and TX/RX rates.

Frequency and Channel Selection

2.4 GHz Channels

The 2.4 GHz band has 11–14 channels (depending on country), but only channels 1, 6, and 11 are non-overlapping in a 20 MHz width. Using auto frequency lets RouterOS scan and pick the least congested channel.

To manually set a specific channel:

/interface wireless set wlan1 frequency=2412

Common 2.4 GHz frequencies:

• Channel 1: 2412 MHz
• Channel 6: 2437 MHz
• Channel 11: 2462 MHz

5 GHz Channels

The 5 GHz band has many more non-overlapping channels and is generally less congested. Frequencies range from 5180 MHz to 5825 MHz. Use frequency=auto to let RouterOS pick.

Country Setting (Important for Legal Compliance)

Set your country to ensure RouterOS only uses frequencies legal in your country:

/interface wireless set wlan1 country=iran
/interface wireless set wlan2 country=iran

Available countries:

/interface wireless info country-info print

Hiding the SSID

If you want to hide your network name (not broadcast it):

/interface wireless set wlan1 hide-ssid=yes

Note: hiding the SSID provides very little security — determined users can still find it. A strong password is much more important.

Full Example: Dual-Band Access Point Setup

# Create security profile
/interface wireless security-profiles add name=home-wifi authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key=SuperSecret99

# Set country
/interface wireless set wlan1 country=united-states
/interface wireless set wlan2 country=united-states

# Configure 2.4 GHz AP
/interface wireless set wlan1 mode=ap-bridge ssid=HomeNet band=2ghz-b/g/n frequency=auto security-profile=home-wifi disabled=no

# Configure 5 GHz AP
/interface wireless set wlan2 mode=ap-bridge ssid=HomeNet-5G band=5ghz-a/n/ac frequency=auto security-profile=home-wifi disabled=no

# Add both to bridge
/interface bridge port add interface=wlan1 bridge=bridge
/interface bridge port add interface=wlan2 bridge=bridge

Summary

Setting up a basic wireless AP on MikroTik:

1. Create a security profile (WPA2 password): /interface wireless security-profiles add
2. Configure the wireless interface: /interface wireless set wlan1 mode=ap-bridge ssid=...
3. Add to bridge: /interface bridge port add interface=wlan1 bridge=bridge

Use registration-table print to see connected clients and their signal strength.