The most common case: you bought a MikroTik to replace the box from your ISP. Here is the whole route, including the places where it usually goes wrong.
What you need
- Your model, for example an hAP ax³, a hEX or an RB5009.
- How your ISP delivers internet: DHCP (cable, or a modem in bridge) or PPPoE with a username and password. Some providers add a VLAN number to that, KPN uses 6 for example.
- A cable from your laptop to the device. Do not do this over Wi-Fi.
Step 1: role and internet
Choose One device, your model, and the Home router role. At the internet step, pick your type:
- DHCP — nothing else to fill in. Put your ISP's modem in bridge mode, otherwise you sit behind two routers (double NAT) and port forwarding will not work.
- PPPoE — the username and password from your ISP. If your provider is in the preset list, pick it: the VLAN number and matching settings are filled in for you.
The WAN port is ether1 by default, so plug your ISP's cable in there, or choose another port if you prefer.
Step 2: your network
The LAN address defaults to 192.168.88.1/24, the MikroTik habit. If you want something else, change it here and now: the DHCP range follows along.
Coming from an ISP router on 192.168.1.1? Think of devices with a fixed address in that old range: printers, cameras, a NAS. You will have to move those, or keep your old range.
Step 3: Wi-Fi
Fill in your SSID and passphrase. A few choices that matter:
- One name for 2.4 and 5 GHz is the most practical; your devices pick for themselves. Only gear that insists on 2.4 GHz (older IoT things) sometimes needs a separate name.
- WPA2 and WPA3 together works with everything you have at home. WPA3 only is safer but shuts older devices out.
- Country should be right, because it decides which channels and what power are allowed.
Step 4: firewall, IPv6 and management
The firewall is fine as it stands: everything from outside is closed, except what belongs to connections you started yourself. Leave it that way unless you want to forward something.
IPv6 is set to prefix delegation: you get a block from your ISP and your network gets addresses, with the IPv6 firewall on. If you do not want IPv6, switch it off deliberately; half on is worse than off.
Set a decent administrator password. Management from the internet is off, and it should stay that way: if you want to reach it from outside, use the VPN.
Step 5: apply it
Reset the device, paste the script, log back in and check that you have internet. See Using the script.
Where it usually goes wrong
- Double NAT. The ISP modem is still acting as a router. Put it in bridge, or accept that port forwarding will not work.
- PPPoE and MTU. PPPoE carries at most 1492 bytes. Leave the MTU field empty and that is handled, and leave TCP MSS clamping on, or some websites will hang while everything else works.
- Wi-Fi on the wrong port. Never paste the script while you are connected over Wi-Fi.
- IPTV. If your ISP delivers television over multicast, switch IPTV on, otherwise those packets are dropped by the firewall.