The WAN / internet section describes the line to your provider. It is on by default for every role that routes, and in the wizard it is the step "how do you get internet". In advanced mode it sits as its own block between the VLANs and the LAN.
At the top there is a provider list. Picking your provider fills in the first uplink: the type, the VLAN number if there is one, and for PPPoE a username to start from. Everything stays editable afterwards. See Provider presets.
The uplinks
Below that is a table of uplinks. Usually you have one; you can have at most four. Per uplink you fill in the following.
Port
The physical port the provider's cable goes into. The default is your model's WAN port, usually ether1, or lte1 on a model with a built-in modem. If you pick a different port, the configurator keeps it out of the bridge so your LAN does not end up mixed with the uplink.
Type
- DHCP
- The provider hands you an address. Cable, and fibre with providers that use no login. Nothing else to fill in.
- Static IP address
- You enter the address with its prefix, the gateway, and optionally the provider's DNS servers. For business lines with a fixed block.
- PPPoE
- A login with username and password. You can name the PPPoE interface (
pppoe-out1by default) and set a service name if your provider insists on one. - LTE / 5G
- Only on models with a modem. You fill in the APN, and optionally a user, a password and the authentication type (PAP or CHAP). IPv6 over LTE has its own switch.
VLAN on the WAN port
A number of providers deliver internet tagged. In that case fill in the number under VLAN id on the WAN port. Leave it empty and there is no VLAN. KPN fibre uses 6, Ziggo uses none. The configurator then creates a VLAN interface named something like ether1-vlan6 and hangs the DHCP client or the PPPoE client on it instead of on the bare port. That one field is the difference between "the router does nothing" and "the router is online".
Cloning a MAC address
With DHCP and with a static address you can give the WAN port a MAC address to take over. That helps with providers that tie the line to whatever hardware was there before, and with a modem that hands its public address to one MAC only. The field writes /interface ethernet set ether1 mac-address=....
MTU
Leave this empty unless you know why not. On PPPoE RouterOS sorts out 1492 by itself. If you do set a PPPoE MTU above 1492 you get a note: that only works when your provider supports RFC 4638, and the port underneath is given eight bytes more. Whenever the MTU towards the internet is below 1500, clamp TCP MSS should stay on. Turn it off and the configurator warns you, because the result is the annoying kind of fault: most sites load, some stall halfway.
Route distance and gateway check
Route distance decides which uplink wins: 1 is primary, higher is backup. With a single uplink leave it at 1. The gateway check has RouterOS verify the gateway is still alive, by ping or by arp; set to none, the route stays in place even when nothing answers behind it. Note that this field only reaches the script on an uplink with a static address, because that is where the configurator writes the default route itself. With DHCP, PPPoE and LTE the client creates the route and no check-gateway comes with it. Both fields only start to matter once you have more than one uplink, and then Several uplinks is the chapter you want.
Use ISP DNS
On means the router takes over the DNS servers it is given with the connection. Off means you decide who the router asks. If you set the DNS section to "ISP DNS", this is where that information comes from; on a static uplink the configurator uses the ISP DNS field for it. See DNS.
Add default route
Leave this on for every uplink that is supposed to carry internet. Switch it off and you get an address but no route, which is rarely what you want. With recursive failover and with PCC the configurator turns it off in the generated lines itself, because the routes are written separately there.
IPTV over multicast
If your provider delivers television as multicast, turn IPTV on. The router then acts as an IGMP proxy: the uplink is upstream, your LAN is downstream. Without it, multicast from WAN is dropped by the firewall rules and you get a black screen. With more than one uplink you also pick which uplink carries the TV.
Two things belong with it. Turn on IGMP snooping on the bridge, or the TV stream is flooded to every port and swamps the network; the configurator points this out. And leave the Firewall section on, because IPTV needs those rules.
What ends up in the script
- A VLAN interface under
/interface vlanwhen you set a VLAN on the WAN port. /ip dhcp-client,/ip addressplus/ip route,/interface pppoe-clientor/interface lte apn, depending on the type.- An MSS rule in
/ip firewall manglewhen the MTU is below 1500. /routing igmp-proxy interfacefor IPTV.
At the bottom of the section there are extra static routes: destination, gateway and distance, for networks behind another device in your own network. Larger routing work lives in Static routes.
When it does not work
- No address. Check with
/ip dhcp-client printthat the client sits on the right interface: with a VLAN that should be the VLAN interface, notether1. - Double NAT. If your provider's modem is still acting as a router, put it in bridge mode. Otherwise port forwarding will not work.
- PPPoE never comes up. Look at
/interface pppoe-client printand at the log. A wrong VLAN looks exactly like a wrong password: nothing at all happens. - Some sites hang. That is almost always MSS. Turn TCP MSS clamping on.
Never paste the script while you are on Wi-Fi yourself, or through the port that is about to become WAN. Use a cable into a LAN port.
Read on: Several uplinks, Provider presets and LAN and DHCP.