Setting up Wi-Fi

The Wi-Fi section describes what your radios broadcast: which network names, with which security, on which band, and which network the clients end up in. The section only appears when the model you picked has a radio.

In the wizard, Wi-Fi is a step of its own in the Home router, Office router with VLANs and Access point roles. In advanced it is a separate block, with the fields the wizard leaves out.

What the radios do

At the top you choose the role of the radios, which decides what appears below it:

Access point: the device broadcasts SSIDs. This is what you want in almost every case.
Station / CPE: the device connects to another access point instead, for a wireless link.
Repeater / extender: one radio joins an existing network and rebroadcasts it. Expect half the throughput at best, and about a quarter with a single radio.
Managed by CAPsMAN: a controller configures the radios. See CAPsMAN.

The rest of this chapter is about the access point role.

The SSID table

You can define up to eight SSIDs, each with its own name. Per row you set:

SSID: the name, 32 characters at most. Names have to differ from each other.
Security: WPA2-PSK, WPA2 + WPA3 (the default), WPA3 only, or open with no passphrase.
Passphrase: eight characters minimum. The button next to it generates one of sixteen. Everything stays in your browser.
Bands: which radios broadcast this SSID. The choices come from the radios of the model you picked.
VLAN: only shown when the VLANs section is on.
Client isolation and Hidden: two toggles, explained below.

The first row gets a name with four random digits, so you do not accidentally copy your neighbour's network name. Add a second row and it is called Guest, with client isolation already on.

Choosing the security

WPA2 + WPA3 lets new devices use WPA3 and old ones stay on WPA2. That is the safe default. WPA3 only is stronger, but older phones, printers and IoT gear will no longer connect. Open means no passphrase at all; the configurator flags that, including when you meant it.

A hidden SSID is not security. The name is still in the traffic of every client that connects to it, and some devices connect worse or slower to a hidden network. Use it to keep a network out of the list, not to protect it.

Client isolation

With client isolation, devices on the same SSID cannot reach each other. You want that on a guest network and usually on an IoT network too. What you do not want is isolation on your own network, because then your laptop no longer sees your printer or your NAS.

An SSID per VLAN

With the VLANs section on, you can attach each SSID to a VLAN. The traffic from that SSID then arrives on the bridge with that tag, and so lands in the network you meant it to. Without a VLAN the SSID falls into the ordinary LAN.

An SSID on a VLAN only works if the cabling carries that VLAN: the port between router and access point has to be a trunk with the VLAN tagged. In a site with several devices the configurator checks this and says so when a device does not carry an SSID's VLAN. See VLANs and Example: a guest network.

Receiving Wi-Fi instead of broadcasting it

A MikroTik can work the other way round: connect to an existing network and pass it on to its Ethernet ports. That is what you want when a TV box, a games console or an old printer only has a network socket and the router is at the other end of the house. The wizard has two roles for it:

Wi-Fi repeater when the device should broadcast the signal again as well.
Wireless CPE / point-to-point when it only has to receive and hand it to the cable.

For both, the tool asks one question that decides everything: what is at the other end? The three answers:

A MikroTik on the same driver. That gives you station-bridge: everything behind this device stays visible with its own MAC address. Note that the driver decides, not the brand. Two MikroTiks both running wireless work together, and two both running wifi do as well, but one of each does not.
Another brand, or the router from your provider. That gives you station-pseudobridge. Everything behind this device appears on the other side under one MAC address. For a TV box or a single computer that is fine; for a whole network with dozens of devices it is not.
Does not matter, this device may route. Then Wi-Fi becomes its WAN side and the devices behind it sit in a network of their own. Useful when you want them separated, awkward when they need to reach the rest.

The wrong choice gives you the most annoying kind of fault: the connection is made, the device reports that it is connected, and nothing passes through. Pick station-bridge while the other end is not a MikroTik and that is exactly what happens.

The two RouterOS v7 Wi-Fi packages

RouterOS v7 has two entirely separate Wi-Fi implementations: the old wireless package (/interface wireless) and the new wifi package (/interface wifi). Which one you have depends on the model. The configurator takes that from the catalogue; it is not something you set.

ax and be models (hAP ax, cAP ax, hAP be) use wifi.
Older ac and n models (cAP ac, hAP ac², wAP ac) use wireless.
A few ac models can do both, through the wifi-qcom-ac package. For those the configurator writes the wireless form. If such a device is in fact running wifi-qcom-ac, the script does not match it and your networks do not come back. See From RouterOS v6 to v7.

The difference is not cosmetic. The old package has no WPA3: pick WPA3 or WPA2 + WPA3 and the SSID is written as WPA2-PSK with AES, and the configurator tells you so. Band steering, 802.11r fast roaming and the management frame protection setting only appear on the new package, because the old one does not have them.

What the configurator generates

On the wifi package you get a security profile per SSID, a datapath (which carries the bridge, the VLAN tag and the isolation), a configuration, and a channel per radio. The first SSID on a radio sits on the radio itself, the rest are added as virtual interfaces with master-interface.

On the wireless package you get /interface wireless security-profiles per SSID, the radio in ap-bridge, virtual APs for the extra SSIDs, and every Wi-Fi interface added as a bridge port. Isolation there is default-forwarding=no and a VLAN is vlan-mode=use-tag.

After pasting, check what landed with /interface wifi print or /interface wireless print, and who is connected with /interface wifi registration-table print.

What goes wrong

An SSID with no band. Tick at least one, or there is nothing to broadcast the configuration on.
An SSID on a VLAN that no longer exists. After deleting a VLAN, check the SSID table; the configurator warns about it.
Clients get no address. Usually the trunk towards the access point does not carry the VLAN, or that VLAN has no DHCP server.
WPA3 does not work on an older device. That is the package, not your setting.

Channels, width and power are in Channels, width and power. Several access points under one SSID: Recipe: Wi-Fi that keeps working as you walk. Where to hang them: The Wi-Fi plan.