The wizard is for the ordinary cases: you know what the device should become, not necessarily what RouterOS calls it. You pick a role, walk through the steps, and can switch to advanced at any point without losing anything.
Pick a role
The role decides which parts are switched on and which questions you get. Anything that does not fit your device is greyed out, with the reason next to it: This is a switch, No wifi radio, No LTE modem, or Needs at least 3 wired ports for the roles that want a WAN, a LAN and a trunk at the same time.
- Home router — one network, internet over DHCP or PPPoE, Wi-Fi, firewall, IPv6. The replacement for the ISP box.
- Office router with VLANs — separate networks for office, guests, IoT and management, a trunk to switch and access points, Wi-Fi per VLAN and isolation in the firewall.
- Switch — every port in the bridge, a VLAN table with access and trunk ports, a management address, no routing and no NAT.
- Access point — Wi-Fi with a management address over DHCP, bridged into your existing network.
- CAP (managed by CAPsMAN) — the same, but without SSIDs of its own: you fill in the controller's address and the Wi-Fi comes from there.
- Router + CAPsMAN — the office router acting as the controller, managing the Wi-Fi of every access point.
- Wi-Fi repeater / extender — one radio connects to your existing network, the other rebroadcasts it. Expect at most half the throughput: a repeater sends everything twice.
- Wireless CPE / point-to-point — an SXT, LHG or wAP as station or access point for a wireless link between two places.
- VPN gateway — home or office router plus WireGuard, with ready-made configurations for phone and laptop, and optionally IKEv2 and L2TP.
- LTE / 5G router, Hotspot / guest portal and Core router — for the cases where that is the main job.
- Harden only (baseline) — leaves the network alone: password, restricted management services, brute-force protection, time and logging. For a router that already works and only needs locking down.
Recipes
Under the roles sit the recipes. A recipe is a role with the settings already filled in for a common setup: a home network with a separate guest Wi-Fi, two internet connections with failover, smart home devices on their own network, an office with centrally managed access points, a home router with WireGuard for phone and laptop, or a guest hotspot with a login page. You then walk exactly the same steps, with the VLANs, SSIDs and firewall rules already there. A recipe never does anything you could not click together yourself, and it runs through the same generator and the same checks.
Combining
For a role that routes, the wizard opens with a Combine step: blocks you can add on top. Those are VLANs, VPN, CAPsMAN controller, Bandwidth (QoS) and IPv6. Anything the role already contains is not offered again, and a switch or an access point does not get this step: they have no internet side to hang it on. Tick a block and that section is switched on and its own steps appear, just before firewall, management access and system. Untick it and what you typed stays where it was.
The steps
Each step puts one subject on screen, with an explanation of why it matters. Depending on the role you will see: internet, ports and bridge, VLANs and port assignment, LAN and DHCP, Wi-Fi, DNS, IPv6, firewall, management access, and last of all name and password. Required fields are marked, and what you leave empty gets a safe default.
If something is wrong you do not get past it: pressing Next scrolls to the field that is not in order. Meanwhile the script runs along on the right, with the number of lines under it. You do not have to wait until the end to see what you are building.
Above the step sits a count of how many steps there are and which one you are on, and above that the four stages of the tool: device, mode, settings and script. Those become clickable once you have been there, so you can always go back to an earlier stage without losing anything.
The summary
After the last step you see your choices in a row, grouped per part, each with a button to jump back. Passwords show as dots, lists as a count. This is also where the checks live: a password that is too short, a VLAN without an address, a subnet that clashes. Those are real mistakes, not suggestions.
Beyond the wizard
Every step has a link to advanced mode, where each part is laid out separately. You land on the part you were working on, and everything you filled in is already there. You can switch back too: the wizard keeps showing your answers. Go to advanced as soon as you want something no role covers, such as static routes, containers or a firewall rule of your own.
Further reading: Choosing your device, Advanced and Using the script.