mAP lite: Not able to configure very simple use case LAN to WLAN bridge; neither does manual describe such a basic thing

Hardware MikroTik hardware general
1

I have just purchased an mAP lite, for its small size. I am a computer engineer myself, with quite some experience in network configuration, but after more than 2 hours of trying, I really don’t manage to configure this device to my needs.

I have a WLAN connected to the internet. I want the mAP to be connected to this WLAN and provide access to it via its Ethernet connector. The goal is to connect any device to the mAP Ethernet and get connected to the internet via WLAN.

PTP bridge seemed the wrong configuration, as I don’t want two mAP connected to each other, I just want one mAP connected to my WLAN. So I figured out I need CPE in bridge mode. But how can I at the same time [Connect] to my WLAN and apply CPE settings (DHCP and the like)? I can do either or, but once having done one thing, I loose connection to the mAP and am no longer able to connect to it!

Looking for a working sequence to achieve my intended setup with a laptop, without WinBox installed. Note that the mAP lite just has a single LAN connector, so it is not possible to use one LAN as config port and another LAN as bridge port.

2

What a coincidence, I discovered this thread while toying around with my new map, posting this from behind this very config.

/ip/address/add interface=bridge address=
/ip/dhcp-server/remove defconf
/interface/wireless/security-profiles/add name= mode=dynamic-keys wpa2-pre-shared-key=
/interface/wireless/set wlan1 ssid= security-profile= country=“united states” mode=station-pseudobridge

The part I would guess you were missing is you can have as many IPs as you like. Once you are associated successfully, you can just release/renew on your wired client, and continue managing with the static you set. You could also turn on a dhcp-client for the bridge interface, but for all the reasons you already pointed out a static is safer. There is a lot of tweaking that could be done from here, if only to clean up all the firewall and NAT you aren’t using. That said, vanilla station mode and NAT is another way of getting there that wouldn’t require any addressing tricks on your side or Mikrotiks.

3

This is what I have already tried (non-successful sequence #1):

  1. ‘First use’ according to https://help-mikrotik-com.translate.goog/docs/display/UM/mAP+lite?_x_tr_sl=en&_x_tr_tl=de&_x_tr_hl=eng&_x_tr_pto=op
    Note that it takes several seconds until the WLAN is ready.
    Also note that login seems to happen automatically, but I had to ‘Close’ a welcome page stating the current router configuration.
  2. ‘Quick Set > CPE’
    Keep Bridge/Static/192.168.88.1
  3. ‘Apply’
  4. ‘Power on/off’
    => WLAN not active anymore
    => No longer access to http://192.168.88.1

Reset again, next try (non-successful sequence #2):
3. ‘Quick Set > CPE’
Keep Bridge
Change ‘Acquisition = Automatic’ and ‘Source = WLAN’
4. Select the desired WLAN
5. Enter the WLAN password
6. Connect’
=> I can see the MikroTik wifi bridge in my WLAN, but a computer connected via LAN doesn’t get an IP, resulting in 169.254.x.x
=> Even though the MikroTik wifi bridge is visible, it doesn’t get an IP address and thus cannot be accessed anymore
=> Suspecting it still is using 192.168.88.1 in static configuration

Using [WebFig > Wireless] and/or [WebFig > Bridge] and/or [WebFig > IP] didn’t help either.

Very frustrating not being able to find an easy way to configure such simple use case. How about if MikroTik added a [Quick Set > WLAN Client] option? Select WLAN, enter password, done! That’s how devices should work, simple and easy!

4

In total I have spent approx. 6 hours trying different things, incl. this forum post and a support ticket:
https://help.mikrotik.com/servicedesk/servicedesk/customer/portal/1/SUP-74769

The answer there was off-putting:
“We do not provide configuration assistance.”

OK, but then at least provide simple and easy-to-use devices and/or documentation!

5

It’s not that difficult, but you have to understand what you do.
Once you have the mAP Lite operating as bridge, then there is no own IP address (192.168.88.1) anymore. Only an IP address from your WLAN network. If the WLAN connection is not made, then the IP address is GONE. And then without WinBox there is no connection until the WLAN connection is made.
Quickset has a very limited set of possibilities! It is far from the easiest way to config that device without losing connection.

So you want to bridge , and use the WLAN to provide an IP address to the PC (and to the mAP Lite). This setup is always troublesome !!! 802.11 standard does not allow this. It has to be faked with the “station-pseudobridge” and there DHCP fails in many conditions, because the MAC address of the mAP Lite is used as only possible MAC for the communication. The other option is to work in CPE router mode with NAT. Then the local network of the mAP remains active all the time as 192.16.88.0/24 , and all connected devices to the ethernet get NATted in the WLAN network. Internet access or access to devices in the WLAN will work.

See http://forum.mikrotik.com/t/configuring-local-network/155928/1

Other hints: give a static IP address to the bridge of the mAP, it may be in the 192.168.88.0/24 range or in the WLAN range. That static IP address is important to gain connection without WinBox. The PC will also need to get an IP address in the same subnet if DHCP is not available or does not work as expected. Not working of DHCP in bridge mode is the most probable reason why you lost connection: the PC did not have an IP address in the same subnet as the mAP.
WARNING: Quickset will clear that static IP address. Do not use Quickset except for the initial step. Work with static IP address in the “bridge” setup. This makes you indepndent from the WLAN status in “bridge” mode. You can combine static and DHCP client IP addresses later on te bridge with Webfig (it cannot be the same address, but must be in the same subnet so choose the static outside the IP pool but in the same subnet.) The bridge can have many addresses, so you can still maintain 192.168.88.1 as extra IP address just to get in via that range of addresses. Adding a static IP address makes the mAP to have an IP address when the WLAN connection is not active in “bridge” mode. In “router” mode the mAP always has it’s own subnet independent from the WLAN.

IF you want to maintain the Wifi connection from the PC to the mAP, even as wifi is used to connect to the WLAN network as uplink, then you need to use the “Repeater Setup” to make the mAP a station and an AP at the same time with just one wifi radio. There is a “Setup Repeater” button in Webfig for WLAN1.

Very frustrating not being able to find an easy way to configure such simple use case. How about if MikroTik added a [Quick Set > WLAN Client] option? Select WLAN, enter password, done! That’s how devices should work, simple and easy!

No Mikrotik is not in that “simple and easy” market, their “added value” is that universal configurable RouterOS, with hundreds of options and possibilities to be mixed and matched at will. And WLAN-LAN bridge is only possible and easy with a Mikrotik WLAN, because of their extension of the 802.11 wifi standards. Otherwise it is always a problem, even with any “Range extender” or “Repeater” off the shelf which can only just do that. A wifi-dongle is yet a different thing, but is maybe the simple device you need.

6

Factory reset it, connect to it with Winbox, and when prompted remove the default configuration entirely.
This will disable wifi and remove the IP addresses and all other configuration.
Now, connect it to your PC over ethernet, open Winbox, and go to the “Neighbors” tab. You will see the device listed with its name and MAC address, but no IP address.

Click on the MAC address in the list, and click connect.

Now you can create your bridge, add the ethernet and wifi interfaces to the bridge, configure the wifi interface however you would like it, and away you go. You may briefly lose access when you add the ethernet port to the bridge, just re-connect and it’ll be fine.

You might be wondering how this works without an IP; Winbox does not require the device to have an IP address in order to connect. Only layer-2 access is required, as long as MAC Winbox Server and neighbor discovery are enabled on the interface (the default configuration disables both neighbor discovery and MAC Winbox Server on the WAN port for security reasons).

This is, in my opinion, one of the best features of RouterOS + Winbox; if you have L2 access you basically never have to worry about losing the ability to log in.

[Edit]: And please, please, please don’t use QuickSet. It only ever works on a device that’s got a completely default configuration on it, and it only works once. It causes more trouble than it solves.

7

Yes with the proper tools it is much easier. But OP wanted to do it without the proper tooling.
Even if WinBox for one or other reason cannot or is not allowed to be installed, the Android “Mikrotik App” can connect via discover and MAC address. And the full setup is available under the tree bars at the upper left of the screen. If a PC feels more comfortable (keyboard, mouse, larger screen) then the “Mikrotik APP” could be used to set the minimal IP info needed for connecting. An extra Mikrotik router on the same L2 is also a good bridgehead to get in via neighbors and TELNET MAC or SSH MAC, even if the bridgehead is very remote from the operator and can only be contacted over a VPN connection.

This is one strength of RouterOS. Only wrong firewall settings and VLAN filtering is likely to lock you out (untill physical reset).

8

@neg2led: Thanks, this is what I have been looking for, a working sequence of steps, not the “could do” / “option” / “maybe” / “try” one gets otherwise. Though not preferrable, I can live with using WinBox and I understand the advantages L2 access gives in my use case.

And the “please, please, please don’t use QuickSet” should warn others for not wasting the many hours as I did.

So I used WinBox and was able to configure the bridge among wlan1 and ether1. I was also able to connect to the WLAN using WPS Client. But then stuck again, the mAP lite doesn’t seem to remember/automatically reconnect to the WLAN.

Next attempt: WinBox and Quick Set (ignoring the above warning) and funny, WLAN now works and gets remembered! But the bridge still isn’t fully working, the device on ether1 doesn’t get a DHCP config, propably for one of the reasons mentioned by @bpwl, so stuck again! Some more refinement might get DHCP working, but then, what is next? So after almost 10 hours I am giving up. I got myself a Zyxel WAP3205, though quite big, it does what I expected: It is simple and it works.

@bpwl: I am not a network expert, but I do have broad knowledge of all basic technologies and topics in network engineering. Developing easy-to-use products and software myself, it’s been frustrating to find all these complications with this very product. I also understand 802.11 does have limitations, but others seem to manage or work around them: VONETS VAP11G-300 (other use case) as well as Zyxel WAP3205 (instead of the mAP lite).

9

Ah, right, okay - sorry, I thought you wanted to go the other way (use it as a wifi AP, not a wifi client). As for the failing to auto-connect after reboot, I suspect that’s something to do with WDS - i’ve never found WDS to be very reliable, and it’s also pretty horrifically insecure (especially with the PIN enabled). I just put the wifi PSK directly into the security profile and that works just fine.

I know you have a solution you’re happy with now, but just in case it helps someone who comes across this thread in the future (or you’d like to give it another try):

For bridging a LAN device to a WLAN network, you run into a fundamental issue with 802.11, namely that you’re only allowed to have one MAC address per client device. There are a couple of ways around this; the easiest one is “use a mikrotik access point”, mikrotik have built some non-standard stuff into their implementation which gets around the problem - but in this case I imagine that’s not an option. The remaining options are:

  1. Set the wifi radio mode to ‘station pseudobridge’ on the mAP; this has a major limitation in that you can only reliably connect one device to the LAN side, but for IPv4 traffic you can connect more and it mostly works out fine. The simplest way to set it up is actually via the wifi repeater wizard in Winbox; open Winbox, go to the ‘wireless’ page, click on ‘setup repeater’, and follow the prompts. Once that’s complete, you should have two wifi interfaces (one physical, one virtual) that are both bridged together; add the ethernet port to that bridge, and away you go.

  2. Do not bridge the interfaces, and instead perform NAT on the mAP. For this, you’d put a DHCP client on the wlan interface, and a static IP + DHCP server on the ethernet interface, then configure a NAT rule to masquerade traffic going out wlan. This is basically the same configuration as the defaults, but with the ethernet and wlan interfaces’ roles swapped and no firewalling.
    The downside to this mode is you can’t access the device/devices behind the mAP without setting up port forwarding, and it can get messy and unpleasant to manage.

  3. Proxy-ARP. This can have its own host of problems, and I’ve never successfully set it up in a wifi context, but I believe it should work in theory?

10

@neg2led thanks again! For the moment I keep using the Zyxel WAP3205, it works just fine, incl. DHCP and everything else. If I ever run into new issues, I might try again as proposed.

Best regards,
Matthias

11

Thanks for all the contributions to the thread so far. About to try this myself as it’s exactly what I need to do. I’m surprised there aren’t any tutorials for this anywhere as it seems like a basic thing most people buying it would want to do. I didn’t realise about the limits of the wlan protocol and MAC address issues etc.

12

Hello, can someone help with this configuraton? I set up wifi repeater, have two wlan interfaces, added ether port to bridge, what I should do next?

13

Follow this:
http://forum.mikrotik.com/t/forum-rules/173010/1
and post your configuration.

Also describe what you want to achieve (goal), it is not clear what you have done till now (hence the need to post your current configuration) nor what you are trying to obtain (“this configuration” means nothing), the more detailed you are in this description, the more likely it is that someone may help you.