HAP AX S wifi bridge not working

RouterOS Wireless Networking
1

Hello, maybe anyone can help. I try to connect two hap ax s as wifi bridge. The station-bridge mode works a little bit. I can connect to the Master AP, get an IP-Adress for the connected AP but no IP adresses for the connected clients. I can also not connect to the internet over the wifi bridge. The station-pseudobridge mode works absolutely fine. But two Mikrotik devices should normally work in station-bridge mode as i read here:

Should i leave the two connected Mikrotik APs in pseudobridge-mode?

2

Are all interfaces in the LAN group?

3

Post the configuration of the device set in station-bridge mode, instructions here:
Forum rules - #5 by gigabyte091

4

Yes, all interfaces in the LAN group. Attached my configuration.

# 2026-07-12 20:44:49 by RouterOS 7.23.2
# software id = XXXXXXXXXXXX
#
# model = XXXXXXXXXXXX
# serial number = XXXXXXXXXXX
/interface bridge
add name=WifiBridge protocol-mode=none
/interface ethernet
set [ find default-name=ether3 ] disabled=yes
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
/interface list
add include=all name=ALLinterfaces
/interface wifi channel
add band=5ghz-ax disabled=no frequency=5240 name=NETINT5GHZ width=20/40/80mhz
/interface wifi configuration
add antenna-gain=0 country=Germany disabled=no installation=indoor mode=\
    station-bridge name=cfg1 ssid=XXXXXXXXXXXXXXXX
/interface wifi security
add authentication-types=wpa2-psk disabled=no encryption=ccmp ft=yes \
    ft-over-ds=yes name=NETINTsec
/interface wifi
set [ find default-name=wifi2 ] channel=NETINT5GHZ configuration=cfg1 \
    configuration.mode=station-bridge disabled=no security=NETINTsec \
    security.wps=disable
/interface bridge port
add bridge=WifiBridge interface=ether1
add bridge=WifiBridge interface=ether2
add bridge=WifiBridge interface=wifi2
add bridge=WifiBridge interface=all
/interface list member
add interface=WifiBridge list=ALLinterfaces
/ip dhcp-client
add interface=WifiBridge name=client1
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=XXXXXXXXXX
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.2.1
5

It seems to me that there are quite a few "strange" settings on your configuration, does this configuration work as station-pseudobridge only changing the mode in /interface wifi AND in /interface wifi configuration?
It should be only in one place.
While normally you need protocol-mode=none for station-pseudobridge, for station-bridge It Is usually set as rstp.
Antenna gain 0?
Interface list and interface list members?
Interface added to bridge two times, once by name and then by "all"?
ccmp encryption?
They don't look as "serious" mis-configurations, but you never know, and they look (to me) like if you had tried several settings at random and some remained "sticky".
Dry principle:
New to Mikrotik and seeking advice - #12 by jaclaz

6

Yes you are right. There were some miss-configurations while trying some settings. Doubled LAN-all and bridge added manual ports together. CCMP is my wifi security setting for WPA2 authentication. Antenna gain 0 for maximize the antenna gain. But now i reverted back to zero configuration after a reset and tried the following tutorial:

But no success. Repeater works only in pseudobridge mode fine. Station-bridge connects to the Master AP and get an IP address. But clients get no IP. Only when i switch to pseudobridge-mode. I should mention that i have all my clients wired on the "Repeater". No wifi clients. Wifi clients are connecting to the master IP. So my setup is: Master AP > Repeater > Switch > wired clients.

7

But the repeater Is another kind of setup.
There must be something, station-bridge should work just fine.
Post both the AP and station-bridge configuration (not working), if the issue Is not on the station, It must be on the AP, point Is if any of the more experienced members can spot It.

8

MAIN AP config:

# 2026-07-14 13:31:02 by RouterOS 7.23.2
# software id = xxxxxxxxx
#
# model = E62iUGS-2axD5axT
# serial number = xxxxxxxxxxx
/interface bridge
add name=bridge1 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether3 ] disabled=yes
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=sfp1 ] disabled=yes
/interface vlan
add comment=WIFI-EXTvlan interface=bridge1 name=vlan1 use-service-tag=yes \
    vlan-id=120
add comment=WIFI-HOvlan interface=bridge1 name=vlan2 use-service-tag=yes \
    vlan-id=130
/interface wifi channel
add band=2ghz-ax disabled=no frequency=2462 name=channelcfg width=20/40mhz
add band=5ghz-ax disabled=no frequency=5240 name=channel5ghz width=\
    20/40/80mhz
/interface wifi configuration
add antenna-gain=0 country=Germany disabled=no installation=indoor name=\
    WIFIINTcfg ssid=WIFI-INT_optout_nomap
add antenna-gain=0 country=Germany disabled=no installation=indoor name=\
    WIFIEXTcfg ssid=WIFI-EXT_optout_nomap
add antenna-gain=0 country=Germany disabled=no installation=indoor name=\
    WIFIHOcfg ssid=WIFI-HO_optout_nomap
add antenna-gain=0 country=Germany disabled=no hide-ssid=yes installation=\
    indoor name=WIFIINT1cfg ssid=WIFI-INT1_optout_nomap
/interface wifi security
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=WIFI-INTsec
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=WIFI-EXTsec
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=WIFI-HOsec
/interface wifi
set [ find default-name=wifi1 ] channel=channelcfg comment=WIFI-INT \
    configuration=WIFIINTcfg configuration.mode=ap disabled=no security=\
    WIFI-INTsec security.ft=yes .ft-over-ds=yes .wps=disable
set [ find default-name=wifi2 ] channel=channel5ghz configuration=WIFIINT1cfg \
    configuration.mode=ap disabled=no security=WIFI-INTsec security.wps=\
    push-button
add comment=WIFI-EXT configuration=WIFIEXTcfg configuration.mode=ap \
    datapath.bridge=bridge1 .vlan-id=120 disabled=no mac-address=\
    XX:XX:XX:XX:D9:58 master-interface=wifi1 name=wifi3 security=WIFI-EXTsec \
    security.ft=yes .ft-over-ds=yes .wps=disable
add comment=WIFI-HO configuration=WIFIHOcfg configuration.mode=ap \
    datapath.bridge=bridge1 .client-isolation=yes .vlan-id=130 disabled=no \
    mac-address=XX:XX:XX:XX:D9:59 master-interface=wifi1 name=wifi4 security=\
    WIFI-HOsec security.ft=yes .ft-over-ds=yes .wps=disable
/system script
add dont-require-permissions=no name=DisableWifi owner=user1 policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
    "/interface/disable wifi1;"
add dont-require-permissions=no name=EnableWifi owner=user1 policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
    "/interface/enable wifi1;"
add dont-require-permissions=no name=DisableWifi2 owner=user1 policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
    "/interface/disable wifi2;"
add dont-require-permissions=no name=EnableWifi2 owner=user1 policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
    "/interface/enable wifi2;"
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=wifi1
add bridge=bridge1 interface=wifi2
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge1 tagged=ether1 vlan-ids=120
add bridge=bridge1 tagged=ether1 vlan-ids=130
/ip dhcp-client
add comment="Server Uplink DHCP" interface=bridge1 name=client1
/system clock
set time-zone-name=Europe/Berlin
/system leds
set 0 interface=wifi1 leds=wifi1-led type=wireless-status
set 1 interface=wifi2 leds=wifi2-led type=wireless-status
/system ntp client
set enabled=yes
/system ntp client servers
add address=XXX.XXX.XX.X
/system scheduler
add interval=1d name=DisableWifiScheduler on-event=DisableWifi policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-07-02 start-time=23:59:00
add interval=1d name=EnableWifiScheduler on-event=EnableWifi policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-07-03 start-time=05:30:00
add interval=1d name=EnableWifiScheduler2 on-event=EnableWifi2 policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-07-03 start-time=05:30:00
add interval=1d name=DisableWifiScheduler2 on-event=DisableWifi2 policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-07-02 start-time=23:59:00
/tool graphing
set store-every=hour
/tool graphing interface
add allow-address=XXX.XXX.XX.XX/32 store-on-disk=no

Repeater/Extender config:

# 2026-07-02 10:35:23 by RouterOS 7.21.5
# software id = XXXXXXXXXXXXXX
#
# model = E62iUGS-2axD5axT
# serial number = XXXXXXXXXXXXX
/interface bridge
add name=bridge1
/interface wifi
set [ find default-name=wifi2 ] configuration.country=Germany .mode=\
    station-bridge .ssid=XXXXXXXXXXXXXXXXX disabled=no \
    security.authentication-types=wpa2-psk .encryption=ccmp
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=wifi2
/ip dhcp-client
add interface=bridge1
9

Mamma Mia. I installed now 7.24rc2 and the issue is fixed. Everything runs fine in station-bridge mode now. Because i found the following in the release notes for testing ROS and tried this version:

*) wifi - improved station-bridge mode;
*) wifi - updated radio regulatory information;
*) wifi - upgraded wifi-qcom driver;
*) wifi-mediatek - fixed broken interfaces on startup;
*) wifi-mediatek - fixed some channel definitions for certain countries;
*) wifi-mediatek - improved channel switching;
*) wifi-mediatek - improved stability during MLO channel switching;

It seems the new mediatek chipset needs some updates :wink: So i am leaving it installed until stable release will be released. Thank you for your help jaclaz!

10

I must remember to add a second meaning to entry improved;
made It work for the First time
in the dictionary:

11

How did you get it to work?

Station Bridge mode still doesnt get an ip on the bridge via the DHCP client when the HAP AX S (is not wired, why else would you run station bridge mode :wink: ) and the wired clients on the HAP AX S are not reachable from other devices, so using it to extend your network as a transparent layer 2 network does not work.

By the way seeing 7.24rc2 does not work for me, I tried 7.24rc3 and still does not work. The HAP AX S does work correctly in Access Point mode, wired network and DHCP.

12

Sorry, but there is no 7.24rc3 testing release. I don't know what you have installed. Otherwise configure your first main-AP as normal access point. Establish a wireless bridge with the second hap ax s as station-bridge does work without any issues. Update packages AND routerboard firmware on the station-bridge AP with RC2. My main AP works with normal stable release. You can use this guide. Also works fine for me.

13

Thanks for the guide. My mistake the version is 7.24beta3 instead of 7.24.rc3. My main router is the RB4011iGS (access point bridge mode) and I am using 3 HAP AC as access points and repeaters. 1 HAP AC is wired to the RB4011IGS and is in Access Point Bridge mode, the other 2 are in Access Point Bridge and Station Bridge mode. All use DHCP client and work fine. I purchased 3 HAP AX S to replace the 3 HAP AC, but the DHCP client remains in searching mode. If I place the HAP AX S in station pseudo bridge the DHCP client receives an address however this is not the case when when placed in station bridge mode. Any suggestions?

14

Well, normally the station-bridge mode works fine.

bashn00b found out that for some reasons some recent versions of RouterOS have broken it at least for some devices (likely only those using the Mediatek driver) AND found that specifically the issue is solved in version 7.24rc2.

You should try that specific version first thing:

15

Thanks for the reply. As stated in my initial post the 7.24rc2 version the DHCP client does not receive an ip address when the HAP AX S is in station bridge mode. The DHCP server is on my RB4011 (7.23.2) which is in access point bridge mode. Other devices including my 3 HAP AC which are also in station bridge mode do receive an address on the DHCP client.

16

I don't know if this is relevant for your issue, but the "wireless" and the "wifi-*" packages handle bridging in a different way and they are incompatible.

Unfortunately there is no feedback about whether 4-address mode was successfully negotiated. Not even in the debug logs.

17

I think your right, I have just done a test to compare the hardware / drivers.

Test 1 - RB4011 and 1x HAP AX S (fails)
RB4011 (7.23.2) DHCP server and in AP Bridge mode, HAP AX S (7.24beta3) in Station Bridge mode the DHCP client does not receive an ip address.

Test 2 - RB4011 and 2x HAP AX S (works):
RB4011 (7.23.2) DHCP server wired to the 1st HAP AX S (7.24beta3) in AP Bridge mode and a 2nd HAP AX S (7.24beta3) in Station Bridge mode, the DHCP client does receive an ip address

The conclusion for now seems to be that depending upon the WiFi hardware (Qualcom or Altheros used by for example RB4011 and HAP AC) where DHCP server runs does not work in conjunction with MediaTek hardware such as the HAP AX S for station Bridge Mode on the HAP AX S when using WiFi.

I don't know if the original question in this article used 2 HAP AX S systems or just 1 and something else. So perhaps, but this is a guess, the fix is refering to using 2 HAP AX S systems or similar using MediaTek WiFi hardware. But as a combination of QualCom / Alteros and MediaTek is concerned the 7.24rc2 or 7.24beta3 does not solve the issue.

18

Lurker888 was saying a different thing.

Which drivers does your RB4011 (the wifi model) use?: https://mikrotik.com/product/rb4011igs_5hacq2hnd_in

Settings under /wireless or /wifi?

If I recall correctly in /wifi there is no "ap bridge" mode, only "ap".

Mixing /wireless with /wifi never worked, see the matrix here:
Wifi 4-address mode (station bridge) between wifi-qcom and wifi-mediatek
Wifi 4-address mode (station bridge) between wifi-qcom and wifi-mediatek - #10 by lurker888

19

As jaclaz is saying, there seem to be two unrelated issues.

One is that there seems to be a bug in the bridge mode implementation that's now fixed in beta. I can't confirm this myself, but I don't have any reason to doubt these reports.

The other is that bridge mode is not supposed to work (as in this limitation is officially documented by Mikrotik) between the "wireless" and "wifi" packages. This is not really a vendor-based limitation but that of the driver.

I have a suspicion that you are running wireless on the 4011 (which is the default for that model) but wifi-mediatek on the hAP, as that's the only package that it can run.

The 4011 can actually run wifi-qcom-ac, but it only supports one of the radios. I don't recall which, but this means that you lose one of them.

If this is the case, you've unfortunately stumbled into a breaking change.

20

If I understand correctly the RB4011 requires the wireless package so that both the 5Ghz and 2.4Ghz radio work, when using the using wifi-qcom only the 5Ghz is supported. The mode on the RB4011 is AP Bridge (just checked).

Thanks for the link Wifi 4-address mode (station bridge) between wifi-qcom and wifi-mediatek

Test 3 - 1x RB4011, 1x HAP AX S, 1x HAP AC (fails)

RB4011 (Qualcom wireless) DHCP Server wired to 1x HAP AX S (MediaTek WiFi) in Access Point mode to HAP AC (Qualcom wireless) in Station Bridge mode with DHCP client does not receive an ip address