For testing purpose, we are trying to connect hAP ax3 to our phone hotspot(AP). Router is able to scan the AP but when tried to click connect, nothing happens. We have set all the SSID and security things on the router side properly. Are we missing some configuration? please advise
Can you share the config?
/export file=anynameyoulike
Remove serial and any other private info, post as Preformatted text by using the </> button.
2025-10-21 07:33:01 by RouterOS 7.20.1
software id = FK6D-W2ZG
model = C53UiG+5HPaxD2HPaxD
serial number =
/interface bridge
add admin-mac=04:F4:1C:68:2B:8F auto-mac=no comment=defconf name=bridge
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac
configuration.mode=ap .ssid=MikroTik-682B93-5GHz disabled=no
security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac
configuration.mode=ap .ssid=MikroTik-682B93-2GHz disabled=no
security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
/interface ethernet switch
set 0 cpu-flow-control=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=wifi1 list=WAN
add comment=deconf interface=wifi2 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
/ip dhcp-client
Interface not active
add interface=ether1
Interface not active
add interface=wifi2
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon
source="\r
\n :if ([system leds settings get all-leds-off] = "never") do={\r
\n /system leds settings set all-leds-off=immediate \r
\n } else={\r
\n /system leds settings set all-leds-off=never \r
\n }\r
\n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=sys
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon
source="\r
\n :foreach iface in=[/interface/wifi find where (configuration.mode="a
p" && disabled=no)] do={\r
\n /interface/wifi wps-push-button $iface;}\r
\n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
hAP AX3 DOES work in station mode.
If config is correct. That was pretty obvious, no ?
You only configured your wifi interfaces as access point. Then it can not work in station mode...
You need to change ap in one of the various station modes:
|mode (ap | station)|Interface operation mode
- ap (default) - interface operates as an access point
- station - interface acts as a client device, scanning for access points advertising the configured SSID
- station-bridge - interface acts as a client device and enables support for a 4-address frame format, so that the interface can be used as a bridge port
- station-pseudobridge - the interface keeps track of outgoing IP connections and performs MAC address translation similarly to how IP masquerading works|
Note: In the first general tab of the wifi interface there is (on my AX3) a Mode option.
This one seems to be the one you need to set correctly.
Will hAP ax3 router in station mode connects to only another Mikrotik router or can we connect to 3rd party routers like d-link, Netgear ?
Maybe, but until you will have configuration.mode=ap, the device is set as ap.
The screenshot you posted is fine, but it is only part of the configuration, post again your full configuration for review.
I pointed you to the relevant documentation.
station is fine with any other brand BUT won't allow L2 bridging of other devices.
station-bridge is ONLY for Mikrotik AP's and allows proper 4 address L2 bridging
station-pseudobridge will work with other brands and it attempts to provide L2 bridging using some workaround
# 2025-10-10 10:57:02 by RouterOS 7.20.1
# software id = FK6D-W2ZG
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = <edited>
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-n .skip-dfs-channels=\
10min-cac configuration.country=India .mode=ap .ssid=D-Link_123 disabled=\
no security.authentication-types=wpa2-psk
set [ find default-name=wifi2 ] channel.band=2ghz-n .skip-dfs-channels=\
10min-cac configuration.country=India .mode=station .ssid=D-Link_123 \
disabled=no security.authentication-types=wpa2-psk
/ip dhcp-client
# Interface not active
add interface=wifi2
Now you have the 2.4 Ghz radio (wifi2) as station, and the 5 GHz (wifi1) as ap.
Maybe it would be easier to have both as station for tests.
Having the DHCP client on interface wifi2 won't let you get an IP address from DHCP, as wifi2 is part of the bridge, you should add the DHCP client to the bridge.
This:
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=wifi1 list=WAN
add comment=deconf interface=wifi2 list=WAN
Is no good, BOTH wifi1 and wifi2 are inside the bridge:
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
so they cannot be WAN, the only port that can be set as WAN is ether1 (which is outside the bridge).