Mikrotik HAP AX s WiFi issues

[Behras]

Good day!

I’m completely at my witts ends here, having some real issues with the new hap ax s router on the newest RouterOS firmware.

Every so ofter - 10, 20, 30 mins - the router decides to not give any internet to one of the devices connected to the 5ghz network. All the other devices continue working + the device that is not working is not disconnected, but it just won’t have any access to anything, not even the admin console.

I’ve tried all different combinations of WiFi settings, bands, frequencies, disabling 2.4ghz all together. Does anyone please have any ideas before i return this router?

[jaclaz]

AFAIK the hAP Ax model does not exist, which device is it among Ax2, Ax3 or Ax S?

Always the same device or a "random" one among those connected?
Please describe the device(s) involved in the issue.

Anything in log when this happens?

Anyway, post your configuration, instructions here:

Forum rules

Hello and welcome to the Mikrotik forum For all new users that uses RouterOS for the first time and have some questions regarding their config here is short tutorial on how to access RouterOS configuration using "WinBox" and how to export their configuration and posting it properly in their topic. So after you unpack your new device and connect it to the power supply you need to connect it to the PC. Be careful when connecting because to access your new router you need to use one of…

[holvoetn]

Unfortunately (or fortunately, depends how you look at it), you are not alone.
Other users also have reported similar issues like you with this device.

Since it is rather new it is not uncommon (but again, very unfortunate) some wrinkles still need to be ironed out.
Also, this is the very first released device with Mediatek wifi drivers so there is not yet a lot of experience around here.

I suggest you create a support ticket with all required info, also included supout.rif when the issues occur.
This way you get proper attention from Mikrotik support staff (this forum is at first a USER forum) and they can see multiple tickets are coming in for maybe the same issue, increasing the probability it will get higher on the priority-list.

[holvoetn]

@jaclaz

AFAIK the hAP Ax model does not exist, which device is it among Ax2, Ax3 or Ax S?

Are you sure ?
He does refer in title and post to hAP AX S.

https://mikrotik.com/product/hap_ax_s

[infabo]

@holvoetn

Unfortunately (or fortunately, depends how you look at it), you are not alone.

There are already several topics for the hap ax s no functioning properly. But 7.22beta5 includes updated wifi-mediatek drivers. Maybe this could improve the situation.

What's new in 7.22beta5 (2026-Jan-21 11:17):
*) wifi-mediatek - fixed malformed information elements in beacons (introduced in v7.22beta1);
*) wifi-mediatek - updated driver and firmware;

[Haley]

probably linked to the re-authentication of WPA3. A real pain. Try Group Key update timeout to 1d, os it happens only once a day if the link is constant.

[Behras]

I really hoped that this was not the case - starting to slightly regret getting s instead of 2 or 3. I will try the beta version and hopefully that makes an impact.

[Behras]

I really hoped it was not related to WPA3 - I will try, however now it’s set to default which I believe should be 5 mins and it seems to last much longer than that.

[holvoetn]

From what I can see, most things are SW related so fixes will come. Give it some time.
MT usually addresses such issues on short term.

[jaclaz]

I might have missed it, or maybe it was corrected after I replied, cannot say.

Anyway yes, the hAP Ax S is a newish devices using a new set of drivers (Mediatek) and some corners still need to be smoothed out.

[Behras]

Nothing in the log at all, tried enabling multiple logging options. Will post the log as soon as it happens again, as every time it happens I try something different with settings and reboot the router which seems to clear the log.

Config is below, same thing happened without the IoT VLAN Config, or in-house DNS server.

# 2026-01-23 16:00:13 by RouterOS 7.21.1
# software id =
#
# model = E62iUGS-2axD5axT
# serial number =
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge \
    vlan-filtering=yes
/interface vlan
add interface=bridge name=vlan20_IoT vlan-id=20
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi security
add authentication-types=wpa2-psk comment="IOT Network Security Profile " \
    disabled=no name=sec_iot
add authentication-types=wpa2-psk,wpa3-psk comment="Main Security Profile" \
    disabled=no encryption=ccmp management-protection=allowed name=sec_main
/interface wifi
set [ find default-name=wifi1 ] channel.band=2ghz-ax .skip-dfs-channels=all \
    .width=20mhz comment="Main 2.4Ghz" configuration.country=Lithuania \
    .installation=indoor .mode=ap .ssid=Ether_2Ghz disabled=no security=\
    sec_main security.ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=5ghz-ax .frequency=5260 \
    .skip-dfs-channels=10min-cac .width=20/40mhz comment="Main 5Ghz Wifi" \
    configuration.country=Lithuania .installation=indoor .mode=ap .ssid=Ether \
    datapath.bridge=bridge disabled=no security=sec_main security.ft=yes \
    .ft-over-ds=yes
add channel.band=2ghz-ax .width=20mhz comment="IOT Walled Garder VLAN 20" \
    configuration.mode=ap .ssid=Ether_IoT datapath.bridge=bridge .vlan-id=20 \
    mac-address=06:F4:1C:CD:8E:15 master-interface=wifi1 name=wifi_iot_2g \
    security=sec_iot
/ip pool
add name=default-dhcp ranges=192.168.88.50-192.168.88.199
add name=dhcp_pool1 ranges=10.0.20.51-10.0.20.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_pool1 interface=vlan20_IoT lease-time=1d name=\
    IoT_VLAN_DHCP
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4 pvid=20
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=20
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=10.0.20.1/24 comment="IoT VLAN" interface=vlan20_IoT network=\
    10.0.20.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=10.0.20.10 comment="Ikea Tradfri Hub" mac-address=\
    D0:40:EF:47:D5:F1 server=IoT_VLAN_DHCP
add address=10.0.20.11 client-id=1:3c:e9:e:87:f3:e4 comment="ZIgbee Sonoff" \
    mac-address=3C:E9:0E:87:F3:E4 server=IoT_VLAN_DHCP
add address=10.0.20.12 comment=WLED_Standing_LED mac-address=\
    F4:65:0B:E8:C5:20 server=IoT_VLAN_DHCP
add address=192.168.88.60 client-id=1:dc:da:c:4d:6b:4c comment=bbl \
    mac-address=DC:DA:0C:4D:6B:4C server=defconf
/ip dhcp-server network
add address=10.0.20.0/24 dns-server=1.1.1.3,8.8.8.8 gateway=10.0.20.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.206 \
    gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,149.112.112.112
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    in-interface-list=WAN
add action=accept chain=forward comment="Allow IoT to Internet" \
    out-interface-list=WAN src-address=10.0.20.0/24
add action=accept chain=forward comment="Allow Main LAN to Access IoT" \
    dst-address=10.0.20.0/24 src-address=192.168.88.0/24
add action=drop chain=forward comment="BLOCK IoT to Main LAN" dst-address=\
    192.168.88.0/24 src-address=10.0.20.0/24
add action=drop chain=input comment="BLOCK IoT to Router Management" \
    src-address=10.0.20.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Vilnius
/system logging
add topics=wireless
add topics=dhcp
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

[holvoetn]

As indicated, there have been some fixes for Mediatek drivers in 7.22beta.
Can you try that version ?

[jaclaz]

And it is important to know if it is alway the same device disconnection (which would point to some incompatibility of the Mediatek drivers with specifically that device) or if it happens to any device randomly.

[Haley]

I have that issue with always the same device → work laptop and broken Windows WiFi 7 drivers. So that is a hint.

[Behras]

Just installed it, will report back on monday if it made a difference.

[Behras]

Different devices affected - so far noticed on two different windows 11 laptops, google pixel 8 and wiim amp.

[holvoetn]

Ordered one. I'm too intrigued now...

Will first serve in home lab, later on it will probably be deployed "in the field".

[infabo]

People missing the "up to" before the 900, when complaining only reach 500mbit. But when it is not fast as promised, maybe this claim is actually true:

[gotsprings]

Barely had Broadcom drivers working… they interduce mediaech.

Its called routerOS for a reason.

[gotsprings]

If its full on falls on its face on the home lab you accept that Mikrotik gave us even more wireless problems?