I would like have 3 VLANS (like OFFICE 10.10.10.1/24, DMZ 10.10.20.1/24 and PROD 10.10.30.1) - the VLANS will be create on Fortigate 60D on int1 to int1 on switch l3 (trunk)
Problem exist with connecting to the internet because I don’t have possibility connected main router (ZTE F660) with Mikrotik through LAN cable. I must do it only through wireless.
My main router have address 192.168.1.1
I tried connected wlan1 on mikrotik as station mode with wi-fi ZTE but the connection flapping (although the main router is the next room)
ZTE F660 (192.168.1.1)→ wireless→Mikrotik→Fortigate 60D (where is VLANS,NAT)→Switch l3→ NAS (with vm’s) ,main Computer,Printer
VLAN OFFICE→ Internet and access to DMZ
VLAN DMZ → Only https,http,ping, access to OFFICE and DMZ
VLAN PROD → Separated network (only access to DMZ)
your wireless connection flapping <- if this is not somehow solved, there is not much point in checking the rest
the "station mode" that is not the correct one if you want multiple devices connected downstream to the hap lite, you can try using "station pseudo-bridge", but still it won't be a "proper" solution[1].
Anyway post your current configuration, instructions here:
[1] short of running an ethernet cable to the router, you could procure a second hap lite, they can often be found used for a few bucks, and with Mikrotik devices on both sides of the wireless link you can use station-bridge mode
As you can see connection to main router (ZTE 192.168.1.1 is ok) but when I’m trying pinging 8.8.8.8 only two packets have been received but rest are timeout or host unreachable2.2026-01-02 16:52:05 by RouterOS 7.20.6
# 2026-01-02 16:52:05 by RouterOS 7.20.6
# software id = 6WAT-D202
#
# model = RB941-2nD
# serial number = removed
/interface bridge
add admin-mac=04:F4:1C:41:65:67 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk comment=\
defconf disable-pmkid=yes mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=zte \
supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no distance=indoors \
frequency=2462 security-profile=zte ssid=MIDIKO_18:44:e6:a7:28:bf \
wireless-protocol=802.11
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
#error exporting "/system/ntp/key" (timeout)
#interrupted
[1] short of running an ethernet cable to the router, you could procure a second hap lite, they can often be found used for a few bucks, and with Mikrotik devices on both sides of the wireless link you can use station-bridge mode
I'm considering it, but the ZTE F660 is connected directly to the IPS via fiber optic. I don't know how much it will cost to convert it to Ethernet (because the ZTE router is owned by the operator).
That could be due to something that only happens randomly or some problems in either the firmware or configuration.
Try again, hopefully it was just busy at the moment you tried the /export, the hap lite is a not-so-much-powerful device, and installing 7.20.6 on it is "border-line", making an export when running v7 is usually "stuttering", but it should complete.
The picture you posted tells little about the quality of the wireless link, as a matter of fact, the pinging to 192.168.1.1 seems fine, is the pinging to 8.8.8.8 that is flaky and that could be this (or that) configuration issue.
If I were you I would downgrade it to latest v6 version, but of course this is (highly) debatable.
Form the parts of configuration you posted I cannot understand if the radio is actually set to station (but again in case it should be set to station pseudo-bridge), it looks like an "undefined" mode? (there is no mode set in /interface wireless and no pre-shared keys in /interface wireless security-profile?)
Now I understand what you mean – I need to connect to the ZTE with an additional Mikrotik and configure a wireless connection between them. The question is, will this solve the problem? and second hAP lite will be enough (or do I need to invest in a better Mikrotik router)?
I still don't understand how your wireless connection Is working, but you have a route with gateway 192.168.1.4, if the zte Is the gateway, that should be 192.168.1.1.
But you don't have seemingly any interface with IP address in that range, so that's another mistery, your device seems configured as router, while likely you want a bridge instead.
Post the output of
/ip route print
and
/ip address print
About a "faster" Mikrotik device, you would need two of them, so some money would be needed, a hap lite (or a mAP lite or anyway a "previous generation" one) can usually be found for around or less than 20 € or so.
Here:
I posted a typical configuration for a hap lite setup as station pseudobridge (but for v6 so something will need to be changed) that you might use as an example.
Maybe now I see, you are setting the ZTE as 'station" and then you have the hap lite setup as AP (and as router).
Usually the roles are inverted (the AP Is on the side connected to the internet, and the station Is on the side of the clients) but I don't think that this can have any adverse effect.
But the hap lite Is routing the connection.
This implies double NAT and only L3 connectivity, these could be just fine, of course.
