Need help setting up a bridge

[NomaiStrawberry]

To preface, this is my first real foray into networking, so please bear with me.

Overarching problem: I want to use ethernet downstairs, but also don’t want to drill a hole in the floor.

My goal is to use a Mikrotik hAC AP lite as a remote ethernet connection point for my main (Netgear) router. I have installed WinBox, and have been trying to follow a few forum threads and guides, but none seem to be doing quite what I want to, and I’m struggling to get the new router connected to the current one. Could I get a step-by-step guide on how to get the two routers connected (with the new one in bridge mode)?

[jaclaz]

Use ethernet Is a bit vague.

The issue Is that the wireless/wifi standards have not a provision for bridging over wireless.

So each manufacturer has developed an own method to have that.

A “real bridge” Is only possible between two Mikrotik devices (and using the same set of drivers), the best you can get otherwise Is called pseudo-bridge mode and has some limitations.

There are workarounds, namely routing or using a tunnel, that as well have their own possible issues.

So, you need to describe in detail which devices (and what use they have) you plan to connect wirelessly or wired to the hap AC lite to find the best possible solution for your specific use.

[NomaiStrawberry]

Hm, I see… For clarification, when I say “use ethernet” I mean “connect my tower PC and Raspberry Pi to the internet via ethernet cable.” The ideal case is that the Mikrotik can basically act as a “second router” that I can run ethernet from. Presumably then the Mikrotik would be connected wirelessly over wifi(?) to the main router.

Thank you for the clarification, I was under the impression that two different routers would generally be able to interface with one another, and I had read good things about the customizability of Mikrotik. I’m unfamiliar (and curious) about some of the terms you mentioned. What are the up/downsides of pseudo-bridging, routing, or tunneling? Alternatively, do you have any suggestions for a different solution to this problem?

[jaclaz]

To have a “real” bridge (L2) the two devices connected need to exchange a certain number of parameters, start reading here:

Station mode as Layer 2 Bridge?

Ok, now I lost you. A L2 bridge between wifi and ethernet Is the most common setting/setup. The problem is L2 bridge over wifi. Search for posts by bpwl with the keyword "4 address" and/or "pseudobridge" he often explained how the station, station pseudobridge, etc. work, they may help you understand the matter. You will find that in your case there Is a workaround (or a "crutch" as someone defined It) consisting in putting the bridges on both sides into a tunnel (like EOIP), example:

If we call AP the device that Is connected directly or indirectly to the internet and allows wifi connection the other device that connects to It, like a phone or tablet, or your AC lite, Is a client (also called station).

Mikrotik devices have a station mode called station-bridge that if the AP Is also Mikrotik allows L2 bridging (using proprietary, non standard, method) but if the AP Is not Mikrotik doesn’t allows It , like the “normal” station mode.

To give you an example of a station mode, It Is what you would use on a Mikrotik device like - say - a mAP to add wireless connectivity to a single device that only has an ethernet port (say an old PC).

See:

Wireless Station Modes - RouterOS - MikroTik Documentation

Mikrotik has this mode station-pseudobridge that some people call L2.5 as It offers something midway between L2 and L3.

Then you have “normal” L3 connectivity (routing) that implies that there will be double NAT (one on your main router and one on the station device). Notwithstanding the common opinion that double NAT Is bad, in practice for normal internet use It Is irrelevant or not noticeable ( while since It increases latency Is a no-no for gaming).

The other option, the tunnel, Is more complex to implement and requires some adding computing load, so It Is not advised on low power devices (such as the AC lite) as It may slow noticeably the connection speed ( and It has to be seen in you case what your Netgear supports).

Easiest would be to procure another Mikrotik device, but this should be using the same set of drivers (to simplify, there are two sets of drivers, the “old” ones set under “wireless” and the “new” ones set under “wifi”).

Some Mikrotik devices can run only the old ones, some only the new ones, and some both (It depends on RoS version running and on architecture/processor of hardware).

If you decide to buy another Mikrotik device ask for advice in choosing which device would be suitable before buying It.

[Buckeye]

@NomaiStrawberry

I want to use ethernet downstairs, but also don’t want to drill a hole in the floor.

@NomaiStrawberry

Alternatively, do you have any suggestions for a different solution to this problem?

There are usually ways to do this without having to drill through the floor if you are creative. There are probably heating ducts, plumbing, etc that are already going through the floor, although there may not be a convenient way to use existing holes.

I don't like using wireless unless it is the last resort. If you have wood floors and if you are in a location with little wifi interference you may be able to get something to work acceptably. But then why not use wifi directly to the end devices (rpi and tower)?

Read this recent thread 2x hAP ax S suitable for 1gbit Symmetrical?

[jaclaz]

Also - and this may depend on various factors - modern Powerline devices are fast and stable, surely better than AC wireless speeds.

There Is also Moca, but of course it depends on the coaxial cabling you may have in your house (It is not at all common in many countries and adapters tend to be expensive).

[Amm0]

@jaclaz

Powerline devices are fast and stable

I'm not sure I'd agree with that statement. I'd say that may also be country-specific and how the electrical circuits connect in panel too. In US, for example, MoCa is going faster - but it's true most EU countries don't have COAX running through homes & most home panel have split phase so powerline will be very slow if it needs to cross phases.

I personally think Wi-Fi bridging be close enough to wireline ethernet. The hAPacLite should have the "CPE" profile in QuickSet, and where can just add the wireless info for main router, and it will connect & you can set "bridge" mode in the radio button in QuickSet and avoid the double NAT. Now this only works on AC devices, newer AX devices only offer "Home Dual AP", so you have setup the wireless bridge manually.

[jaclaz]

@Amm0

Sure, as said it depends on various factors.

JFYI multi-phase Powerlines do exist (though not exactly cheap):

https://www.devolo.global/magic-2-lan-dinrail

Not so casually the product is made in Germany (where multi-phase at home is common).

[NomaiStrawberry]

Thank you for all the advice.

@Buckeye

But then why not use wifi directly to the end devices (rpi and tower)?

I could do that, but the previous wifi dongle I was using on my PC was responsible for many blue screens and even a decent PCIE wifi chip costs around the same as the AC AP lite, so I figured I could kill two birds with one stone (and have a “fun” experiment with some home networking stuff ).

As for the various wired solutions, while I really would have liked to have a wired connection to the main router, it just isn’t feasible in my home without wiring things through walls, which I’m pretty apprehensive about (we don’t have any communication wires running through the house already to my knowledge so it’d be a new installation). I’m willing to sacrifice a bit of speed for the cost and convenience, and my motivation for seeking a bridge was consistency, something wifi dongles are pretty bad at.

@jaclaz thank you for your very in depth breakdown yesterday. I’ve been looking into pseudo-bridging (though I’ve yet to find a very good tutorial for that), and in general there’s one thing in most tutorials (for any solution) that I find very confusing: how do I decide what IP address/Netmask/Gateway/DNS servers to put in certain fields? My understanding is that there is a certain range of addresses my main router will assign, and I need to be operating within that, but how can I determine that range? Is there anything else I need to do to make sure the router doesn’t try to assign that IP to anything else? (This one is more for my own learning, but) why do I need to give an IP address to the Mikrotik when the main router assigns all the other devices an IP address automatically?

[jaclaz]

As always it depends.

Many people trust DHCP servers and clients (I personally don't like them much).
Then what is the network about?
If it is only a way to access the internet, the typical home topology is a router connected to the ISP routing everything to the internet and a number of switches and AP's as needed.
This single router is also normally set as DHCP server and provides addresses (usually) in a /24 network (254 addresses, more than enough in a home).
Everything works just fine, BUT the day this router fails (a simple fail, let's say fried power adapter) you don't lose only your internet connection, you cannot print anymore on your network connected printer, nor you can backup your PC on your NAS, etc., most of your whole LAN will simply go poof for lack of dynamically assigned IP addresses.
Of course you do need a DHCP server for mobile wireless connected devices like phones and tablets.

So my personal (old and old school) approach is to divide between "static" (routers, switches, Ap's, desktops, printers, NAS, and the like[1], no matter if connected wired or wireless) and "mobile" (phones, tablets, etc,) devices, the former ones I set with static IP addresses, the rest with DHCP.

If the DHCP server fails, for whatever reason, the static devices still work and can communicate.

Anyway, to the core of your question, in most if not all homes a /24 (the netmask corresponding to 255.255.255.0) will be more than adequate.
Mikrotik defaults are for the 192.168.88.0/24 network, this gives 254 usable addresses in the range 192.168.88.1-192.168.88.254 (the .0 is "network" and the 255 is "broadcast"):
https://www.calculator.net/ip-subnet-calculator.html?cclass=any&csubnet=24&cip=192.168.88.1&ctype=ipv4&x=Calculate

The Mikrotik DHCP server assigns IP's to clients from the top to the bottom, i.e. the first assigned IP will be 192.168.88.254, then 192.168.88.253, etc.

I usually reserve a certain number of IP's in the bottom range, excluding them from the DHCP server assignable addresses. I.e. the network does cover 192.168.88.1-192.168.88.254 but the DHCP server is limited to assign addresses in the range- say - 192.168.88.31-192.168.88.254.

192.168.88.1 is - usually the "main" router (gateway) and DHCP server.
192.168.88.2-192.168.88.30 are 29 addresses that can be statically assigned to "static" devices
192.168.88.31-192.168.88.254 are the addresses that the DHCP server will assign on request, 224 devices can be connected to the network.

Of course you can limit (or expand) this range changing the netmask, a /25 will give you 126 usable addresses, etc. :
https://www.calculator.net/ip-subnet-calculator.html?cclass=any&csubnet=25&cip=192.168.88.1&ctype=ipv4&x=Calculate

[1] loosely anything that needs mains power is "static", anything that has a battery is potentially "mobile"

[Buckeye]

@NomaiStrawberry

Could I get a step-by-step guide on how to get the two routers connected (with the new one in bridge mode)?

@NomaiStrawberry

The ideal case is that the Mikrotik can basically act as a “second router” that I can run ethernet from.

@NomaiStrawberry

there’s one thing in most tutorials (for any solution) that I find very confusing: how do I decide what IP address/Netmask/Gateway/DNS servers to put in certain fields? My understanding is that there is a certain range of addresses my main router will assign, and I need to be operating within that, but how can I determine that range? Is there anything else I need to do to make sure the router doesn’t try to assign that IP to anything else? (This one is more for my own learning, but) why do I need to give an IP address to the Mikrotik when the main router assigns all the other devices an IP address automatically?

Although the hap AC lite is a router, in the configuration you are using it (bridged mode), it is not acting as router, but instead it is essentially a managed switch that just happens to be using a wireless link to the upstream device. How well this will work when connected to a netgear compared to using another Mikrotik device, I don't know. The only experience I have with wireless bridges is using a pair of Ubiquiti airMAX NanoBeam 5AC devices to provide internet to a building about 250 ft away in a rural area. Those are reasonably transparent (extends the LAN and will is transparent to vlan tags), but use a proprietary protocol, and they wouldn't be what I would use in your situation.

The point being, if the hap ac lite is operating with all ports in the bridge, then the reason for an IP address is just so you can "connect to the hap ac lite" for its management. The "router" in the hap ac lite won't be routing anything (at layer 3), it will just be bridging (at layer 2). The only layer three functionality will be the management (just like the raspberry pi with a single ethernet has an ip address, but isn't routing any traffic).

If the last paragraph doesn't make sense, this is what I recommend for learning background info.

[Buckeye]

@NomaiStrawberry

My understanding is that there is a certain range of addresses my main router will assign, and I need to be operating within that, but how can I determine that range?

I will assume your "main router" is the netgear? If it is the dhcp server for your network, from a pc that is obtaining an ip address from it, open a cmd window, and type netstat -rn which will print the routing table for your PC. the first section will show the interfaces list, the next section the IPv4 routing table; at the top of this section will be an entry that shows the default route

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.4.1    192.168.4.254     60

ipconfig /all

You will get a list of information for each network adapter on your network.

Find the one that corresponds to your default gateway

Ethernet adapter Ethernet 5:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : ASIX USB to Gigabit Ethernet Family Adapter
   Physical Address. . . . . . . . . : F8-**-**-**-**-46
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : ***removed***
   IPv4 Address. . . . . . . . . . . : 192.168.4.254(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Wednesday, November 12, 2025 3:18:18 AM
   Lease Expires . . . . . . . . . . : Monday, November 17, 2025 3:18:22 PM
   Default Gateway . . . . . . . . . : 192.168.4.1
   DHCP Server . . . . . . . . . . . : 192.168.4.1
   DHCPv6 IAID . . . . . . . . . . . : **removed**
   DHCPv6 Client DUID. . . . . . . . : **removed**
   DNS Servers . . . . . . . . . . . : 192.168.4.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

This is all provided by the dhcp server.

In this case the subnet is 192.168.4.0/24 (netmask 255.255.255.0 corresponds to /24 see @jaclaz post for a bit more info, you can search for ip subnetting on google if you want to learn more).

A dchp client can gets this information from the dhcp server, in your case the "main router". If you have management access to the main router, then you can find the section about its dhcp server for its LAN interface, and that's where you would be able to change the LAN ip address and netmask, as well as possibly creating "reserved" addresses for specific mac addresses.

[NomaiStrawberry]

Thank you everyone for all the help, and for taking the time to give such detailed and thoughtful input! I was able to cobble enough together from the advice here and various other tutorials to get a pseudobridge up and running.