No CAPsMAN connection over wireless backhaul (hAP ax3 + wAP ax)

Ronh · February 12, 2026, 5:02pm

Hi all,

I am new to MikroTik and currently trying to set up a small network with CAPsMAN. I am running RouterOS 7.21.

My setup is as follows:

hAP ax3 as main router and CAPsMAN controller
One wAP ax connected via Ether2 (wired trunk)
This wired AP is fully working via CAPsMAN and CAP
VLANs are configured and working correctly for the wired AP

Now I need to connect a second wAP ax via wireless backhaul.

For this:

On the wAP, I use wifi2 (5GHz) configured as station-bridge
On the hAP ax3, the corresponding 5GHz interface is configured as AP
The wireless link between hAP and wAP is established and stable

However, the wireless wAP does not connect to CAPsMAN. It shows “no connection to CAPsMAN” and never becomes a remote CAP.

Management is on a VLAN. The wired AP works correctly on that VLAN, so the CAPsMAN configuration itself seems fine.

CONFIG ROUTER:

# 2026-01-15 22:52:56 by RouterOS 7.21
# software id = B47Z-AKGR
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = HKB0AXW6RM8
/interface bridge
add comment="LAN bridge with VLAN filtering" name=br-lan vlan-filtering=yes
/interface wifi
set [ find default-name=wifi2 ] configuration.mode=ap
/interface vlan
add comment="Management VLAN" interface=br-lan name=vlan10-mgmt vlan-id=10
add comment="prive VLAN" interface=br-lan name=vlan20-prive vlan-id=20
add comment="Werk VLAN" interface=br-lan name=vlan30-werk vlan-id=30
add comment="IoT VLAN" interface=br-lan name=vlan40-iot vlan-id=40
add comment="Kids VLAN" interface=br-lan name=vlan50-kids vlan-id=50
add comment="Gast VLAN" interface=br-lan name=vlan60-gast vlan-id=60
add comment="Servers VLAN" interface=br-lan name=vlan70-servers vlan-id=70
add comment="NAS VLAN" interface=br-lan name=vlan80-nas vlan-id=80
add comment="TV VLAN" interface=br-lan name=vlan90-tv vlan-id=90
add comment="Odido WAN VLAN300" interface=ether1 name=vlan300-wan vlan-id=300
/interface list
add comment=Internet name=WAN
add comment="Alle interne VLANs" name=LAN
add comment=Beheerbronnen name=MGMT
add comment="Mag DNS en DHCP naar router" name=LOCAL-SVC
/interface wifi channel
add band=5ghz-ax frequency=5180 name=ch_backhaul_5g width=20/40/80mhz
add band=2ghz-ax disabled=no name=CH_2.4 width=20mhz
add band=5ghz-ax disabled=no name=CH_5 width=20/40/80mhz
/interface wifi datapath
add bridge=br-lan disabled=no name=dp_backhaul vlan-id=10
add bridge=br-lan disabled=no name=dp_prive vlan-id=20
add bridge=br-lan disabled=no name=dp_werk vlan-id=30
add bridge=br-lan disabled=no name=dp_iot vlan-id=40
add bridge=br-lan disabled=no name=dp_kids vlan-id=50
add bridge=br-lan client-isolation=yes disabled=no name=dp_gast vlan-id=60
add bridge=br-lan disabled=no name=dp_tv vlan-id=90
/interface wifi security
add authentication-types=wpa2-psk disabled=no encryption=ccmp ft=no \
    ft-over-ds=no name=sec_prive
add authentication-types=wpa2-psk disabled=no encryption=ccmp ft=no name=\
    sec_werk
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=sec_iot
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=sec_kids
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=sec_gast
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=sec_tv
add authentication-types=wpa2-psk disabled=no encryption=ccmp name=\
    sec_backhaul
add authentication-types=wpa2-psk encryption=ccmp management-protection=\
    disabled name=TEST-WPA2
/interface wifi configuration
add channel=ch_backhaul_5g country=Netherlands datapath=dp_backhaul disabled=\
    no hide-ssid=yes mode=ap name=cfg_backhaul security=sec_backhaul ssid=\
    MT_backhaul
add channel=CH_5 country=Netherlands datapath=dp_prive disabled=no name=\
    cfg_prive_5ghz security=sec_prive security.ft=no .ft-over-ds=no ssid=\
    Wifi_van_Ons
add channel=CH_5 country=Netherlands datapath=dp_werk disabled=no name=\
    cfg_werk_5ghz security=sec_werk security.ft=no .ft-over-ds=no ssid=\
    Hier_word_gewerkt
add channel=CH_2.4 country=Netherlands datapath=dp_iot disabled=no name=\
    cfg_iot security=sec_iot ssid=Slimme_dingen
add channel=CH_2.4 country=Netherlands datapath=dp_kids disabled=no name=\
    cfg_kids_2.4 security=sec_kids ssid=kids
add channel=CH_2.4 country=Netherlands datapath=dp_tv disabled=no name=cfg_tv \
    security=sec_tv ssid=tv
add channel=CH_2.4 country=Netherlands datapath=dp_gast disabled=no name=\
    cfg_gast_2.4 security=sec_gast ssid=Wifi_Gast_en_niet_kwast
add channel=CH_5 country=Netherlands datapath=dp_gast disabled=no name=\
    cfg_gast_5ghz security=sec_gast ssid=Wifi_Gast_en_niet_kwast
add channel=CH_5 country=Netherlands datapath=dp_kids disabled=no name=\
    cfg_kids_5ghz security=sec_kids ssid=kids
add channel=CH_2.4 country=Netherlands datapath=dp_prive disabled=no name=\
    cfg_prive_2.4 security=sec_prive security.ft=no .ft-over-ds=no ssid=\
    Wifi_van_Ons
add channel=CH_2.4 country=Netherlands datapath=dp_werk disabled=no name=\
    cfg_werk_2.4 security=sec_werk security.ft=no .ft-over-ds=no ssid=\
    Hier_word_gewerkt
/interface wifi
set [ find default-name=wifi1 ] channel.frequency=5180 configuration=\
    cfg_backhaul configuration.mode=ap disabled=no
/ip pool
add name=pool20 ranges=10.10.20.50-10.10.20.200
add name=pool30 ranges=10.10.30.50-10.10.30.200
add name=pool40 ranges=10.10.40.50-10.10.40.200
add name=pool50 ranges=10.10.50.50-10.10.50.200
add name=pool60 ranges=10.10.60.50-10.10.60.200
add name=pool70 ranges=10.10.70.50-10.10.70.200
add name=pool80 ranges=10.10.80.50-10.10.80.200
add name=pool90 ranges=10.10.90.50-10.10.90.200
/ip dhcp-server
add address-pool=pool20 interface=vlan20-prive lease-time=12h name=dhcp20
add address-pool=pool30 interface=vlan30-werk lease-time=12h name=dhcp30
add address-pool=pool40 interface=vlan40-iot lease-time=1d name=dhcp40
add address-pool=pool50 interface=vlan50-kids lease-time=12h name=dhcp50
add address-pool=pool60 interface=vlan60-gast lease-time=8h name=dhcp60
add address-pool=pool70 interface=vlan70-servers lease-time=1d name=dhcp70
add address-pool=pool80 interface=vlan80-nas lease-time=1d name=dhcp80
add address-pool=pool90 interface=vlan90-tv lease-time=12h name=dhcp90
/interface bridge port
add bridge=br-lan comment="trunk bedrade ap" frame-types=\
    admit-only-vlan-tagged interface=ether2
add bridge=br-lan comment=Servers frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 pvid=70
add bridge=br-lan comment=NAS frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether4 pvid=80
add bridge=br-lan comment="Beheer (VLAN10)" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether5 pvid=10
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=wifi2
add bridge=br-lan frame-types=admit-only-vlan-tagged interface=wifi1
/interface bridge vlan
add bridge=br-lan tagged=br-lan,ether2,wifi1 untagged=ether5 vlan-ids=10
add bridge=br-lan tagged=br-lan,ether2,wifi1 vlan-ids=20
add bridge=br-lan tagged=br-lan,ether2,wifi1 vlan-ids=30
add bridge=br-lan tagged=br-lan,ether2,wifi1 vlan-ids=40
add bridge=br-lan tagged=br-lan,ether2,wifi1 vlan-ids=50
add bridge=br-lan tagged=br-lan,ether2,wifi1 vlan-ids=60
add bridge=br-lan tagged=br-lan,ether2,wifi1 untagged=ether3 vlan-ids=70
add bridge=br-lan tagged=br-lan,ether2,wifi1 untagged=ether4 vlan-ids=80
add bridge=br-lan tagged=br-lan,ether2,wifi1 vlan-ids=90
/interface list member
add interface=vlan300-wan list=WAN
add interface=vlan20-prive list=LAN
add interface=vlan30-werk list=LAN
add interface=vlan40-iot list=LAN
add interface=vlan50-kids list=LAN
add interface=vlan60-gast list=LAN
add interface=vlan70-servers list=LAN
add interface=vlan80-nas list=LAN
add interface=vlan90-tv list=LAN
add interface=vlan10-mgmt list=MGMT
add interface=ether5 list=MGMT
/interface wifi capsman
set enabled=yes interfaces=vlan10-mgmt
/interface wifi provisioning
add action=create-dynamic-enabled comment="Bedrade AP" disabled=no \
    master-configuration=cfg_prive_2.4 slave-configurations=\
    cfg_gast_2.4,cfg_iot,cfg_kids_2.4,cfg_tv,cfg_werk_2.4 supported-bands=\
    2ghz-ax
add action=create-dynamic-enabled comment="Bedrade AP_5gz" disabled=no \
    master-configuration=cfg_prive_5ghz radio-mac=04:F4:1C:AF:73:5D \
    slave-configurations=cfg_gast_5ghz,cfg_kids_5ghz,cfg_werk_5ghz \
    supported-bands=5ghz-ax
/ip address
add address=10.10.10.1/24 comment="GW VLAN10 Mgmt" interface=vlan10-mgmt \
    network=10.10.10.0
add address=10.10.20.1/24 comment="GW VLAN20 Private" interface=vlan20-prive \
    network=10.10.20.0
add address=10.10.30.1/24 comment="GW VLAN30 Work" interface=vlan30-werk \
    network=10.10.30.0
add address=10.10.40.1/24 comment="GW VLAN40 IoT" interface=vlan40-iot \
    network=10.10.40.0
add address=10.10.50.1/24 comment="GW VLAN50 Kids" interface=vlan50-kids \
    network=10.10.50.0
add address=10.10.60.1/24 comment="GW VLAN60 Guest" interface=vlan60-gast \
    network=10.10.60.0
add address=10.10.70.1/24 comment="GW VLAN70 Servers" interface=\
    vlan70-servers network=10.10.70.0
add address=10.10.80.1/24 comment="GW VLAN80 NAS" interface=vlan80-nas \
    network=10.10.80.0
add address=10.10.90.1/24 comment="GW VLAN90 TV" interface=vlan90-tv network=\
    10.10.90.0
/ip dhcp-server network
add address=10.10.20.0/24 dns-server=10.10.20.1 domain=lan gateway=10.10.20.1
add address=10.10.30.0/24 dns-server=10.10.30.1 domain=lan gateway=10.10.30.1
add address=10.10.40.0/24 dns-server=10.10.40.1 domain=lan gateway=10.10.40.1
add address=10.10.50.0/24 dns-server=10.10.50.1 domain=lan gateway=10.10.50.1
add address=10.10.60.0/24 dns-server=10.10.60.1 domain=lan gateway=10.10.60.1
add address=10.10.70.0/24 dns-server=10.10.70.1 domain=lan gateway=10.10.70.1
add address=10.10.80.0/24 dns-server=10.10.80.1 domain=lan gateway=10.10.80.1
add address=10.10.90.0/24 dns-server=10.10.90.1 domain=lan gateway=10.10.90.1
/ip dns
set servers=1.1.1.1,8.8.8.8
/ip firewall address-list
add address=10.10.20.0/24 comment="Prive beheer subnet" list=mgmt-allowed
/ip firewall filter
add action=accept chain=input comment="IN established,related" \
    connection-state=established,related
add action=drop chain=input comment="DROP IN invalid" connection-state=\
    invalid
add action=accept chain=input comment="IN ICMP" protocol=icmp
add action=accept chain=input comment="IN DHCP from LAN" dst-port=67,68 \
    in-interface-list=LAN protocol=udp
add action=accept chain=input comment="IN DNS UDP from LAN" dst-port=53 \
    in-interface-list=LAN protocol=udp
add action=accept chain=input comment="IN DNS TCP from LAN" dst-port=53 \
    in-interface-list=LAN protocol=tcp
add action=accept chain=input comment="IN CAPsMAN mgmt" dst-port=5246,5247 \
    in-interface=vlan10-mgmt protocol=udp
add action=accept chain=input comment="IN Winbox beheer" dst-port=8291 \
    in-interface-list=MGMT protocol=tcp src-address=10.10.20.0/24
add action=drop chain=input comment="DROP IN default"
add action=accept chain=forward comment="FW established,related" \
    connection-state=established,related
add action=drop chain=forward comment="DROP FW invalid" connection-state=\
    invalid
add action=drop chain=forward comment="DROP WAN to LAN" connection-state=new \
    in-interface-list=WAN out-interface-list=LAN
add action=accept chain=forward comment="ALLOW LAN to WAN" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="FW prive to all VLANs" in-interface=\
    vlan20-prive out-interface-list=LAN
add action=accept chain=forward comment="FW HA to IoT" in-interface=\
    vlan70-servers out-interface=vlan40-iot
add action=accept chain=forward comment="FW IoT to HA" in-interface=\
    vlan40-iot out-interface=vlan70-servers
add action=accept chain=forward comment="FW HA to TV" in-interface=\
    vlan70-servers out-interface=vlan90-tv
add action=drop chain=forward comment="DROP interVLAN" in-interface-list=LAN \
    out-interface-list=LAN
/ip firewall nat
add action=masquerade chain=srcnat comment="NAT to internet" \
    out-interface-list=WAN
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set winbox address=10.10.10.0/24
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=MT_hAP_AX3_MK
/system logging
add topics=firewall
add topics=dhcp
add topics=account
add topics=interface,info
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add comment="Nightly update and backup" interval=1d name=nightly-maintenance \
    on-event=nightly-maintenance policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-01-11 start-time=03:30:00

CONFIG WAP

# 2026-01-12 12:15:53 by RouterOS 7.21
# software id = 5L0L-048Y
#
# model = wAPG-5HaxD2HaxD
# serial number = HKA0AH42S2E
/interface bridge
add name=br-lan
/interface vlan
add interface=br-lan name=vlan10-mgmt vlan-id=10
/interface wifi datapath
add bridge=br-lan name=capdp
/interface wifi security
add authentication-types=wpa2-psk encryption=ccmp name=sec-backhaul
/interface wifi configuration
add channel.band=5ghz-ax country=Netherlands mode=station name=\
    cfg-sta-backhaul security=sec-backhaul ssid=MT_backhaul
/interface wifi
set [ find default-name=wifi2 ] configuration=cfg-sta-backhaul \
    configuration.mode=station datapath.vlan-id=10 disabled=no
/interface wifi
# no connection to CAPsMAN
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap \
    datapath=*2
/interface bridge port
add bridge=br-lan interface=wifi2
/interface wifi cap
set caps-man-addresses=10.10.10.1 discovery-interfaces=vlan10-mgmt enabled=\
    yes slaves-datapath=capdp
/ip address
add address=10.10.10.3/24 interface=vlan10-mgmt network=10.10.10.0
/ip dhcp-client
# Interface not active
add comment=defconf interface=*7
/ip route
add dst-address=0.0.0.0/0 gateway=10.10.10.1
/system identity
set name=MT_wAP_AX_BOVEN
/system routerboard settings
set auto-upgrade=yes

I suspect I am doing something wrong with:

VLAN handling over the wireless trunk
Bridge and VLAN filtering settings
CAP discovery interface
Management VLAN tagging over the wireless backhaul

Since I am new to MikroTik, I may be missing something fundamental.

Could someone please point me in the right direction regarding:

How management VLAN should be transported over a wireless station-bridge backhaul
Whether VLAN filtering should be enabled or disabled on the wireless AP
How CAP discovery should be configured in this scenario

Thank you in advance.

jaclaz · February 12, 2026, 5:39pm

I would say that the thingies are called CAP and CAPSMAN for a reason, and they are not called CSTATION and CSTATIONSMAN.

Stations (clients) are not configured through CAPSMAN, AFAICT.

But the radio set as AP should be able to reach the CAPSMAN and get the settings from it.

Besides and before the issues (if any) with VLAN(s) you should get rid of the asterisks in your configuration, see point #21 here:

You have one in dhcp client interface (that is probably irrelevant) but you have also one on the wifi1 datapath (that may be well the key issue).

And consider that right now you have set the wAP as "station", while most likely you want it set as "station-bridge", see:

DuctView · February 12, 2026, 5:52pm

Hmm.I just googled to check out station-bridge and AI tells me that station-bridge is not compatible with CAPsMAN. OK, that is just AI - but ...

... what do you want to do with your new wAP? You want to use it to provide a link back to the hAP ax3 and you want it to do wireless? OK, how are you going to split the functionality to do both the access point and the station-bridge? And then you want to manage the wireless with CAPsMAN, but CAPsMAN is going to try to configure the wireless, presumably identically to the wired wAP ... which is going to undo the configuration for your station-bridge. And even if you do a distinctly different CAPsMAN config for the wireless WAP, you may need to split wifi1 and wifi2 control between local and CAPsMAN

I am not saying that this cannot be done, but it will probably require compromises in your expectations and your concept needs thinking about, to identify the potential issues and how you will address them.

cpunk · February 12, 2026, 6:05pm

That is indeed what they have set up. It should work to have one radio for backhaul (set to station-bridge) and one radio managed by CAPsMAN. Probably worth the effort to get ft.

@cwebb recently did this thing, although without VLANs. Here was their last post with cAP /interface/wifi config: