Noob on a hap be lite - looking for guidance!

RouterOS Beginner Basics
1

my background:
i'm a vmware/storage/DR/backup guy at work. i don't do networking, except at home (tplink wifi, ubiquity edgerouterx, older mikrotik 5*10gbe thing which i use as a homelab iscsi switch, cisco 2960s). i can handle my nmtui, nmcli, netplan and windows networking. i understand vendor/hardware-agnostic stuff between L2 and L4 and some firewalling.
my understanding of wifi is basic and ancient, probably like in 802.11g/n times - configure a central AP and connect more APs over cable in a star topology, to extend reach. the clients will roam between APs, somehow. still, wanna learn and decide if i like/need the new stuff like meshing, multilink and other wifi6/7 things. also - never had to build networks with more than 2 or 3 AP's.

i got a few usecases incoming for Mikrotik APs/router/switches (for me, family and friends)

i'm dreaming of a be3 media in a few months (for modern wifi, 2.5GbE LAN, wireguard and some basic monitoring of my toys in containers etc)

but - for now, i'm trying to harness my new tiny hAP be lite.
looking from this router's perspective, my current idea is such:

default native vlan which runs 192.168.88.1/24 i use for ssh/webfig over ssl
3 VLANs (10.66.61.0/24, 10.66.62.0/24, 10.66.63.0/24; 3rd octet=vlan tag)

ether4 - WAN. starlink antenna over cable in bypass mode (because their wifi mesh and android app pissed me off like nothing has, for months). their docs say, it's enough to run a dhcp client here and "should" work.

ether3 - an ubuntu-server laptop over 1GbE with some game server and other experiments. port in access mode for now, maybe trunk or hybrid later

ether2 - n/c, maybe a "slave" AP later, but out of scope for now

ether1 - 2,5GbE to my linux PC. port mode - access. i access 192.168.88.1 from here. maybe i'll switch it to hybrid later.

wifi - 3 ssid's (prod, IoT, guest) which put clients into above VLANs

(yea, i know switching eth frames in the bridge of ether1,2,3 is done in software. i can live with it, for now.)

questions and key points:

  1. this mediatek wifi chip can do this multiple-ssid thing over 2.4 and 5GHz? right...?

  2. tried looking at Mikrotik documentation - Introduction | RouterOS Manual is current, right?
    smart people wrote it, for sure. but i wanna understand key concepts and get things working with CLI commands. it sure is extensive, but it either gets too marketing-y or too theoretical.
    well - i kind-of expected this :slight_smile:

googled a bit.
i found this guide and a few similar:

https://blog.gntech.me/posts/2026-05-15-mikrotik-capsman-vlan-configuration/

for a simple setup like mine, above - do i really have to use capsman?
or is it possible to do this multi-ssid-to-vlans thing by hand?

  1. how do i find docs which are actually relevant to my hw platform (be lite) and routerOS 7.22?
    the above guide made sense - until i realized, there's no /caps-man in my CLI :slight_smile:
    where's capsman in my be-lite? somewhere else? or - absent?

  2. is there some serial or serial-over-usb in this hAP be lite i can use to access CLI if i screw up VLAN switching/bridging too much? or would i have to open the case, solder some wires and lose hw warranty?

for network devices like this one, i prefer to write configs in .txt
copy-paste to CLI over SSH
and if it hits the fan - factory reset and restore a known-working config :slight_smile:

i'm guessing some of you could write such a config on a napkin at a bar table and it would work. if so - just give me your price.
just bear in mind, i'm Polish :wink:

so, i prefer not to use winbox
webfig over https with self-signed cert - just for watching stats and graphs
ssh for configuring - because i can do it from anything with a keyboard

please help me find my way... i really wanna learn Mikrotik to support something made in EU, instead of blowing money on overpriced US gear or crappy chinese!

also, i prefer written guides and tutorials.
i don't like watching 1h youtube vid only to find 5 min relevant to me :slight_smile:

rgds
Adam

2

Hi,

You should start there: Topics tagged rtfum

and do forget VLANS for some time if you are not familiar with MT at all.

The question (rather rethorical one) is why users tend to implement quite advanced setups when they do not know basics? Do you plan a fully flagged wooden roof if you do not know how to properly use hammer, saw and nails?

3

@AdamB, Welcome to the forum!

Your setup is perfectly doable without CAPsMAN. For a single hAP be lite, you can configure the SSIDs and map them to VLANs directly using the local WiFi configuration. CAPsMAN mainly becomes useful once you want to manage multiple APs centrally.

The newer WiFi devices also use the /interface/wifi stack, not the older /caps-man menu, which is why some of the guides you find won't match your device.

When it comes to VLANs, Mikrotik RouterOS handles them in a somewhat unusual way through its bridge and VLAN-filtering model, so it might be worth reading up a bit before diving into more advanced VLAN setups.

A few good starting points:

I'd start with a minimal working config, keep at least one physical port outside the VLAN-filtered bridge as an emergency management port, and add one VLAN/SSID at a time.

4

BartoszP, are you a professor? you must be a professor

https://dowcip.net/dowcip/profesor-konczy-temat-o-osmozie-cieczy-18508

if i wanted a simple setup, i'd buy a tplink in my nearest supermarket along with a bottle of vodka, setup and forget - like i did with my archer c7 a few years ago

Larsa - thx for links

unfortunately, i didn't have enough time to play with VLANs and multi-ssid,

so i did some basic testing with some PC's over 2.5G, iperf3, old and new laptops, a pixel9a with iperf3...

hap be lite was unstable for me after upd to fw 23.2. it kicked me out twice during a workday. i downgraded to 7.22.something, which was factory

so i setup a Huawei DG8245V as a spare wifi, connected to one of the 1G ports on the be lite and put it on the shelf, just next to it.

and guess what?

iperf3 --bidir from a laptop with intel ax211 tests towards the PC with 2.5G iperf3 run much faster and with more consistent speed on the Huawei than thru the be lite

i can use the huawei wifi on the toilet on the other side of the cottage, while the mikrotik ssid is barely reachable

same tendencies on my pixel 9a

so - i don't know, whether it's poor antenna design, electronics, firmware or childhood illnesses of wifi7. it's unusable.

i'm willing to sell this crap for half shop price to whoever wants it. i don't even want to troubleshoot it - i already wasted too much time here.
Mikrotik - never again.

5

I had a teaching episode many years ago. Thankfully only for a semester. Never ever again :slight_smile:

6

That, and in the time that I have been here, that new users seem to have a tendency to overcomplicate things (and have problems because of it).

Just because a form has 40 entries doesn't imply an obligation to try to fill in all of them!

(And, of course, a lot of that is done while moving down the path that you have described.)

Coming from a background of Cisco, Netgear, OpenWRT, OpenSwan and others, my transition to MikroTik was relatively painless. First, a switch a number of years ago for a 10G lab. Then an haP AC2 to get a VPN tunnel/bi-directional path through a remote NAT setup. That showed issues on my local end (and I didn't like needing to pass the OpenVPN traffic in to my server), so I bought a HEX for that. Routing was odd enough with two routers, that that drove an RB5009 for my core. I set it up in parallel to the outgoing Cisco, and quickly figured out VLANs (although, contrary to some advice, I use VLAN 1 and hybrid ports almost constantly, as I have for decades, with zero issues.) Noting WiFi holes with my Netgear Wifi6 AP's (as well as an amazingly crippled/dumbed down UI that fought me constantly), I bought a CAP AX to fill the gap. I liked it so much that I bought 2 more, and pitched the NetGear stuff. CapsMan was next, and I found it no more complicated than local config on the AP's once I figured out that just because there is a form or tab, that that does not mandate that you use it. So, full CapsMan with different channel plans for the 3 AP's to guarantee no freq overlap, and seeing speeds up to 1gig on 5G, and FastRoam is golden! ... Lastly, since I had the 10G hardware from way back when, I upgraded my switches to run a 10G optical backbone (SwOS - ROS offered me nothing here), as well as a 10G server connection.

Somewhere in this process, the RB5009 grew containers and AdGuard, backed by my own server's authoritative DNS for my domain, and then the internet. Firewalling allows SMTP, SMTPS, and IMAPS into my server.

Not to ramble, but the key was a phased approach, and parallel deployment during upgrade, one key thing at a time. Nothing took too long to figure out, and I found the ROS7 centric vids by "The Network Berg" which always seemed to be "over the target".

But yes,there is a lot of seriously deprecated/outdated/no longer valid stuff out there for ROS6/WinBox3 that can cause a lot of confusion.

Overall, 6 AP's, 5 VLANs, ipsec, OpenVPN, Containers, 4 switches, 2 routers (I maintain a backup) in what is a pretty complex config.

As the old joke goes, yes youCAN eat an elephant, just one bite at a time! (And overall, ROS/SwOs has been orders of magnitude easier than I recall initially learning Cisco!)

YMMV . . .

7

Try 7.24rc firmware and disable mlo, then it works pretty stable for me.
I did not manage to get the be lite wifi working stable and reliably with 7.22 or 7.23 firmware.