Setting up wAP ax to bridge to existing network

[RonK]

I have a new wAP ax that I am trying to set up to bridge to an existing non-wireless router.

It appears that much of the information that search returns seems to apply to older versions of Winbox.

One hitch I have encountered is that my plan was to use LAN1 and power it from a POE port on my router but I have not been able to do much that way. I have had some success with LAN2 but that is not POE.

There are a plethora of options with the OS so it is pretty easy to get into trouble fast.

Suggestions?

[jaclaz]

Read this first:

wAP ax Access Pts ship with ether1 unbridged by default

Hello, Wanted to bring up something I ran into after unboxing my new APs (wAP ax wAPG-5HaxD2HaxD) yesterday. Got them to pair with my L009, however these do not work OOTB. In fact, it took me about 4 hours to figure out why they had no internet access at all. Even when hooked directly to modem I got nothing and couldn’t update the firmware. I couldn’t even ping the switch it was connected to. It turns out that these units ship with the following interfaces bridged: ether2, wifi1, wifi2. I’m su…

Your main issue Is that in the default configuration with which the device Is shipped Is not for a "pure" AP, but rather for an AP and router.

A "pure" AP has usually these characteristics:

1. all interfaces, ethernet and wifi, are inside a single bridge
2. there are no firewall filter rules, nor Nat
3. the DHCP server Is usually running on the "main" router, and the bridge on the AP may have a static IP address (easier/better) or get one through a DHCP client

This approach Is the simplest one, and the wifi clients will be all in the same network as the wired devices.

If you need/want a "Guest" wifi, things get more complicated, see:
https://tangentsoft.com/mikrotik/wiki?name=Isolated%20Guest%20WiFi%20Sans%20VLANs

In any case, post your current configuration, following the instructions here:

Forum rules

Hello and welcome to the Mikrotik forum For all new users that uses RouterOS for the first time and have some questions regarding their config here is short tutorial on how to access RouterOS configuration using "WinBox" and how to export their configuration and posting it properly in their topic. So after you unpack your new device and connect it to the power supply you need to connect it to the PC. Be careful when connecting because to access your new router you need to use one of…

And some member will be able to assist you with the needed changes.

[gogmix838]

I had the same confusion when I first used a wAP ax. The trick is not to touch too many defaults. Just create one bridge, add both WLAN and LAN1 to it, and make that bridge the main interface with a DHCP client. LAN1 will still take POE fine. The only reason it fails is usually if it’s still bound to another config profile.

[gigabyte091]

What I don’t understand is why Mikrotik ships their APs configured as routers… They should come preconfigured as plain APs so they work OOTB.

[RonK]

This config works on ether2. Adding ether1 to bridge seems to work but the Quick Set screen IP area seems unhappy assuming that red stuff denotes unhappiness. I have included a config file as well as a screen shot of the red field.

While I am probably getting way ahead of my self, is there a way to get the AP to simply pass through the DHCP requests to the router? I am hoping to create a VLAN in the future to isolate the various IOT devices around here from my computers.
That may, or may not, be the right approach so suggestions are invited.

configexport.rsc (6.4 KB)

[jaclaz]

@gigabyte091
The WaP Ax is intended mainly for:

1. countryside getaway
2. rural gas station
3. bus stop
   where a router/Ap would make sense.

@RonK
You should have (only snippets of the relevant parts):

/interface bridge port
add bridge=bridge comment=myconf interface ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2

/interface list member
add comment=defconf interface=bridge list=LAN

[add comment=defconf interface=ether1 list=WAN

/ip dhcp-client
'# Interface not active
add comment=defconf interface=ether1

You can then remove the whole
/ip firewall filter
and
/ip firewall nat
sections
and all the
/ipv6
ones

Now the IP address DNS and DHCP server, relevant parts:

/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A

Right now the Wap Ax has the (default mikrotik) IP 192.168.88.1, serves via DHCP addresses in the range 192.168.88.10-192.168.88.254, with gateway and DNS set as "itself".

You want instead to use the DHCP server on your main router, and as well the DNS should be provided by the main router.
So, remove :
/ip dhcp-server
/ip dhcp-server network
/ip pool
and:
/ip dns
/ip dns static

If you use Winbox, you can continue connecting even without assigning an IP to the Wap Ax (bridge), but for Webfig you need to assign one, the easiest would be a static IP address in your main network but outside the DHCP assigned range, only as an example, if your main router is using 192.168.1.1, and giving addresses 192.168.1.10-192.168.1.254, give to the Wap Ax a static IP address of 192.168.1.9:

/ip address
add address=192.168.1.9/24 comment=myconf interface=bridge network=
192.168.1.0

[gigabyte091]

@jaclaz

I agree, there are use cases where that configuration make sense, BUT then you have people that buys them thinking it’s just an AP and then they have a problem

Also Mikrotik sets this default configuration on almost, if not on all, APs they sell. Make no sense to me TBH.

[RonK]

I changed the rsc per the above and it works though WinBox is still unhappy about the lack of a gateway IP. That caused me to have to find another way to enter the wifi password because APPLY would barf. Is there some way to fix that?

Here is the current exported config just in case I missed something or there is anything I can clean up (unnecessary, etc.)

Thanks for the input!

[RonK]

# 2025-09-28 09:38:48 by RouterOS 7.20
# software id = UHY7-ILKR
#
# model = wAPG-5HaxD2HaxD
# serial number = HJH0AN9TZZY
/interface bridge
add admin-mac=04:F4:1C:0B:F1:49 auto-mac=no comment=defconf name=bridge
/interface wifi
set [ find default-name=wifi1 ] channel.band=2ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40mhz configuration.mode=ap .ssid=MikroTik-0BF14A \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk .ft=yes \
    .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=5ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40/80mhz configuration.mode=ap .ssid=MikroTik-0BF14A \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk .ft=yes \
    .ft-over-ds=yes .multi-passphrase-group=""
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.1.3/24 comment=myconf interface=bridge network=\
    192.168.1.0
/system identity
set name="MikroTik AP"
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

[jaclaz]

You can remove the /ip pool and the second IP address of the bridge, get rid of the 192.168.88.1 and keep the 192.168.1.3.

Very minor, but you shouldn't have modified entries tagged/commented as defconf. In your simple configuration It Is not a problem, but if there are tens of lines tagged as defconf, some actually default configuration and some modified/custom, It can become confusing.

I don't understand the point about Winbox not being happy, can you try better describing the issue?

[RonK]

This is what I mean by unhappy. When I tried to change the network name or wifi password (also located on that page) it flags the missing gateway as an error and won’t save anything.

[jaclaz]

How (EXACTLY) do you get to that Winbox dialog?
Not through Quickset, I hope.

Rule #4, JFYI:

The twelve Rules of Mikrotik Club

Preamble and disclaimer: The following is a set of Rules that are intended as advice useful to avoid the most common errors observed in configuration posted on this forum. It is my personal take on the matter, and in no way approved, endorsed or recommended, officially or unofficially, by Mikrotik or their partners or by anyone else. In other words you are perfectly free to ignore them, though they represent (IMHO) a sort of (good) cheat sheet/reminder for people starting to use these devices…

Hint:
in Winbox try looking under "wifi" for pages where to change SSID and password.

[RonK]

Apparently I violated one of the rules. That dialog is in Quickset.

I did find out how to change those parameters elsewhere but I always get nervous about red fields and error warnings.

[jaclaz]

Yep, Quickset is prominent in winbox as it is first item, so it is very easy to think that it should be used, and used often.

It actually can be used (and actually works usually fine if you want EXACTLY one of the available configuration templates) BUT ONLY ONCE and ONLY AFTER a device reset to default, what it produces when used over an already modified configuration can be as well good in some cases, but in most it just corrupts the existing configuration changing, adding or removing settings that should be left alone.

[RonK]

Thanks. Seems to be behaving nicely now.