WiFi Station to Ethernet Port

RouterOS Beginner Basics
1

Hi there,

I would like to use an mAP lite (7.16.2 (stable)) to connect to a WiFi network and provide internet to the ethernet port0.

I checked:

  • that the WiFi station is connected to my AP and its get an IP address.


  • that my PC obtain an IP address from the mAP DHCP on bridge1

I would like to have different networks on WiFi Station and Eth0.

I have a question how to routing trafic between the WiFi Station to the Eth0.
I miss a piece of the configuration.

I attached the configuration.

Thank you for the help!
mAP_Config.rsc (1.92 KB)

2

I don’t understand.

The mAP lite has only one ethernet port, ether1.

You want to connect your radio (wlan1) to an existing wi-fi network?
Then the device is a “client” or “station” (and not an AP).

And - it depends on choices - it can be configured both as “router” (with wlan1 as WAN and ether1 as LAN) or as a “switch” (with both wlan1 and ether1 in a bridge).

If it is a router and the Wi-FI is “unknown” it is not a very good idea to connect without a firewall, on the other hand if it a “trusted Wi-FI” a bridge configuration would be simpler and avoid double NAT, (but of course you can have the router configuration without a firewall), but I see a few perplexing settings in your configuration:

there is seemingly no “mode” in /interface wireless

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=italy disabled=no \
    installation=indoor security-profile=Pixel6a ssid=Pixel

which should be either station bridge (if the wi-fi network AP is also Mikrotik) or station pseudobridge (if the wi-fi network AP is not Mikrotik), like:

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=italy disabled=no
installation=indoor > mode=station-pseudobridge > security-profile=Pixel6a ssid=Pixel

There is a LTE interface:

/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no

which cannot exist on a mAP lite.

And ovpn/hotspot/ipsec/bfd settings that seem to have no reason to exist.

The rest seems just fine.

So please check the setting in /interface wireless, then post your configuration again.
Post also the output of:

/ip address print

and of:

/ip route print

so that we can check that dynamic addresses are assigned and dynamic routes are created.

3

Likely a result of upgrading from RouterOS v6 to v7 as the config conversion isn’t great, better to start from a factory reset after upgrading from v6.

4

Yes correct, I upgraded from OS v6 to v7.

I’ll follow you suggestion and reset from factory.

After that I’ll post the configuration.

Thank you.

5

Hi there,

this is my configuration starting from a reset.

With this configuration, the mAP is connected to the WiFi AP and my PC got a IP address from the mAP DHCP Server.

Can I improve this configuration?

Output of “/ip route print”

[admin@MikroTik] > /ip route print
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, d - DHCP
Columns: DST-ADDRESS, GATEWAY, DISTANCE
    DST-ADDRESS       GATEWAY        DISTANCE
DAd 0.0.0.0/0         192.168.123.1         1
DAc 192.168.100.0/24  bridge1               0
DAc 192.168.123.0/24  wlan1                 0

Thank you for the help!
first_config.rsc (1.39 KB)

6

I don’t understand how it can connect to your Wi-Fi access point as there is no station (or station-bridge or station-pseudobridge) mode set in /interface wireless and without wpa and wpa2-pre-shared-key (maybe these latter are not shown without the show sensitive, as in /export show-sensitive, but the mode should not be hidden :confused: )

You can try checking if with
/export show-sensitive
these settings are shown (without posting them on the forum).

Anyway if it works for you, good :slight_smile: .

You have the bridge that is not needed, in your setup is only containing ether1, so you could use ether1 directly.
BTW right now you have ether1 (and not bridge1) set as lan in /interface list member (if you later want to use the default firewall, which makes use of this categorization, you might have troubles.
If you keep bridge1, you should IMHO change:

/interface list member
add interface=wlan1 list=wan
add interface=> ether1> bridge1 > list=lan

Personally I would simplify as follows:

/interface bridge
add name=bridge1
/interface list
add name=wan
add name=lan
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm mode=
dynamic-keys name=Guest supplicant-identity=“” unicast-ciphers=
tkip,aes-ccm
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=italy disabled=no
frequency=2437 installation=indoor security-profile=Guest ssid=
Guest
/ip pool
add name=> bridge_pool > > lan_pool > ranges=192.168.100.2-192.168.100.20
/ip dhcp-server
add address-pool=> bridge_pool > > lan_pool > interface=> bridge1 > > ether1 > name=> bridge_dhcp> lan_dhcp
/interface bridge port
add bridge=bridge1 interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface list member
add interface=wlan1 list=wan
add interface=ether1 list=lan
/ip address
add address=192.168.100.1/24 interface=> bridge1 > > ether1 > network=192.168.100.0
/ip dhcp-client
add interface=wlan1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.100.0/24 dns-server=192.168.100.1 gateway=192.168.100.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip firewall nat
add action=masquerade chain=srcnat out-interface=wlan1
/system note
set show-at-login=no

but it is just a matter of preferences.

7

Thank you for your feedback, I removed the bridge for more clarity.

The mAP wlan1 is configured as “station” with.

  • dynamic keys: “WPA PSK, WPA2 PSK”


  • cypher: aes ccm, tkip

Next I added a wireguard interface in order to use ProtonVPN on my ethernet client.

And it works, I followed this tutorial: https://protonvpn.com/support/wireguard-mikrotik-routers

Thank you very much for your help!