simple switch and WiFi AP (no dhcp, no nat)

SergeS · Thu Oct 18, 2018 5:33 pm

Hello,

i have a home network based on another router (given by provider), which i do not want to change.
I would like to use Mikrotik router as simple switch (for wired clients) and wireless AccessPoint (same IP subnet, no dhcp, no nat).
Which standard configuration is for that?
If none - how can i configure it manually?

mkx · Thu Oct 18, 2018 8:06 pm

I think "Home AP" in quick set should do.

SergeS · Fri Oct 19, 2018 6:38 am

I think "Home AP" in quick set should do.

No, Home AP will create another IP subnet for wifi and wired clients on lan ports. This is exactly I would like to avoid.
I need just switch and wifi AP, no dhcp server, no nat, no another ip subnet, no masquerading.

vecernik87 · Fri Oct 19, 2018 8:44 am

There is no defconf for this purpose. Easiest is to do

/system reset-configuration no-defaults=yes

WARNING! after this command, your router will restart, disable wifi and lose any IP and password will be blank again. You will need to connect via MAC (either from another mikrotik or with winbox)

Then, you need to create bridge and add all interfaces to it. If you want, you may add DHCP client so you can reach your Mikrotik with IP. Personally I prefer to also disable any IP forwarding because ap/switch is not supposed to do that. Also you need to configure your wifi. Last thing is to secure your router by creating new user and password.

/interface bridge add name=bridge-lan
/interface bridge port add bridge=bridge-lan interface=all
/ip dhcp-client add interface=bridge-lan disabled=no
/ip settings set ip-forward=no
/interface wireless set [find] ssid=YourWifiName frequency=auto disabled=no mode=ap-bridge
/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key=YourWifiPassword
/user add disabled=no group=full name=YourUserName password=YourUserPassword
/user remove [find (name="YourUserName" = false)]

replace all "YourXXXXXX" strings - those are names or passwords.
I did not include any firewall rules but you should drop input all packets unless they come from trusted IP/mac. As it is your local network, I guess any IP which can reach your mikrotik is trusted (at least it is trusted in defconf)
I did not disable any service but you should disable every single service which you dont use - http/https/telnet etc etc... Keep only what you need.
if you want to simplify your task, you can upload this config as "config.rsc" to your device into "flash" folder and then run the reset command like this:
Code: Select all
```
/system reset-configuration no-defaults=yes run-after-reset=flash/config.rsc
```

If you are unsure with anything, feel free to ask :) plenty of people around will be happy to help

EDIT 2021-02-24: updated mode to suit current version.

Jotne · Fri Oct 19, 2018 8:51 am

Here you go:
This is the minimum configuration. Do a System-Reset-No Default Configuration

This do:
Makes a Bridge
Makes a security profile for the wifi
Set up te Wifi with SSID
Connects all port to the Bridge
Add a DCHP client to the Bridge so you can reach the box remote

/interface bridge
add fast-forward=no name=bridge1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=test1234 \
    supplicant-identity="" wpa2-pre-shared-key=test1234
/interface wireless
set [ find default-name=wlan1 ] disabled=no security-profile=test1234 ssid=MikroTik1234
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=wlan1
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=bridge1

This is how it looks like in a diagram:

Simple Wifi Switch.jpg

mkx · Fri Oct 19, 2018 11:58 am

Don't forget to set disable-pmkid=yes in wireless security profile.

Mattteas · Mon Feb 03, 2020 10:33 pm

Hi guys. I am very grateful for your posts. I want exactly the same. I have a rb751. I have tried it. LAN is ok, but no wifi. I cant find it on my phone. Any signal. I have tried both codes - from vecernik87 and from Jotne. It is the same. Dont have an idea what I am doing wrong?

Thank You for your help.

WarhawkCZ · Tue Jun 23, 2020 7:24 pm

Hello everyone,
I will try to rejuvenate this old thread. I came across the very same situation as the OP. I investigated the config from vecernik87 as well as from Jotne. I do not understand the wireless interface config. Byt default the wireless interface operates in the station mode. I am not sure if the SSID/key config should be the same SSID as the AP. This would make sense since the station could connect to the AP. But how come this help "extending the AP functionality" that OP requested? Could the station help to forward data to the AP? If so, which functionality it uses? I think the station-presudobridge mode fits better here.

In case the wireless should be unique than there's a missing parameter that sets the interface to Wireless AP. This would explain why the user Mattteas does not see any wifi. Just change the mode to Wireless AP and it works. But it would surprise me if both vecernik87 and Jotne forgot changing the mode in their configs.

The ultimate question - could any of the professionals here review the config and explain which wireless interface more applies and why?
Have a great day. Jiri

PS: This is my first post on the forum. I do not do networking professionally. I am a beginner but I google before asking dumb questions .

vecernik87 · Wed Feb 24, 2021 3:35 am

Byt default the wireless interface operates in the station mode. I am not sure if the SSID/key config should be the same SSID as the AP. This would make sense since the station could connect to the AP.

The default value probably changed over the years. My understanding was that OP wanted to set the device with wired uplink. Therefore Station mode shouldn't be used

But how come this help "extending the AP functionality" that OP requested? Could the station help to forward data to the AP? If so, which functionality it uses? I think the station-presudobridge mode fits better here.

I couldn't find the quoted text in OP's messages so I assume it is just misunderstanding on your side. What you are describing can be named as "wifi extender/repeater/mesh" - that means both uplink and downlink is wireless with option of additional wired downlinks. Thats where

mode=station-bridge

or

mode=station-pseudobridge

would make sense. Otherwise (with wired uplink) we are talking about a simple AP (thats what this topic is all about) and therefore

mode=ap-bridge

is the right choice.

The

mode=station

is not usual in home environment. It generally means that your uplink can't be bridged, so either your local network is routed to uplink (e.g. behind NAT with DHCP server on the station), or you use some tunnel (e.g. EoIP) to provide L2 uplink

...This would explain why the user Mattteas does not see any wifi. Just change the mode to Wireless AP and it works.

You are most certainly correct. I have updated my code to make it working again and tested it in current long-term 6.47.9. Thanks for pointing it out!

PS: word of advice - check your typos before submitting your text :-P makes it easier to understand. Also, it gives me less reasons to cyber bully you.

martinderm · Thu Jun 03, 2021 9:19 pm

I have to say that I find it quite funny that this config is not a selectable default. Especially for a product like the wAP ac...
For normal people, that's what probably most needed.
I'd say that for most normal people DHCP would be a nice thing to be able to connect to the web interface for configuring 5ghz wifi, config updates, software updates etc.
This really needs to be available from "QuickSet" screen...

So maybe @vecernik87 could you be so kind and add the DHCP to your config example? Sorry for asking so dumb... Is "QuickSet" even possible after applying that config?
THX for the example!!!

salarazad · Sun Nov 28, 2021 6:44 pm

I think "Home AP" in quick set should do.

I had a similar situation and creating a Home AP worked for me; thanks!>

Regards
Salar

MosesKoyo · Mon Apr 25, 2022 8:51 pm

I managed to get my internet working and using the same IP address as my Main router .My mikrotik router is the access point but I can't managed to have it work via wireless.
I changed the wireless mode to Wireless AP but I get an error "input does not match any value of mode"
I am using hap lite(smips)
Mikrotik version 6.49.4
Thanks!

anav · Tue Apr 26, 2022 2:37 am

You mean this............ viewtopic.php?t=182276

simple switch and WiFi AP (no dhcp, no nat)

simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)

Re: simple switch and WiFi AP (no dhcp, no nat)