MikroTik Wireless : Complete WiFi, CAPsMAN, and Access Point Configuration Guide
Learn MikroTik wireless configuration including WiFi setup, CAPsMAN centralized management, security profiles, and enterprise access point deployment strategies.

Introduction: MikroTik's Wireless Ecosystem
MikroTik offers one of the most flexible and cost-effective wireless solutions in the networking market. Whether you're deploying a simple home WiFi network or managing hundreds of enterprise access points, RouterOS provides the tools you need. This guide covers everything from basic wireless interface configuration to advanced CAPsMAN centralized management.
Wireless Package Evolution: Understanding Your Hardware
Wireless Package Types
MikroTik has evolved its wireless drivers across different RouterOS versions:
# Check installed wireless packages
/system package print
# Common wireless packages:
# - wireless (legacy, up to 802.11ac)
# - wifi-qcom (802.11ax, RouterOS v7.13+)
# - wifi-qcom-ac (optional 802.11ac drivers)
Hardware Compatibility
- Legacy Devices: Use
wirelesspackage (hAP ac, RB951Ui-2HnD) - WiFi 6/AX Devices: Require
wifi-qcompackage (hAP ax, Audience) - Mixed Environments: CAPsMAN can manage both package types
Basic Wireless Interface Configuration
Initial Wireless Setup
# Enable wireless interface
/interface wireless enable wlan1
# Basic access point configuration
/interface wireless set wlan1 \
disabled=no \
mode=ap-bridge \
ssid="MyOffice-WiFi" \
band=2ghz-b/g/n \
frequency=auto \
channel-width=20/40mhz-ce \
wireless-protocol=802.11 \
security-profile=default
# Check wireless status
/interface wireless print
Security Profile Configuration
# Create WPA2 security profile
/interface wireless security-profiles add \
name=wpa2-enterprise \
authentication-types=wpa2-psk \
mode=dynamic-keys \
unicast-ciphers=aes-ccm \
group-ciphers=aes-ccm \
wpa2-pre-shared-key="StrongPassword123!"
# Create WPA3 security profile (for compatible devices)
/interface wireless security-profiles add \
name=wpa3-personal \
authentication-types=wpa3-psk \
mode=dynamic-keys \
wpa3-pre-shared-key="EvenStrongerPassword456!"
Advanced Wireless Settings
Frequency and Channel Optimization
# 5GHz access point configuration
/interface wireless set wlan2 \
mode=ap-bridge \
band=5ghz-a/n/ac \
frequency=auto \
channel-width=20/40/80mhz-XXXX \
ssid="MyOffice-5GHz" \
security-profile=wpa2-enterprise
# Manual frequency selection for crowded areas
/interface wireless set wlan1 \
frequency=2412 \
channel-width=20mhz \
skip-dfs-channels=all
Advanced Radio Settings
# Optimize for high-density environments
/interface wireless set wlan1 \
adaptive-noise-immunity=ap-and-client-mode \
amsdu-limit=8192 \
ampdu-priorities=0,1,2,3,4,5,6,7 \
hide-ssid=no \
installation=indoor \
multicast-helper=full
# TX power adjustment
/interface wireless set wlan1 tx-power-mode=card-rates \
tx-power=20
CAPsMAN: Centralized Wireless Management
CAPsMAN Controller Setup
# Enable CAPsMAN
/interface wireless capsman set enabled=yes
/interface wireless capsman set ca-certificate=none
# Create configuration templates
/interface wireless capsman configuration \
add name=office-2ghz \
ssid="Office-2G" \
mode=ap-bridge \
band=2ghz-b/g/n \
security-profile=wpa2-enterprise
/interface wireless capsman configuration \
add name=office-5ghz \
ssid="Office-5G" \
mode=ap-bridge \
band=5ghz-a/n/ac \
security-profile=wpa2-enterprise
# Create provisioning rules
/interface wireless capsman provisioning \
add action=create-dynamic-enabled \
master-configuration=office-2ghz \
slave-configurations=office-5ghz \
supported-bands=2ghz-n
/interface wireless capsman provisioning \
add action=create-dynamic-enabled \
master-configuration=office-5ghz \
slave-configurations=office-2ghz \
supported-bands=5ghz-ac
CAPsMAN Security Configuration
# Certificate-based security (enterprise)
/interface wireless capsman security \
add name=enterprise-security \
authentication-types=wpa2-eap \
eap-methods=peap \
disable-pmkid=no \
management-protection=allowed
# Pre-shared key security
/interface wireless capsman security \
add name=psk-security \
authentication-types=wpa2-psk \
mode=dynamic-keys \
wpa2-pre-shared-key="SecurePassphrase123"
Wireless Modes and Use Cases
Access Point Mode
# Standard AP configuration
/interface wireless set wlan1 \
mode=ap-bridge \
ssid="Office-Network" \
security-profile=default
Station Mode (Client)
# Connect as client to another AP
/interface wireless set wlan1 \
mode=station \
ssid="Upstream-AP" \
security-profile=client-profile
Bridge Modes
# Station bridge for transparent bridging
/interface wireless set wlan1 \
mode=station-bridge \
ssid="Remote-Office" \
security-profile=bridge-profile
# Station pseudobridge for specific use cases
/interface wireless set wlan1 \
mode=station-pseudobridge \
ssid="Pseudo-Bridge" \
security-profile=bridge-profile
Mesh Networking
# Mesh point configuration
/interface wireless set wlan1 \
mode=mesh \
mesh-id="Office-Mesh" \
security-profile=mesh-profile
Wireless Security Best Practices
Enterprise Security Setup
# RADIUS integration for enterprise WiFi
/interface wireless security-profiles \
add name=enterprise-wpa2 \
authentication-types=wpa2-eap \
eap-methods=peap \
management-protection=allowed \
tls-mode=verify-certificate \
tls-certificate=corp-ca
# Configure RADIUS server
/radius add service=wireless \
address=192.168.88.10 \
secret="radius-shared-secret" \
timeout=10s \
called-id="office-wifi"
MAC Authentication and Access Control
# MAC address access list
/interface wireless access-list \
add mac-address=AA:BB:CC:DD:EE:FF \
interface=wlan1 \
allowed=yes \
comment="CEO Laptop"
/interface wireless access-list \
add mac-address=11:22:33:44:55:66 \
interface=wlan1 \
allowed=no \
comment="Blocked Device"
Advanced Wireless Features
Virtual AP Configuration
# Create multiple SSIDs on single radio
/interface wireless add \
name=virtual-guest \
master-interface=wlan1 \
ssid="Office-Guest" \
security-profile=guest-profile \
disabled=no
/interface wireless add \
name=virtual-iot \
master-interface=wlan1 \
ssid="Office-IoT" \
security-profile=iot-profile \
disabled=no
Wireless Uplink Monitoring
# Monitor wireless connection quality
/interface wireless monitor wlan1
# Check registered clients
/interface wireless registration-table print
# Monitor wireless statistics
/interface wireless snooper print
Quality of Service for Wireless
Simple Queue Setup
# Limit bandwidth per wireless client
/queue simple add \
name="wifi-client-limit" \
target=wlan1 \
max-limit=10M/10M \
burst-limit=15M/15M \
burst-threshold=5M/5M \
burst-time=30s
PCQ for Fair Bandwidth Distribution
# Create PCQ queue type
/queue type add \
name="pcq-wifi-download" \
kind=pcq \
pcq-rate=5M \
pcq-limit=50 \
pcq-classifier=dst-address
/queue type add \
name="pcq-wifi-upload" \
kind=pcq \
pcq-rate=2M \
pcq-limit=50 \
pcq-classifier=src-address
# Apply PCQ to wireless interface
/queue tree add \
name="wifi-download" \
parent=global \
packet-mark=wifi-download \
queue=pcq-wifi-download
/queue tree add \
name="wifi-upload" \
parent=global \
packet-mark=wifi-upload \
queue=pcq-wifi-upload
Troubleshooting Wireless Issues
Diagnostic Commands
# Check wireless interface status
/interface wireless print
# Monitor wireless connections
/interface wireless registration-table print
# Check wireless security profiles
/interface wireless security-profiles print
# Monitor wireless traffic
/interface wireless snooper print
# Check frequency usage
/interface wireless sniffer
Common Issue Resolution
# Reset wireless configuration
/interface wireless reset [find]
# Clear wireless statistics
/interface wireless reset-counters [find]
# Restart wireless interface
/interface wireless disable wlan1
/interface wireless enable wlan1
Enterprise Deployment Examples
Multi-AP Office Deployment
# CAPsMAN configuration for office with multiple APs
/interface wireless capsman configuration \
add name=office-2g-config \
ssid="Corporate-WiFi" \
mode=ap-bridge \
band=2ghz-b/g/n \
channel-width=20/40mhz-ce \
security-profile=corp-security
/interface wireless capsman configuration \
add name=office-5g-config \
ssid="Corporate-WiFi" \
mode=ap-bridge \
band=5ghz-a/n/ac \
channel-width=20/40/80mhz-XXXX \
security-profile=corp-security
# Provisioning rules for different AP models
/interface wireless capsman provisioning \
add action=create-dynamic-enabled \
master-configuration=office-2g-config \
supported-bands=2ghz-n \
identity-regexp="^AP-OFFICE-.*$"
Hotel/Public WiFi Setup
# HotSpot configuration for guest WiFi
/ip hotspot profile add name=hotel-guest \
dns-name=hotel-wifi.com \
html-directory=hotspot1 \
http-cookie-lifetime=1d
/ip hotspot add name=hotel-guest \
interface=wlan1 \
profile=hotel-guest \
address-pool=hotel-guests \
disabled=no
# Create user accounts
/ip hotspot user add name=room101 \
password=welcome101 \
profile=hotel-guest
/ip hotspot user add name=room102 \
password=welcome102 \
profile=hotel-guest
Performance Optimization
Channel Planning and Optimization
# Manual channel selection for minimal interference
/interface wireless set wlan1 \
frequency=5180 \
channel-width=20mhz \
country="united states" \
antenna-gain=3
# DFS channel usage for 5GHz
/interface wireless set wlan2 \
frequency=5500 \
channel-width=80mhz \
skip-dfs-channels=no
Client Management and Load Balancing
# Connect list for client management
/interface wireless connect-list \
add interface=wlan1 \
mac-address=AA:BB:CC:DD:EE:FF \
allowed=yes \
signal-range=-70..120
# Load balancing across multiple APs
/interface wireless capsman set \
channel.reselect-interval=1h \
configuration.band=5ghz-only
Monitoring and Maintenance
Wireless Monitoring Setup
# Enable wireless logging
/system logging add topics=wireless
# Set up wireless graphing
/tool graphing interface add \
interface=wlan1 \
allow-address=0.0.0.0/0
# Monitor client connections
:local clients [/interface wireless registration-table print count-only]
:put ("Connected clients: " . $clients)
Automated Maintenance Scripts
# Script to monitor AP status
/system script add name=check-wireless \
source="/interface wireless print; \
/interface wireless registration-table print; \
/interface wireless access-list print"
# Schedule regular wireless checks
/system scheduler add name=wireless-check \
interval=1h \
on-event=check-wireless
Conclusion: Building Robust Wireless Networks
MikroTik's wireless capabilities provide enterprise-grade features at consumer-level pricing. The key to successful wireless deployments lies in:
- Proper hardware selection for your use case
- Strategic channel planning to minimize interference
- Robust security configuration including WPA3 where supported
- CAPsMAN implementation for multi-AP environments
- Continuous monitoring and performance optimization
Whether you're deploying a simple home network or managing a large enterprise wireless infrastructure, MikroTik provides the tools and flexibility needed for success.
Follow for more networking insights: Connect on LinkedIn | Join our WhatsApp Channel


