MikroTik RouterOS – Complete Configuration Guide RouterOS v7
MikroTik RouterOS
Complete Configuration Guide
Step-by-Step · RouterOS v7 · WinBox / CLI / WebFig
Document MikroTik RouterOS Complete Configuration Guide
Version RouterOS v7 (Long-term & Stable)
Interface WinBox · WebFig · CLI (SSH / Telnet)
Audience Network Admins · Home Lab · ISPs · Enterprise
Updated April 2026
© 2026 MikroTik Configuration Guide Page 1
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
TABLE OF CONTENTS
Step 1 Prerequisites & Required Tools
Step 2 Initial Connection to the Router
Step 3 Security – Change Default Password
Step 4 Reset & Clean Configuration
Step 5 Create a LAN Bridge
Step 6 Configure WAN Interface (DHCP / Static / PPPoE)
Step 7 Set Up DHCP Server for LAN
Step 8 Configure NAT (Masquerade)
Step 9 Configure DNS
Step 10 Set Up Firewall Rules
Step 11 Configure Wi-Fi (Wireless Access Point)
Step 12 Test & Verify Connectivity
Step 13 Hardening & Best Practices
Step
Appendix Common CLI Quick-Reference Commands
© 2026 MikroTik Configuration Guide Page 2
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 1 · Prerequisites & Required Tools
Before configuring your MikroTik router, ensure you have the following hardware, software, and information ready.
Skipping any of these may cause connectivity issues.
Hardware Required
• MikroTik RouterBOARD device (any model running RouterOS v6 or v7)
• Ethernet cable (Cat5e or better) to connect your PC to the router
• ISP cable / modem connected to ether1 (WAN port)
• PC or laptop with an Ethernet port (or USB-to-Ethernet adapter)
Software Tools (choose one or all)
Tool Platform Best For Download
WinBox Windows / Wine Full GUI configuration [Link]/download
WebFig Any browser Quick web-based access [Link]
SSH / CLI Any OS Scripting & automation Built-in terminal
The Dude Windows Network monitoring [Link]/download
Default Router Credentials
## Factory Defaults
IP Address : [Link]
Username : admin
Password : (blank – press Enter)
Subnet mask: [Link] (/24)
■■ WARNING: Always change the default password immediately after first login. Leaving it blank is a
serious security risk.
ISP Information to Gather
• Connection type: DHCP, Static IP, or PPPoE
• If Static: IP address, subnet mask, default gateway, DNS servers
• If PPPoE: username and password from your ISP
• MTU value (usually 1500 for Ethernet, 1492 for PPPoE)
© 2026 MikroTik Configuration Guide Page 3
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 2 · Initial Connection to the Router
Method A – WinBox (Recommended)
WinBox is MikroTik's dedicated GUI utility. It can connect via IP address or directly via MAC address — useful when
the router has no IP assigned yet.
• Download WinBox from [Link]/download (no installation needed)
• Plug your PC into any LAN port (NOT ether1)
• Open WinBox → click the Neighbors tab → your router will appear
• Click the MAC address entry → it auto-fills the Connect To field
• Leave Password blank → click Connect
Method B – WebFig (Browser)
• Connect your PC via Ethernet to a LAN port
• Set your PC's IP to 192.168.88.x / gateway [Link] (or use DHCP)
• Open a browser → navigate to [Link]
• Login: admin / (blank password)
Method C – SSH / CLI
## SSH Login
ssh admin@[Link]
# Accept the host key fingerprint when prompted
# Password: (press Enter for blank)
■ TIP: If WinBox shows 'Connection timed out', connect via MAC address in the Neighbors tab instead
of IP. The router may not have an IP yet on a fresh reset.
© 2026 MikroTik Configuration Guide Page 4
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 3 · Security – Change Default Password
The very first action after connecting should be securing your router with a strong password. This prevents
unauthorized access from any device on the same network.
Via WinBox / WebFig
• Go to System → Users
• Double-click the admin user
• Enter a strong new password in the Password field
• Confirm and click OK
Via CLI
## Change Password (CLI)
/user set admin password=YourStrongP@ssw0rd
# Verify the change
/user print
■■ WARNING: Use a password manager. Losing the admin password requires a physical reset of the
router.
Create an Additional Admin User (Best Practice)
## Add Secondary Admin
/user add name=netadmin password=SecurePass123! group=full
/user disable admin
# Disabling 'admin' prevents brute-force on the default username
© 2026 MikroTik Configuration Guide Page 5
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 4 · Reset & Clean Configuration (Optional)
If the router has a previous configuration or you want a known-clean state, perform a full reset before proceeding.
This is recommended for used devices.
Via WinBox / WebFig
• Go to System → Reset Configuration
• Check ■ No Default Configuration (gives a completely blank slate)
• Click Reset Configuration → router reboots
• Reconnect via MAC address in WinBox Neighbors tab after reboot
Via CLI
## Factory Reset (CLI)
/system reset-configuration no-defaults=yes
# Router will reboot automatically
# Reconnect via WinBox MAC address after ~30 seconds
■ NOTE: After a no-defaults reset, the router has no IP. Always reconnect via MAC address in WinBox.
© 2026 MikroTik Configuration Guide Page 6
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 5 · Create a LAN Bridge
A bridge combines multiple Ethernet and/or wireless ports into a single logical network segment, acting like a switch.
All LAN ports and Wi-Fi interfaces are added to this bridge.
Via WinBox
• Go to Bridge → click + to create a new bridge
• Name it bridge-LAN → click OK
• Switch to the Ports tab → click + for each LAN interface
• Add ether2, ether3, ether4, ether5 (all except ether1 which is WAN)
• Also add wlan1 / wlan2 if using Wi-Fi
Via CLI
## Bridge Setup (CLI)
# Create the bridge
/interface bridge add name=bridge-LAN
# Add LAN Ethernet ports (adjust interface names for your model)
/interface bridge port add bridge=bridge-LAN interface=ether2
/interface bridge port add bridge=bridge-LAN interface=ether3
/interface bridge port add bridge=bridge-LAN interface=ether4
/interface bridge port add bridge=bridge-LAN interface=ether5
# Assign LAN IP address to the bridge
/ip address add address=[Link]/24 interface=bridge-LAN
■■ WARNING: Do NOT add ether1 to the bridge — ether1 is your WAN port and must remain
separate.
© 2026 MikroTik Configuration Guide Page 7
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 6 · Configure WAN Interface
The WAN interface connects the router to the internet via your ISP. Choose the method that matches your ISP
connection type.
6A – DHCP Client (Most Common – Cable / Fiber)
Use this when your ISP automatically assigns an IP address to your router.
## DHCP Client on ether1
/ip dhcp-client add interface=ether1 disabled=no add-default-route=yes
use-peer-dns=yes
# Verify the assigned IP
/ip dhcp-client print
/ip address print
6B – Static IP
Use when your ISP provides a fixed IP address, gateway, and DNS servers.
## Static IP on ether1
# Replace values with those provided by your ISP
/ip address add address=[Link]/24 interface=ether1
/ip route add dst-address=[Link]/0 gateway=[Link]
/ip dns set servers=[Link],[Link]
6C – PPPoE (DSL / Some Fiber Connections)
Use when your ISP requires a username and password (common with DSL/VDSL).
## PPPoE Client on ether1
/interface pppoe-client
add name=pppoe-out interface=ether1 \
user=your@[Link] password=ISPpassword \
add-default-route=yes use-peer-dns=yes disabled=no
# Monitor connection status
/interface pppoe-client print detail
■ NOTE: For PPPoE, set out-interface=pppoe-out (not ether1) in all NAT and firewall rules.
© 2026 MikroTik Configuration Guide Page 8
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 7 · Set Up DHCP Server for LAN
The DHCP server automatically distributes IP addresses to devices on your LAN. Without this, each device would
need a manually configured IP address.
Via WinBox Wizard (Easiest Method)
• Go to IP → DHCP Server
• Click DHCP Setup button
• Select bridge-LAN as the DHCP Server Interface → Next
• Accept or modify the DHCP Address Space (e.g. [Link]/24) → Next
• Set Gateway ([Link]) → Next
• Set the Address Range to give out (e.g. [Link] – [Link]) → Next
• Set DNS Servers (e.g. [Link] or your router's IP) → Next
• Set Lease Time (e.g. 1d = 1 day) → Next → Done
Via CLI
## DHCP Server (CLI)
# Define IP pool
/ip pool add name=LAN-pool ranges=[Link]-[Link]
# Create DHCP network definition
/ip dhcp-server network add
address=[Link]/24
gateway=[Link]
dns-server=[Link],[Link]
# Create DHCP server
/ip dhcp-server add name=LAN-dhcp interface=bridge-LAN
address-pool=LAN-pool disabled=no lease-time=1d
# Verify
/ip dhcp-server print
/ip dhcp-server lease print
■ TIP: After setup, disconnect and reconnect your PC to get a DHCP address. Check it with ipconfig
(Windows) or ip addr (Linux/Mac).
© 2026 MikroTik Configuration Guide Page 9
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 8 · Configure NAT (Network Address Translation)
NAT allows multiple LAN devices to share a single public IP address. Without NAT, LAN devices cannot reach the
internet. This is the masquerade rule.
Via WinBox
• Go to IP → Firewall → NAT tab
• Click + to add a new rule
• Chain: srcnat | Out. Interface: ether1 (or pppoe-out for PPPoE)
• Go to Action tab → Action: masquerade
• Click OK
Via CLI
## NAT Masquerade Rule
# For DHCP / Static WAN on ether1
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
# For PPPoE WAN
/ip firewall nat add chain=srcnat out-interface=pppoe-out action=masquerade
# Verify
/ip firewall nat print
■ NOTE: Masquerade is dynamic — it automatically uses the current IP on the WAN interface. For
static IPs, you can also use 'src-nat' with a fixed address.
© 2026 MikroTik Configuration Guide Page 10
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 9 · Configure DNS
DNS resolves domain names to IP addresses. The MikroTik can act as a caching DNS resolver for your LAN,
improving speed and allowing custom hostname resolution.
Via WinBox
• Go to IP → DNS
• Set Servers to your preferred DNS (e.g. [Link] and [Link])
• Check ■ Allow Remote Requests (so LAN clients can use the router as DNS)
• Click OK
Via CLI
## DNS Configuration
/ip dns set
servers=[Link],[Link]
allow-remote-requests=yes
max-udp-packet-size=4096
# Test DNS resolution from the router
/resolve [Link]
Provider Primary DNS Secondary DNS Notes
Google [Link] [Link] Fast, reliable, global
Cloudflare [Link] [Link] Privacy-focused, fast
OpenDNS [Link] [Link] Content filtering available
Quad9 [Link] [Link] Security-focused, blocks malware
© 2026 MikroTik Configuration Guide Page 11
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 10 · Configure Firewall Rules
A proper firewall protects your router and LAN from internet attacks. The rules below implement a standard stateful
firewall — accepting established connections while blocking unsolicited inbound traffic.
Input Chain (Protecting the Router Itself)
## Input Chain Rules
/ip firewall filter
# Allow established/related/untracked connections
add chain=input action=accept connection-state=established,related,untracked
# Drop invalid connections
add chain=input action=drop connection-state=invalid
# Allow ICMP (ping) – useful for diagnostics
add chain=input action=accept protocol=icmp
# Allow access from LAN only
add chain=input action=accept in-interface=bridge-LAN
# Drop everything else on WAN
add chain=input action=drop in-interface=ether1
Forward Chain (Traffic Between LAN and WAN)
## Forward Chain Rules
# Allow established/related forwarding
add chain=forward action=accept connection-state=established,related,untracked
# Drop invalid
add chain=forward action=drop connection-state=invalid
# Allow LAN to WAN
add chain=forward action=accept in-interface=bridge-LAN out-interface=ether1
# Drop everything else
add chain=forward action=drop
■ NOTE: Rule order matters in MikroTik firewall. Rules are evaluated top-to-bottom. Always place
'accept established' rules first for performance.
© 2026 MikroTik Configuration Guide Page 12
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 11 · Configure Wi-Fi (Wireless Access Point)
Configure the built-in wireless interface as an access point so Wi-Fi devices can connect to your network. This
applies to MikroTik routers with wireless capability.
Enable & Configure Wireless Interface (WinBox)
• Go to Wireless → select wlan1 → click the Enable button (blue checkmark)
• Double-click wlan1 to open settings
• Mode: ap bridge | Band: 2GHz-b/g/n (or 5GHz-a/n/ac)
• SSID: Enter your Wi-Fi network name
• Channel Width: 20/40MHz HT Above | Frequency: auto
• Go to Security tab → Security Profile → click +
• Name: WPA2 | Mode: dynamic keys | Authentication: WPA2-PSK
• WPA2 Pre-Shared Key: Enter your Wi-Fi password (min 8 chars)
• Apply the security profile to the wlan1 interface
Via CLI
## Wi-Fi Configuration (CLI)
# Enable wireless interface
/interface wireless enable wlan1
# Create security profile
/interface wireless security-profiles add
name=WPA2-profile mode=dynamic-keys
authentication-types=wpa2-psk
wpa2-pre-shared-key=YourWiFiPassword
# Configure access point
/interface wireless set wlan1
mode=ap-bridge ssid=MyNetwork
band=2ghz-b/g/n channel-width=20/40mhz-ht-above
frequency=auto security-profile=WPA2-profile
# Add wlan1 to the LAN bridge
/interface bridge port add bridge=bridge-LAN interface=wlan1
■ TIP: For dual-band routers, repeat the same process for wlan2 using band=5ghz-a/n/ac for a separate
5 GHz SSID.
© 2026 MikroTik Configuration Guide Page 13
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 12 · Test & Verify Connectivity
After completing configuration, systematically verify each layer of connectivity using the built-in RouterOS tools.
Router → Internet
/ping [Link] count=4
# Should show replies with round-trip times
Router → DNS Resolution
/resolve [Link]
# Should return an IP address
LAN Client → Router
/ping [Link] count=4
# Run from a connected PC; should succeed
Traceroute (Path to Internet)
/tool traceroute [Link]
# Shows each hop to destination
Troubleshooting Checklist
• No WAN IP? → Check ether1 connection and ISP cable | /ip dhcp-client print
• No internet from LAN? → Verify NAT masquerade rule | /ip firewall nat print
• DNS not working? → Check allow-remote-requests=yes | /ip dns print
• Can't reach router? → Check firewall input rules | /ip firewall filter print
• Wi-Fi not connecting? → Check security profile and SSID spelling
© 2026 MikroTik Configuration Guide Page 14
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP 13 · Hardening & Best Practices
After basic setup, apply these security hardening measures to reduce your router's attack surface and improve
overall network security.
Disable Unused Services
/ip service disable telnet,ftp,www,api,api-ssl
# Keep only ssh and winbox (or what you actually use)
/ip service print
Change Default Service Ports
/ip service set ssh port=2222
/ip service set winbox port=8291
# Non-standard ports stop most automated scanners
Disable MAC Discovery on WAN
/ip neighbor discovery-settings set discover-interface-list=LAN
# Prevents router from advertising itself on WAN
Enable NTP Time Sync
/system ntp client set enabled=yes
/system ntp client servers add address=[Link]
# Accurate time is critical for logs and certificates
Limit Winbox Access to LAN Only
/ip service set winbox address=[Link]/24
# Winbox only accessible from your LAN subnet
Create Router Backup
/system backup save name=router-config-backup
/export file=router-config-export
# Download both files from Files menu in WinBox
© 2026 MikroTik Configuration Guide Page 15
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
STEP Appendix · Common CLI Quick-Reference Commands
A handy reference for the most frequently used RouterOS CLI commands.
System Info
/system resource print # CPU, RAM, uptime
/system routerboard print # Hardware model, firmware
/system package print # Installed packages & versions
Interface Status
/interface print # All interfaces
/interface monitor wlan1 # Live wireless stats
/interface ethernet print # Ethernet port status
IP Addresses & Routes
/ip address print # All IP addresses
/ip route print # Routing table
/ip dhcp-client print # WAN DHCP lease
Firewall & NAT
/ip firewall filter print # Firewall rules
/ip firewall nat print # NAT rules
/ip firewall connection print # Active connections
DHCP Leases
/ip dhcp-server lease print # All DHCP leases
/ip dhcp-server lease make-static 0 # Make lease #0 static
Wireless
/interface wireless registration-table print # Connected clients
/interface wireless scan wlan1 # Scan Wi-Fi channels
Update RouterOS
© 2026 MikroTik Configuration Guide Page 16
MikroTik RouterOS – Complete Configuration Guide RouterOS v7
/system package update check-for-updates
/system package update install
# Router will reboot after update
For the latest documentation, visit [Link] | Community forums: [Link] | Official training: [Link]/training
© 2026 MikroTik Configuration Guide Page 17