Lab 05-02 · Connect list: choosing which AP to join¶
MTCNA
Module 5 · Wireless. Official course slides 204–210: wireless station, security, Connect list and its LAB (slide 210: "create a rule that does not allow connecting to the class AP").
Real hardware in class
This lab is config-only: it is done on the real MikroTik router on your desk (a virtual CHR has no radio).
Your phone remembers every WiFi network you ever joined. Walk into the school and it jumps onto eduroam by itself; walk past a café and it may jump onto the café's slow, open WiFi and suddenly nothing loads. Annoying, right? On a phone you fix that by tapping Forget this network.
A router working as a WiFi client has the same problem, but worse: nobody is there to tap a button. It needs rules written in advance: "join this AP, never that one". That is the connect list.
What you will learn
- Explain how a station chooses an access point: SSID, scan list and signal
- Write a connect list rule that forbids an AP, and read how rules are evaluated (top-down, first match)
- Relate the connect list to the interface setting Default Authenticate
- Use the scan tool to see the APs around you (and why it cuts your connection)
- Do the same job on the new WiFi menu, which has no connect list (the trap of this lab)
How a station picks an AP¶
Our analogy for this lab: your phone's list of saved networks.
When a station is switched on it does not know any channel. It scans: it listens on each channel of its scan list (the channels it is allowed to look at), collects the beacons (the "here I am" messages every AP broadcasts about ten times per second) and then picks an AP that:
- advertises the SSID the station is configured for,
- accepts the station's security settings (WPA2/WPA3 and password),
- and, among several candidates, has the best signal.
flowchart LR
S["<b>Station</b><br>ssid=ClassAP"] --> SCAN["<b>Scan</b><br>channels in the scan list"]
SCAN --> CL{"<b>Connect list</b><br>first matching rule?"}
CL -- "connect=yes" --> JOIN["<b>Join</b> that AP"]
CL -- "connect=no" --> SKIP["<b>Skip</b> that AP<br>keep looking"]
CL -- "no rule matches" --> DA{"<b>Default Authenticate</b>"}
DA -- "yes" --> JOIN
DA -- "no" --> SKIPThe connect list (legacy menu Wireless → Connect List) is an ordered list of rules a station uses to decide which APs it may join. Each rule can match an AP by MAC address, SSID, signal range, security profile... and says
connect=yesorconnect=no.
Rules are read from the top down and only the first matching rule counts (exactly like a firewall). If no rule matches, the interface setting Default Authenticate decides: yes (the default) means "join anyway", no means "only join the APs my list allows".
| Legacy interface setting | Station mode (this lab) | AP mode (Lab 05-05) |
|---|---|---|
| Default Authenticate = yes | join APs that no connect-list rule mentions | accept stations that no access-list rule mentions |
| Default Authenticate = no | join only APs allowed by the connect list | accept only stations allowed by the access list |
Connect list vs access list: who decides?
The connect list is for the client (station): which APs I will join. The access list is for the AP: which clients I will accept. Same idea, opposite side of the link.
The trap: the new WiFi menu has no connect list¶
On routers with the new WiFi package (hAP ax², /interface wifi) there is no connect list: we checked the menu tree of RouterOS 7.23.8 and /interface/wifi has access-list but no connect-list. MikroTik's own forum confirms users moving from old to new hardware miss it.
What the new menu does have is the scan list itself: for a station, the channel setting frequency is the list of channels it will scan. If the AP you want to avoid sits on a channel you do not scan, your station will never see it. It is a blunter tool (it skips every AP on that channel, not just one), but it does the job in our classroom, where ClassAP is fixed on channel 1 (2412 MHz).
| Goal | Legacy /interface wireless |
New /interface wifi |
|---|---|---|
| Never join one AP | connect-list rule connect=no |
not possible per AP; remove its channel from the scan list |
| Only join one SSID | ssid= on the interface |
configuration.ssid= |
| Prefer one AP over another | connect-list order | not available; the station picks the best signal |
The scenario¶
Same classroom as Lab 05-01: your router is a station of ClassAP and gets the Internet through it. At the end of this lab it will deliberately refuse ClassAP, so you will lose the Internet. That is the expected result.
flowchart LR
subgraph CAP["<b>class-ap</b> (teacher)"]
CAPW["AP <b>ClassAP</b><br>2.4 GHz, ch 1 (2412 MHz)<br>10.0.0.1/24"]
end
CAPW -. "WiFi: blocked by<br>your rule" .- R1W
subgraph R1["<b>r1</b> (your router)"]
R1W["wifi2 / wlan1<br><b>station</b>"]
BR["bridge1<br>192.168.88.1/24"]
end
BR -- "cable to ether2" --- PC["<b>Your laptop</b><br>WinBox"]| Node | Role | Address |
|---|---|---|
class-ap |
teacher's router, AP ClassAP on channel 1 | 10.0.0.1/24 |
r1 |
your router, station on its 2.4 GHz radio | wifi2/wlan1 = 10.0.0.x (DHCP) until you block ClassAP; bridge1 = 192.168.88.1/24 |
| laptop | your PC on ether2 | 192.168.88.x (DHCP from r1) |
Where is ether1?
On a real hAP the Internet port is ether1; in the virtual labs ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3. Here, on real hardware, the Internet arrives over WiFi and ether1 stays unused; the LAN is ether2–ether5.
Start the lab¶
Download the lab files and unzip them: 05-02-connect-list.zip. Open a terminal inside the 05-02-connect-list folder.
Upload initial/r1.rsc (hAP ax², WiFi menu) or initial/r1-legacy-wireless.rsc (hAP ac², legacy menu) to Files, then reset the router so it runs that file:
After about a minute, reconnect WinBox to 192.168.88.1 (cable in ether2). Open a New Terminal.
Step 1 · Confirm you are connected to ClassAP¶
Why: you need a "before" picture to compare with.
WinBox: WiFi → Registration (legacy: Wireless → Registration). On a station, the registration table shows the AP it is connected to.
Expected: one entry (the ClassAP's MAC address, signal, uptime), DHCP client bound to 10.0.0.x, and three ping replies.
Check yourself
Write down the MAC address of ClassAP. Why is it called a BSSID when it identifies an AP?
Done when: you have ClassAP's MAC and the ping works.
Step 2 · Look around with a scan¶
Why: a connect list is about choosing between APs, so first see which APs exist. The scan tool lists every AP your radio hears (the course's Snooper shows even more: every station too).
WinBox: WiFi → WiFi Interfaces → Scan... (legacy: Wireless → WiFi Interfaces → Scan...).
Expected: a table of APs: MAC address, SSID, channel, signal. Your classmates' routers will appear here too once they reach Lab 05-03.
Scanning disconnects you
While the radio scans other channels it cannot stay on ClassAP's channel, so your WiFi link drops during the scan and reconnects afterwards. Never scan on a link you are using to manage a remote router.
Check yourself
How many APs did the scan find on 2.4 GHz? Which channels are the busiest?
Done when: you have seen ClassAP in the scan results with its channel.
Step 3 · Write the rule that refuses ClassAP¶
Why: this is the LAB of slide 210. You want your station to never join the class AP.
WinBox: Wireless → Connect List → +. Interface wlan1, uncheck Connect, SSID ClassAP. A shortcut: in Wireless → Registration double-click ClassAP and press Copy to Connect List, then uncheck Connect: that copies its exact MAC address.
/interface wireless connect-list add interface=wlan1 ssid=ClassAP connect=no comment="do not connect to the class AP"
/interface wireless connect-list print
Matching by SSID blocks every AP called ClassAP; matching by MAC address (mac-address= the BSSID you wrote down) blocks just that one radio. Either is a correct answer to the LAB.
There is no connect list, so take ClassAP's channel out of your scan list. WinBox: WiFi → Channels → + (name ch-scan-no-class, band 2ghz-ax, frequency 2437,2462), then WiFi → Configurations → cfg-uplink → Channel = ch-scan-no-class.
/interface wifi channel add name=ch-scan-no-class band=2ghz-ax frequency=2437,2462 comment="scan list without channel 1"
/interface wifi configuration set [find name=cfg-uplink] channel=ch-scan-no-class
Your station now only listens on channels 6 (2437 MHz) and 11 (2462 MHz), so ClassAP on channel 1 has become invisible.
Within a few seconds the link drops. Check:
Expected: the registration table is empty, the monitor says the station is searching for a network, and the DHCP client is no longer bound. ping www.mikrotik.com fails: you have no Internet. That is the goal.
Check yourself
Your laptop can still open WinBox on 192.168.88.1. Why? Which part of the network did you cut, and which part still works?
Done when: your router is no longer connected to ClassAP and the teacher no longer sees you in the class AP's registration table.
Step 4 · Undo it and get the Internet back¶
Why: the course asks to restore the previous configuration when you finish. Disabling a rule is the quickest way to prove it was the cause.
Expected: after a few seconds the station reconnects, the DHCP client is bound again and the ping to www.mikrotik.com works.
Check yourself
Legacy only: if you had added a second rule connect=yes ssid=ClassAP below the connect=no rule, would your router connect? And if it were above?
Done when: the Internet works again. (The final/ files keep the blocking rule active, as the solved state of slide 210.)
If something goes wrong¶
| Symptom | Likely cause | Fix |
|---|---|---|
| The router stays connected after the rule | rule on the wrong interface, or SSID typed with a different case | /interface wireless connect-list print; interface=wlan1, ssid=ClassAP exactly |
bad command name connect-list |
your router runs the new WiFi package | use the WiFi tab (scan-list method) |
| WiFi: still connected after changing the channel | the configuration was not the one used by wifi2 | /interface wifi print detail where default-name=wifi2 shows configuration=cfg-uplink |
| Legacy: the router connects to no AP at all, even after disabling the rule | Default Authenticate was turned off | /interface wireless set wlan1 default-authentication=yes |
| The scan shows nothing | scanning the wrong radio (5 GHz) | scan the 2.4 GHz interface: wifi2 / wlan1 |
| WinBox froze during the scan | you were managing the router over WiFi | manage it by cable on ether2 |
Clean up¶
Leave the rule disabled (Step 4), or reload this lab's initial/ file with the same reset command. The next lab starts from its own initial/ file.
Key takeaways¶
- A station scans its scan list, listens to the beacons and joins an AP with the right SSID, security and the best signal.
- The connect list (legacy wireless) is the station's rule list: top-down, first match wins,
connect=yes/no. - If no rule matches, Default Authenticate decides; set it to
noto join only the APs your list allows. - The access list is the mirror tool on the AP side: which stations the AP accepts.
- The new WiFi menu has no connect list; the closest tool is the station's scan list (
channel.frequency), which hides every AP on the excluded channels. - A scan disconnects the radio while it runs.
Quick check¶
1. What is the connect list used for?
- Deciding which access points a station may join
- Deciding which stations an access point accepts
- Listing the DHCP leases given to WiFi clients
- Choosing the channel an access point transmits on
The connect list is the station's rule list. The access list is its mirror on the AP side.
2. A connect list has two rules for the same AP: first connect=no, then connect=yes. What does the station do?
- It does not join that AP, because only the first matching rule counts
- It joins that AP, because the last rule always wins
- It joins and leaves the AP every few seconds
- It ignores both rules and uses Default Authenticate
Connect-list rules are evaluated top-down and the first match decides, like firewall rules. The second rule is never reached.
3. A legacy station has Default Authenticate turned off and an empty connect list. What happens?
- It joins no access point at all
- It joins any access point with an open network
- It joins the access point with the strongest signal
- It joins only access points running RouterOS
With Default Authenticate = no, an AP that no rule allows is refused. With an empty list, every AP is refused.
4. Why does your WiFi link drop while you run a scan on that same interface?
- The radio leaves the current channel to listen on the others
- The scan changes the WPA2 password of the interface
- The access point bans clients that scan
- The scan turns the interface into an access point
One radio can only listen on one channel at a time. To list the APs on every channel it must leave the AP's channel, so the connection is interrupted.
5. Your hAP ax² uses /interface wifi. How did we stop it from joining ClassAP?
- By removing ClassAP's channel from the station's scan list
- By adding a connect-list rule with connect=no
- By setting Default Authenticate to no on wifi2
- By adding ClassAP's MAC to the access list of wifi2
The new WiFi menu has no connect list and no Default Authenticate. A station's channel.frequency is its scan list: leave out 2412 MHz and ClassAP is never seen.
6. Which value identifies one specific access point radio, even if several APs share the SSID ClassAP?
- Its MAC address, also called the BSSID
- The SSID
- The channel width
- The WPA2 passphrase
Many APs can broadcast the same SSID (that is how large networks give you roaming). Each radio still has its own MAC address, called the BSSID, so a connect-list rule by MAC blocks only that one.
7. Your router is a station of the school WiFi. Two APs called 'School' are in range: one in the library (-50 dBm) and a far one that is overloaded (-78 dBm). With the legacy package you want it to always use the library AP. Pick the two correct actions.
- Add a connect=yes rule with the library AP's MAC address
- Set Default Authenticate to no so unlisted APs are refused
- Add a connect=yes rule matching only the SSID School
- Turn the router into an access point called School
A rule by MAC address (BSSID) singles out the library AP; with Default Authenticate = no, any AP not allowed by the list (the far one) is refused. A rule by SSID matches both APs.
Your router now obeys rules about where it connects. Next lab: turn it around and make it an access point that others connect to.