Lab 05-03 · Your own access point¶
MTCNA
Module 5 · Wireless. Official course slides 207–208 (security, security profiles), 211 (access point) and the Access point LAB (slides 220–221: create a security profile, set the interface to AP bridge, bridge the wireless interface, connect your laptop and watch the registration table). Slide 219 (wireless repeater) is mentioned as an aside.
Real hardware in class
This lab is config-only: it is done on the real MikroTik router on your desk (a virtual CHR has no radio).
You walk into a café, look at the little sign on the counter: WiFi: CafeLuna · Password: croissant2024. You type it, and your phone is online. Someone, at some point, configured that. Today that someone is you.
So far your router has been a WiFi client of the teacher's network. Now it becomes an access point: it will broadcast its own network, protect it with a password, and hand out addresses to every phone and laptop that joins. That is exactly what the box under your TV at home does.
What you will learn
- Explain the difference between an open network, WEP, WPA, WPA2 and WPA3, and choose the right one today
- Create a security profile (legacy) or a security object (WiFi) with a pre-shared key
- Turn a radio into an access point with the right mode, band, channel and SSID
- Bridge the wireless interface with the LAN so WiFi clients behave like cabled ones
- Read the AP's registration table to see who is connected and how well
- Avoid the course trap "disable the DHCP client, you will lose the Internet" (and know when it really applies)
The café sign: SSID and password¶
Our analogy for this lab: the WiFi of a café.
| Café | WiFi access point |
|---|---|
| The name on the sign | SSID: the network name, up to 32 characters |
| The code printed on your receipt | Pre-shared key (PSK): one password shared by every client |
| The waiter who checks the code | Authentication (WPA2/WPA3) |
| Whispering so other tables can't hear | Encryption (AES-CCMP) |
| The café's single room | The bridge: WiFi and cable clients in the same network |
| The waiter's list of who is sitting where | The registration table |
A short history of WiFi security¶
WiFi travels through the air, so anyone nearby can receive your frames. Security is not optional.
| Name | Year | What happened |
|---|---|---|
| Open | — | no password, no encryption: everyone can read everything |
| WEP | 1997 | the first attempt; broken in 2001, cracked in minutes today. Never use it |
| WPA | 2003 | an emergency patch for WEP hardware (TKIP cipher). Obsolete |
| WPA2 | 2004 | strong encryption (AES-CCMP). Still the minimum acceptable today |
| WPA3 | 2018 | SAE handshake: even if someone records your connection, they cannot try millions of passwords offline |
WPA2-PSK / WPA3-PSK ("Personal") use one shared password for everybody. WPA2-EAP / WPA3-EAP ("Enterprise") give each user their own login, checked by a server (like
eduroamat universities).
The course slides (made with older routers) say "use only WPA or WPA2, with AES-CCM". Today the advice is: WPA2 + WPA3 together (a "transition mode", so old devices use WPA2 and new ones WPA3), and never WEP, WPA or TKIP. The legacy wireless package cannot do WPA3, so there you use WPA2 with AES only.
The password is the whole security
With PSK, anybody who knows the password can join. And with WPA2, someone who records a client connecting can try passwords offline as fast as their graphics card allows. A short word like croissant2024 falls quickly. Use 12 or more characters, not a dictionary word. The passphrase must have 8 to 63 characters.
Hiding the SSID is not security
There is a Hide SSID checkbox. The AP stops announcing its name in beacons, but every client that connects still says the name out loud, so anyone with a sniffer learns it in seconds. It only makes life harder for your own guests.
Access point modes¶
In the legacy menu an AP is mode ap-bridge (the course writes "bridge ap"): many clients can join. Mode bridge is an AP that accepts only one client (used for point-to-point links). In the new WiFi menu there is simply mode=ap.
An AP needs: band, channel (frequency), SSID, security, and the country (Lab 05-01). A station only needs band, SSID and security, because it scans. That asymmetry is the key idea of slide 211.
Bridging the wireless interface¶
A WiFi interface is just another network port. If you leave it alone, it is its own little network with no IP address and no DHCP server: phones would connect but get no address.
The fix is the same as for ether2–ether5 in Module 3: add it to bridge1. Then WiFi clients and cabled clients are in the same network 192.168.88.0/24, get their address from the same DHCP server, and can see each other.
flowchart TB
subgraph R1["<b>r1</b> (your router)"]
subgraph BR["<b>bridge1</b> · 192.168.88.1/24 · DHCP server lan-dhcp"]
E2["ether2"]
E3["ether3..5"]
W1["<b>wifi1 / wlan2</b><br>AP 13_JohnDoe, 5 GHz"]
end
UP["wifi2 / wlan1<br>station of ClassAP<br>(Internet, NAT)"]
end
PH["<b>Phone</b><br>192.168.88.x"] -. "WiFi 5 GHz" .- W1
LT["<b>Laptop</b>"] -. "WiFi 5 GHz<br>(after unplugging)" .- W1
UP -. "WiFi 2.4 GHz" .- CAP["<b>ClassAP</b><br>Internet"]Why the course says you will lose the Internet
Slide 220 asks you to disable the DHCP client on the wireless interface. The routers of the original course have one radio: it was the station towards ClassAP, and now it must become your AP, so the uplink dies. Our hAP ax² and hAP ac² have two radios: the 2.4 GHz one keeps being a station of ClassAP (your Internet), and the 5 GHz radio becomes your AP. So you keep the Internet, and your WiFi clients use it too. If your router has a single radio, follow the course: disable the DHCP client and expect no Internet.
Repeater mode (slide 219)
RouterOS can also be a repeater: one radio is a station of an existing AP and an AP of its own at the same time, extending the network without cables. It halves the speed, because every frame crosses the air twice. We do not configure it in this lab.
The scenario¶
| Node | Role | Address |
|---|---|---|
class-ap |
teacher's router, AP ClassAP on 2.4 GHz channel 1 | 10.0.0.1/24 |
r1 2.4 GHz radio (wifi2 / wlan1) |
station of ClassAP (Internet) | 10.0.0.x (DHCP) |
r1 5 GHz radio (wifi1 / wlan2) |
your AP, SSID 13_JohnDoe (your number and name), channel 36–48 |
port of bridge1 |
r1 bridge1 |
LAN: ether2–ether5 + your AP | 192.168.88.1/24, DHCP 192.168.88.10–254 |
| laptop / phone | WiFi clients of your AP | 192.168.88.x (DHCP) |
Where is ether1?
On a real hAP the Internet port is ether1; in the virtual labs ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3. Here, on real hardware, the Internet arrives over WiFi and ether1 stays unused; the LAN is ether2–ether5.
Start the lab¶
Download the lab files and unzip them: 05-03-access-point.zip. Open a terminal inside the 05-03-access-point folder.
Upload initial/r1.rsc (hAP ax², WiFi menu) or initial/r1-legacy-wireless.rsc (hAP ac², legacy menu) to Files, then:
After about a minute reconnect WinBox to 192.168.88.1 through the cable in ether2, and check you have Internet (ping www.mikrotik.com).
In every command below, replace 13_JohnDoe with your number and name, and the passphrase with your own.
Step 1 · Create the security settings¶
Why: an AP without security is an open café where everybody can read everything. Define the password first, then use it in the AP.
WinBox: WiFi → Security tab → + (name sec-ap, Authentication Types WPA2 PSK and WPA3 PSK, Passphrase).
WinBox: Wireless → Security Profiles → + (name ap, Mode dynamic keys, Authentication Types WPA2 PSK, Unicast and Group Ciphers aes ccm, WPA2 Pre-Shared Key).
/interface wireless security-profiles add name=ap mode=dynamic-keys authentication-types=wpa2-psk unicast-ciphers=aes-ccm group-ciphers=aes-ccm wpa2-pre-shared-key="mtcna-13-JohnDoe"
/interface wireless security-profiles print
dynamic keys is the WPA/WPA2 mode: each client gets its own encryption keys, derived from the shared password.
Expected: the new entry in the list (the password itself is hidden in export).
Check yourself
Why do we leave wpa-psk (WPA, not WPA2) and the tkip cipher unchecked?
Done when: sec-ap (or ap) exists with WPA2 (and WPA3 on the WiFi menu).
Step 2 · Turn the 5 GHz radio into an access point¶
Why: this is the core of slide 220: mode AP, band, channel, SSID, security.
WinBox: WiFi → Channels → + (ch-ap), WiFi → Configurations → + (cfg-ap), then double-click wifi1 and choose Configuration cfg-ap, press Enable.
/interface wifi channel add name=ch-ap band=5ghz-ax width=20mhz frequency=5180,5200,5220,5240
/interface wifi configuration add name=cfg-ap mode=ap ssid=13_JohnDoe country=Spain security=sec-ap channel=ch-ap
/interface wifi set [find default-name=wifi1] configuration=cfg-ap disabled=no
The channel list 5180–5240 MHz is channels 36–48: no DFS, so the AP starts at once. The AP picks the least busy of the four.
WinBox: Wireless → WiFi Interfaces → wlan2 → Wireless tab (Advanced Mode): Mode ap bridge, Band 5GHz-A/N/AC, Channel Width 20MHz, Frequency 5180, SSID, Security Profile ap, Country spain. Press Enable.
Expected: the interface shows the flag R (running) after a few seconds:
On your phone, the network 13_JohnDoe appears in the WiFi list. Do not connect yet.
Check yourself
Which frequency (MHz) did your AP end up on? Why did we not have to pick a channel for the station in Lab 05-01, but we do for the AP?
Done when: your SSID is visible from your phone.
Step 3 · Bridge the wireless interface with the LAN¶
Why: without this, clients would connect to the AP and get no IP address (slide 221: "add the wireless interface to the bridge").
WinBox: Bridge → Ports → +, Interface wifi1 (legacy: wlan2), Bridge bridge1.
Expected: bridge1 now has five ports: ether2–ether5 and the WiFi interface.
Optional, single-radio routers only
If your router has only one radio, it was your uplink. Do what slide 220 says: /ip dhcp-client disable [find interface=wlan1], then use wlan1 in steps 2 and 3. You lose the Internet; that is expected.
Check yourself
After this step, which DHCP server will give an address to a phone that joins your WiFi? From which pool?
Done when: the WiFi interface is a port of bridge1.
Step 4 · Connect your laptop and phone, and read the registration table¶
Why: prove that it works end to end, and learn the tool you will use every time a user says "the WiFi doesn't work".
- Connect your phone to
13_JohnDoewith your passphrase. Open a web page. - Unplug the cable from your laptop and connect the laptop to
13_JohnDoetoo. - Open WinBox again (192.168.88.1, now over WiFi).
WinBox: WiFi → Registration (legacy: Wireless → Registration).
Expected: two entries in the registration table (phone and laptop), each with its MAC address, signal (dBm), tx/rx rate and uptime; and two DHCP leases in 192.168.88.0/24 with the same MAC addresses.
Phones hide their real MAC
Modern phones and laptops use a private (random) MAC address for each WiFi network by default. The MAC in your registration table is not the one printed in the phone's "About" screen. It usually stays the same for this network, but can change if you "forget" the network. Keep that in mind for Lab 05-05.
Check yourself
Walk to the other side of the classroom with your phone and print the registration table again. What happens to the signal and the tx rate? Why?
Done when: your laptop and phone browse the Internet through your AP and both appear in the registration table.
Step 5 · Restore (end of the lab)¶
The course asks you to restore the previous configuration when you finish. Plug the cable back into ether2 and either reload the initial file (same reset command as in Start the lab) or simply disable the AP:
The final/ files keep the AP enabled: that is the solved state, and the starting point of Labs 05-04 and 05-05.
If something goes wrong¶
| Symptom | Likely cause | Fix |
|---|---|---|
| The SSID does not appear on the phone | interface still disabled, or wrong radio | /interface wifi print (flag X = disabled); use the 5 GHz radio wifi1 / wlan2 |
| The SSID appears a minute late | the AP is on a DFS channel and is listening for radars | normal; or use channels 36–48 (5180–5240 MHz) |
| The phone says "wrong password" | passphrase typo, or legacy profile without wpa2-psk |
re-type it in the security profile; check authentication-types |
| The phone connects but gets no IP ("no Internet", 169.254.x.x) | WiFi interface not in bridge1 | Step 3 |
| Connected and has an IP, but no Internet | the uplink (wifi2 / wlan1) lost ClassAP, or you disabled the DHCP client | /ip dhcp-client print must show bound |
| An old laptop cannot see the network | it only does 2.4 GHz, and your AP is on 5 GHz | use a newer device, or build the AP on the 2.4 GHz radio |
failure: device already added as bridge port |
Step 3 done twice | nothing to fix |
Clean up¶
Step 5 restores the router. Plug your laptop back into ether2 with the cable before the next lab.
Key takeaways¶
- An access point needs mode (ap-bridge / ap), band, channel, SSID, security and the country; a station only needs band, SSID and security.
- Use WPA2 + WPA3 (WPA3 is only in the new WiFi menu); never WEP, WPA or TKIP; the passphrase is the whole security of a PSK network.
- In the legacy menu the password lives in a security profile (mode dynamic keys); in the WiFi menu, in a security object assigned through a configuration.
- Add the WiFi interface to the bridge so wireless clients share the LAN, its DHCP server and its Internet.
- The registration table lists connected clients with MAC, signal, rates and uptime: your first stop when "the WiFi doesn't work".
- Hide SSID is not security, and modern devices use private MAC addresses.
Quick check¶
1. Which security setting should a new access point use today?
- WPA2 and WPA3 together with a long passphrase
- WEP with a 128-bit key
- WPA with the TKIP cipher
- An open network with a hidden SSID
WPA2 + WPA3 (transition mode) lets old devices use WPA2 and new ones the stronger WPA3. WEP and WPA/TKIP are broken, and a hidden SSID protects nothing.
2. A phone joins your AP and shows 'connected, no Internet' with a 169.254.x.x address. What did you most likely forget?
- Adding the wireless interface to bridge1
- Setting the country of the AP to Spain
- Enabling WPA3 in the security settings
- Giving the AP a frequency in the 2.4 GHz band
169.254.x.x means the phone got no DHCP answer. The DHCP server runs on bridge1; until the WiFi interface is a bridge port, phones on WiFi never reach it.
3. What is the difference between the legacy modes ap-bridge and bridge?
- ap-bridge accepts many clients, bridge accepts only one
- ap-bridge uses 5 GHz, bridge uses 2.4 GHz
- ap-bridge has encryption, bridge is always open
- ap-bridge is a station, bridge is an access point
Both are AP modes. ap-bridge is the normal multi-client AP; bridge allows a single client, for point-to-point links.
4. Why does an access point need a frequency while a station does not?
- The AP chooses where to transmit; the station scans to find it
- Stations always use channel 1 by law
- The station copies the frequency from the DHCP server
- Stations only work in the 2.4 GHz band
The AP decides the channel and broadcasts beacons there. The station scans its scan list until it hears the SSID, so its frequency does not matter (slide 206).
5. Where do you see the clients connected to your AP, with their signal and speed?
- In the registration table
- In the connect list
- In the security profiles
- In the IP routes
The registration table (WiFi → Registration / Wireless → Registration) lists every associated client: MAC, signal, tx/rx rate and uptime.
6. Why does WPA3 resist password guessing better than WPA2?
- Its SAE handshake stops attackers testing passwords offline from a recorded login
- It forces passwords to be at least 63 characters long
- It changes the passphrase automatically every 5 minutes
- It hides the SSID from devices that do not know it
With WPA2-PSK, a recorded handshake can be attacked offline at full speed. WPA3 uses SAE, which forces the attacker to interact with the AP for every guess.
7. A course router has a single radio. It is a station of ClassAP, and you turn that radio into your AP as slide 220 says. Pick the two things that happen.
- The router loses its Internet uplink through ClassAP
- The DHCP client on that wireless interface has nothing to talk to any more
- The router keeps its Internet because the AP repeats ClassAP automatically
- The router's LAN ports stop working until the AP is disabled
One radio cannot be your AP and a station of ClassAP at the same time (unless you set up a repeater). The uplink disappears, so the course asks you to disable the DHCP client and accept having no Internet. The LAN keeps working.
Your router is now a real access point. In the next lab you will let a guest in without telling them the password, with WPS.