Lab 05-04 · WPS: let a guest in without the password¶
MTCNA
Module 5 · Wireless. Official course slides 212–218 (WPS, WPS accept, WPS client) and the optional WPS LAB (slide 222: connect a WPS-capable device to your AP using the WPS accept button, physical or virtual, and check the router's logs).
Real hardware in class
This lab is config-only and optional in the official course: it is done on the real MikroTik router on your desk (a virtual CHR has no radio). It starts where Lab 05-03 ended: your AP 13_JohnDoe on the 5 GHz radio.
Your grandmother comes for lunch and asks for the WiFi password. Your password is T7#qm-Wz!r9pLx, because you did Lab 05-03 properly. Do you really want to dictate that, letter by letter, while she types it on a tablet with her index finger?
WPS was invented for exactly this moment: press a button on the router, press a button on the device, done. No password typed. Today you will try it, read what the router logs while it happens, and learn why one flavour of WPS is so dangerous that RouterOS simply refuses to implement it.
What you will learn
- Explain what WPS does and how the push-button method works (the 2-minute window)
- Enable WPS on your AP and press the virtual WPS button from WinBox or the CLI
- Connect a device with WPS (a Windows laptop, or another RouterOS router as WPS client)
- Follow the connection in the router's log
- Explain why the PIN method is insecure (11,000 guesses) and why RouterOS does not support it
The door buzzer¶
Our analogy for this lab: the buzzer of a block of flats.
When a visitor rings, you do not go downstairs to give them a key: you press the buzzer in your flat and the street door unlocks for a few seconds. Whoever pushes the door in that moment gets in.
WPS (WiFi Protected Setup) is a Wi-Fi Alliance standard to join a WPA2-protected network without typing the password. In push-button mode, you press a button on the AP and, within 2 minutes, a button on the device; the AP then sends the device the network's password over the air.
| Block of flats | WPS push-button |
|---|---|
| You press the buzzer | WPS Accept: press the AP's button (physical or virtual) |
| The street door stays unlocked a few seconds | The AP accepts WPS for 2 minutes or until one device connects |
| The visitor pushes the door | The device starts its WPS client |
| The visitor gets in once; next time they ring again | Each new device needs a new press; a device that joined keeps the password |
flowchart LR
A["<b>1. WPS Accept</b><br>button on the AP<br>(physical or virtual)"] --> W["<b>2-minute window</b><br>the AP accepts WPS"]
D["<b>2. WPS client</b><br>on the device<br>(Windows, RouterOS...)"] --> W
W --> K["<b>3. The AP sends the<br>SSID and passphrase</b>"]
K --> C["<b>4. The device joins</b><br>with normal WPA2"]WPS does not replace WPA2
WPS only delivers the password. After that, the device connects with normal WPA2/WPA3 and the same passphrase as everybody else. It is a delivery service, not a different kind of lock.
The insecure brother: the WPS PIN¶
WPS also has a PIN method: an 8-digit number printed on a sticker under many home routers. Type it on the device and you are in.
In December 2011 the researcher Stefan Viehböck showed that the PIN can be guessed in hours: the router checks it in two halves and the last digit is only a checksum, so instead of 10⁸ (100 million) combinations an attacker needs at most 10⁴ + 10³ = 11,000 tries. Many routers had the PIN enabled by default and could not even turn it off. Anyone parked outside could get the WiFi password.
RouterOS does not support the PIN mode at all (slide 215): only push-button. And it lets you disable WPS completely.
Who can be a WPS client?¶
| Device | WPS push-button? |
|---|---|
| Windows 10 / 11 laptop | yes: when you pick the network it says you can also connect by pressing the button on the router |
| RouterOS router (station) | yes: WPS Client button / wps-client command |
| Printers, TV boxes, WiFi extenders | usually yes: often a physical WPS button |
| Android phones | deprecated in Android 9 (2018); most phones no longer offer it |
| iPhone / iPad | never supported |
That is why slide 222 says "if you have a device that supports WPS client mode".
WPS in the two RouterOS menus¶
WiFi (/interface wifi) |
Legacy (/interface wireless) |
|
|---|---|---|
| Where is the WPS setting | security object: wps=push-button (the default) or wps=disable (without "d": the manual says disabled, RouterOS 7.23.8 only accepts disable) |
interface: wps-mode=push-button, push-button-virtual-only or disabled (default depends on model) |
| Virtual button (AP) | /interface wifi wps-push-button wifi1 |
/interface wireless wps-push-button wlan2 |
| WPS client (station) | /interface wifi wps-client <interface> |
/interface wireless wps-client <interface> |
WPS is on by default in the new WiFi menu
On the WiFi package security.wps defaults to push-button. Anyone who presses the physical button on your router (if it has one) can let a device in. In a shop or a classroom, where strangers can touch the router, set wps=disable.
The scenario¶
| Node | Role | Address |
|---|---|---|
class-ap |
teacher's router, AP ClassAP (2.4 GHz) | 10.0.0.1/24 |
r1 2.4 GHz radio (wifi2 / wlan1) |
station of ClassAP (Internet) | 10.0.0.x (DHCP) |
r1 5 GHz radio (wifi1 / wlan2) |
your AP 13_JohnDoe, port of bridge1 |
— |
r1 bridge1 |
LAN (ether2–ether5 + your AP) | 192.168.88.1/24 |
| WPS client | a Windows laptop, or your neighbour's router | 192.168.88.x (DHCP) |
flowchart LR
CAP["<b>ClassAP</b><br>Internet"] -. "2.4 GHz" .- UP
subgraph R1["<b>r1</b> (your router)"]
UP["wifi2 / wlan1<br>station"]
AP["wifi1 / wlan2<br>AP <b>13_JohnDoe</b><br><b>WPS accept</b>"]
end
AP -. "5 GHz, WPS<br>then WPA2" .- G["<b>Guest device</b><br>WPS client"]Where is ether1?
On a real hAP the Internet port is ether1; in the virtual labs ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3. Here, on real hardware, the Internet arrives over WiFi and ether1 stays unused; the LAN is ether2–ether5.
Start the lab¶
Download the lab files and unzip them: 05-04-wps.zip. Open a terminal inside the 05-04-wps folder.
The starting point is the solution of Lab 05-03 (your AP is already running). Upload initial/r1.rsc (hAP ax²) or initial/r1-legacy-wireless.rsc (hAP ac²) to Files, then:
Reconnect WinBox to 192.168.88.1 by cable (ether2). Replace 13_JohnDoe and the passphrase with yours if you edited the file.
Step 1 · Check (or enable) WPS push-button on your AP¶
Why: the AP must be willing to hand out its password before anyone presses anything.
WinBox: WiFi → Security → sec-ap → WPS = push button.
WinBox: Wireless → WiFi Interfaces → wlan2 → Wireless tab (Advanced Mode) → WPS Mode = push button.
/interface wireless set [find default-name=wlan2] wps-mode=push-button
/interface wireless print detail where default-name=wlan2
push-button-virtual-only would ignore the router's physical button and accept only the virtual one.
Expected: wps=push-button (WiFi) or wps-mode=push-button (legacy).
Check yourself
Does your router model have a physical WPS button? (Look at the case: on many MikroTik routers it is the res/wps or mode button.) Who could press it?
Done when: WPS push-button is enabled on your AP.
Step 2 · Start following the log¶
Why: slide 222 asks you to check the router's logs during the process. Open the log before pressing the button so you see everything in order.
WinBox: Log (left menu). In the terminal, open a second New Terminal window and run:
Leave it running. You will see one line per WiFi event: clients connecting and disconnecting, and the WPS activity. Stop it later with Ctrl+C.
Done when: the log window is open and updating.
Step 3 · Press the virtual WPS button¶
Why: this opens the 2-minute window (the buzzer).
You now have 2 minutes. Go to Step 4 straight away.
Done when: the button has been pressed (no error in the terminal).
Step 4 · Connect a device with WPS¶
Why: this is the guest pushing the door.
- Unplug the cable. Click the WiFi icon, choose
13_JohnDoe, click Connect. - When Windows asks for the network security key, it also says you can connect by pushing the button on the router. Do not type anything: if you pressed it in Step 3 less than 2 minutes ago, Windows receives the key and connects.
Pair with a classmate. On their router (legacy menu, 5 GHz radio wlan2 free or a second unit), while you press WPS Accept on yours:
WinBox: Wireless → WiFi Interfaces → WPS Client (slides 216–218). When it says success, the router has created the security profile wps-profile with your passphrase. To actually connect, set the interface as in slide 218:
On their router (WiFi menu), with a radio that is free to be a station:
The WiFi package also has create-profile and duration options for this command. When it reports success, check with /interface wifi print detail and /interface wifi security print what it obtained, and make sure the interface is in mode=station with your SSID.
Look at the log of your router: the guest's MAC address appears as connected to wifi1/wlan2. Then:
Check yourself
Copy into your report the log lines from the moment you pressed the button until the device connected. Then press nothing, and try to connect a second device with WPS. What happens, and why?
Done when: a device joined your AP without anyone typing the passphrase, and it appears in the registration table.
Step 5 · Close the door again (good practice)¶
Why: WPS is convenient, but every press is an open door for 2 minutes, and a physical button can be pressed by anyone who can reach the router. When you do not need it, turn it off.
The course asks you to restore the previous configuration at the end: reload this lab's initial/ file with the reset command. The final/ files show the solved state of slide 222 (WPS push-button enabled).
Check yourself
The device that joined by WPS in Step 4: can it still connect tomorrow, after you disabled WPS? Why?
Done when: you know how to turn WPS off and why you would.
If something goes wrong¶
| Symptom | Likely cause | Fix |
|---|---|---|
| Windows never offers the "push the button" option | WPS disabled on the AP, or more than 2 minutes passed | Step 1, then press the button again and connect immediately |
| The client says "WPS timeout" | the AP window closed (2 minutes, or another device used it) | press the button again; one press = one device |
wps-client finds nothing |
the client scans the wrong band (your AP is on 5 GHz) | use a 5 GHz-capable radio on the client |
| Phone has no WPS option | modern Android and iOS do not support WPS | use a Windows laptop or a router as client |
| Legacy: WPS button does nothing | wps-mode=disabled on that model by default |
set wps-mode=push-button |
| The client joined but has no IP | your AP is not in bridge1 | redo Lab 05-03 Step 3 |
Clean up¶
Plug the laptop back into ether2, and reload this lab's initial/ file (or leave WPS disabled as in Step 5).
Key takeaways¶
- WPS delivers the WPA2 passphrase to a device without typing it; afterwards the device connects normally.
- Push-button: press WPS Accept on the AP (physical or virtual) and start the WPS client on the device; the AP accepts for 2 minutes or until one device connects.
- Each new device needs a new press; a device that joined keeps the password.
- The PIN method is broken (at most 11,000 guesses, Viehböck, 2011); RouterOS does not support it.
- In the WiFi menu WPS lives in the security object (
wps=push-buttonby default); in the legacy menu it is the interface's wps-mode. - Turn WPS off when you do not need it, especially on routers strangers can touch.
Quick check¶
1. What does WPS push-button actually give to the device?
- The network's SSID and passphrase, so it can join with normal WPA2
- A separate password that only works for that device
- An IP address reserved in the DHCP server
- A permanent exception that skips encryption
WPS is a delivery service: it sends the SSID and passphrase to the device, which then connects with normal WPA2/WPA3, exactly like a device whose user typed the password.
2. For how long does a RouterOS AP accept WPS after the button is pressed?
- 2 minutes, or until one device connects
- 10 seconds, like a door buzzer
- Until the router is rebooted
- 24 hours, for every device that tries
After WPS Accept the AP accepts WPS for 2 minutes or until one station has connected (slide 213). Each new device needs a new press.
3. Why is the WPS PIN method considered insecure?
- The PIN is checked in two halves, so about 11,000 guesses are enough
- The PIN is sent in plain text inside every beacon
- The PIN is the same on every router in the world
- The PIN disables WPA2 encryption while it is active
The 8-digit PIN is verified in two halves and its last digit is a checksum, so an attacker needs at most 10⁴ + 10³ = 11,000 attempts instead of 100 million. RouterOS does not implement it.
4. In the new WiFi menu, where do you switch WPS off?
- In the security object, with wps=disable
- In the channel object, with frequency=0
- In the bridge, by removing the WiFi port
- In the DHCP server, by disabling the lease
In /interface wifi WPS is a property of the security settings: wps=push-button (the default) or wps=disable. In the legacy menu it is the interface's wps-mode.
5. A device joined your AP with WPS yesterday. Today WPS is disabled. What happens when the device comes back?
- It connects normally, because it saved the passphrase
- It cannot connect until someone presses WPS again
- It connects without encryption
- It is moved to a guest network automatically
WPS only delivered the passphrase once. The device stored it, so it reconnects with normal WPA2 whether WPS is on or off. That is also why a stolen passphrase stays valid until you change it.
6. Your router is in the school corridor, where anyone can reach it, and it has a physical WPS button. What is the safest setting?
- Disable WPS on the AP
- Keep WPS push-button enabled so guests can join easily
- Switch WPS to PIN mode with a sticker on the router
- Hide the SSID so nobody sees the WPS button
With push-button enabled, anyone who presses the physical button can let a device in. Disable WPS (wps=disable / wps-mode=disabled). PIN mode does not exist in RouterOS, and hiding the SSID protects nothing.
7. Your grandmother's tablet (Android 13) and your aunt's Windows 11 laptop both need the WiFi. Pick the two true statements.
- The Windows laptop can join with WPS push-button
- The tablet will most likely need the passphrase typed
- Both can join with the WPS PIN printed under the router
- Pressing WPS once lets both devices in at the same time
Windows supports WPS push-button; Android deprecated WPS in Android 9, so recent tablets usually do not offer it. RouterOS has no PIN mode, and one press admits one device.
Guests are in. In the last lab of the module you will decide who may stay, when, and whether WiFi clients may talk to each other: the access list.