Complete MikroTik RouterOS 7 Initial Configuration Using WinBox

Explain It Simply

This lesson takes a brand-new MikroTik router — untouched, factory default — and gets it to the point where devices on your LAN can reach the Internet safely. Every step explains what it’s doing and why, not just what to click.

Terminology

• WinBox — MikroTik’s graphical configuration utility, connecting over MAC address or IP.
• Terminal — The command-line interface (CLI) available within WinBox or via SSH.
• Bridge — A RouterOS interface that switches traffic between the physical ports assigned to it, the way a hardware switch would.
• Identity — The device’s hostname within RouterOS.

---

1. Initial Access

On first boot, a factory-default RouterOS device has no configuration — no bridge, no addressing, no DHCP client. Connect a laptop directly to one of the switch ports (e.g., ether2) and open WinBox.

WinBox can discover the device by MAC address even before it has an IP address, which is why it’s the recommended tool for first contact with unconfigured hardware.

WinBox Procedure:

1. Open WinBox and click on the Neighbors tab.
2. Wait a moment for your router’s MAC address to appear.
3. Click directly on the MAC Address (not the IP address).
4. Login with user admin and leave the password blank.
5. Click Connect.

---

2. Device Identity and Security

Before anything else, rename the device from its default identity to something meaningful for your inventory, and set a strong password.

WinBox Procedure:

1. Password: Go to System -> Password. Enter your new strong password and click Apply.
2. Identity: Go to System -> Identity. Change the name to something like Core-Router and click OK.

---

3. Bridge and LAN Addressing

We need to group your LAN-facing ports into a single bridge interface, then assign the bridge a LAN IP address. This IP becomes the “default gateway” for all devices on your LAN.

What is actually happening? Without a bridge, every port on the router acts as a completely separate network. A bridge software-links these ports together so they act like a normal 4-port switch you’d find on a home router.

WinBox Procedure:

1. Create the Bridge: Go to Bridge -> Bridge tab. Click + (Add), name it bridge-LAN, and click OK.
2. Add Ports: Go to the Ports tab in the Bridge window. Click +. Select ether2 for the Interface and bridge-LAN for the Bridge. Repeat this for ether3, ether4, etc.
3. Assign IP: Go to IP -> Addresses. Click +. Enter your chosen LAN subnet, e.g., 192.168.88.1/24. Select bridge-LAN as the interface. Click OK.

---

4. DHCP Server and DNS

To avoid configuring IPs manually on every laptop or phone, enable a DHCP server on the bridge. The router must also act as a DNS resolver so it can forward website name requests to the Internet.

WinBox Procedure:

1. DHCP Setup: Go to IP -> DHCP Server. Click the DHCP Setup button.
   • Select bridge-LAN and click Next.
   • Keep clicking Next to accept the default network space, gateway, and IP pool.
   • Enter a DNS server (like 1.1.1.1 or 8.8.8.8) and finish the setup.
2. DNS Caching: Go to IP -> DNS. Check the box for Allow Remote Requests. Add 8.8.8.8 and 1.1.1.1 in the Servers field. Click OK.

---

5. WAN Configuration

Your WAN configuration depends entirely on what your ISP hands off.

Scenario A: DHCP WAN

When to use: Your ISP’s edge hands out an address automatically (like a cable modem).

1. Go to IP -> DHCP Client.
2. Click +, select ether1, ensure Add Default Route is checked. Click OK.

Scenario B: Static WAN

When to use: Your ISP has given you a fixed IP, gateway, and subnet mask (common in enterprise fiber).

1. Go to IP -> Addresses. Click +. Enter your public IP (e.g., 203.0.113.2/30), select ether1, click OK.
2. Go to IP -> Routes. Click +. Set Dst. Address to 0.0.0.0/0. Set Gateway to your ISP’s gateway IP (e.g., 203.0.113.1). Click OK.

Scenario C: PPPoE WAN

When to use: Your ISP authenticates you with a username and password over a PPPoE session (common on DSL/Fiber).

1. Go to PPP. Click + and select PPPoE Client.
2. On the General tab, select Interfaces: ether1.
3. On the Dial Out tab, enter your User and Password. Check Add Default Route. Click OK.

---

6. NAT (Masquerade)

LAN devices use “private” IP addresses that cannot route on the public Internet. NAT (Network Address Translation) translates these private IPs into the router’s public WAN IP.

WinBox Procedure:

1. Go to IP -> Firewall -> NAT tab.
2. Click +.
3. Chain: srcnat
4. Out. Interface: Select ether1 (or your pppoe-out1 interface if using Scenario C).
5. Go to the Action tab.
6. Action: masquerade. Click OK.

---

7. Firewall

A factory-default RouterOS device has absolutely no firewall. Applying a basic input/forward firewall is mandatory before connecting to the Internet.

WinBox Procedure:

1. Go to IP -> Firewall -> Filter Rules tab.
2. Accept Established/Related (Input): Click +. Chain: input. Connection State: check established and related. Action: accept.
3. Drop Invalid (Input): Click +. Chain: input. Connection State: invalid. Action: drop.
4. Drop External Management (Input): Click +. Chain: input. In. Interface: ether1 (or PPPoE). Action: drop.
5. Repeat the same three rules but change the Chain to forward.

---

Can You Explain It?

Close the lesson and answer these without looking back. The goal isn't the wording — it's whether you've formed a usable mental model.

• Why does a factory-default router have no firewall, and why does that matter?
• What's the difference between static, DHCP, and PPPoE WAN — and why can't you configure all three at once?
• What would you check first if LAN clients get a DHCP lease but can't reach the Internet?

Official References

• MikroTik Help — RouterOS
• MikroTik Manual