Learn.GTArsenals
Search

Quick Start

New Router (MikroTik RouterOS)

Get a factory-default MikroTik router from unbox to a working, secured LAN and WAN.

Objective Configure a factory-default MikroTik router with LAN, DHCP, WAN, NAT, and a basic firewall.
Device MikroTik RouterOS 7 (any current model)
Time 30-45 min

This is the fast-path version of Complete MikroTik RouterOS 7 Initial Configuration Using WinBox — use that lesson if you want the full explanation behind each step.

Required Information

Before you start, gather the following:

  • WAN Scenario: Static, DHCP, or PPPoE (Check your ISP documentation).
  • Intended LAN Subnet: e.g., 192.168.88.0/24.
  • Strong Administrator Password: Ready to be applied.

Interactive Configuration Generator

Use this tool to instantly generate the exact RouterOS script for your environment. Copy the output and paste it into your MikroTik terminal.

Network Parameters

Generated RouterOS CLI

1. Initial Access & Security

Why: By default, a factory reset MikroTik router has an open admin account. We must secure this and set an identity.

# Connect via MAC address in WinBox or terminal, then set identity and password
/system identity set name="Core-Router"
/user set admin password="YourStrongPasswordHere"
  1. Open WinBox and connect via MAC Address (Login: admin, Password: [blank]).
  2. Go to System → Identity and enter Core-Router. Click OK.
  3. Go to System → Users, double-click admin, click Password, and set your strong password.

2. LAN Bridge & IP Addressing

Why: RouterOS requires a software “Bridge” to group physical ports together so they act as a single switch.

# Create the bridge and add ports ether2-ether5
/interface bridge add name=bridge-LAN
/interface bridge port
add bridge=bridge-LAN interface=ether2
add bridge=bridge-LAN interface=ether3
add bridge=bridge-LAN interface=ether4
add bridge=bridge-LAN interface=ether5

# Assign the LAN subnet gateway IP to the bridge
/ip address add address=192.168.88.1/24 interface=bridge-LAN
  1. Go to Bridge → Bridge tab. Click [+], name it bridge-LAN, click OK.
  2. Go to Bridge → Ports tab. Click [+] and add ether2 to bridge-LAN. Repeat for ether3, ether4, and ether5.
  3. Go to IP → Addresses. Click [+], set Address to 192.168.88.1/24, Interface to bridge-LAN. Click OK.

3. DHCP Server for LAN

Why: Clients need IP addresses automatically assigned to them when they connect.

# Define the pool of addresses to hand out
/ip pool add name=dhcp-pool ranges=192.168.88.10-192.168.88.250

# Create the DHCP server on the bridge
/ip dhcp-server add address-pool=dhcp-pool interface=bridge-LAN name=dhcp1 disabled=no

# Provide clients with a gateway and DNS servers
/ip dhcp-server network add address=192.168.88.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.88.1
  1. Go to IP → DHCP Server → DHCP Setup button.
  2. Select bridge-LAN. Click Next until finished (accept default ranges and add 8.8.8.8 as DNS).

4. WAN Configuration (Internet Access)

Why: The router needs an IP address from your ISP on the WAN port (ether1).

# Assuming dynamic IP (DHCP) from the ISP
/ip dhcp-client add interface=ether1 disabled=no
  1. Go to IP → DHCP Client.
  2. Click [+]. Select ether1 as the interface. Check “Use Peer DNS” and “Use Peer NTP”. Click OK.

5. NAT (Network Address Translation)

Why: Private LAN IPs (192.168.x.x) cannot route over the public internet. NAT translates them behind the router’s public IP.

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
  1. Go to IP → Firewall → NAT tab.
  2. Click [+]. In General, set Chain to srcnat and Out. Interface to ether1.
  3. In Action, set Action to masquerade. Click OK.

6. Basic Firewall

Why: A factory default router has no firewall. We must protect it from the outside.

# Allow established/related connections
/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=forward connection-state=established,related action=accept

# Drop invalid packets
/ip firewall filter add chain=input connection-state=invalid action=drop
/ip firewall filter add chain=forward connection-state=invalid action=drop

# Drop all other incoming traffic from the WAN (assuming ether1)
/ip firewall filter add chain=input in-interface=ether1 action=drop
  1. Go to IP → Firewall → Filter Rules tab.
  2. Click [+]. Chain: input, Connection State: established and related. Action: accept.
  3. Click [+]. Chain: forward, Connection State: established and related. Action: accept.
  4. Click [+]. Chain: input, Connection State: invalid. Action: drop.
  5. Click [+]. Chain: forward, Connection State: invalid. Action: drop.
  6. Click [+]. Chain: input, In. Interface: ether1. Action: drop.

Verification

  1. Check LAN IP: Ensure your computer gets a 192.168.88.x IP address.
  2. Ping Gateway: ping 192.168.88.1
  3. Ping Internet: ping 8.8.8.8 (Tests NAT and routing).
  4. Resolve DNS: ping google.com (Tests DNS).

Common Failures

  • No DHCP lease: Verify your computer is plugged into a port assigned to bridge-LAN (e.g. ether2).
  • No Internet despite lease: Verify your default route (/ip route print) and ensure the NAT rule uses the correct out-interface.
  • Management locked out: If you applied a firewall rule dropping input on the bridge instead of the WAN interface, you will block yourself.

Production Notes

  • Backup: Run /export file=clean-initial-config and download the .rsc file.
  • Safe Mode: Always use Safe Mode in WinBox (the button at the top left) before altering firewalls or bridges.
  • Security: This is a basic firewall. For production, consider securing the management interface to specific management IPs.