howITwork

MikroTik router setup, step by step (RouterOS 7)

A safe, step-by-step basic setup for a MikroTik router running RouterOS 7: internet on ether1 (DHCP or PPPoE), a LAN with DHCP, DNS, NAT, a sensible firewall, and the security steps most guides skip. Every command can be pasted into the WinBox terminal.

Before you start

  • Use WinBox (download it from mikrotik.com) and connect to the router by its MAC address, so a wrong IP setting can’t lock you out.
  • Turn on Safe Mode (the Safe Mode button in WinBox, or Ctrl+X in the terminal). If your connection drops, the router undoes your recent changes.
  • Take a backup first, even on a new router:
/system backup save name=before-setup
/export file=before-setup

This guide assumes ether1 is the internet (WAN) port and ether2 to ether5 are the office LAN. Many home and small-office models ship with a default configuration that already does most of this; read it with /export and adjust rather than starting from nothing.

1. Name the router and secure the admin account

/system identity set name=office-router
# create your own admin user, then disable the default "admin"
/user add name=netadmin group=full password="use-a-long-unique-password"
/user disable admin

Log in again as the new user before disabling admin.

2. Put the LAN ports in a bridge and give it an address

/interface bridge add name=bridge-lan
/interface bridge port add bridge=bridge-lan interface=ether2
/interface bridge port add bridge=bridge-lan interface=ether3
/interface bridge port add bridge=bridge-lan interface=ether4
/interface bridge port add bridge=bridge-lan interface=ether5
/ip address add address=192.168.88.1/24 interface=bridge-lan

3. Connect to the internet

Use one of these, depending on your ISP.

# ISP gives an address automatically (cable, fibre ONT in router mode)
/ip dhcp-client add interface=ether1 disabled=no

# ISP uses PPPoE (common for fibre and DSL in Pakistan)
/interface pppoe-client add name=pppoe-out1 interface=ether1 
    user="your-isp-username" password="your-isp-password" 
    add-default-route=yes use-peer-dns=yes disabled=no

4. Interface lists (makes the firewall simple)

/interface list add name=WAN
/interface list add name=LAN
/interface list member add list=LAN interface=bridge-lan
/interface list member add list=WAN interface=ether1
# with PPPoE, also add the PPPoE interface to WAN
/interface list member add list=WAN interface=pppoe-out1

5. DHCP server for the LAN

/ip pool add name=lan-pool ranges=192.168.88.100-192.168.88.200
/ip dhcp-server add name=lan-dhcp interface=bridge-lan address-pool=lan-pool disabled=no
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1

Keep printers, access points and servers outside 100 to 200, or give them reservations later.

6. DNS

/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes

allow-remote-requests=yes lets LAN clients use the router for DNS. The firewall below makes sure the internet can’t, otherwise your router becomes an open DNS resolver that attackers abuse.

7. NAT (share one public address)

/ip firewall nat add chain=srcnat out-interface-list=WAN action=masquerade

8. Firewall: protect the router and the LAN

/ip firewall filter
# traffic to the router itself
add chain=input action=accept connection-state=established,related,untracked comment="allow replies"
add chain=input action=drop connection-state=invalid comment="drop invalid"
add chain=input action=accept protocol=icmp comment="allow ping"
add chain=input action=drop in-interface-list=!LAN comment="drop everything not from LAN"
# traffic passing through the router
add chain=forward action=accept connection-state=established,related,untracked comment="allow replies"
add chain=forward action=drop connection-state=invalid comment="drop invalid"
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat 
    in-interface-list=WAN comment="drop new connections from the internet"

Order matters: RouterOS checks rules from the top and stops at the first match. Add new “allow” rules above the “drop” rules.

9. Switch off what you don’t use

/ip service disable telnet,ftp,www,api,api-ssl
/ip service set winbox address=192.168.88.0/24
/ip service set ssh address=192.168.88.0/24
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LAN

10. Update RouterOS and the firmware

/system package update check-for-updates
/system package update install
# after it reboots, update the RouterBOARD firmware too
/system routerboard upgrade
/system reboot

Stay on the stable or long-term channel for office routers.

11. Check it works

/ip address print
/ip route print          # a default route 0.0.0.0/0 should be active
/ping 1.1.1.1 count=4
/ping google.com count=4  # tests DNS too
/ip dhcp-server lease print

12. Back up the finished config

/system backup save name=office-router-final      # binary backup, same model only
/export file=office-router-config                 # readable script, keep a copy off the router

Download both from the WinBox Files menu. A binary backup restores only to the same model; the export can be read, compared and re-applied.

Using AI to write MikroTik configs

AI assistants can draft RouterOS commands quickly, but check every line before pasting: confirm the interface names match yours (/interface print), never paste your real PPPoE password or public IP into a chatbot, and always apply changes with Safe Mode on. The firewall section above is the part AI most often gets wrong, usually by forgetting the “drop everything not from LAN” input rule.

More IT guides · howITwork on YouTube