MikroTik Configuration and RouterOS Setup in Istanbul

What does MikroTik configuration cover?

A MikroTik setup covers updating RouterOS, building the interface and VLAN structure, writing firewall and NAT rules, bringing up VPN tunnels, balancing two internet lines where needed and configuring wireless. Management is done through WinBox, WebFig or the command line; we apply changes from the command line so they are repeatable and easy to back up.

Beyond that, RouterOS has plenty more to offer, including hotspot (captive portal), bandwidth management with queues, OSPF and BGP. You do not need to switch it all on. Working out which features the project will actually use, and configuring only those, keeps the device both secure and understandable.

Is the MikroTik default configuration secure?

The default configuration is a good starting point, but not enough on its own. According to MikroTik’s own documentation, the factory firewall blocks connections from the WAN side and that rule is there on purpose; if you need remote management, the advice is to use a VPN such as WireGuard rather than open a port to the internet (MikroTik: Securing your router). The most common mistake we find in the field is exactly that rule having been deleted to allow remote access.

These are the hardening steps we apply during setup:

• Upgrade RouterOS to the current stable release
• Disable the default “admin” user and create named accounts with passwords of at least 12 characters
• Turn off MAC-Telnet, MAC-WinBox, MAC-Ping, proxy, SOCKS, UPnP and remote DNS requests unless they are needed
• Make management services (WinBox, SSH) reachable from the management network only
• Disable unused interfaces

How do you write MikroTik firewall rules?

In the RouterOS firewall, traffic addressed to the router itself is filtered in the “input” chain, and traffic passing through it in the “forward” chain. A solid rule set opens by accepting established and related connections and dropping invalid packets; after that, only explicitly permitted traffic gets through, and everything else is dropped at the end.

Address lists cut down the number of rules: we define lists such as “admin-pcs”, “servers” and “branches” and write the rules against them. In a 25-person architecture practice, say, the guest Wi-Fi, the staff network and the NAS holding the drawings sit in separate VLANs. The forward chain drops everything from the guest network to the internal networks, and only the file-sharing ports are open from the staff network to the NAS.

MikroTik VPN: WireGuard or IPsec?

Choose WireGuard if both ends are MikroTik or a few administrators need remote access, and IPsec (IKEv2) if there is another vendor’s firewall at the far end. WireGuard is built into RouterOS 7, with a default listen port of 13231 and a default MTU of 1420 (MikroTik: WireGuard). Its configuration is short, which leaves less room for mistakes.

IPsec is the common language for talking to a FortiGate, pfSense or a cloud virtual network gateway (MikroTik: IPsec). The encryption and key exchange parameters must match exactly at both ends, and most “the tunnel is up but no traffic passes” problems come from there. We design head office to branch tunnels as part of VPN server setup.

How do you load balance two internet lines on MikroTik?

The usual way to balance two lines on a MikroTik is PCC (Per Connection Classifier): every packet in a connection always uses the same line, while different connections are spread across the lines (MikroTik: Per connection classifier). If we classify by source address, each user always goes out through the same line, which avoids trouble with banking and government sites that drop the session when the source IP changes.

Alongside balancing, failover to the other line has to be set up too. Checking whether the modem is up is not enough: when there is an outage inside the provider’s network, the modem carries on answering. So we use recursive routes that check internet targets beyond the line itself. If you need more detailed quality measurement and application-based routing, FortiGate SD-WAN is worth considering.

How do you manage MikroTik Wi-Fi with CAPsMAN?

CAPsMAN lets you manage the wireless settings of several MikroTik access points from one place: SSID, security and channel settings are written once and pushed out to every device (MikroTik: CAPsMAN). When a new access point is added, it picks up its configuration from the centre.

Watch the version differences here. The “WiFi” menu introduced in RouterOS 7.13 manages Wi-Fi 5 wave2 and newer radios, and needs the right driver package for the device (wifi-qcom or wifi-qcom-ac) (MikroTik: WiFi). On networks with a mix of older and newer devices, we plan up front which device will be managed by which CAPsMAN. For floor plans, access point placement and 802.1X, see our enterprise Wi-Fi installation page.

What you receive

• Up-to-date RouterOS with hardened management access
• VLAN structure, firewall and NAT rules, and address lists
• WireGuard or IPsec VPN tunnels
• Dual WAN load balancing and a line failure scenario (where needed)
• Central Wi-Fi management with CAPsMAN (where needed)
• Automatic configuration backups and a handover document

How we work

1. 1

   Free review

   We review your current MikroTik configuration, lines and requirements, and report any security weaknesses in writing.

2. 2

   Plan

   We draw up the VLAN, firewall, VPN and line balancing design and put it to you for sign-off.

3. 3

   Configuration

   We update RouterOS and apply the rules, tunnels and wireless settings.

4. 4

   Testing

   We test line failure, VPN access and access between segments.

5. 5

   Handover

   We hand over the backups, the documentation and the admin accounts.

Frequently asked questions