MikroTik Wi-Fi Setup for iPhone and Android

1. Diagnosis: iPhone sees the network but won’t connect

You set up MikroTik. Wi-Fi is broadcasting. Your laptop joins without a hitch. Meanwhile your iPhone spins its loading wheel and after 20 seconds says “Unable to Join Network.” Android sometimes behaves even worse: it connects, gets an IP, then drops on its own a minute later. Sound familiar?

This isn’t an Apple bug or a MikroTik bug. It’s that your MikroTik Wi-Fi setup for iPhone and Android is built for a decade-old laptop, while phones today are far pickier about protocol details than Windows has ever been.

A laptop will forgive mixed encryption, swallow TKIP mixed with AES without complaint, and shrug off a wrong country code. Its driver is written with a lot of slack built in: Windows and Linux will tolerate almost any mess in access point settings. The Broadcom or Qualcomm chip inside an iPhone or Android phone follows the 802.11 spec much more strictly. If the access point doesn’t respond by the book, the phone simply refuses, with no explanation and no clear error in the UI.

That’s why the symptom “everything works except phones” almost always comes down to a specific protocol-level incompatibility, not a signal or distance problem. Below we’ll go through where that incompatibility usually hides, and why it tends to survive untouched in configs for years.

What you’ll end up with:

• Working Wi-Fi that reliably holds both iPhone and Android connections
• An understanding of what exactly broke, not just “it works now, good enough”
• Ready-made configs for RouterOS 6.x and RouterOS 7.x (wireless-cm2 and wifi-qcom)
• A diagnostic checklist in case it starts acting up again a month from now

Time needed: 20 to 30 minutes if you have Winbox and SSH access handy. Longer if you need to untangle a legacy config from a previous admin who “it worked, don’t touch it.”

This article is based on real work, from home routers to office networks with fifty-plus users. The configs below are tested on RouterOS 6.49, 7.16, and 7.23.2, on hAP ac2, hAP ax2, and RB951Ui-2HnD models. If you have a different model, the logic is the same; only interface names may differ (wlan1/wlan2 vs radio1/radio2 on some series).

System requirements

At publication time, RouterOS 7.23.2 Stable is current (there’s also 7.21.5 LTS for those who prefer not to run the bleeding edge). Before installing, check the latest releases on the MikroTik download page. Versions come out fast, and rolling back is a pain.

2. Why phones don’t get along with MikroTik

“Quite the requests you’ve got” the database would say, if it could talk, looking at a config with TKIP+AES at the same time. Here are the main causes you’ll actually run into.

• TKIP in the security profile. iPhones on iOS 14+ and modern Android phones aggressively throttle speed or refuse to connect outright to networks using TKIP or mixed TKIP+AES. Apple has officially discouraged WPA-TKIP since 2018.
• Wrong country code. If it’s set to “no_country_set” or the wrong country, the allowed channel list and power levels won’t match what the phone’s region expects. The result: the network is either invisible or the connection drops after a couple of seconds.
• Group key update too rare or too frequent. The default of 5 minutes in some old configs can cause an iPhone to lose its session during a group key rotation if the timeout is set oddly.
• WMM disabled. Without WMM (Wi-Fi Multimedia), modern Qualcomm and Broadcom chips in phones run in a degraded mode, sometimes refusing to associate on 5 GHz at all.
• Fast Transition (802.11r) enabled on a single access point. FT is meant for roaming between multiple APs. On a single router it sometimes conflicts with iOS’s implementation, causing SA Query timeouts.
• Hidden SSID. Android technically supports hidden networks, but the implementation is shaky on some firmware: slow connections, occasional drops.
• 5 GHz channel from the DFS range. If MikroTik picked a DFS channel (52-64, 100-140) and the phone or local regulations don’t like it, the connection comes and goes due to radar detection checks.

A separate word about legacy configs. You show up on-site and find an access point configured back in 2016 for the first iPhone on the market, untouched ever since because “it works.” It works, for the device fleet that existed back then. A new iPhone or Android phone with a modern Wi-Fi 6 chip just doesn’t fit that config, because the driver enforces the standard much more strictly, and the old security profile doesn’t meet it.

There’s another nuance rarely mentioned in articles: different phone Wi-Fi chip makers interpret edge cases in the 802.11 spec differently. Broadcom (often in iPhones) and Qualcomm (often in Android phones) can behave differently on the exact same access point with identical settings. So if one phone in your household connects fine and another connects only sometimes, that doesn’t mean the problem is with Android. It might be a specific combination of chip model and router configuration.

Let’s go through each cause in more detail, because “just remove TKIP” sounds simple, but it’s worth understanding why exactly that fixes things instead of just taking it on faith.

TKIP is an encryption protocol from 2003, invented as a temporary patch for old WEP-era hardware that physically couldn’t handle AES. More than twenty years have passed since then, and phone manufacturers have one by one cut TKIP support at the driver level, first by capping the maximum connection speed on TKIP networks to 54 Mbps (the 802.11g standard), then eventually requiring pure AES to operate in 802.11n/ac/ax modes at all. MikroTik defaults some older profiles to a “smart” mode that allows both TKIP and AES for backward compatibility with old hardware, and that compromise is exactly what breaks new phones.

Country code isn’t a cosmetic “check the box” setting. It’s a parameter that hard-codes the table of allowed frequencies, channels, and maximum transmit power in the chip’s firmware. If the router is set to one country while the phone’s regulatory database expects another, in the best case the phone simply won’t see some channels, and in the worst case it’ll refuse to associate, deciding the access point’s parameters are invalid for its region.

Group key update is the interval at which the access point rotates the group encryption key used for broadcast/multicast traffic. Rotating too often (every minute or two) means clients constantly have to renegotiate the key. On a weak signal this creates micro-interruptions that the phone interprets as a lost connection, so it reconnects and drops active TCP sessions in the process.

Table: cause → symptom → where to look

WMM (Wi-Fi Multimedia) originates from the 802.11e spec and was originally meant to prioritize voice and video traffic. Over time, the 802.11n standard formally made WMM a required condition for operating above 54 Mbps, meaning without WMM a phone technically can’t use n/ac/ax mode and either falls back to legacy 802.11g or refuses to connect outright if the router is configured strictly for the newer standards. A disabled WMM setting in a MikroTik config is a common leftover from the era when this parameter was treated as an optional extra rather than a mandatory compatibility requirement.

3. The fix: step by step

Prep work

Before touching the config, do three checks. Don’t skip these, you’ll save yourself an hour of guesswork later.

1. Find out which wireless package you have: legacy wireless or the new wifi (wifi-qcom). This depends on the chip: wAP ac, hAP ac and similar models migrated to wifi-qcom starting with RouterOS 7.13+.
2. Back up your current config. No exceptions.
3. Check your RouterOS version. If it’s really old (6.4x with no updates), upgrade first, then configure Wi-Fi.

/system backup save name=before-wifi-fix
/export file=before-wifi-fix-config

Result: a .backup and .rsc file will appear in the router’s files. Download them to your own disk via Winbox (Files). If something goes wrong, you’ll roll back in a minute.

A story from the field

I once showed up at a small office, eight people, a MikroTik hAP ac router configured back when the office opened in 2019. The complaint: “the new iPhones won’t connect for our staff, but the old laptops work fine.” I dug into the config and found a security profile with authentication-types=wpa-psk,wpa2-psk and unicast-ciphers=tkip,aes-ccm. The router was offering both old WPA with TKIP and new WPA2 with AES at the same time, “for compatibility,” as the previous contractor had once set it up.

That mixed mode worked fine for 2015-2018 hardware. The new iPhone 15s that showed up in the office that year would either hang on “Connecting…” for 15-20 seconds, or connect and immediately drop. I removed WPA and TKIP entirely, leaving pure WPA2-PSK with AES. Every new phone connected on the first try, and the old Windows 10 laptops didn’t notice a difference, since they’ve long supported pure AES.

The lesson is simple: “compatibility for old hardware” turns into “incompatibility with new hardware” ten years later. Technical debt works exactly like that: it quietly piles up until someone buys a new phone.

Step 1. Check which wireless package you’re using

/interface wireless print
/interface wifi print

If the first command returns interfaces, you have legacy wireless (RouterOS 6.x or 7.x without migration). If the second one does, you have wifi-qcom (the new Qualcomm driver on RouterOS 7.13+). The configs below differ, so don’t mix them up.

Step 2. Set up the security profile: legacy wireless (RouterOS 6.x / older 7.x)

This is the important part: remove TKIP entirely, keep pure AES. This alone fixes 90% of “iPhone won’t connect” cases.

/interface wireless security-profiles
set [ find default=yes ] mode=dynamic-keys authentication-types=wpa2-psk \
    unicast-ciphers=aes-ccm group-ciphers=aes-ccm \
    wpa2-pre-shared-key="StrongPassword123" \
    group-key-update=1h

What you should end up with: a profile with no mention of TKIP anywhere. Check with the command below; tkip shouldn’t appear anywhere in the output.

/interface wireless security-profiles print detail

Step 3. Configure the wireless interface itself (legacy)

/interface wireless
set [ find default-name=wlan1 ] mode=ap-bridge ssid="MyHomeWiFi" \
    security-profile=default band=2ghz-b/g/n/ax channel-width=20/40mhz-Ce \
    country=russia wireless-protocol=802.11 wmm-support=enabled \
    frequency=auto disabled=no

set [ find default-name=wlan2 ] mode=ap-bridge ssid="MyHomeWiFi" \
    security-profile=default band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee \
    country=russia wireless-protocol=802.11 wmm-support=enabled \
    frequency=auto disabled=no

Note country=russia: substitute your actual country here, this isn’t a formality. A wrong country code trims the available channels and power, and phones notice it before laptops do.

The channel-width=20/40/80mhz-Ceee parameter for 5 GHz means “let the router automatically pick a channel width between 20 and 80 MHz depending on air conditions.” It’s a tradeoff between maximum speed (80 MHz) and resistance to interference (20 MHz). If your area has a lot of neighboring 5 GHz networks, it’s better to fix it at 20/40mhz, because a wide 80 MHz channel overlaps several adjacent channels at once and is more prone to interference than a narrower one.

DFS (Dynamic Frequency Selection) is a mechanism legally required in most countries for channels 52-64 and 100-140 in the 5 GHz band, because these frequencies overlap with military and weather radar. When a router occupies such a channel, it must listen to the air for radar signals, and if anything resembling one is detected (even a false positive from a microwave or a neighbor’s equipment), the access point must go silent on that channel for at least 30 minutes and switch to another. For home Wi-Fi this means a sudden connection drop with no apparent cause on either the router’s or the phone’s side.

/interface wireless set wlan2 frequency=5180

Channel 5180 MHz (channel 36) is a non-DFS frequency, available almost everywhere without restrictions. By pinning it manually instead of using auto, you eliminate the possibility of a sudden radar-check interruption entirely.

Step 4. Configure wifi-qcom (RouterOS 7.13+, the new driver)

If the first command from step 1 returned nothing and the second one returned something, you’re on the new stack. The logic is the same, the syntax is different.

/interface wifi security
set [ find default=yes ] authentication-types=wpa2-psk,wpa3-psk \
    encryption=ccmp \
    passphrase="StrongPassword123" \
    group-key-update=1h

/interface wifi configuration
set [ find default=yes ] country="russia" mode=ap ssid="MyHomeWiFi"

/interface wifi
set [ find ] configuration=cfg1 security=sec1 disabled=no

Result: the command /interface wifi print shows running=yes on every interface, and /interface wifi registration-table print starts showing clients as they connect.

If you’re picking a new router and can get a model with wifi-qcom, go with it. The new stack handles a large number of simultaneous connections better, runs more stably on Wi-Fi 6, and gets new functionality first. Legacy wireless is still supported and gets security patches, but it’s barely receiving new features anymore. MikroTik is clearly pushing development toward wifi-qcom.

Step 5. A separate SSID on 5 GHz or a unified one: which to choose

A single SSID with band steering is more convenient for users, but iPhones sometimes stubbornly stick to 2.4 GHz even with a great 5 GHz signal. If maximum speed on iPhone matters, split the SSID into “Home” (2.4) and “Home-5G” (5 GHz) and let people choose manually.

MikroTik doesn’t have built-in “smart” band steering like proprietary solutions from Ubiquiti or TP-Link Omada. On a unified SSID, all the connection logic depends entirely on how the phone itself decides where to attach. Usually the algorithm in the phone’s firmware looks at signal strength: if 5 GHz is noticeably weaker due to distance or walls, the phone will prefer 2.4 GHz even when both bands are technically available. For most users this isn’t an issue. For those who care about maximum speed on a specific device (streaming from a security camera to a phone, for example), splitting the SSID gives direct control.

There’s a middle ground: set the transmit power on 2.4 GHz slightly lower and leave 5 GHz at maximum. Then, all else being equal, the phone will more often pick 5 GHz simply because the signal there won’t seem any worse, while 2.4 GHz coverage remains available for genuinely distant corners of the building.

Step 6. Configure Fast Transition (802.11r) correctly

If you have a single access point, disable 802.11r entirely. It’s not needed here and can cause SA Query timeouts on iPhone.

/interface wireless security-profiles
set [ find default=yes ] management-protection=disabled

If you have CAPsMAN with multiple access points and need roaming, only enable FT together with identical settings on every AP. Otherwise you’ll end up with exactly the problem you’re trying to fix.

Step 7. A guest network for friends and relatives

Don’t hand out your main network password to guests. This is a rule, not paranoia. A guest Wi-Fi network on a separate VLAN isolates other people’s phones from your NAS, printers, and smart outlets.

/interface bridge add name=bridge-guest
/interface wireless
add master-interface=wlan2 ssid="Guest-WiFi" security-profile=guest-profile \
    disabled=no

/interface wireless security-profiles
add name=guest-profile mode=dynamic-keys authentication-types=wpa2-psk \
    unicast-ciphers=aes-ccm group-ciphers=aes-ccm \
    wpa2-pre-shared-key="GuestPassword456"

/ip pool add name=guest-pool ranges=192.168.99.10-192.168.99.254
/ip dhcp-server add name=guest-dhcp interface=bridge-guest address-pool=guest-pool
/ip address add address=192.168.99.1/24 interface=bridge-guest

/ip firewall filter
add chain=forward src-address=192.168.99.0/24 dst-address=192.168.88.0/24 action=drop

Result: guests sit in a separate 192.168.99.0/24 subnet, get internet access, but can’t reach your main 192.168.88.0/24 LAN. That last firewall rule is the key one. Without it, all this isolation is just a nice-looking illusion.

Step 8. Rolling back if something goes wrong

If Wi-Fi disappears entirely or gets worse after your changes, don’t panic. You have the backup from the prep step.

/system backup load name=before-wifi-fix.backup

The router will reboot and restore the config to its previous state. If you don’t have a backup (you did skip it, didn’t you?), roll back your changes manually, step by step, in reverse order. This is exactly why the backup step at the start of this article isn’t a formality.

Step 9. DHCP settings that fix “got an IP, but no internet”

/ip dhcp-server network
set [ find ] dns-server=8.8.8.8,1.1.1.1 gateway=192.168.88.1 \
    netmask=24

Android is especially sensitive to captive portals and DNS with no fallback server. If the primary DNS is unavailable for even 2 seconds, some Android firmware flags the network as “no internet” and switches to mobile data.

4. Verification: how to confirm it’s actually working

Don’t take “it connected” at face value. Check signal, speed, and stability separately.

/interface wireless registration-table print
/interface wifi registration-table print
/interface wireless monitor wlan1
/ping 8.8.8.8 count=20

What to look at in registration-table: the tx-rate and rx-rate columns should show reasonable values (not 1Mbps, that’s a sign the client is barely hanging on due to signal or compatibility issues). The signal-strength column should be -65 dBm or better for normal operation.

It’s worth checking directly from the phone as well, not just from the router. On iPhone: Settings → Wi-Fi, tap the “i” next to the network, and check the IP address, making sure it’s in the right subnet and not 169.254.x.x (a sign DHCP didn’t come through). On Android: Settings → Wi-Fi → the selected network shows the IP, link speed, and band (2.4 or 5 GHz).

/interface wireless registration-table print detail

In the detailed output, check the tx-ccq field, an aggregated channel quality estimate in percent. Below 70%, expect complaints about laggy video calls. Also check signal-to-noise: if the noise level is close to the signal, only a channel change or physically moving the access point will help.

Network architecture, for understanding what happens where

%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#ffffff',
    'primaryTextColor': '#1e293b',
    'primaryBorderColor': '#94a3b8',
    'lineColor': '#64748b',
    'fontSize': '15px',
    'fontFamily': 'ui-sans-serif, system-ui, sans-serif'
  },
  'flowchart': {'curve': 'linear', 'nodeSpacing': 50, 'rankSpacing': 50}
}}%%
flowchart TD
    A["iPhone / Android"] --> B["MikroTik Wireless Interface"]
    B --> C["Security Profile WPA2 AES"]
    C --> D["Bridge LAN"]
    D --> E["DHCP Server"]
    D --> F["NAT to internet"]
    style A fill:#f8fafc,stroke:#3b82f6,stroke-width:2px,color:#1e40af
    style B fill:#f8fafc,stroke:#3b82f6,stroke-width:2px,color:#1e40af
    style C fill:#f8fafc,stroke:#22c55e,stroke-width:2px,color:#15803d
    style D fill:#f8fafc,stroke:#22c55e,stroke-width:2px,color:#15803d
    style E fill:#f8fafc,stroke:#22c55e,stroke-width:2px,color:#15803d
    style F fill:#f8fafc,stroke:#22c55e,stroke-width:2px,color:#15803d

The sequence of a phone connecting to an access point

%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#f8fafc',
    'primaryTextColor': '#1e293b',
    'primaryBorderColor': '#94a3b8',
    'noteBkgColor': '#fefce8',
    'noteTextColor': '#713f12',
    'noteBorderColor': '#fbbf24',
    'actorBkg': '#f8fafc',
    'actorBorder': '#94a3b8',
    'actorTextColor': '#1e293b',
    'fontSize': '15px',
    'fontFamily': 'ui-sans-serif, system-ui, sans-serif'
  },
  'sequence': {
    'mirrorActors': false,
    'messageAlign': 'center',
    'actorMargin': 120,
    'width': 160,
    'noteMargin': 12
  }
}}%%
sequenceDiagram
    participant P as Phone
    participant AP as MikroTik AP
    P->>AP: Probe request
    AP->>P: Probe response
    P->>AP: Authentication
    AP->>P: Association
    P->>AP: 4-way handshake
    AP->>P: DHCP offer

How to test changes without kicking everyone offline at once

If the router is already in production with real people on it, don’t change the security profile on the main SSID during work hours without warning. The right order: set up a temporary test SSID with the new settings alongside the main one, verify the problem phones connect to it fine, and only after confirming stability, migrate the settings to the main network and remove the test one.

/interface wireless
add master-interface=wlan2 ssid="Test-WiFi" security-profile=default \
    disabled=no

Five minutes spent on a temporary SSID save you an evening of fielding “what happened to the internet again” calls from coworkers or family.

A useful habit: keep a separate text file with baseline values for your network, typical signal-strength in different rooms, expected tx-rate for your main devices at home or in the office. A month from now, when someone complains about “slow internet,” you’ll have something to compare against instead of just a vague “it feels worse.”

5. Complications: common mistakes and their fixes

/log print where topics~"wireless"

It’s always the small things that bite you. One forgotten “hide ssid” checkbox on a home router means three evenings of fighting with your spouse’s phone that “for some reason can’t see the network.”

Five more real-world situations

Situation 1: the phone connects during the day but not at night. Check the scheduler and time-based firewall rules. Sometimes a previous admin set up “parental controls” by disabling Wi-Fi on a schedule and forgot to mention it during handover.

Situation 2: one specific iPhone won’t connect, while the rest connect fine. Check MAC filtering. Someone may have set up a MAC allow-list at some point and never updated it after a phone was replaced. Also check the private MAC address setting on the iPhone itself (Wi-Fi → network → Private Address). If the private address is enabled while the router has a static binding to the old MAC, it’ll keep looking like a “new” device with no access.

/interface wireless access-list print

Situation 3: Wi-Fi works, but it’s very slow specifically on phones. Often the cause is a channel crowded with neighbors. Run an air scan and check whether your channel overlaps with half the routers in the building.

/interface wireless scan wlan2

Situation 4: the connection works but video calls keep dropping. Usually a QoS issue or missing WMM. Confirm WMM is enabled, and add traffic prioritization for voice and video via queue tree if the router serves a lot of devices at once.

Situation 5: after replacing the router with a new model, phones massively stopped connecting. Check whether the country code or band changed automatically on the new hardware when importing the old config. Different models support different ranges, and the old config may reference a channel that doesn’t exist on the new model.

All five situations share one thing: the symptom on the phone almost never tells you directly what the cause is. “Won’t connect” can mean anything from a wrong password to a MAC address conflict. Diagnosis always starts from logs and the registration-table, not guesswork. That’s exactly what separates “reboot it and see” from actually working the problem.

6. Alternative approaches

If a specific phone model is still misbehaving after all the steps above, there are backup options.

• CAPsMAN with multiple access points. If the house is big and one router physically can’t cover it, several wAP units with CAPsMAN beat a single powerful router. More setup work, but it solves weak-signal zones along the way.
• A separate SSID for guests (Virtual AP). Isolates problem devices from the main network without letting them affect other clients. Technically it’s a virtual interface layered on top of the physical radio card: one antenna can broadcast several SSIDs at once, each with its own security profile and subnet via bridge and VLAN.
• Hotspot instead of WPA2-PSK. Good for public spaces that need a login portal, but not for home use. It’s extra hassle for something a plain security profile already solves.
• Full wireless config reset and setup from scratch via Quick Set. If the config has accumulated three admins’ worth of legacy, sometimes it’s faster to tear it down and rebuild than to decipher someone else’s comments.

The main approach from the “Fix” section was picked for a reason: it addresses the root cause (encryption protocol and compatibility), rather than working around it with extra infrastructure. CAPsMAN and Virtual AP solve different problems, scale and isolation, not compatibility with a specific phone.

Legacy code doesn’t fear refactoring, but if a config is fifteen years old and layered with settings from three different admins, each with their own commenting style in transliterated Russian, sometimes it really is faster to tear out the wireless section entirely and rebuild it from scratch using the checklist in this article, instead of archaeologically figuring out why there’s a third security profile named “test123” in there.

Setting up CAPsMAN for multiple access points

If the house is two or three stories and one router physically can’t reach the far bedroom, instead of cranking up transmit power to the max (which won’t help and will actually make things worse due to mutual interference), add a second access point and tie them together with CAPsMAN. That’s a whole separate topic, but since we’re on alternatives, here’s a minimal config to get the idea.

/caps-man manager set enabled=yes

/caps-man configuration
add name=cfg-2ghz country=russia mode=ap ssid="MyHomeWiFi" \
    security=sec-main channel.band=2ghz-n channel.width=20/40mhz-Ce
add name=cfg-5ghz country=russia mode=ap ssid="MyHomeWiFi" \
    security=sec-main channel.band=5ghz-ac channel.width=20/40/80mhz-Ceee

/caps-man security
add name=sec-main authentication-types=wpa2-psk encryption=aes-ccm \
    passphrase="StrongPassword123" group-key-update=1h

/caps-man provisioning
add action=create-dynamic-enabled master-configuration=cfg-2ghz radio-mac=any

The point is that every access point gets the same config pushed from one controlling router. The phone sees a single SSID everywhere in the house and switches between access points without a manual network selection, provided 802.11r is configured identically on all APs, or disabled identically everywhere. A mixed configuration (enabled on one AP, disabled on another) is a guaranteed source of odd drops that are impossible to explain logically without understanding this exact nuance.

Comparing approaches

7. Prevention

Monitoring

Wi-Fi prevention isn’t a one-time action, it’s a habit of checking the network once a month with the same commands you used for the initial setup. Regression happens quietly: a neighbor sets up a new router on an adjacent channel, your ISP updates the modem firmware and changes DNS, someone at home turns on their phone’s hotspot mode and creates interference. None of these events have anything to do with MikroTik directly, but all of them hit your network’s stability.

/tool graphing interface add interface=wlan1
/tool graphing interface add interface=wlan2

Graphs will show if the signal starts drifting or the client count suddenly drops, earlier than you’d get a call from family asking “what happened to the internet.”

For more serious monitoring, use Zabbix or Grafana with SNMP polling of MikroTik. Enable SNMP on the router if you plan to collect metrics centrally instead of checking graphs by hand once a week.

/snmp set enabled=yes contact="admin@example.com" location="Office"
/snmp community set [ find default=yes ] addresses=192.168.88.0/24

Restrict the community string to a specific subnet instead of leaving it open to any network. SNMP with no IP restrictions is no less dangerous than an open Winbox port facing the internet.

Backups

/system scheduler
add name=weekly-backup interval=1w on-event="/system backup save name=auto-backup" \
    start-time=03:00:00

A backup that only lives on the router itself isn’t a backup, it’s the illusion of one. If the router dies, the backup file dies with it. Set up automatic upload to FTP or an external storage via a script, so the copy physically lives somewhere other than the device it’s meant to restore.

/tool fetch address=192.168.1.100 src-path=auto-backup.backup \
    upload=yes user=backupuser password=backuppass mode=ftp

Autostart and recovery

If the router reboots on its own (power flicker, outage), the config should come back up by itself, with no manual intervention. Make sure every interface you need is set to disabled=no, rather than tied to a manual start through the scheduler.

Security

• Change the router admin password, don’t leave admin with no password
• Disable external access to Winbox/API via firewall
• Set up a separate user with limited permissions for day-to-day work
• Restrict router management by IP via /ip service
• Enable firewall filter rules for the forward chain, don’t rely on the default config
• Keep RouterOS updated regularly; wireless stack vulnerabilities get patched quickly, but only on current versions
• Don’t keep the same Wi-Fi password for years; rotating it every 6-12 months reduces the risk of leaks through former guests

A separate note on SSH access: if you manage the router remotely, don’t open port 22 directly to the world. The right approach is a VPN to the router (WireGuard on RouterOS 7.x takes five minutes to set up), and SSH or Winbox access inside the tunnel. Port 8291 exposed to the internet with no restrictions is a classic audit finding, and it’s not just security specialists who find it, automated scanners spot it within hours of it appearing online.

/ip firewall filter
add chain=input protocol=tcp dst-port=8291 src-address-list=!trusted action=drop
add chain=input protocol=tcp dst-port=22 src-address-list=!trusted action=drop

Populate the trusted list with your actual IP addresses or office range. Everything outside that trusted list gets dropped at the door, and an external scanner won’t even register that the port is open.

Fail2ban-like protection with RouterOS tools

MikroTik has no fail2ban package, but you can build similar behavior using an address-list with a timeout for password-guessing attempts.

/ip firewall filter
add chain=input protocol=tcp dst-port=22 connection-state=new \
    action=add-src-to-address-list address-list=ssh-blacklist \
    address-list-timeout=1d
add chain=input src-address-list=ssh-blacklist action=drop

This config on its own won’t replace a proper fail2ban setup on a Linux box, but as the router’s only entry point, it’s a working and sufficient option.

Updating RouterOS without surprises

Updating blindly in production is a guaranteed way to meet an incident at 3 AM. There’s a process that cuts that risk close to zero.

1. Read the changelog for the new version on the MikroTik site, looking for mentions of wireless, wifi, security profile.
2. Make a backup (see the “Prep work” section above). Without it, a rollback turns into manual reconstruction from memory.
3. Update sequentially between minor versions, don’t skip several major versions at once.
4. After updating, check the registration-table and logs for the first hour. That’s when compatibility problems tend to surface.

/system package update check-for-updates
/system package update download
/system package update install

If Wi-Fi for phones breaks after an update, roll back to the previous package using the backup you made before updating. Don’t try to fix things live if you don’t have time to work through it calmly. A rollback is cheaper than the stress.

Port table

8. FAQ

Why doesn’t Wi-Fi work after setting up MikroTik?

Most often it’s TKIP in the encryption settings, a wrong country code, or a DFS channel where the router is doing a radar detection pause. Run security-profiles print detail and you’ll see right away if TKIP snuck in.

How do I check that my MikroTik Wi-Fi setup is actually working correctly?

Check registration-table print. Connected devices should show up with a decent tx-rate, not 1 Mbps. Also run a ping from the phone itself to an external address: 0% loss and stable response time confirm everything’s fine.

What do I do if Android keeps reconnecting to Wi-Fi?

Usually the cause is too short a group-key-update interval or Fast Transition enabled on a single access point. Set group-key-update=1h and disable management-protection, unless you’re running CAPsMAN with roaming.

What’s the difference between wifi-qcom and legacy wireless on MikroTik?

wifi-qcom is the new driver for Qualcomm-based Wi-Fi 5/6 chips, available starting with RouterOS 7.13 on some models (hAP ac, wAP ac, and others). The command syntax is different: instead of /interface wireless you use /interface wifi, with configuration split into security, configuration, and datapath. Older models with Atheros chips stay on legacy wireless.

Why does my iPhone see the network but can’t connect, even though the password is correct?

Nine times out of ten it’s mixed TKIP+AES encryption or pure TKIP. Starting with iOS 14, iPhones dislike such networks and either won’t connect or connect at minimum speed with constant drops.

Do I need to enable 802.11r (Fast Transition) for iPhone?

Only if you have multiple access points on one SSID and your phone actually roams between them. On a single router, 802.11r tends to cause more problems than it solves. Disable it and leave it alone unless you’re running CAPsMAN with multiple APs.

Why does Android show “Connected, no internet access”?

Android aggressively checks for real connectivity via captive portal detection (reaching out to google.com or connectivitycheck). If DNS responds slowly or is unavailable, Android flags the network as broken even when the internet is actually working. Add a fallback DNS server to your DHCP settings.

Can I use the same password for the 2.4 GHz and 5 GHz networks?

You can, and you should, if you have a unified SSID with band steering. If the SSIDs are split into “Home” and “Home-5G,” using the same password doesn’t reduce security, it just makes life easier for users.

Does the MikroTik model affect iPhone compatibility?

Indirectly, yes. Models with legacy wireless (older Atheros chips) and models with wifi-qcom (the new Qualcomm driver on RouterOS 7.13+) are configured differently, but with correct setup on either, there shouldn’t be compatibility problems. The real difference is in maximum speed and Wi-Fi 6 support, not basic connection stability.

Do I need special MikroTik settings for an iPhone 15/16 with Wi-Fi 6E?

There are no mandatory extra settings, but to actually use Wi-Fi 6/6E capabilities you need a router model with a matching chip (such as hAP ax or similar) and current RouterOS 7.x with wifi-qcom. On older hardware with legacy wireless, the phone will simply run in ac mode, with no stability issues but no speed gain from the newer standards either.

How do I tell whether it’s the router or the phone itself causing the problem?

Check whether another phone of the same brand connects to the same network. If it does, the issue is with that specific device (a damaged Wi-Fi module, old firmware, a stale network settings cache). If no phone of a particular brand connects while other brands work fine, look toward the encryption and country code settings covered in the “Causes” section.

9. Outlook

We removed TKIP, set the correct country code, fixed group-key-update, and sorted out Fast Transition. As a result, Wi-Fi now holds both iPhone and Android without any workarounds, and 5 GHz speed no longer drops to dial-up levels.

If a specific phone is still misbehaving after all these steps, chances are the problem is with the device itself (old firmware, a faulty Wi-Fi module) or interference from neighboring routers on the same channel. Run /interface wireless scan and check how crowded the air is around you.

Keep the main takeaway from this article in mind: phones follow the 802.11 standard more strictly than laptops and older devices do. Anything an old client used to “forgive,” a modern chip in an iPhone or Android will treat as a reason to refuse the connection. That’s exactly why a config that “worked for ten years” can suddenly stop satisfying a new phone in the house, not because the phone is faulty, but because nobody ever checked it against the spec this strictly before.

It’s not as bad as it looks. It’s actually much simpler: set the security profile correctly once, pin the channel and country code, and it’ll just keep working for years with no intervention. If it still doesn’t work, leave a comment with your router model and RouterOS version, and we’ll sort it out.