MikroTik Router Basic Setup for a Small Office
Practice4 minInnovialabs editorial team
In short
Start from the default configuration, change credentials and block management from the internet, set up WAN, LAN and DHCP, keep the default firewall, put guests on a separate network and save export and backup files regularly.
The short answer
A small-office MikroTik takes a handful of steps: update RouterOS, create your own admin, block management from the internet, configure WAN and LAN, enable DHCP, keep the default firewall, add a guest network and save the configuration. Most beginner problems are not caused by RouterOS complexity but by deleted firewall rules and missing backups.
Step 1. A secure start
Connect to the router with Winbox or WebFig from a LAN port. If the device ships with the default configuration (defconf), start from it: it already includes a LAN bridge, DHCP, NAT and a basic firewall.
Do this right away:
- Update RouterOS in System → Packages, then the RouterBOARD firmware in System → RouterBOARD.
- Create a new user in the full group with a strong password, then disable or rename the default admin.
- Disable unused services in IP → Services: telnet, ftp, www (if you only use Winbox), api.
- Limit discovery and MAC access to LAN interfaces.
/ip service disable telnet,ftp,api,api-ssl
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LAN
When experimenting, turn on Safe Mode (button in Winbox or Ctrl+X in the terminal): if you lose the connection, changes roll back automatically.
Step 2. WAN and LAN
WAN is the port your ISP connects to. Depending on the service it is a DHCP client, a static IP or PPPoE. Address, gateway and login come from the provider.
LAN is a bridge that groups the remaining ports and Wi-Fi. Give it an address such as 192.168.88.1/24 and make sure the bridge is in the LAN interface list and the ISP port is in the WAN list. Firewall rules rely on these lists.
Internet access needs NAT masquerade in the srcnat chain with out-interface-list=WAN. Defconf already has it.
Step 3. DHCP and DNS
- Run a DHCP Server on the LAN bridge using the DHCP Setup wizard.
- Define an address pool and leave a range outside it for static devices: printers, NAS, cameras.
- Use static leases for important devices instead of configuring IPs manually on each device.
- In IP → DNS, enable Allow Remote Requests only with a working firewall, otherwise the router becomes an open DNS resolver for the whole internet.
Step 4. The default firewall
The defconf rules are a sensible baseline. Their logic:
| Chain | What it does |
|---|---|
| input | accepts established/related, drops invalid, allows ICMP, drops anything not coming from LAN |
| forward | speeds up established connections (fasttrack), drops invalid and blocks inbound WAN traffic that is not port-forwarded |
Add your own rules carefully and watch the order: RouterOS evaluates them top to bottom until the first match.
Step 5. Guest network
Guests do not need access to accounting PCs and printers. A minimal setup:
- A separate bridge or VLAN for guest Wi-Fi with its own subnet.
- Its own DHCP Server and pool.
- NAT for internet access.
- A rule blocking traffic from the guest network to the office network.
- In the input chain, allow guests only DHCP and DNS, not router management.
/ip firewall filter add chain=forward in-interface=bridge-guest out-interface=bridge action=drop comment="guest to LAN"
If needed, limit guest speed with Simple Queues.
Step 6. Backing up the configuration
Keep two copies and store them off the router:
- export — a readable
.rscscript, handy for comparing and migrating. - backup — a binary file for restoring onto the same device.
/export file=office-config
/system backup save name=office-backup encryption=aes-sha256 password=StrongPassword
Depending on the RouterOS version, passwords and keys may be left out of an export unless you add a dedicated parameter. Save a copy after every significant change.
Common beginner mistakes
- Deleting the whole firewall because "something didn't work". The router becomes exposed to the internet.
- Winbox and WebFig reachable from WAN on default ports.
- Mixing Quick Set with manual configuration — Quick Set can overwrite some rules.
- Reset Configuration without a backup and without keeping defconf.
- Forwarding ports (RDP, cameras) straight to the internet instead of using a VPN.
- Updating RouterOS but not the RouterBOARD firmware, or the other way round.
- No documentation: nobody knows which addresses are reserved or why a rule exists.