Setup MikroTik hAP be lite as an Access Point

Our home network is simple: We have a cable modem that connects the internet into a mini PC running OPNSense as our main router; this runs our firewall, DHCP and local DNS server. From that the LAN connection runs into a basic unmanaged switch, which connects various devices via Ethernet and access points for wireless devices. I want to add the hAP be lite as another access point.

I'm was the setup from a mini-PC running Linux Mint, and have installed MikroTik's WinBox software. I'll mostly be using the Console (Terminal) to do the setup (I find typing easier than clicking through menus), but WinBox does make it easier to connect to the hAP when it doesn't have an IP address, which will happen during some parts of the setup.

(I found it worth adjusting the GUI scaling via the cog top right, under Interface:GUI scaling>Open Settings. That really helped to make it readable on my screen, the default text was tiny.)

I followed the instructions for first time connection, and logged in using the credentials printed on the paperwork in the hAP's box. I connected the ether1 port to the main switch on our network, which acts as the 'WAN' connection to connect it to the wider world. The Linux PC is running an DHCP client, and gets an IP address from the router automatically when connecting via a cable on ether port 2.

(> is the symbol for a routerOS prompt, if you're copying these prompts, don't copy the triangle bracket and the space after it.)

First step is to create a backup, in the RouterOS terminal run:

> /system/backup/save name=YYYY-MM-DD-default-config

You can check that is has appeared correctly with:

> /file/print
Columns: NAME, TYPE, SIZE, LAST-MODIFIED
# NAME                                TYPE       SIZE     LAST-MODIFIED
0 2026-10-17-default-config.backup    backup     30.1KiB  2026-10-17 11:38:09

Then use WinBox to update the version of RouterOS to whatever the latest is. You can see the version by running

> /system/resource/print

At the time of writing the version is '7.24.5 (stable)'.

The default config of the hAP is running a DHCP server, firewall etc. that means it acts as its own network segment, separate from the rest of the network, and we don't need any of that, but first…

The best initial overview for using RouterOS from the command line is console part of the documentation. To start with I've found it a bit of a confusing mix of navigating menus, navigating a file system, and the ability to run commands. Being in a console makes me naturally think of it like a *nix command line, but it's not (mostly).

You can navigate to different parts of the configuration by using / or space to parts of the hierarchy, and then press enter. Tab complete is available. More detail in the hierarchy part of the docs.

print and print detail are your friends for seeing information and each hierarchy level. These are like commands, but you can operate them as part of the hierarchy as well. e.g. the following are equivalent:

> /system/resource/print

and

> /system/resource # press enter
/system/resource> print

There is also the export command that prints out all the things that have been configured, if you run export at the top level, it will print all configured options for the device, which is like a human readable backup, if you replayed these commands it should restore this configuration.

/ on its own will take you back to the top of the menu hierarchy, and .. will take you up one level.

[ ] is for command substitution, which means the command will run, and its return value will be used in that part of the outer command. You see this a lot in the expression set [ find name="MyName" ] configuration.whatever="blah", where the 'find' command is being used select a thing to configure by the number shown at the start of the print output, as these numbers are not unchanging, see Item Names and Numbers for details, there's a lot of this to get the right number based on an configurable item's name.

The leading dot on named sub parameters (params) is a shorthand for repeating the last used param's upper level. e.g.

configuration.country="Latvia" .ssid="MyHomeNet"

and

configuration.country="Latvia" configuration.ssid="MyHomeNet"

are the same.

You can use " " to wrap strings, which I'll be doing as I find it much clearer as to what something is. Most of the docs don't do this, and then I'm never sure if 'guest.ssid.2' is some kind of special argument/variable or just a string, especially compared with the previous abbreviation rules using dots (it's just a string).

add and set are relatively obvious; add adds a new item to the list, and set modifies and existing list item/configuration option.

You can exit the terminal with /quit.

We don't need the default setup, so we can remove it. Warning This will completely wipe all the settings. Make sure you've created a backup. Then run:

> /system/reset-configuration no-defaults=yes skip-backup=yes

Then use Winbox to re-connect to the router, I'm still connected via ether port 2. The username was now 'admin' and the password was empty, not the one printed on the paper in the box. According to the docs it could apparently be either, depending on your model.

I also found I was getting the error "ERR: Could not connect. Mac connect syn timeout". It turns out this is because by resetting the router you removed the DHCP client, and now my PC doesn't have an IP address, and neither does the router. So you have to manually set it to something. I changed by PC's IP4 network settings from DHCP to manual (static), and added 192.168.50.1 as the PC's IP address, with netmask 255.255.0.0 and gateway 192.168.0.1. These values don't really matter, but you need to have something. After that I could connect with WinBox again.

When logging in you'll be asked to set a new password, so set a nice secure password. Ideally it's better not to have an obvious 'admin' user, so create a new user with a different name, add them to the group 'full' (for full admin rights) and disable the default admin user.

The instructions are almost identical to those in the MikroTik guide for a stand along AP, except the hAP be lite is a Wi-Fi 7 device, and so supports Multi-Link Operation (MLO) - which allows a device to use different radios (frequency bands, such as 2.4GHz and 5GHz) simultaneously. Even after the reset above my router had this included in the default setup. It appears in the hAP be lite's interfaces as mld1 (Multi-Link Device). You can see it as the first entry with:

> /interface/wifi/print
Flags: M - MASTER; B - BOUND; R - RUNNING
Columns: NAME, CONFIGURATION.MODE, CONFIGURATION.SSID
#     NAME   CONFIGURATION.MODE  CONFIGURATION.SSID
0  BR mld1   ap                  MyHomeNet
1 MB  wifi1  ap                  MyHomeNet
2 MB  wifi2  ap                  MyHomeNet

The MLD then combines the two single-band access points into one requires your two wifi entries to have the same SSID, and the default guide sets these as two different names, which doesn't work. That means the setup has to be:

> /interface/wifi
> set mld1 configuration.mode=ap configuration.country="Latvia" .ssid="MyHomeNet" security.authentication-types=wpa2-psk .passphrase="MySecret"
> set [ find default-name=wifi1 ] mld-interface=mld1 disabled=no configuration.country="Latvia" .ssid="MyHomeNet" security.authentication-types=wpa2-psk .passphrase="MySecret"
> set [ find default-name=wifi2 ] mld-interface=mld1 disabled=no configuration.country="Latvia" .ssid="MyHomeNet" security.authentication-types=wpa2-psk .passphrase="MySecret"

Aligning the MLD and it's configuration with the two wifi entries then meant this worked as expected, otherwise I got the error "configuration incompatible with other MLD links, SSID mismatch" when printing the interfaces.

The rest of the setup, as below, was the same as the guide:

> /interface/list
> add comment=defconf name=WAN
> add comment=defconf name=LAN
> /interface/bridge
> add auto-mac=no comment=defconf name=bridge
> /interface/bridge/port
> add interface=all bridge=bridge 
> /interface/list/member
> add comment=defconf interface=bridge list=LAN
> /ip/dhcp-client
> add interface=bridge

After that I restarted the router, changed the PC's network options back to DHCP (automatic) from the manual (static) setting, and then I could connect via cable, or wirelessly, and get an IP address from the network's main router.