MikroTik hAP login, restart, updates and UPnP

Sign in to the MikroTik hAP

Factory default. The username is admin. Older models have no password; newer ones use the sticker password. Set your own in QuickSet straight away.

1. Plug the Mac into any port except ether1, or join the MikroTik-… Wi-Fi.

2. Open http://192.168.88.1 in a browser.

3. Sign in as admin with the sticker password, or a blank one on older models.

4. In WinBox, if the address doesn’t answer, open Neighbors and double-click the router’s MAC address.

5. In the MikroTik app, the address and username are filled in: tap Connect, then Quick setup.

A lost password can’t be recovered. Unplug the router, hold Reset, plug it back in and release when the LED starts flashing. This restores the factory configuration and the sticker password.

Restart it properly

1. In WebFig or WinBox, open System › Reboot.

2. Confirm the restart. From the terminal, the command is /system/reboot.

Don’t hold the reset button while powering on just to restart. Depending on how long you hold it, it resets the configuration, starts CAPs mode or waits for Netinstall.

Schedule a restart

Home routers ship in the home device mode, which turns off the scheduler. Turning it on needs physical access to the router.

1. In the terminal, run /system/device-mode/update scheduler=yes.

2. Within five minutes, press the reset or mode button, or unplug the power, to confirm.

3. Open System › Scheduler and click New.

4. Set Start Time, for example 04:00:00, and Interval to 1d.

5. Enter /system/reboot in On Event and click OK.

Update the firmware

1. Open QuickSet and click Check For Updates, or use System › Packages › Check For Updates.

2. Keep Channel on stable, or long-term for fewer changes.

3. Click Download&Install. The router reboots when the download finishes.

4. Then open System › RouterBOARD, click Upgrade and reboot again to update the bootloader.

The router itself must reach MikroTik’s server over HTTPS. Very old releases may need an intermediate version first; check for updates again after each step.

The maker’s firmware download page

See connected devices

1. Open QuickSet. The Wireless clients table lists Wi-Fi devices with their MAC address, last IP address, uptime and signal.

2. For every device with an address, open IP › DHCP Server and the Leases tab (/ip/dhcp-server/lease/print).

3. Select a lease and click Make Static (make-static) to keep its address.

Connect it to Kilobat

Kilobat Pro reads RouterOS 7’s local REST API. Per-device counters depend on the accounting already configured on the router.

1. Enable www-ssl with a certificate and a dedicated user whose group has only read and rest-api policies.

2. At home, open Kilobat’s Tools › Devices › Connect your router and choose MikroTik.

3. Enter its local HTTPS address and that user’s credentials.

4. Compare the fingerprint with the www-ssl certificate in System › Certificates before choosing Trust and Connect.

Per-device bytes come from the Kid Control device list when available, or simple queues with one target address each. Queue counters may include local transfers and exclude traffic that bypasses queues, including FastTracked traffic. They are not complete internet-only totals. Otherwise Kilobat shows whole-home counters only. Kilobat changes no router setting and keeps the password in this Mac’s Keychain. Connection details and limits.

UPnP and port forwarding

RouterOS implements the UPnP Internet Gateway Device (IGD) profile for IPv4. It is off by default.

1. In QuickSet, tick UPnP under Local Network, then click Apply.

2. Or open IP › UPnP and tick Enabled.

3. Under Interfaces, add ether1 as external and the LAN bridge as internal.

UPnP has no authentication. Any device on an internal interface can open ports, even for another device’s address. MikroTik advises enabling it only on trusted networks and keeping it off otherwise. NAT-PMP only maps ports to the device that asks.

NAT-PMP

RouterOS also supports NAT-PMP, which Apple devices use. It is off by default.

1. Open IP › NAT-PMP and tick Enabled.

2. Add ether1 as external and the LAN bridge as internal.

Prioritise calls and gaming

RouterOS shapes traffic with queues. For calls and games on a busy line, MikroTik documents CAKE, which keeps latency low and shares the line fairly.

1. Open Queues › Queue Types and add a type with Kind cake.

2. Open Simple Queues and add a queue with Target 192.168.88.0/24.

3. Set Max Limit just below your real upload and download speeds.

4. Choose the cake type as the queue type for both directions and click OK.

The default configuration FastTracks most traffic, and FastTracked traffic skips Simple Queues. Disable FastTrack for the traffic the queue must handle, or the queue does nothing.

2.4 and 5 GHz, and the channel

In QuickSet, the HomeAP dual mode gives 2.4 GHz and 5 GHz their own Network Name fields.

1. Open QuickSet and choose HomeAP dual mode.

2. Use the same name for both bands, or different names to pin devices to 5 GHz.

3. Set WiFi Password, which is separate from the router password.

4. Click Apply. Wi-Fi devices disconnect and rejoin.

Change the channel

1. In QuickSet, change Frequency from Auto to a specific channel.

2. For finer control, open the WiFi interface and set the channel frequency and width.

Auto scans once and picks the least busy channel, so it doesn’t keep adjusting.

Mesh: which node a device uses

MikroTik’s home mesh uses CAPsMAN: one router controls other MikroTik access points.

1. On the main router, open QuickSet and choose Home Mesh mode.

2. Unplug the second access point, hold its reset button and power it on.

3. Keep holding about 5 seconds after the LED starts flashing, until it goes solid, then release.

4. It starts in CAPs mode and joins the main router’s network.

Check the other device’s Quick Guide; the button steps differ slightly between models.

Guest network

1. Open QuickSet in HomeAP or HomeAP dual mode.

2. Under Wireless, turn on Guest network.

3. Give it its own password, then click Apply.

Guests can’t reach your other devices or each other; QuickSet adds bridge filters for this.

DNS settings

1. Open IP › DNS.

2. Enter the resolvers you want in Servers, for example 1.1.1.1.

3. Click OK. The router tries these before the ones it gets from your provider.

In the default configuration, devices use the router as their DNS server, so they follow this change. The same menu offers DNS over HTTPS and adlists for blocking ads.

Connection status and logs

1. Open QuickSet. Internet shows the address the router got from your provider.

2. For details, open IP › DHCP Client. The status should read bound.

3. Open Log to read events such as logins, interfaces going up or down, and DHCP.

The log keeps the newest 1,000 entries in memory and loses them on reboot. Log to a disk or syslog server to keep them.

Manuals and downloads

• MikroTik hAP ax² user manual
• MikroTik hAP ax³ user manual
• MikroTik RouterOS: First Time Configuration
• Firmware downloads

Links go to the maker’s own pages.

Questions

Sources

• MikroTik Documentation: Default Configuration Passwords
• MikroTik Documentation: hAP ax³ user manual
• MikroTik Documentation: hAP ax² user manual
• MikroTik Documentation: First Time Configuration
• MikroTik Documentation: WebFig
• MikroTik Documentation: WinBox
• MikroTik Documentation: MikroTik mobile app
• MikroTik Documentation: Quick Set
• MikroTik Documentation: RouterOS configuration reset
• MikroTik Documentation: Device mode
• MikroTik Documentation: Scheduler
• MikroTik Documentation: Upgrade
• MikroTik Documentation: DHCP Server
• MikroTik Documentation: UPnP
• MikroTik Documentation: NAT-PMP
• MikroTik Documentation: Queues
• MikroTik Documentation: CAKE
• MikroTik Documentation: Wi-Fi
• MikroTik Documentation: DNS
• MikroTik Documentation: Log

Checked on 1 November 2026.

More router guides