--- title: "MikroTik hAP login, restart, updates and UPnP: a practical guide" url: "https://kilobat.app/routers/mikrotik" description: "Sign in to a MikroTik hAP at 192.168.88.1, restart and update RouterOS 7, see devices, set UPnP and NAT-PMP, CAKE queues, Wi-Fi, guest access, DNS and the log." --- Router · MikroTik # MikroTik hAP login, restart, updates and UPnP MikroTik’s hAP routers run RouterOS, a full professional router system. You manage them in a browser (WebFig), the WinBox app for Mac and PC, or the MikroTik phone app. QuickSet gathers the home settings on one page. MikroTik hAP Sign in `192.168.88.1` App The MikroTik app (iOS and Android), or WinBox for macOS, Windows and Linux Password Newer models have a unique password on the serial-number sticker, on the box and on the printed Quick Guide. On the hAP ax³, pull out the card holder next to the product information to find it. Models hAP ax², hAP ax³, hAP ax lite, hAP ax S, hAP be lite, hAP ac², hAP ac³ **Checked 1 November 2026.** hAP ax², ax³, ax lite and similar home routers on RouterOS 7 with the default configuration (manual for 7.26, 2026). WebFig and WinBox menus mirror the command line, so each step also gives the command. ## Sign in to the MikroTik hAP **Factory default.** The username is `admin`. Older models have no password; newer ones use the sticker password. Set your own in **QuickSet** straight away. 1. Plug the Mac into any port except **ether1**, or join the `MikroTik-…` Wi-Fi. 2. Open `http://192.168.88.1` in a browser. 3. Sign in as `admin` with the sticker password, or a blank one on older models. 4. In WinBox, if the address doesn’t answer, open **Neighbors** and double-click the router’s MAC address. 5. In the MikroTik app, the address and username are filled in: tap **Connect**, then **Quick setup**. A lost password can’t be recovered. Unplug the router, hold **Reset**, plug it back in and release when the LED starts flashing. This restores the factory configuration and the sticker password. ## Restart it properly 1. In WebFig or WinBox, open **System › Reboot**. 2. Confirm the restart. From the terminal, the command is `/system/reboot`. Don’t hold the reset button while powering on just to restart. Depending on how long you hold it, it resets the configuration, starts CAPs mode or waits for Netinstall. ### Schedule a restart Home routers ship in the `home` device mode, which turns off the scheduler. Turning it on needs physical access to the router. 1. In the terminal, run `/system/device-mode/update scheduler=yes`. 2. Within five minutes, press the reset or mode button, or unplug the power, to confirm. 3. Open **System › Scheduler** and click **New**. 4. Set **Start Time**, for example `04:00:00`, and **Interval** to `1d`. 5. Enter `/system/reboot` in **On Event** and click **OK**. **Kilobat can help.** Kilobat Pro’s [router check-up](https://kilobat.app/docs/home-network#router-checkup) learns how fast this router usually answers, says when a restart is due, and checks the next day whether it helped. ## Update the firmware 1. Open **QuickSet** and click **Check For Updates**, or use **System › Packages › Check For Updates**. 2. Keep **Channel** on `stable`, or `long-term` for fewer changes. 3. Click **Download&Install**. The router reboots when the download finishes. 4. Then open **System › RouterBOARD**, click **Upgrade** and reboot again to update the bootloader. The router itself must reach MikroTik’s server over HTTPS. Very old releases may need an intermediate version first; check for updates again after each step. [The maker’s firmware download page](https://mikrotik.com/download) ## See connected devices 1. Open **QuickSet**. The **Wireless clients** table lists Wi-Fi devices with their MAC address, last IP address, uptime and signal. 2. For every device with an address, open **IP › DHCP Server** and the **Leases** tab (`/ip/dhcp-server/lease/print`). 3. Select a lease and click **Make Static** (`make-static`) to keep its address. ### Connect it to Kilobat Kilobat Pro reads RouterOS 7’s local REST API. Per-device counters depend on the accounting already configured on the router. 1. Enable `www-ssl` with a certificate and a dedicated user whose group has only `read` and `rest-api` policies. 2. At home, open Kilobat’s **Tools › Devices › Connect your router** and choose MikroTik. 3. Enter its local HTTPS address and that user’s credentials. 4. Compare the fingerprint with the `www-ssl` certificate in **System › Certificates** before choosing **Trust and Connect**. Per-device bytes come from the Kid Control device list when available, or simple queues with one target address each. Queue counters may include local transfers and exclude traffic that bypasses queues, including FastTracked traffic. They are not complete internet-only totals. Otherwise Kilobat shows whole-home counters only. Kilobat changes no router setting and keeps the password in this Mac’s Keychain. [Connection details and limits](https://kilobat.app/docs/home-network#router). **Kilobat can help.** Kilobat’s [new-device alerts](https://kilobat.app/docs/home-network#new-devices) tell you when a device you haven’t seen joins your home Wi-Fi. **Tools › Devices** lists what answers on the network, and you can name each one. ## UPnP and port forwarding RouterOS implements the UPnP Internet Gateway Device (IGD) profile for IPv4. It is off by default. 1. In **QuickSet**, tick **UPnP** under **Local Network**, then click **Apply**. 2. Or open **IP › UPnP** and tick **Enabled**. 3. Under **Interfaces**, add **ether1** as `external` and the LAN bridge as `internal`. UPnP has no authentication. Any device on an internal interface can open ports, even for another device’s address. MikroTik advises enabling it only on trusted networks and keeping it off otherwise. NAT-PMP only maps ports to the device that asks. ### NAT-PMP RouterOS also supports NAT-PMP, which Apple devices use. It is off by default. 1. Open **IP › NAT-PMP** and tick **Enabled**. 2. Add **ether1** as `external` and the LAN bridge as `internal`. **Kilobat can help.** On supported routers, Kilobat’s [call reports](https://kilobat.app/video-calls) can read available traffic counters, read-only, to identify another device that was busy when a call froze. Correlation does not prove the cause. Kilobat never opens ports. ## Prioritise calls and gaming RouterOS shapes traffic with queues. For calls and games on a busy line, MikroTik documents CAKE, which keeps latency low and shares the line fairly. 1. Open **Queues › Queue Types** and add a type with **Kind** `cake`. 2. Open **Simple Queues** and add a queue with **Target** `192.168.88.0/24`. 3. Set **Max Limit** just below your real upload and download speeds. 4. Choose the cake type as the queue type for both directions and click **OK**. The default configuration FastTracks most traffic, and FastTracked traffic skips Simple Queues. Disable FastTrack for the traffic the queue must handle, or the queue does nothing. **Kilobat can help.** Run Kilobat’s [stutter test](https://kilobat.app/guides/recipes/test-call-stutter) before and after you change priorities, to see whether calls really got smoother. ## 2.4 and 5 GHz, and the channel In **QuickSet**, the **HomeAP dual** mode gives 2.4 GHz and 5 GHz their own **Network Name** fields. 1. Open **QuickSet** and choose **HomeAP dual** mode. 2. Use the same name for both bands, or different names to pin devices to 5 GHz. 3. Set **WiFi Password**, which is separate from the router password. 4. Click **Apply**. Wi-Fi devices disconnect and rejoin. ### Change the channel 1. In **QuickSet**, change **Frequency** from **Auto** to a specific channel. 2. For finer control, open the WiFi interface and set the channel frequency and width. **Auto** scans once and picks the least busy channel, so it doesn’t keep adjusting. **Kilobat can help.** Kilobat shows which band and channel your Mac is on, and `kilobat channels` suggests the least crowded channel. More in [crowded Wi-Fi channels](https://kilobat.app/guides/wifi-channel-congestion) and [Wi-Fi on a Mac](https://kilobat.app/wifi-analyzer-mac). ## Mesh: which node a device uses MikroTik’s home mesh uses CAPsMAN: one router controls other MikroTik access points. 1. On the main router, open **QuickSet** and choose **Home Mesh** mode. 2. Unplug the second access point, hold its reset button and power it on. 3. Keep holding about 5 seconds after the LED starts flashing, until it goes solid, then release. 4. It starts in CAPs mode and joins the main router’s network. Check the other device’s Quick Guide; the button steps differ slightly between models. **Kilobat can help.** When your Mac moves to another node or band, Kilobat’s Health says so, so a weaker node isn’t taken for a router problem. See [find a better Wi-Fi spot](https://kilobat.app/guides/recipes/find-better-wifi-spot). ## Guest network 1. Open **QuickSet** in **HomeAP** or **HomeAP dual** mode. 2. Under **Wireless**, turn on **Guest network**. 3. Give it its own password, then click **Apply**. Guests can’t reach your other devices or each other; QuickSet adds bridge filters for this. **Kilobat can help.** Kilobat can show a network as a QR code, so guests join with their phone’s camera: [share Wi-Fi with a QR code](https://kilobat.app/guides/recipes/share-wifi-qr-code). ## DNS settings 1. Open **IP › DNS**. 2. Enter the resolvers you want in **Servers**, for example `1.1.1.1`. 3. Click **OK**. The router tries these before the ones it gets from your provider. In the default configuration, devices use the router as their DNS server, so they follow this change. The same menu offers DNS over HTTPS and adlists for blocking ads. **Kilobat can help.** Before you change DNS, [compare resolvers with Kilobat](https://kilobat.app/guides/recipes/pick-faster-dns) to see which answers fastest from your home. ## Connection status and logs 1. Open **QuickSet**. **Internet** shows the address the router got from your provider. 2. For details, open **IP › DHCP Client**. The status should read `bound`. 3. Open **Log** to read events such as logins, interfaces going up or down, and DHCP. The log keeps the newest 1,000 entries in memory and loses them on reboot. Log to a disk or syslog server to keep them. **Kilobat can help.** When the line keeps dropping, Kilobat’s [provider report](https://kilobat.app/docs/health#report) lists outages, latency and speed tests against your plan, ready to send to your provider. ## Manuals and downloads - [MikroTik hAP ax² user manual](https://help.mikrotik.com/docs/spaces/UM/pages/141197388/hAP+ax%C2%B2) - [MikroTik hAP ax³ user manual](https://help.mikrotik.com/docs/spaces/UM/pages/150601820/hAP+ax%C2%B3) - [MikroTik RouterOS: First Time Configuration](https://manual.mikrotik.com/docs/getting-started/first-time-configuration) - [Firmware downloads](https://mikrotik.com/download) Links go to the maker’s own pages. ## Questions **Should I use QuickSet or the full menus?** MikroTik says to use one or the other. QuickSet can overwrite settings you changed in the other WebFig or WinBox menus. **Why do my queues have no effect?** FastTracked connections bypass Simple Queues. Disable the FastTrack rule for the traffic you want to shape. ## Sources - [MikroTik Documentation: Default Configuration Passwords](https://manual.mikrotik.com/docs/getting-started/configuration-management/default-configuration-passwords) - [MikroTik Documentation: hAP ax³ user manual](https://help.mikrotik.com/docs/spaces/UM/pages/150601820/hAP+ax%C2%B3) - [MikroTik Documentation: hAP ax² user manual](https://help.mikrotik.com/docs/pages/viewpage.action?pageId=141197388) - [MikroTik Documentation: First Time Configuration](https://manual.mikrotik.com/docs/getting-started/first-time-configuration) - [MikroTik Documentation: WebFig](https://manual.mikrotik.com/docs/management-tools/webfig) - [MikroTik Documentation: WinBox](https://manual.mikrotik.com/docs/management-tools/winbox) - [MikroTik Documentation: MikroTik mobile app](https://manual.mikrotik.com/docs/management-tools/mikrotik-mobile-app) - [MikroTik Documentation: Quick Set](https://manual.mikrotik.com/docs/management-tools/quick-set) - [MikroTik Documentation: RouterOS configuration reset](https://manual.mikrotik.com/docs/getting-started/configuration-management/routeros-configuration-reset) - [MikroTik Documentation: Device mode](https://manual.mikrotik.com/docs/system-information-and-utilities/device-mode) - [MikroTik Documentation: Scheduler](https://manual.mikrotik.com/docs/system-information-and-utilities/scheduler) - [MikroTik Documentation: Upgrade](https://manual.mikrotik.com/docs/getting-started/installation-and-upgrade/upgrade) - [MikroTik Documentation: DHCP Server](https://manual.mikrotik.com/docs/network-management/dhcp/server) - [MikroTik Documentation: UPnP](https://manual.mikrotik.com/docs/firewall-and-quality-of-service/upnp) - [MikroTik Documentation: NAT-PMP](https://manual.mikrotik.com/docs/firewall-and-quality-of-service/nat-pmp) - [MikroTik Documentation: Queues](https://manual.mikrotik.com/docs/firewall-and-quality-of-service/queues/) - [MikroTik Documentation: CAKE](https://manual.mikrotik.com/docs/firewall-and-quality-of-service/queues/queue-types/cake) - [MikroTik Documentation: Wi-Fi](https://manual.mikrotik.com/docs/wireless/wifi/) - [MikroTik Documentation: DNS](https://manual.mikrotik.com/docs/network-management/dns) - [MikroTik Documentation: Log](https://manual.mikrotik.com/docs/diagnostics-monitoring-and-troubleshooting/log/) Checked on 1 November 2026. ## See what your router can’t tell you Kilobat is a Mac menu-bar app that watches the network from your side: which app is using it, whether the Wi-Fi, the router or the provider is slow, and why a call froze. [Download for Mac ↓](https://kilobat.app/downloads/Kilobat-1.31.1.dmg?via=site) ``` brew install seifip/kilobat/kilobat ``` ## More router guides - [AmpliFi](https://kilobat.app/routers/amplifi): AmpliFi is Ubiquiti’s consumer mesh Wi-Fi line, with a touchscreen router and MeshPoints. - [Apple AirPort](https://kilobat.app/routers/apple-airport): AirPort Extreme, AirPort Time Capsule and AirPort Express are Apple’s Wi-Fi base stations. - [ASUS router](https://kilobat.app/routers/asus): ASUS RT, ROG Rapture, TUF Gaming and ZenWiFi routers all run ASUSWRT. - [Cudy Wi-Fi router](https://kilobat.app/routers/cudy): Cudy’s Wi-Fi routers and mesh systems, such as the WR3000 and M3000, share one web interface at cudy.net.