Skip to content
MikroTik RouterOS Docs

Quick Set Initial Configuration

Quick Set Initial Configuration

Section titled “Quick Set Initial Configuration”

Overview

Section titled “Overview”

Quick Set is a RouterOS GUI-based configuration wizard designed to provide a fast, opinionated initial configuration for MikroTik routers. It is primarily intended for first-time setup and small deployments, translating high-level selections into standard RouterOS configuration objects.

While Quick Set is a GUI tool available in WinBox and WebFig, it does not have a direct CLI command interface. Instead, it generates standard RouterOS configuration elements (interfaces, bridges, IP addressing, DHCP, firewall, NAT).

This guide documents the Home AP configuration logic applied by Quick Set, allowing you to understand the underlying changes or replicate them manually via the CLI for precise control.

Quick Set Topology

Prerequisites

Section titled “Prerequisites”
  • RouterOS v7.x installed
  • Router reset to default configuration (no existing conflicting config)
  • Physical access to the router (LAN port)

Configuration Steps

Section titled “Configuration Steps”

The following steps replicate the standard “Home AP” Quick Set configuration using the CLI. This creates a bridge for the LAN, assigns a static IP, and configures DHCP and NAT.

Step 1: Configure Bridge and Interfaces

Section titled “Step 1: Configure Bridge and Interfaces”

Create a software bridge to group LAN interfaces together. This allows devices on ether2 (and other LAN ports) to communicate.

/interface bridge
add name=bridge-lan protocol-mode=rstp


/interface bridge port
add bridge=bridge-lan interface=ether2

Note: In this topology, ether1 is reserved for the WAN connection and is not added to the bridge.

Step 2: Assign IP Address

Section titled “Step 2: Assign IP Address”

Assign the standard gateway IP address to the bridge interface. This will be the default gateway for LAN clients.

/ip address
add address=192.168.88.1/24 interface=bridge-lan

Step 3: Configure DHCP Server

Section titled “Step 3: Configure DHCP Server”

Set up the DHCP server to automatically assign IP addresses to connected devices. This involves creating an IP pool, defining the network, and enabling the server.

/ip pool
add name=lan-pool ranges=192.168.88.10-192.168.88.254


/ip dhcp-server
add name=lan-dhcp interface=bridge-lan address-pool=lan-pool


/ip dhcp-server network
add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1

Step 4: Configure DNS and NAT

Section titled “Step 4: Configure DNS and NAT”

Enable DNS forwarding so the router can resolve domain names for clients, and configure Masquerade NAT to allow LAN devices to access the internet via the WAN IP.

# Enable DNS Forwarding
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1


# Enable NAT (Masquerade) for outbound traffic on ether1
/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade

Step 5: Basic Firewall Rules

Section titled “Step 5: Basic Firewall Rules”

Apply a baseline firewall to protect the router. This allows LAN traffic but blocks unsolicited WAN traffic.

/ip firewall filter
add chain=input connection-state=established,related action=accept comment="Allow established/related"
add chain=input connection-state=invalid action=drop comment="Drop invalid"
add chain=input in-interface=bridge-lan action=accept comment="Allow LAN to router"
add chain=input in-interface=ether1 action=drop comment="Drop WAN to router"

Verification

Section titled “Verification”

Confirm your configuration is working:

Check 1: Verify Bridge Status

Section titled “Check 1: Verify Bridge Status”

Ensure the bridge is created and ether2 is a member port.

/interface bridge print
/interface bridge port print

Expected Output:

Flags: X - disabled, R - running
 0 R name="bridge-lan" mtu=auto actual-mtu=1500 l2mtu=1598 ...


Flags: X - disabled, I - inactive, D - dynamic, H - hw-offload
 #     INTERFACE     BRIDGE          HW  PVID PRIORITY  PATH-COST INTERNAL-PATH-COST
 0     ether2        bridge-lan      yes    1     0x80         10                 10

Check 2: Verify IP and DHCP

Section titled “Check 2: Verify IP and DHCP”

Check that the IP address is assigned and the DHCP server is running.

/ip address print
/ip dhcp-server print

Expected Output:

 #   ADDRESS            NETWORK         INTERFACE
 0   192.168.88.1/24    192.168.88.0    bridge-lan


Flags: D - dynamic, X - disabled, I - invalid
 #   NAME      INTERFACE   RELAY           ADDRESS-POOL   LEASE-TIME ADD-ARP
 0   lan-dhcp  bridge-lan                  lan-pool       10m

Check 3: Connectivity Test

Section titled “Check 3: Connectivity Test”

Verify internet connectivity (requires WAN cable connected to ether1).

/ping 8.8.8.8 count=5

Troubleshooting

Section titled “Troubleshooting”

Problem: Existing Configuration Overwritten

Section titled “Problem: Existing Configuration Overwritten”

Symptoms: Previous settings (VLANs, custom IPs) are missing or changed after running Quick Set.

Cause: Quick Set is designed for initial setup and may overwrite conflicting configurations to enforce its “known good” state.

Solution: Avoid using Quick Set on routers that have already been manually configured. If you need to change settings, modify the specific subsystems (e.g., /ip address, /interface bridge) directly.

Problem: Double NAT or IP Conflict

Section titled “Problem: Double NAT or IP Conflict”

Symptoms: Internet access works but some applications fail; router IP conflicts with upstream modem.

Cause: The default IP 192.168.88.1 might conflict if the upstream modem uses the same subnet, or if the router is behind another NAT router.

Solution: Change the LAN IP address and DHCP network to a different subnet (e.g., 192.168.99.1/24).

/ip address set [find interface=bridge-lan] address=192.168.99.1/24
/ip dhcp-server network set [find gateway=192.168.88.1] address=192.168.99.0/24 gateway=192.168.99.1

Problem: No Internet Access After Quick Set

Section titled “Problem: No Internet Access After Quick Set”

Symptoms: LAN devices get IP addresses but cannot reach the internet.

Cause: WAN interface not getting IP from ISP or DNS not configured.

Solution:

  1. Check WAN interface has IP:
/ip address print where interface=ether1
/ip dhcp-client print
  1. Verify default route exists:
/ip route print where dst-address=0.0.0.0/0
  1. Check DNS configuration:
/ip dns print
/ping 8.8.8.8 count=3

If ping to IP works but names don’t resolve, DNS is the issue. If neither works, check WAN connectivity and ISP settings.

Advanced Configuration

Section titled “Advanced Configuration”

Exporting Configuration

Section titled “Exporting Configuration”

Before making further changes, it is good practice to back up the Quick Set baseline.

/export file=post-quickset

Transitioning to Manual Management

Section titled “Transitioning to Manual Management”

Quick Set is a starting point. For production environments, consider:

  • Securing Management Access: Restrict WinBox/SSH access to specific IPs.
  • Tuning Firewall: Add rules for port forwarding (DST-NAT) or specific services.
  • VLANs: Quick Set does not configure VLANs. See the VLAN Fundamentals guide for next steps.
Section titled “Related Topics”

What Quick Set Configures

Section titled “What Quick Set Configures”

Next Steps After Quick Set

Section titled “Next Steps After Quick Set”

References

Section titled “References”