MikroTik Tutorial

Mikrotik has a huge variety of routers, wifi devices, and circuit boards (“RouterBOARDs”) which all run their RouterOS. They also have some switches running SwitchOS. We will concentrate on the Routers as they are most flexible for what we are doing. Below is guide on configuring these devices to support AREDN nodes and hosts, Pi, phones, cameras, etc.

A number of models support passive PoE compatible with Ubiquiti devices. The voltage you put in on the DC jack is what comes out the PoE. Some also support powering the device on port 1, while also passing that power on to one or more of the remaining ports. Most will work from 8-30V, some up to 50V, and some will do regular 802.3af/at. My nodes are fed 24V thru several models of MikroTik’s. All of it should work from 12V if your cable lengths aren’t too long. I have some 150ft runs to the roof so I standardized on 24V.

The devices can be configured via Winbox.exe a Windows application, via built-in web page, or CLI via telnet/ssh. I prefer using Winbox and the screenshots below are from that. The web page is very similar to Winbox.

I set up my systems with the following parameters:

-The MikroTiks are used only for the AREDN network. They are on longer-running dedicated backup power separate from the main network stuff. The MikroTiks power the nodes directly via passive PoE. Raspberrys and VoIP phones are also powered from this backup power source so they are connected directly to the MikroTik. Other stuff goes on to my main network.

-VLAN 30-39 is the range that fit into my VLAN scheme. You can use whatever you want of course. As is best practice on secure production networks, I do not use or allow traffic on VLAN 1. VLAN 1 traffic (WAN) from the nodes, which is always tagged VLAN 1 in the AREDN code, only exists on the cable to the node. It is bridged to VLAN30 within the router. VLAN30 is passed to a dedicated port on my firewall for the nodes’ internet access & tunnels.  In a standalone operation or if you don't care, leave it on 1 of course, and replace all instances of #30 in the examples with #1.

-Full PC’s, laptops, and anything else is passed on to the main network on VLAN 31, 32, etc. for each node’s LAN subnet.

-I do have MikroTik’s with built-in WiFi serving it up from the nodes' LAN subnets. I will work on that tutorial later.

I will leave the device basics up to you to figure out and learn ;) I recommend blowing out the default config as it may have NAT and Firewall stuff going on. Assign a temporary static IP Address to the last port on the device and plug your computer in there so you don’t lose connectivity while messing with the rest of the ports. One nice feature is that using Winbox, you can connect to the device by MAC address even if no IP is assigned or you "cut yourself off" with a config error. Make sure to update with the latest firmware while you have an IP connection as file transfers are iffy when doing the MAC-only connection.

With XM vintage nodes recall that LAN, WAN, and DtD all come down the same wire from the Main port. With M5 XW’s we see the LAN untagged on the Main port and WAN and DtD tagged on VLAN 1 and 2 on the Secondary port. Let’s start with an XM based node. The first step is to configure your interfaces and VLANs. If you are only connecting a single node, are not using DtD and WAN functions, you can skip this. Under the Interfaces tab, Click the + tab and add a VLAN. I have named this one ‘ether2-vlan1’ indicating it will be the tagged vlan1 traffic from the ether2 interface. Configure ‘VLAN ID: 1’ and select ‘ether2’ as the interface and click OK. Repeat for VLAN 2. Do this for each interface that will have a node on it.

For an XW revision node using WAN and/or DtD you will need two physical ports. The Main port will have no VLANs configured on it; leave this one alone. The Secondary port will need the VLAN 1 & 2 treatment above. Note that on this second port, only the two VLAN sub-interfaces are used. The native port (untagged) is ignored.


In my example I use the SFP port (fiber) for an uplink to the main switch but it is configured like any other ethernet port. It carries both node LAN’s and the WAN.

Open the Bridge button on the left and create Bridges for DtD and WAN and however many LAN for each node you have. The name is the only parameter you need.

In the Bridge window, click on the Ports tab. Now the fun part. Here we will connect the appropriate things together. We will be connecting the ports that represent the VLAN-tagged interfaces and well as native ethernet ports (untagged) to Bridges which are just a virtual port within the router. Click +. then select the Interface and which Bridge it will belong to and click OK. The vlan2 ports will all go into the DtD bridge. The vlan1 ports will go into the WAN bridge (Also note that I add in VLAN30 on my Uplink port to this bridge). Finally, each node’s LAN port is assigned to its own Bridge. This allows us to “steer” any end-user device onto a particular node by adding the ethernet port it is plugged into to the appropriate Bridge. For example I can double click on ether1 below, change it to Bridge32 and now the Raspberry is on radio 2's network. Renew the Pi's DHCP lease and go.

Please note I did a little photoshopping to remove excess ports for clarity. The # column is arbitrary. Not all ports may be ‘up’ or used at all.

In this bridge list from another site, we see a 2nd switch is connected and all VLANs are passed to it on ether1. XW Node 1 is connected on ports 2 & 3. XW Node 2 is on 4 & 5.

You will also want to put a password on the MikroTik (System/Password), change the identity to your hostname (System/Identity).
You can assign the MikroTik itself an address via DHCP from a node. Here we request one from Radio 1 and add the default Route and DNS the node gives out.

Once everything is working, open New Terminal and type ‘export’ to view your work in the CLI!

Ian