Setting up a MikroTik router for the first time can feel intimidating. This guide walks you through every essential step – from your first WinBox connection to a secure home/office network. No prior RouterOS experience needed.

What You’ll Need

A MikroTik router (any model with RouterOS)
A computer with an Ethernet port
WinBox – download from MikroTik.com
Your ISP’s connection info (DHCP or PPPoE credentials)

Step 1: First Connection via WinBox

WinBox is the official configuration utility that works even without an IP address.

Plug your computer into any LAN port (usually ports 2–5).
Launch WinBox, click the Neighbors tab.
Select your router’s MAC address and click Connect.
Default login: admin with a blank password.

Tip: If the router doesn’t appear, temporarily disable your PC’s firewall or check that you’re not on a guest network.

Step 2: Secure the Router (Do This First!)

Lock down the device before connecting to the internet.

2.1 Change the Admin Password

/user set 0 password="your-strong-password"

2.2 Create a Backup Admin User

/user add name=backup-admin group=full password="another-strong-password"

Then disable the default admin user.

2.3 Disable Unused Services

In IP → Services disable telnet, ftp, www, and api. Keep winbox and ssh if needed.

Step 3: Update RouterOS

Always update before further configuration: System → Software → Check For Updates.

Step 4: Configure the WAN (Internet) Port

Connect your ISP cable to ether1 (usually the WAN).

4.1 DHCP (Cable, most fibre)

/ip dhcp-client add interface=ether1 disabled=no

4.2 PPPoE (DSL, some fibre)

/interface pppoe-client add interface=ether1 user="your-username" password="your-password" disabled=no

Step 5: Set Up the LAN

Create a bridge and assign an IP.

/interface bridge add name=bridge-local
/interface bridge port add interface=ether2 bridge=bridge-local
/interface bridge port add interface=ether3 bridge=bridge-local
/interface bridge port add interface=ether4 bridge=bridge-local
/interface bridge port add interface=ether5 bridge=bridge-local
/ip address add address=192.168.88.1/24 interface=bridge-local

Step 6: DHCP Server for LAN

/ip pool add name=dhcp-pool ranges=192.168.88.10-192.168.88.254
/ip dhcp-server add address-pool=dhcp-pool interface=bridge-local name=dhcp1
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=1.1.1.1,8.8.8.8

Step 7: NAT Masquerade

/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="WAN masquerade"

Step 8: Basic Firewall

/ip firewall filter add chain=input connection-state=established,related action=accept comment="Accept established"
/ip firewall filter add chain=input protocol=tcp dst-port=8291 action=accept comment="WinBox"
/ip firewall filter add chain=input protocol=tcp dst-port=22 action=accept comment="SSH"
/ip firewall filter add chain=input action=drop comment="Drop all else"

Step 9: Test

Connect a laptop – it should get an IP and internet access.

Next Steps

Now you can:

Set up a guest WiFi hotspot.
Configure a secure WireGuard VPN (skip PPTP – here’s why).
Manage users centrally with MikroRadius RADIUS.

How to Set Up a MikroTik Router from Scratch: A Complete Beginner's Guide (2026)