GUIDE / WI-FI

Wi-Fi.

RouterOS has two wireless stacks — the classic /interface wireless and the newer /interface wifi (a.k.a. "WiFiWave2"). They share zero syntax. Whether your router uses one or the other depends on the radio chipset + the RouterOS package you've installed. This page explains how to tell which you have, what to use, and the basic AP setup on each.

Two stacks, one router

RouterOS v6
RouterOS v7

Which stack do I have?

v7 3 lines · 196 bytes 
/system/package/print where name~"wifi|wireless"
# If you see "wifi-qcom" or "wifi": WiFiWave2 — read §"WiFiWave2" below
# If you see "wireless":            Classic   — read §"Classic" below
v6 2 lines · 92 bytes 
/system package print where name~"wireless"
# v6 only has classic — read §"Classic" below

Classic /interface wireless

The setup most older RouterOS docs show. Works on RB951, hAP ac², hEX S with USB Wi-Fi, anything pre-WiFiWave2.

v6 13 lines · 509 bytes 
# Security profile — WPA2-PSK with a passphrase
/interface wireless security-profiles add name=home-sec \
  mode=dynamic-keys authentication-types=wpa2-psk \
  wpa2-pre-shared-key="<your-passphrase>" \
  unicast-ciphers=aes-ccm group-ciphers=aes-ccm

# AP — 5 GHz band, modern channel-width
/interface wireless set wlan1 \
  mode=ap-bridge band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee \
  frequency=auto ssid="my-home-5g" \
  security-profile=home-sec hide-ssid=no \
  wps-mode=disabled \
  disabled=no
v7 12 lines · 470 bytes 
# Same syntax on v7 with classic /interface wireless
/interface/wireless/security-profiles add name=home-sec \
  mode=dynamic-keys authentication-types=wpa2-psk \
  wpa2-pre-shared-key="<your-passphrase>" \
  unicast-ciphers=aes-ccm group-ciphers=aes-ccm

/interface/wireless set wlan1 \
  mode=ap-bridge band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee \
  frequency=auto ssid="my-home-5g" \
  security-profile=home-sec hide-ssid=no \
  wps-mode=disabled \
  disabled=no

Virtual APs (SSID per VLAN)

A single physical radio can broadcast multiple SSIDs, each on its own VLAN. Create virtual APs as children of wlan1:

v6 8 lines · 331 bytes 
# Guest SSID on VLAN 30
/interface wireless security-profiles add name=guest-sec \
  mode=dynamic-keys authentication-types=wpa2-psk \
  wpa2-pre-shared-key="<guest-passphrase>"

/interface wireless add name=wlan1-guest master-interface=wlan1 \
  ssid="guest" vlan-mode=use-tag vlan-id=30 \
  security-profile=guest-sec disabled=no

The virtual AP rides on wlan1's radio; its tagged frames join the bridge's VLAN table from VLANs.

WiFiWave2 /interface wifi

The new stack on Qualcomm-chipset boards (hAP ax², cAP ax, etc.). Different syntax, similar concepts. Notable: WiFi 6 / 6E support, cleaner steering / band-steering, central-config story via /interface wifi configuration templates.

v7 11 lines · 456 bytes 
# Security
/interface/wifi/security add name=home-sec authentication-types=wpa2-psk,wpa3-psk \
  passphrase="<your-passphrase>" \
  disable-pmkid=yes wps=disable

# Configuration template (re-usable across radios)
/interface/wifi/configuration add name=home-cfg \
  ssid="my-home" mode=ap security=home-sec country="Australia"

# Apply to the radio
/interface/wifi set wifi1 configuration=home-cfg channel.band=5ghz-ax channel.width=20/40/80mhz disabled=no

Virtual APs on WiFiWave2

v7 6 lines · 251 bytes 
/interface/wifi/configuration add name=guest-cfg \
  ssid="guest" mode=ap security=guest-sec country="Australia" \
  bridge=bridge-vlan bridge-vlan=30

/interface/wifi add name=wifi1-guest master-interface=wifi1 \
  configuration=guest-cfg disabled=no

The bridge-vlan=30 on the configuration template binds frames from the virtual AP into VLAN 30 on the bridge — no separate vlan-id on the interface needed.

  • WPA3 if every client supports it; WPA2 with a strong passphrase otherwise. WPA2/WPA3 transition modes are acceptable for mixed-client networks.
  • WPS off. WPS-PIN has known weaknesses; WPS-PBC's "press the button" UX rarely justifies leaving it on.
  • Hidden SSID buys nothing. Anyone watching probes sees it broadcast by every connected client. Useful as a friction-reducer (don't show up in the neighbour's list), not as security.
  • Channel: auto is fine on 5/6 GHz, manual on 2.4. 2.4 GHz has 3 non-overlapping channels (1, 6, 11) and "auto" often picks something dumb. Pick whichever is least crowded in your area via /interface wireless scan (classic) / /interface/wifi scanner (WiFiWave2).
  • Match the country code to your physical location. Regulatory limits (TX power, available channels) depend on it; a wrong country code is legally questionable and often gives worse range than the correct one.