HomeLab #1: MikroTik as a Home Router

How it all begin…

Know your ISP

IPoE or PPPoE

Public or private WAN IPv4

Setting up MikroTik router

Getting Internet

# Check the current MAC before changing it
/interface ethernet print where name=ether1
# Flags: X - disabled, R - running, S - slave
#  #    NAME    MTU  MAC-ADDRESS        ARP     SWITCH
#  0  R ether1  1500 48:A9:8A:11:22:33  enabled switch1

# Clone the ISP router's MAC (replace with the address from its label)
/interface ethernet set ether1 mac-address=AA:BB:CC:DD:EE:FF

# Confirm the WAN port now advertises the cloned MAC
/interface ethernet print where name=ether1
# Flags: X - disabled, R - running, S - slave
#  #    NAME    MTU  MAC-ADDRESS        ARP     SWITCH
#  0  R ether1  1500 AA:BB:CC:DD:EE:FF  enabled switch1

/interface vlan add name=internet-vlan-35 vlan-id=35 interface=ether1

/interface vlan print
# Flags: X - disabled, I - invalid, D - dynamic
#  NAME               MTU  ARP  VLAN-ID  INTERFACE
# 0 internet-vlan-35  1500  enabled  35       ether1

/interface pppoe-client add name=pppoe-out1 interface=internet-vlan-35 \
    add-default-route=yes use-peer-dns=yes disabled=no

/interface pppoe-client print
# Flags: X - disabled, I - invalid, R - running, D - dynamic
#  NAME        MTU   INTERFACE          USER  SERVICE  CALLER-ID  ENCODING  STATUS
# 0 pppoe-out1  auto  internet-vlan-35         internet                    linking

/interface pppoe-client set pppoe-out1 user=YOUR_ISP_USERNAME password=YOUR_ISP_PASSWORD

/interface pppoe-client print
# Flags: X - disabled, I - invalid, R - running, D - dynamic
#  NAME        MTU   INTERFACE          USER              SERVICE  CALLER-ID  ENCODING  STATUS
# 0 R pppoe-out1  auto  internet-vlan-35   YOUR_ISP_USERNAME  internet              connected

/ip route print where dst-address=0.0.0.0/0
# Flags: D - dynamic; X - disabled, R - running, S - static; + - active
#  DST-ADDRESS     PREF-SRC  GATEWAY           DISTANCE
# D 0.0.0.0/0               pppoe-out1        1

Let’s get clean WiFi setup

# Physical step: run an Ethernet cable from router port 8 (ether8) to the wAP AP.
# Then enable PoE output on port 8 so the wAP powers up:
/interface ethernet poe set ether8 poe-out=auto-on

/interface ethernet poe print
# NAME   POE-OUT   VOLTAGE  CURRENT
# ether8 auto-on   24.0V    210mA

# --- On the router (CAPsMAN controller) ---
/interface wifi security add name=home-sec \
    authentication-types=wpa2-psk,wpa3-psk \
    wps=disable passphrase=YOUR_WIFI_PASSWORD
/interface wifi channel add name=ch-2ghz band=2ghz-n width=20mhz
/interface wifi channel add name=ch-5ghz band=5ghz-ac width=20/40mhz
/interface wifi datapath add name=home-dp bridge=bridge disabled=no
/interface wifi configuration add name=home-2g ssid=HomeNetwork \
    country=YOUR_COUNTRY security=home-sec channel=ch-2ghz datapath=home-dp mode=ap
/interface wifi configuration add name=home-5g ssid=HomeNetwork \
    country=YOUR_COUNTRY security=home-sec channel=ch-5ghz datapath=home-dp mode=ap
/interface wifi capsman set enabled=yes interfaces=bridge
/interface wifi provisioning add action=create-dynamic-enabled \
    master-configuration=home-2g supported-bands=2ghz-n
/interface wifi provisioning add action=create-dynamic-enabled \
    master-configuration=home-5g supported-bands=5ghz-ac

# Verify the controller is listening
/interface wifi capsman print
#            enabled: yes
#           package: wifi-qcom
#        interfaces: bridge
# require-peer-certificate: no
#     upgrade-policy: none

# --- On the wAP (CAP / managed AP) ---
/interface wifi cap set enabled=yes discovery-interfaces=bridge
/interface wifi set wifi1 configuration.manager=capsman disabled=no
/interface wifi set wifi2 configuration.manager=capsman disabled=no

# Verify the wAP has joined the controller
/interface wifi cap print
#        enabled: yes
# discovery-interfaces: bridge
#   caps-man-addresses:
#   caps-man-names:

# Back on the controller, check that managed radios appeared
/interface wifi print
# Flags: D - dynamic
#    #    NAME                                              TYPE       ACTUAL-CONFIGURATION
#    0  D  cap1@2.4GHz                                       wifi       home-2g
#    1  D  cap1@5GHz                                         wifi       home-5g

Fighting Bufferbloat

FQ-CoDel to the rescue

/queue type add name=fq-codel kind=fq-codel

/queue type print where name=fq-codel
# Flags: * - default, X - disabled, I - invalid, D - dynamic
#  0   name="fq-codel" kind=fq-codel fq-codel-target=5ms fq-codel-interval=100ms \
#      fq-codel-ecn=yes fq-codel-flows=1024 fq-codel-quantum=1514 \
#      fq-codel-limit=10240 fq-codel-memlimit=32.0MiB

/queue simple add name=shaping target=pppoe-out1 max-limit=<0.9xUPLOAD>M/<0.9xDOWNLOAD>M \
    queue=fq-codel/fq-codel total-queue=fq-codel

/queue simple print where name=shaping
# Flags: X - disabled, I - invalid; D - dynamic
#  0   name="shaping" target=pppoe-out1 dst-address=0.0.0.0/0 \
#      interface=all parent=none priority=8/8 queue=fq-codel/fq-codel \
#      limit-at=0/0 max-limit=<0.9xUPLOAD>M/<0.9xDOWNLOAD>M burst-limit=0/0 burst-threshold=0/0 \
#      burst-time=0s/0s bucket-size=0.1/0.1 total-queue=fq-codel

# Find the fasttrack rule
/ip firewall filter print where action=fasttrack-connection

# Option A: disable the rule
/ip firewall filter disable [find action=fasttrack-connection]

# Option B: remove it entirely
/ip firewall filter remove [find action=fasttrack-connection]