**Disclaimer: This guide is provided by 3NG as a courtesy to its partners. You are using this guide at your own risk and 3NG is NOT responsible or liable for any issues that may occur from the use of this guide or a Mikrotik device.

While we recommend Mikrotik products because of their reliability and VoIP friendliness, we are NOT Mikrotik distributors or authorized support vendors, nor do we manage or support any Mikrotik devices on anyone’s behalf.

We recommend that you are always up to date with any information related to the products that you sell, install and or support, and signup for any news or product notices that your hardware distributor or manufacture may offer.**


Getting Started

This guide will help you perform a simple but complete configuration on a Mikrotik router.

If using a pre-configured router you should perform a factory reset and upgrade the firmware before starting.

How to Factory Reset a Mikrotik: https://wiki.mikrotik.com/wiki/Manual:Reset 
Download and Upgrade Mikrotik Firmware: https://mikrotik.com/download 


Steps Outlined

The following steps are covered in this guide. If a step or feature is not needed you can skip it. Steps with a (*) are highly recommended.

• *Set a password for the admin account
• Set an Identity on the Mikrotik
• Set an SSID for the wireless connection
• Set a wireless key to connect to the wireless connection
• Add a static WAN IP
• Add a gateway for the WAN IP
• *Add DNS servers
• *Add a Firewall Rule to allow remote access via Winbox
• *Add a Firewall Rule to prevent DNS DoS Attack
• *Disable SIP ALG and h323
• *Disable Services: ftp, ssh, telnet
• Add an available from address to match the LAN subnet
• Set the Clock to desired timezone
• Set SNTP Client
• Enable the Cloud feature

*Note: After you have setup your Mikrotik router see this guide for instructions on how to configure QoS (Quality of Service)


Instructions

To access the mikrotik, please change your network settings to be able to access 192.168.88.1 which is the default IP address of the Mikrotik.

Once the network settings have been updated, please connect to ETH2 or port 2 to access the LAN connection. Please note that ETH1 or port 1 is for the WAN connection.

With the network settings able to access 192.168.88.1 and your computer or laptop is connected to eth2, please open a web browser and enter in 192.168.88.1 in the address bar.

You will now have the web login screen available. Here will want to download Winbox, which is the tool we will be using to manage the Mikrotik.

1. From the Mikrotik login webpage, click on Winbox to download the Winbox application.
2. Once Winbox has been downloaded, open the application and it will find the Mikrotik, if not press Refresh to find the Mikrotik.
3. The Mikrotik will display the Mikrotik with the MAC Address, IP Address, Identity, Version, and the Board. 
4. By default the Login is admin and there is no password. Press Connect to connect to the Mikrotik.

 Set Password for Admin Account

5. Go to System
6. Go to Users
7. From the User List, select the admin account by double clicking the account
8. From the User <admin> window, click on Password
9. From the Change Password window, enter in the desired password and re-enter to confirm
10. Click OK from the Change Password window
11. Click OK from the User <admin> window

Set Identity 

12. Go to System
13. Go to Identity
14. In the Identity window, enter in an identity to identifty the given Mikrotik (i.e.: Cust Name)
15. Click OK

Set an SSID

16. Go to Wireless
17. From the Wireless Tables select wlan1 by double clicking the wlan1 interface
18. From the Interface <wlan1> window, find SSID and enter in the desired SSID
19. Click OK

Set a Wireless Key

20. From the Wireless Tables window, go to the Security Profiles tab
21. From the list, find the default Security Profile and double clicking the default profile
22. From the Security Profile <default> window, Change the Mode to "dynamic keys"
23. From the Authentication Type, select WPA2 PSK by checking the box
24. In the WPA2 Pre-Shared Key, enter in the desired wireless key (if the key is too short, the WPA2 Pre-Shared Key text will be red. If acceptable, it will be blue)
25. Click OK

 
Add a static WAN IP

26. Go to IP
27. Go to Addresses
28. From the Address List window, click the blue Plus Sign
29. From the New Address window, enter in the WAN IP that will be used which is provided by the ISP (i.e.: 12.34.56.78/29)
30. Select the Interface and set to ether1-gateway
31. Click Apply
32. The Network feild will auto populate with the network address
33. Click OK
34. Note that the WAN IP now appears on the Address List window

Add a Gateway for WAN IP

35. Go to IP
36. Go to Routes
37. From the Route List window click the blue Plus Sign
38. From the New Route window, enter in the Gateway that was provided by the ISP (i.e.: 12.34.56.73)
39. Click OK
40. Note that the Gateway is now appears on the Route List window (when ETH1 is connected to the WAN connection, the ISP's bridged modem, the status should be reachable)

Add DNS servers

41. Go to IP
42. Go to DNS
43. From the DNS Settings window, enter in the DNS server addresses provided by the ISP; click on the arrows to add a second server address (i.e.: 1.1.1.1, 4.2.2.2)
44. Press OK

Add Firewall Rule for Winbox

45. Go to IP
46. Go to Firewall
47. From the Firewall window, click the blue Plus Sign
48. From the New Firewall Rule, do the following:
    1. Select Chain, and set to input
    2. Select Protocol, and set to tcp
    3. Enter in the Dst. Port to 8291
    4. Select the In. Interface, and set to ether1-gateway
49. Go to the Action tab
50. Select Action, and set to accept
51. Click OK
52. Select the new rule which is now seen on the Filter Rules list
53. Drap the new rule to the top

Add Firewall Rule for DNS DoS Attack

54. From the Firewall window, click the blue Plus Sign
55. From the New Firewall Rule, do the following:
    1. Select Chain, and set to input
    2. Select Protocol, and set to udp
    3. Enter in the Dst. Port to 53
    4. Select the In. Interface, and set to ether1-gateway
56. Go to the Action tab
57. Select Action, and set to drop
58. Click OK
59. The new rule is now seen on the Filters Rule list

Disable SIP (SIP ALG)

60. From the Firewall window, click on the Service Ports tab
61. Select h323 and SIP (use Ctrl to select both)
62. Hit "d" on your keyboard or click the red "x" to disable, both h323 and sip now appear grayed out which means they are now disabled

Disable IP Services

63. Go to IP
64. Go to Services
65. Select the following Services from the Service List; ftp, ssh, and telnet
66. Hit "d" on your keyboard or click the red "x" to disable the services selected, they will now appear grayed out which means they have been disabled

Add an Available from Address

67. From the IP Services List, double click on "www" to edit the service
68. In the IP Service <www> window, type in the local LAN subnet (i.e.: 192.168.88.0/24)
69. Click OK
70. The available from address now appears with the LAN subnet.

Set Clock

71. Go to System
72. Go to Clock
73. From the Time Zone Name drop down menu, select the Time Zone for the device
74. Click OK

Set SNTP

75. Go to System
76. Go to SNTP Client
77. Check the box for Enable
78. In the Primary NTP server field enter in: time.nist.gov In the Secondary NTP server field enter in: us.pool.ntp.org
79. Click Apply.
80. If DNS was set, the server addresses will be changed to IPs (NTP Server text will be blue, if DNS is not set NTP Server address will be red)
81. Click OK

Enable Cloud Feature

82. Go to IP
83. Go to Cloud
84. Check the box for Enable
85. If the Mikrotik is connected to the internet, the Public Address and DNS Name will become populated (use the DNS Name to log in remotely regardless of the IP address)
86. Click OK