MikroTik Tutorial: Adding a 2nd Wireless SSID Virtual Access Point

MikroTik Tutorial: Adding a 2nd Wireless SSID Virtual Access Point

How to configure a VirtualAP in RouterOS

This example assumes you are starting with the RouterOS default configuration. The screenshots below detail the steps required to add a second access point to a MikroTik router. This quick tutorial does not address the setup steps required to secure your wireless network WPA/WPA2 wireless authentication.

  1.  Click Wireless from the left menu, Click Add and choose VirtualAP
    Create Virtual AP Interface
  2.  Enter the SSID name your would like the 2nd wireless network to appear as.
    Set the SSID of the VAP wireless interface
  3.  Click Bridge from the left menu and then click the “Ports” tab. Click Add
    Add VAP to the bridge
  4.  Choose the newly created VAP interface and add it to the “bridge-local” bridge.
  5.  Now you will see 2 SSIDs presented by the Mikrotik Router from a single wireless interface.
  1. mikrotik-virtual-access-point-step01

  2. Step 2: Enter the SSID name your would like the 2nd wireless network to appear as.

  3. Step 3: Open the Bridge dialog and choose the "Ports" tab. Click Add

  4. Step 4: Choose the newly created VAP interface and add it to the "bridge-local" bridge.

  5. mikrotik-virtual-access-point-wireless-networks

I hope you found this MikroTik Tutorial on VirtualAP useful. If it helped you out, please leave a comment below and checkout my other MikroTik Tutorials!

NetScout LinkRunner G2

LinkRunner G2 is the ultimate network cable test tool


CAT5 Cable Tester, Measure Cable Length,
PoE Voltage, Network Connectivity, Switch Port ID
Optional Wireless & Fiber Optics Modules
Check Price on Amazon

6 Replies to “MikroTik Tutorial: Adding a 2nd Wireless SSID Virtual Access Point”

  1. Does this method create 2 isolated wireless networks that prevent users on the separate networks from communicating, or does it simply create 2 SSIDs with different logins credentials for a single network?

  2. This method does not isolate the 2nd wireless network.

    To accomplish the isolation you can use two approaches.

    1. Use a bridge filter, you can see an example of this setup by configuring a new mikrotik router with the quickset feature. It has an option for guest wireless network. Once applied take a look at the bridge filter that is created.

    2. Create a separate bridge, assign 2nd VAP interface to new bridge. Assign a new ip subnet to the new bridge and run DHCP server setup. add a Nat rule for new bridge, and then ip filter rules to limit traffic between the 2 subnets.

    1. Yes, first create new Virtual AP like described in the article using Winbox, then click Wireless on the left menu, select the Security Profiles tab and add a new profile. I just copied the default profile (double click on default, click Copy Button to th right) and changed the name and passwords (WPA and WPA2 Pre-Shared Key). Back on the Wireless window, click the WiFi Interfaces tab and double click on the virtual AP entry in the list. In the Wireless tab of the dialog select the new Security profile. Done.

  3. Hello,

    I have a D-Link DAP-1330 wifi extender that I want to add as a separate SSID to my LAN, in which the main router is the Mikrotik hap AC2. So, the Mikrotik has one SSID for the upper rooms and the D-Link for the rest of the lower level rooms. It creates an SSID with the EXT at the end of the SSID name. The D-Link has as its gateway the Mikrotik of course, it is a second Access Point (the D-Link). However, when clients connect to the D-Link, traffic for some reason is not allowed by the Mikrotik nor does DHCP in the Mikrotik assigns proper addresses, only APIPA form (169.254… etc.) Does this separate SSID-EXT have to be added and allowed in the Hap AC2 somehow, to allow internet traffic and DHCP to work properly to clients connected to the D-Link?

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.