Networking, Wi-Fi & Fibre Optics
When a MikroTik router loses the internet, the fault is almost always in one of five places: the line from the ISP, the WAN address, the default route, DNS or NAT. Check them in that order in WinBox or the terminal, and back up the configuration before you change anything.
What you will learn
Applies to
Tools Required
Before you start
Important
Supported Models
Procedures differ between manufacturers, models and firmware. Choose yours to see the method, where the controls are, what you need and the official source.
MikroTik · RouterOS
Run /export file=name show-sensitive for a readable copy, and /system backup save name=name password=... for an encrypted clone. Copy both off the router. Restore a backup only on the same router and RouterOS version.
Without show-sensitive, passwords and keys are hidden from the v7 export.
MikroTik · RouterOS
Run /export file=name and treat the file as containing passwords and keys. Save /system backup save name=name password=.... Copy both off the router.
How v6 handles secrets in an export was not found in MikroTik's current manual; check with export ? on a v6 router. Loading a v6 backup on v7 needs force-v6-to-v7-configuration-upgrade=yes.
MikroTik · Default configuration
The first Ethernet port is the WAN with a DHCP client and firewall; MAC connection and discovery are off on it. The LAN bridge has 192.168.88.1/24 with a DHCP server. Check yours with /system default-configuration print.
CPE and CAP profiles differ. A router set up by an installer may not use the default layout at all.
Step-by-Step Guide
1 / 9 steps
Step 1
Check the ONT before the router
Look at the fibre ONT or modem. The LOS light should be off and the PON light steady.
Expected result: A red or flashing LOS light means a fibre or ISP fault. Call the ISP; no router setting will help.
On the default configuration the ISP cable goes into ether1. Its port light should be lit.
Expected result: No light: reseat the cable, try a known-good cable, and check the ONT is powered.
Plug the laptop into ether2, open WinBox and pick the router in Neighbors. Click the MAC address if the IP shows 0.0.0.0.
Expected result: You are logged in. MAC discovery is off on the WAN port by default, so ether1 will not work.
| MAC Address | IP Address | Identity | Version |
|---|---|---|---|
| (router MAC) | 192.168.88.1 | MikroTik | 7.x |
Default LAN address shown; yours may differ.
Open New Terminal and save a text export and an encrypted backup. Then drag both from Files to your laptop.
Expected result: You can now undo any change, or rebuild the router if it fails.
[admin@MikroTik] > /export file=before-fix show-sensitive[admin@MikroTik] > /system backup save name=before-fix password=(strong password)Configuration backup saved[admin@MikroTik] > /file print
On RouterOS v6, treat any export as containing passwords and keys.
Open IP > DHCP Client. The WAN entry should say bound with an address. For PPPoE, check pppoe-out1 is running in Interfaces.
Expected result: Searching or not running: check the ISP account, the PPPoE login in Log, the VLAN or MAC lock.
| Interface | Use Peer DNS | Add Default Route | Status |
|---|---|---|---|
| ether1 | yes | yes | bound |
Open IP > Routes and look for 0.0.0.0/0 with the A (active) flag. With two, the lower distance wins.
Expected result: Missing or inactive: turn on Add Default Route on the client, or remove a stale static route.
| Flags | Dst. Address | Gateway | Distance |
|---|---|---|---|
| DAd | 0.0.0.0/0 | (ISP gateway) | 1 |
| DAc | 192.168.88.0/24 | bridge | 0 |
From the router, ping 8.8.8.8 and then mikrotik.com.
Expected result: Address fails: WAN or route. Address works but the name fails: DNS. Both work: check NAT.
[admin@MikroTik] > /ping 8.8.8.8 count=4 sent=4 received=4 packet-loss=0%[admin@MikroTik] > /ping mikrotik.com count=4 sent=4 received=4 packet-loss=0%
Open IP > DNS. There must be working servers, and Allow Remote Requests must be on if computers use the router for DNS.
Expected result: Names resolve again. Keep the default firewall so the router is not an open resolver.
Open IP > Firewall > NAT. A srcnat masquerade rule must be enabled and point out of the WAN list or the real WAN interface.
Expected result: Computers behind the router reach the internet. With PPPoE, the rule or WAN list must include pppoe-out1.
| # | Chain | Action | Out. Interface List |
|---|---|---|---|
| 0 | srcnat | masquerade | WAN |
Interactive Demonstration
What is happening with your MikroTik?
Is the LOS light on the fibre ONT off (not red or flashing)?
If not, the likely cause
No signal from the ISP: a fibre fault or an outage.
What to do: Call your ISP and describe the ONT lights. Do not touch the fibre or reset the router.
Is the internet package paid and still active?
If not, the likely cause
The service has expired or been suspended.
What to do: Renew the package with your ISP, then restart the ONT and router.
Is the port light lit on the router port the ISP cable uses (usually ether1)?
If not, the likely cause
No physical link between the ONT and the router.
What to do: Reseat or replace the cable, check the ONT is on, and make sure the cable is in the WAN port.
Does IP > DHCP Client show bound, or is pppoe-out1 running?
If not, the likely cause
The router is not getting an internet address.
What to do: For PPPoE, read the Log for login errors. For DHCP, ask the ISP about a MAC lock or VLAN.
Is there an active 0.0.0.0/0 route in IP > Routes?
If not, the likely cause
No working default route.
What to do: Turn on Add Default Route on the DHCP or PPPoE client, or remove a stale static route.
Can the router ping 8.8.8.8 and mikrotik.com?
If not, the likely cause
If the address works but the name fails, DNS is broken. If neither works, the ISP side is down.
What to do: Fix IP > DNS servers, or call the ISP with your ping results.
Every check passed
The router is online, so the fault is between the router and your devices.
What to do: Check the NAT masquerade rule and that devices get an address from the router's DHCP server.
Do the computers have an address in the router's range, such as 192.168.88.x?
If not, the likely cause
The DHCP server on the LAN is off or the bridge has changed.
What to do: Check IP > DHCP Server on the LAN bridge and its address pool.
Is there an enabled srcnat masquerade rule in IP > Firewall > NAT?
If not, the likely cause
Without masquerade, private addresses cannot reach the internet.
What to do: Enable or re-create the masquerade rule on the WAN interface list.
Does the rule point at the interface the internet really uses (for example pppoe-out1)?
If not, the likely cause
The rule names ether1 while traffic leaves over PPPoE or LTE.
What to do: Change the out-interface, or add the real WAN interface to the WAN list.
Can a computer open a site by IP address but not by name?
If not, the likely cause
Something other than DNS is blocking traffic, often a firewall rule.
What to do: Review recent firewall changes, or ask a professional to check the filter rules.
Every check passed
DNS from the router is not reaching the computers.
What to do: Turn on Allow Remote Requests in IP > DNS, keeping the default firewall rules in place.
Is the problem the same on every device?
If not, the likely cause
One device has its own problem: VPN, proxy or security software.
What to do: Check that device's VPN, proxy and DNS settings.
If you use PPPoE, is Change TCP MSS on in the PPP profile it uses?
If not, the likely cause
Large packets do not fit through PPPoE and get dropped.
What to do: Turn on Change TCP MSS in PPP > Profiles, or add an MSS clamping rule.
Is the PPPoE MTU set to the value your ISP gave?
If not, the likely cause
A changed MTU causes stalls on larger transfers.
What to do: Set the MTU your ISP specifies, or return it to its default.
Every check passed
The ISP may be dropping traffic or the line may be congested.
What to do: Run speed tests at different times and send the results to your ISP.
Is your laptop plugged into a LAN port, not ether1?
If not, the likely cause
MAC discovery is off on the WAN port by default.
What to do: Move the laptop cable to ether2 or another LAN port and look in WinBox Neighbors again.
Does the router appear in the WinBox Neighbors list?
If not, the likely cause
The laptop has no address, or discovery is disabled on that port.
What to do: Give the laptop an address in the router's range, try another LAN port, and check the cable.
Do you have the admin password from the installer or the sticker?
If not, the likely cause
Without the password, only a reset gives access, and it erases the configuration.
What to do: Ask your installer first. If you must reset, follow our MikroTik reset and reconfigure guide.
Every check passed
Your account may lack rights, or WinBox access is limited to certain addresses.
What to do: Check with whoever set up the router about user groups and allowed addresses.
Does the fibre route have a lower distance than the 4G route in IP > Routes?
If not, the likely cause
The 4G route is preferred all the time.
What to do: Give the fibre route the lower distance.
Does the failover check ping a public address beyond the ISP gateway?
If not, the likely cause
Check gateway only tests the next hop, which may answer even when the ISP is down.
What to do: Use recursive routes or Netwatch to test a public address.
Every check passed
A script or Netwatch rule may be holding the 4G route.
What to do: Review Tools > Netwatch and System > Scripts, or ask a professional.
Troubleshooting
Likely cause No light from the ISP: cut fibre, bent patch cable or an ISP outage.
Solution Call the ISP with a photo of the lights. Do not unplug or bend the fibre.
Likely cause No link, an expired account, a MAC lock after a router change, or a missing VLAN.
Solution Check ether1's link light and the account, ask the ISP to clear the MAC lock, and confirm the VLAN interface.
Likely cause Wrong user name or password, suspended account, or the client is on the wrong interface.
Solution Read the Log for authentication errors and confirm the login and interface with the ISP.
Likely cause Add Default Route is off, or a stale static route with a lower distance wins.
Solution Turn on Add Default Route on the client, or disable the old static route.
Likely cause No working DNS servers.
Solution Check IP > DNS, add a reliable resolver, and keep Allow Remote Requests behind the firewall.
Likely cause Masquerade rule disabled or pointing at ether1 instead of pppoe-out1.
Solution Enable the srcnat masquerade rule on the WAN list or the real WAN interface.
Likely cause Packets too large for PPPoE and no MSS clamping.
Solution Turn on Change TCP MSS in the PPP profile and use the ISP's MTU.
Likely cause Failover only checks the next hop, or route distances are wrong.
Solution Check distances in IP > Routes and use a check that pings beyond the gateway.
In Depth
When a MikroTik router loses the internet, the fault is almost always in one of five places: the line from the ISP, the WAN address, the default route, DNS or NAT. Check them in that order in WinBox or the terminal, and back up the configuration before you change anything.
MikroTik routers are popular with businesses, hotels and internet providers because they are powerful and good value. That power has a cost: there is no friendly "repair" button, and a careless reset can wipe settings that took hours to build. The menu names here are from WinBox and RouterOS v7. RouterOS v6 uses the same menus for everything in this guide; where a command differs, it is noted. The same settings are also in WebFig and the terminal.
Warning Do not reset the router to "fix" the internet unless you have a copy of its configuration. A reset erases ISP login details, VLANs, port forwards, Wi-Fi, hotspot and firewall rules. If a reset really is needed, follow how to reset a MikroTik router and set it up again.
| What you see | Where to look first |
|---|---|
| No device on the network can reach the internet, wired or wireless | The ONT, the account, ether1, then the WAN address |
| Phones say "Connected, no internet" | WAN, route, DNS or NAT on the router, not the Wi-Fi |
| Pinging 8.8.8.8 works but websites fail by name | DNS |
| The router can ping out but computers behind it cannot | NAT masquerade, or the computers' own addresses |
| Small pages load but banking sites, uploads or app logins hang | MTU or MSS, usually on PPPoE |
| The internet fails over to 4G and never switches back | Route distances and the failover check |
| You cannot log in to the router at all | Cable in the wrong port, laptop settings, or the password |
If only one laptop or phone has the problem, it is that device, not the router. If the Wi-Fi itself is weak or slow rather than offline, read why your Wi-Fi is slow instead.
These checks change nothing in the configuration:
Warning Do not bend, pull or unplug the fibre patch cable on the ONT, and never look into a fibre connector. The fibre is easily damaged and the laser light can harm your eyes.
WinBox is MikroTik's management tool; download it only from mikrotik.com. Plug the laptop into a LAN port, not ether1. On the default configuration, MAC connection and neighbour discovery are switched off on the WAN port, so the router will not appear in WinBox from there.
The Neighbors tab lists MikroTik devices on that segment. Click the MAC address to connect even if the router's IP address is unknown or broken. MikroTik notes that MAC sessions use broadcasts and are less reliable than IP, so switch to the IP address once you can. If the laptop has no address at all, give it one in the router's range first; many network drivers will not carry a MAC session without one.
Log in with the admin account. On the default configuration the router is usually at 192.168.88.1. Older models shipped with user admin and a blank password; newer ones have a unique password printed on the sticker. That sticker password only applies to a router still on its default configuration: if the installer changed it, the sticker will not work, and the only routes forward are the installer's records or a reset.
RouterOS keeps two kinds of copy, and you want both before changing anything:
/export) is readable and can be used to rebuild the configuration by hand or on another router. On RouterOS v7, passwords and keys are hidden unless you add show-sensitive, and user passwords, certificates and SSH keys are never exported. On an older RouterOS v6 router, assume the export contains passwords and keys. Either way, a file containing secrets must be stored securely./system backup save) is a full clone for restoring the same router. It contains the device's MAC addresses, so loading it on a different router can leave interfaces misconfigured. Giving a password encrypts the file; without one it is stored unencrypted.Copy both files from the Files window to your laptop. A file that only lives on the router is lost if the router dies. MikroTik's backup documentation also advises restoring on the same RouterOS version that made the backup.
Plays from YouTube when you press play.
How the router gets its internet address depends on the ISP.
DHCP. The ISP's box hands out an address. In IP > DHCP Client, the WAN entry should show bound and an address. If it stays on searching: check the cable and the ONT; ask whether the ISP locks the service to the MAC address of the first device that connected (common after a router is replaced); and if the ISP needs a VLAN ID, make sure the VLAN interface still sits on the right port and that the DHCP client runs on the VLAN, not on ether1.
Static. The ISP gave you a fixed address, gateway and DNS. Check all three in IP > Addresses, IP > Routes and IP > DNS against the ISP's letter. One wrong digit in the gateway is enough.
PPPoE. You log in with a user name and password. In Interfaces, the PPPoE client (usually pppoe-out1) should be running. If it is not, open Log: an authentication failure means a wrong user name or password, or an account the ISP has suspended. Once PPPoE is in use, the internet leaves through pppoe-out1, not ether1, which matters for the NAT rule below.
In IP > Routes there must be an active route to 0.0.0.0/0. The DHCP and PPPoE clients add it themselves when their "add default route" option is on; a static connection needs one added by hand.
Test from the router itself (Tools > Ping, or the terminal). If the router cannot ping 8.8.8.8, the problem is upstream of your computers.
If the router can ping 8.8.8.8 but not a name such as mikrotik.com, open IP > DNS. There should be servers listed, either dynamic ones from the ISP or static ones you added. Add a reliable public resolver if none work.
If your computers use the router as their DNS server, Allow Remote Requests must be on, and the firewall must stop DNS requests from the internet side. The default configuration's firewall does this.
Warning Allowing remote DNS requests without a firewall rule that drops them on the WAN turns the router into an open resolver that attackers can abuse. Keep the default input rules, or have someone check them.
If the router reaches the internet but the devices behind it do not, check IP > Firewall > NAT. You need a rule with chain srcnat and action masquerade, pointing out of the WAN, either as an out-interface or (as in the default configuration) the WAN interface list. MikroTik's NAT documentation explains that masquerade is designed for connections whose public address can change, such as DHCP and PPPoE.
Typical mistakes: the rule was disabled or deleted while "tidying up"; it names ether1 while the internet now comes over pppoe-out1 or an LTE interface; or pppoe-out1 was never added to the WAN interface list.
PPPoE carries a little less data per packet than plain Ethernet. If nothing adjusts for that, small pages load but larger transfers stall. RouterOS PPP profiles have a Change TCP MSS setting (in PPP > Profiles) that clamps connections to fit. MikroTik's manual shows it set to yes on the built-in default profile, and default-encryption takes its value from there. A custom profile may not have it, so check the profile your PPPoE client actually uses, and that nobody has changed the PPPoE MTU from the value your ISP expects.
A common set-up uses two default routes with different distances. A plain check gateway only tests the next hop, often the ONT or the ISP's first router, which may still answer when the ISP is down. A check that pings a public address beyond the gateway (often built with recursive routes or Tools > Netwatch) is more reliable. If the router stays on 4G after the fibre returns, look at the distances and checks in IP > Routes and any Netwatch scripts. A failover that never switches back can use a month's data bundle in a day.
Plays from YouTube when you press play.
Brownouts leave routers and ONTs half-working, and surges kill Ethernet ports. Put the router, ONT and switches on a UPS with voltage regulation, plus surge protection. If a port shows no link with a known-good cable, it may be damaged; moving the WAN to another port also means changing the configuration (the DHCP or PPPoE client, the WAN interface list and the bridge).
Call us if you cannot log in, there is no backup, the ISP says the line is fine but the WAN will not connect, or you find rules and scripts you do not understand. Extrion Tech designs and supports business networks, including MikroTik routing, fibre and 4G failover, VLANs and backups. See our network architecture and infrastructure service or contact us with your router model and the information above.
This guide is general information. Procedures, product features and firmware change, so check your own equipment's documentation before you start.
FAQs
Not to fix the internet. A reset erases the ISP login, VLANs, firewall and Wi-Fi, so you rebuild from scratch. Export the configuration first, and if you do need a reset, follow our MikroTik reset and reconfigure guide.
Connect a laptop by cable to a LAN port (not ether1), open WinBox and use the Neighbors tab to connect by MAC address. Then note the IP address and reconnect with it, because IP sessions are more reliable.
Probably not. "Connected, no internet" means the device reached the router but the router has no working WAN, route, DNS or NAT. Work through those in order.
An export is a readable text file you can use to rebuild settings, even on another router. A backup is a binary clone meant for restoring the same router on the same RouterOS version. Keep both, off the router.
It is not recommended. The backup carries the original router's MAC addresses and interface layout. For a different router, apply the text export by hand, adjusting interface names.
Usually the NAT masquerade rule is missing, disabled or pointing at the wrong interface, for example ether1 when the internet now comes over PPPoE. Also check that the computers got an address from the router's DHCP server.
The package has probably expired. Check the renewal date with your ISP, and set a reminder or automatic renewal.
We design, cable and configure routers, switches and firewalls that stay up, with documentation you can hand to the next engineer.
Ask for clarification, tell us a problem this did not solve, or suggest a topic. An engineer reads every message, and we use them to improve the Knowledge Center.
Keep learning
Networking, Wi-Fi & Fibre Optics
20 min
Troubleshooting fix
Slow Wi-Fi is rarely one fault. It is usually distance, thick walls, a crowded channel or simply the internet plan. One wired test tells you which hal...
View Guide
Networking, Wi-Fi & Fibre Optics
45 min
Troubleshooting fix
Wi-Fi dead zones happen when walls, distance or a badly placed router stop the signal reaching a room. Map them with a phone, rule out cheap fixes, th...
View Guide
Networking, Wi-Fi & Fibre Optics
40 min
A reset wipes a MikroTik router back to its default configuration, or to nothing at all. Done well it takes twenty minutes; done in a hurry it erases...
View Guide
Networking, Wi-Fi & Fibre Optics
25 min
When staff say "the internet is slow", the connection is often not the problem: it is one router trying to serve forty devices through stone walls. Th...
View GuideEngineers reply Mon – Fri, 08:00 – 17:00
We'll send a copy of the conversation to our team. Next time, the chat starts fresh.
