Setup Wizard

The Setup Wizard builds the guest network from scratch. Reading the device's current configuration, it generates what is needed for the guest network, hotspot, RADIUS and 5651 logging. Your existing settings are preserved — the wizard fills the gaps rather than overwriting.

How do I open this screen? MikroTik Management → GUEST NETWORK → Setup.

1. Current state of the device

Before the wizard starts it lists what the device already has:

• Internet uplink (WAN)
• Hotspot server
• DHCP server
• RADIUS definition
• NAT for the internet uplink

Each row reads present / none, or ? if the device cannot be reached. Come back to this list after setup to confirm the result.

2. The wizard's three steps

The steps appear at the top: 1. Selection → 2. Script approval → 3. Code. So the wizard does not apply anything directly — it takes your choices and then puts the configuration destined for the device in front of you for approval.

3. Step 1 — Selection

• Which interface will carry the guest network: The interfaces read from the device are listed. Ports that are members of a bridge cannot be selected — choose the bridge itself instead.
• Guest gateway address: If the chosen interface already has an address, it appears here and is preserved. Change it and the address on the device is updated. The DHCP range is derived from this network automatically (e.g. 10.99.1.1/24).
• Portal domain: The name guests will see in their browser address bar. Do not define it in public DNS — it only needs to resolve inside the guest network.

4. Security and compliance steps

The same step carries four checkboxes:

• 5651 logging: forward records to the Useroam server — mandatory, it cannot be switched off. This is the basis of legal logging in Türkiye.
• DNS enforcement, blocking DoH, DoT and QUIC: Stops a guest bypassing logging with encrypted DNS or QUIC.
• Close device management ports from the guest network: Prevents guests reaching the router.
• Isolate the guest network from internal networks: Keeps guest traffic away from the office or POS network.

All four are recommended: the first three protect the 5651 obligation directly, the last protects your internal network.

Next takes you to the script approval step.

Related pages: MikroTik Management → Guest Wi-Fi and Useroam Connection; Analytics and Reports → 5651 Logs.