this configuration will be/was used for Commerce St. public art project: Electric Chameleons

1. if required reset mAPLite: unplug, replug and immediately press reset and hold until AP and WiFi lights alternate blinking
2. connect via wireless access point
   1. WiFi password is written on the back of the unit
3. point browser to wireless default IP address (192.168.88.1) and login. Default name is admin and default password is blank. On newer firmware password is written on the back of the unit.
4. in GUI: webfig → IP → firewall then disable #5: defconf: drop all not coming from LAN. This will allow you to connect to the GUI through the Ethernet
5. optionally disconnect from mAP lite wireless access point
6. using a DHCP server connect to mAP lite over Ethernet
7. point browser to webgui using DHCP server assigned IP address
8. in GUI: webfig → interfaces → disable wlan1
9. in GUI: quickset → CAP → apply configuration ←- This is critical
10. mAP lite will be assigned a new IP address. Connect to webgui through Ethernet with new address

// Stolen verbatim from Mikrotik's documentation//

• The currently configured network-key can be seen using the monitor command as plc-actual-network-key: [admin@MikroTik] > /interface pwr-line monitor pwr-line1
• Set network key: /interface pwr-line configure pwr-line1 network-key=cb01fcc6167bf3d1edb1433c2ebde4b3
• for some reason, setting the network password instead of the network key didn't work

• echo "mynetwork" | hpavkeys -M
• hpavkeys can maybe be installed with apt install plc-utils-extra but if not it's relatively easy to compile from source:

git clone https://github.com/qca/open-plc-utils.git
cd open-plc-utils/
make
sudo make install

Maplite B is the gateway: it joins the upstream wifi as a client, NATs, and runs DHCP. Everything else uses B as gateway and DNS.

Path to the internet: main machine → A → powerline → B → upstream wifi → internet.

Use an interactive session so the password stays out of shell history:

ssh admin@10.42.0.71

Then run these two lines per network. The profile name is only a label: it must be unique and the same in both lines. Increment it (wifi2, wifi3, …) or use a descriptive name (office, home).

/interface wireless security-profiles add name=wifi2 mode=dynamic-keys authentication-types=wpa2-psk wpa2-pre-shared-key="PASSWORD"
/interface wireless connect-list add interface=wlan1 ssid="SSID" security-profile=wifi2 connect=yes

Notes:

• The mAP lite is 2.4 GHz only. Choose the SSID that broadcasts on 2.4.
• For an open network use mode=none and leave out the key.
• Reusing an existing profile name fails with “already have such profile”.
• Put the preferred network first in the connect-list.

/interface wireless connect-list print
/interface wireless security-profiles print proplist=name,mode,authentication-types
/interface wireless registration-table print

• The connect-list shows each saved SSID, its profile and the order.
• proplist= hides passwords. A plain security-profiles print prints every stored key in clear text.
• The registration table shows which network B is currently joined to.
• The default profile is the factory one and is not used by the uplink.

/interface wireless connect-list remove [find ssid="SSID"]
/interface wireless security-profiles remove [find name=wifi2]

Pick one outside the DHCP pool (.150-.199) and not already in use (.71, .72, .99, .139). Use .73, .74, … in order.

• Plug it into the chain (powerline or ethernet).
• If its DHCP client is on (A's factory config was), it gets a lease from B. Find it on B with /ip dhcp-server lease print.
• Otherwise it is at its default address, usually 192.168.88.1. Give your machine a temporary address on that subnet to reach it.
• A factory-fresh unit has not been checked on this network, so confirm which of these applies.

Replace 10.42.0.73 with the new unit's address. Run it as one line: removing the current address can freeze or drop the SSH session, and on a single line RouterOS finishes all the commands before the connection notices.

/ip dhcp-client remove [find]; /ip address remove [find where interface=bridge or interface=wlan1]; /ip address add address=10.42.0.73/24 interface=bridge comment=lan; /ip route add dst-address=0.0.0.0/0 gateway=10.42.0.71 comment=default-gw; /ip dns set servers=10.42.0.71

The same commands work as separate lines, but only if you paste them all at once, not type them one by one:

/ip dhcp-client remove [find]
/ip address remove [find where interface=bridge or interface=wlan1]
/ip address add address=10.42.0.73/24 interface=bridge comment=lan
/ip route add dst-address=0.0.0.0/0 gateway=10.42.0.71 comment=default-gw
/ip dns set servers=10.42.0.71

If you are already connected on the address the unit should keep (for example a DHCP lease you want to make permanent), the session will not drop. Typing the lines one at a time is then fine, but do the address add before the remove, or skip the remove.

If you reach the unit on a different address (for example 192.168.88.1), the session drops when the address changes. Reconnect on the new address.

/system identity set name=maplite-D
/user set admin password="NEWPASSWORD"
/interface wireless cap set enabled=no

• Name the unit so it is easy to tell apart (all units default to “MikroTik”).
• Change the default login password.
• Turn off the factory CAP mode.

/ping 10.42.0.71 count=3
/ping google.com count=3

• Address on a bridge slave: on C the address is attached to wlan1, which is a bridge port. It works while wlan1 stays in the bridge. If you ever remove it from the bridge, move the address onto bridge first, in one line.
• Two DHCP servers: never run B's DHCP server and a “Shared to other computers” connection on the same wire at once. Disable B's first with /ip dhcp-server disable lan-dhcp.
• Shared SSH sessions (ControlMaster) are bound to the source IP and die when the machine's address changes. Remove stale sockets (rm -f /tmp/mt-<ip>.sock) before reopening, or you get “ControlSocket already exists”.
• If a unit is unreachable: the only recovery is the reset button on the unit.