MikroTik Router: No Internet? A Step-by-Step Troubleshooting Guide

MikroTik routers are popular with businesses, hotels and internet providers because they are powerful and good value. That power has a cost: when the internet stops, there is no friendly "repair" button, and a careless reset can wipe settings that took hours to build.

This guide follows the path a packet takes out of your network: the cable or fibre, the ISP connection, the router's route to the internet, DNS and NAT. Check them in that order and you will find most faults quickly. The menu names below are from Winbox and RouterOS. The same settings are in WebFig and the terminal.

Warning Do not reset the router to "fix" the internet unless you have a copy of its configuration. A reset erases ISP login details, VLANs, port forwards, Wi-Fi, hotspot and firewall rules. Export the configuration first (see below), and if there is no backup at all, call whoever set the router up.

Symptoms

• No device on the network can reach the internet, wired or wireless.
• Devices connect to Wi-Fi but show "No internet" or "Connected, no internet".
• Websites fail by name, but pinging an IP address such as 8.8.8.8 works (a DNS problem).
• The router can reach the internet, but the computers behind it cannot (often NAT).
• The connection drops and returns, or fails over to 4G and never switches back.
• You cannot log in to the router at all.

Likely causes

1. ISP or ONT fault. The fibre is cut, the ONT (the ISP's fibre box) has lost signal, or there is an outage in your area.
2. Expired or suspended service. The internet package has not been renewed or paid.
3. WAN not getting an address. The DHCP client is not bound, or the PPPoE session will not connect (wrong password, wrong VLAN, ISP account locked).
4. No working default route. The route to the internet is missing, disabled or pointing at the wrong gateway.
5. DNS failure. The router or devices have no working DNS servers.
6. NAT missing. The masquerade rule has been deleted, disabled or tied to the wrong interface.
7. Failover misconfigured. The backup link takes over and does not hand back, or both links are marked down.
8. Power or hardware. A brownout has left the router or ONT in a bad state, or a port has been damaged by a surge.

Safe checks you can do

These steps change nothing in the router's settings.

1. Check that it is not just one device. Try a second phone or laptop, wired if possible.
2. Look at the ONT or modem lights. A red or flashing LOS light (loss of signal) on a fibre ONT means no light is reaching it: the fibre is damaged or the ISP has a fault. Call the ISP.
3. Confirm the account is active. Check for unpaid bills, expiry SMS messages or messages from your ISP. Many packages simply stop on the renewal date.
4. Restart in the right order. Turn off the router and ONT. Turn on the ONT and wait until its lights are steady (a couple of minutes), then turn on the router.
5. Check cables. Make sure the WAN cable from the ONT goes into the router's WAN port (on the default configuration this is usually ether1) and that the port light is on.
6. Ask the ISP if there is a known outage. Tell them what the ONT lights show.

Warning Do not bend, pull or unplug the green or blue fibre patch cable on the ONT, and never look into a fibre connector or the end of a fibre. The ISP's fibre is easily damaged and the laser light can harm your eyes.

Solutions

The following steps need Winbox access and some confidence with network settings. If you are not comfortable, collect the information listed at the end and call a professional.

Get into the router with Winbox

Winbox is MikroTik's management tool. Download it only from mikrotik.com.

• Connect a laptop by cable to a LAN port.
• Open Winbox and look in the Neighbors tab. It lists MikroTik devices on that network segment, and you can connect by MAC address even if you do not know (or have broken) the router's IP address.
• Log in with the admin account. On the default configuration the router address is usually 192.168.88.1. Newer devices ship with a unique password printed on the label instead of a blank one.

Back up before you change anything

Before any change, save two copies:

1. A text export. In the terminal, run /export file=before-fix. On RouterOS v7, passwords and keys are hidden from the export unless you add show-sensitive. You need them if you will restore by hand, so store that file securely.
2. A binary backup. Run /system backup save name=before-fix password=YourStrongPassword. It restores the whole configuration on the same router.

Then drag both files from the Files window to your laptop. MikroTik's Configuration Management page explains that a backup is best for restoring the same device, and an export for reading or moving settings to another device.

Plays from YouTube when you press play.

Check the WAN connection: DHCP or PPPoE

How your router gets internet depends on your ISP.

DHCP (the ISP's box hands out an address). Open IP > DHCP Client. The WAN entry should show the status bound and an IP address. If it says searching:

• check the cable and the ONT;
• some ISPs lock the service to the MAC address of the first device that connected, so a replaced router may need the ISP to clear it;
• some ISPs need a VLAN ID on the WAN. If a VLAN interface exists in the configuration, make sure it is still attached to the right port.

PPPoE (you log in with a user name and password). Open Interfaces and find the PPPoE client. It should be running (R flag) and show connected status. If not:

• open Log and look for authentication errors. "Authentication failed" means a wrong user name or password, or an account the ISP has suspended;
• confirm the PPPoE client is attached to the correct interface (or VLAN);
• ask the ISP to confirm the credentials and that the account is active.

Check the default route

Open IP > Routes. You need a route with destination 0.0.0.0/0 that is active (A flag). The DHCP client and PPPoE client normally add it automatically when their "add default route" option is enabled.

• No default route: enable "add default route" on the DHCP or PPPoE client, or add a static route to the ISP gateway.
• Route present but not active: the gateway is unreachable. Go back to the WAN checks.
• Two default routes: the one with the lower distance wins. A static route left over from an old connection can override the real one.

Test from the router: Tools > Ping to 8.8.8.8. If this fails, the problem is the WAN or the route, not your computers.

Check DNS

Ping 8.8.8.8 from the router, then ping a name such as mikrotik.com.

• IP works, names fail: open IP > DNS. There should be DNS servers listed (dynamic ones from the ISP, or static ones you added). Add a reliable public resolver if none are working.
• If devices use the router for DNS, Allow Remote Requests must be enabled on the router, and the firewall must block DNS requests from the internet side. The default configuration does this.

Warning Enabling remote DNS requests without a firewall rule blocking DNS from the WAN turns your router into an open resolver that attackers can abuse. Keep the default firewall rules, or have someone check them.

Check NAT masquerade

If the router reaches the internet but computers behind it do not, check IP > Firewall > NAT. There should be a rule with chain srcnat, action masquerade, and the out-interface set to your WAN (or the WAN interface list). MikroTik's NAT documentation explains masquerade is designed for connections whose public IP can change, such as DHCP or PPPoE.

Common mistakes:

• the rule is disabled, or was deleted during "tidying up";
• the out-interface is ether1, but the internet now comes over the PPPoE interface;
• a rule above it in the list matches the traffic first.

Some websites work, others hang

If small pages load but large ones, banking sites or app logins hang, especially on PPPoE, the cause is often the MTU. PPPoE has a smaller packet size than normal Ethernet. RouterOS PPPoE profiles normally adjust the TCP maximum segment size automatically. If someone changed the profile or the MTU, ask your ISP for the correct values.

Failover between fibre and 4G

Many sites use 4G as a backup when fibre fails. A typical MikroTik set-up uses two default routes with different distances, plus a check that the primary actually reaches the internet.

• A simple check gateway only tests the next hop (often the ONT), which may still answer when the ISP is down. Checking a public address beyond the gateway (often called recursive routing) is more reliable.
• If the router stays on 4G after the fibre returns, look at the route distances and the checks in IP > Routes, and any scripts in Tools > Netwatch.
• Watch 4G data use. A failover that never switches back can use a month's bundle in a day.

Plays from YouTube when you press play.

Power and surge damage

Brownouts can leave routers and ONTs half-working. Put the router, ONT and switches on a UPS with voltage regulation, and add surge protection. If a port has no link light with a known-good cable, it may be damaged. Move the WAN to another port, which needs a configuration change.

When to call a professional

Call your network installer or a MikroTik professional if you cannot log in, the configuration has no backup, the ISP says the line is fine but the WAN will not connect, or you see rules and scripts you do not understand. Before calling, collect:

• Router model and RouterOS version (System > Resources).
• Photos of the ONT and router port lights.
• Your ISP, connection type (DHCP or PPPoE) and any account number.
• Screenshots of IP > Routes, IP > DHCP Client or the PPPoE status, and the Log.
• The result of pinging 8.8.8.8 and mikrotik.com from the router.
• What changed recently: new ISP box, power cut, someone editing the router.
• Your exported configuration file (share it only with someone you trust).

Frequently asked questions

When to call Extrion

Extrion Tech designs and supports business networks, including MikroTik routing, fibre and 4G failover, VLANs and backups. See our network architecture and infrastructure service or contact us with your router model and the information above.

This guide is general information to help you plan. Prices, product features and regulations change, so confirm the details for your own site before you buy.

Still stuck, or want more detail?

Ask for clarification, tell us a problem this did not solve, or suggest a topic. An engineer reads every message, and we use them to improve the Knowledge Center.

Leave empty

What would you like to do?

Ask for clarification Report a problem this did not solve Suggest a topic

Your message

Name (optional)

Email (for a reply)

Send to an engineer Or ask in live chat