How to Use a MikroTik Router With Starlink: WAN Setup and Safe Rollback

A MikroTik router can give a Starlink connection more control over VLANs, firewall rules, routing and monitoring. The important decision is which device owns routing and DHCP. Set that boundary before you move a cable.

This guide covers a MikroTik RouterOS device used as the main router behind a Starlink Ethernet handoff. It also explains the simpler fallback where the Starlink router remains in charge. Menu names vary between RouterOS versions and MikroTik models, so use the settings below as a design checklist rather than a copy-and-paste configuration.

Before you start

Have these ready:

• Your Starlink kit model and the correct Ethernet path for it.
• A MikroTik router with a working WAN port and a current RouterOS backup.
• A laptop connected by cable for the first test.
• Your current Starlink Wi-Fi name, password and important device reservations.
• A written record of the existing cable layout so you can undo the change.
• The Starlink app and your account login.

Some Starlink kits expose Ethernet from the power supply, while others need a compatible Ethernet adapter. Starlink Mini and newer hardware can use different cable and power arrangements. Do not force a connector or assume that a port with a similar shape has the same role.

Update the MikroTik only when you have a recovery path. Changing firmware and changing the network topology at the same time makes a failed test harder to diagnose.

Choose the network layout

Layout A: MikroTik is the main router

Use this when you want MikroTik to provide the LAN, DHCP, NAT, firewall, VLANs and Wi-Fi or access-point coordination.

If the Starlink router is still routing, enable Starlink Bypass Mode where the kit supports it. Bypass Mode removes the Starlink router's local routing and Wi-Fi layer so the MikroTik can own the network.

Layout B: Starlink stays as the router

Use this when bypass mode is unavailable, you need to keep the Starlink router's Wi-Fi, or you want a lower-risk first test.

This normally creates double NAT. Browsing, streaming and many work applications may still function, but inbound connections and some peer-to-peer services can be limited by both local NAT and Starlink's carrier-grade NAT. It is a valid temporary layout, not a reason to open broad firewall rules.

Do not connect a Starlink LAN port back into the MikroTik LAN while also connecting Starlink Ethernet to the MikroTik WAN. That can create a loop or a second DHCP path.

Build a safe MikroTik starting point

Start with one working LAN. Add VLANs, traffic shaping and monitoring after the basic path is proven.

On the MikroTik:

• Use the port connected to Starlink as the WAN interface.
• Configure the WAN as a DHCP client unless your service documentation explicitly requires another method.
• Put the remaining intended LAN ports into one LAN bridge.
• Enable a DHCP server on the LAN bridge.
• Use a private LAN subnet that does not overlap the Starlink upstream subnet.
• Keep the administration interface reachable from the LAN only.
• Use the default stateful firewall structure as a starting point: allow established and related traffic, allow the LAN to make outbound connections, and drop unsolicited WAN input.
• Add a masquerade source-NAT rule for traffic leaving through the Starlink WAN.

Do not copy an address from the Starlink router onto the MikroTik LAN. For example, a MikroTik LAN such as 192.168.50.0/24 is less likely to overlap a common upstream range than reusing 192.168.1.0/24. The exact private range is not important; keeping the WAN and LAN on different subnets is.

If you plan to use separate Main, Guest or IoT networks, create them only after one unsegmented LAN works. Give each network its own subnet, DHCP scope and firewall policy. Keep inter-network access blocked by default, then allow only the services that have a clear need to cross the boundary.

Connect the hardware in stages

1. Photograph or write down the current Starlink cable layout.
2. Power down the MikroTik and disconnect its downstream switch or access points.
3. Connect the Starlink Ethernet output to the MikroTik WAN port.
4. Connect one laptop to a MikroTik LAN port.
5. If using Layout A, enable Bypass Mode in the Starlink app on supported hardware and allow the Starlink equipment to restart.
6. Wait for the Starlink app to report that the service is online.
7. Start the MikroTik and wait for its DHCP client to request a WAN lease.
8. Confirm the laptop receives an address from the MikroTik LAN DHCP server.
9. Test one website and one DNS lookup before reconnecting other equipment.

In bypass mode, Starlink Wi-Fi may disappear and some Starlink router controls may no longer be available. That is expected for a handoff to another router. The precise setting name and recovery process vary by kit and software version.

Verify the WAN and LAN separately

Check the MikroTik status pages before changing anything else.

The WAN should show:

• A DHCP lease or other expected upstream state.
• A default route.
• Working DNS resolution.
• A changing or renewable lease time rather than a manually invented static address.

The laptop on the LAN should show:

• An address in the MikroTik LAN subnet.
• The MikroTik as its default gateway.
• A DNS server that the MikroTik is intended to use.
• Internet access over a wired connection.

Test in this order:

1. Open the MikroTik management page from the LAN.
2. Resolve a few domain names.
3. Open several websites.
4. Run a speed and latency test over Ethernet.
5. Restart the MikroTik and confirm that the WAN lease, DHCP and DNS recover.
6. Reconnect one switch or access point at a time.
7. Test a normal video call, streaming session and any work VPN.
8. Check that printers, NAS devices and smart-home equipment still have the local access they need.

A speed result over Wi-Fi is not a clean test of Starlink performance. First establish that the wired path, routing and DNS are correct.

Avoid common MikroTik mistakes

The WAN has no address: check the cable path, confirm the DHCP client is attached to the correct interface or WAN bridge, and verify that the Starlink Ethernet path is active. Restart Starlink first, then renew the MikroTik lease.

The WAN has an address but the LAN cannot browse: check the default route, DNS settings, the LAN DHCP server and the source-NAT rule. Confirm that the LAN subnet does not overlap the WAN subnet.

Only some devices work: look for a second DHCP server, an old access point still in router mode or a switch connected to the wrong interface list. Disconnect downstream equipment and add it back one device at a time.

Remote access does not work: Bypass Mode removes one local NAT layer but does not guarantee a public IPv4 address. Starlink may still use carrier-grade NAT. Use an outbound overlay or relay service you trust, and never expose the MikroTik administration service broadly to the internet.

A VPN or large transfer hangs: verify the basic route and packet loss first. Then test the VPN's MTU setting on one client or tunnel and record the original value before changing it. Do not change every MTU in the network at once.

You cannot manage the router: connect a laptop directly to the MikroTik LAN and use the local management address. A firewall that blocks WAN administration is doing the safer thing.

Safe rollback

Before enabling bypass mode or moving cables, keep a simple recovery path:

1. Disconnect the MikroTik WAN and downstream LAN.
2. Restore the original Starlink router connections.
3. Disable Bypass Mode in the Starlink app if it was enabled and your kit allows it.
4. Wait for the Starlink router to restart.
5. Confirm one device can browse.
6. Recheck the MikroTik configuration offline and change one setting at a time.

Some Starlink routers require a manual reset to leave Bypass Mode. Treat a reset as a last-resort recovery action because it can remove saved router settings. Follow the instructions for the exact hardware rather than repeatedly power-cycling it.

Final checklist

The setup is ready when:

• One device clearly owns routing and DHCP.
• The MikroTik WAN uses DHCP or the documented service method.
• The MikroTik LAN and upstream networks do not overlap.
• Unsolicited WAN input is blocked.
• MikroTik administration is restricted to the LAN.
• A wired client can browse and resolve DNS.
• A restart restores service without manual intervention.
• You have written cable notes and a tested rollback path.

The cleanest design is usually Starlink providing the internet handoff and MikroTik providing the local network. If that is not possible, a routed MikroTik behind the Starlink router can still be useful; just plan around double NAT and keep the security boundary explicit.

Sources

• Starlink: Can I use my own router with Starlink?
• Starlink: What is bypass mode?
• MikroTik RouterOS: DHCP
• MikroTik RouterOS: NAT
• MikroTik RouterOS: Firewall