Open WiFi network without encryption

What the audit found

An enabled wireless interface on your router is using a security profile with no encryption: the network is open. Anyone within radio range can connect without a password, and traffic between the access point and its clients is sent in the clear.

The audit reports this as high when the network is open and no hotspot (captive portal) is configured for it. If a hotspot is present, the same state is reported as low, because a public guest network with a portal is a deliberate design — the remaining concerns are then isolation and what the portal itself protects.

Why it matters

Two separate things go wrong on an open network.

The first is access. Without a passphrase, the only thing standing between a passer-by and your internal network is the firewall — and on most small routers the WiFi interface sits on the same bridge as the wired LAN. Someone in the car park can join, browse your file shares, reach your printer's admin page, and try the router's own login. If your management interface is reachable from that bridge, they are one weak password away from the router.

The second is confidentiality. With no encryption, radio traffic is readable by anyone nearby with a laptop. Web traffic to HTTPS sites is still protected by TLS, but DNS lookups, plain HTTP, older e-mail clients and many IoT devices are not. A guest network with a captive portal is no better in this respect: the portal login itself travels unencrypted, and after login everything else does too.

WPA2 with AES has been standard on every device made in the last fifteen years. There is no compatibility reason to run an open network today except for a deliberate public hotspot — and even those have better options now.

What it looks like in Winbox

Open Wireless → Security Profiles. The profile used by the offending interface has Mode set to none. Then check Wireless → WiFi Interfaces, double-click the interface and look at the Wireless tab: the Security Profile field tells you which profile is in use.

On RouterOS 7 with the newer wifi package, the equivalent is WiFi → Security and the Security field on the interface.

How to fix it

Switch the security profile to WPA2 with AES and a strong passphrase. Under Wireless → Security Profiles, open the profile the interface uses, set its Mode to dynamic keys, allow only WPA2-PSK, force AES-CCM for both unicast and group ciphers, and enter a passphrase of at least 12 characters that is not a dictionary word. Change every profile that is in use, not just the default.

On RouterOS 7 with the newer wifi package, the equivalent is a security entry under WiFi → Security with WPA2-PSK and WPA3-PSK as authentication types and a passphrase, which you then assign in the Security field of each interface. Offering WPA3 alongside WPA2 lets newer clients use the stronger protocol.

If the network is meant to be a public hotspot, you have two options. Either use WPA2 with a passphrase displayed on the wall — it still stops casual eavesdropping — or, on RouterOS 7, enable OWE (opportunistic wireless encryption) so that clients get per-session encryption without a password. In every case, put the guest network on its own bridge or VLAN, firewalled off from the internal LAN and the router's management services. Clients will need to reconnect after the change; do it out of hours, and use Safe Mode if you manage the router over that same WiFi.

Afterwards, forget the network on a phone or laptop and reconnect: you should be asked for the passphrase, and the connection details should show WPA2 or WPA3. Confirm that every profile in use shows dynamic keys mode, then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I run a café hotspot. Do I really need encryption?

Not strictly, but your guests benefit from it. A passphrase written on the counter costs nothing and stops people across the street reading your customers' traffic. Whether or not you encrypt, make sure the hotspot network cannot reach your till, your office PCs or the router's login page.

Will old devices stop working with WPA2-AES?

Anything sold since about 2006 supports WPA2 with AES. The devices that fail are typically very old printers or embedded gadgets; put them on a separate, firewalled network rather than lowering security for everyone.

Is a hidden SSID or MAC filtering a substitute?

No. A hidden SSID is visible to any wireless scanner the moment a client connects, and MAC addresses can be copied in seconds. Neither provides encryption. Use WPA2 or WPA3.