What Is MikroTik Hotspot? How It Works, Setup Steps and Tips

In short: what is MikroTik Hotspot?

MikroTik Hotspot is an access control feature built into the MikroTik RouterOS operating system that redirects users joining the network to a login or authentication page before they can access the internet. Once the user is authenticated, RouterOS applies the speed, time and quota rules defined for that user. It is widely used in hotels, cafés, restaurants, campuses and shared spaces to manage guest connections in a controlled way, and it can be extended to more advanced scenarios together with external hotspot software.

A brief introduction to MikroTik and RouterOS

MikroTik is a network hardware manufacturer based in Latvia. It produces routers, switches, wireless access points and outdoor equipment. Most of these devices run an operating system called RouterOS. Because RouterOS offers enterprise-grade functions such as routing, firewalling, VLANs, VPN, DHCP, bandwidth management and hotspot on affordable hardware, it is very widely used in hotel, café and SME networks in Turkey. The devices are managed via WinBox, WebFig or the command line (terminal).

How does MikroTik Hotspot work?

The working logic of MikroTik Hotspot is based on a few key steps:

1. Connection and IP assignment: The user joins the guest network, and the DHCP server in RouterOS gives the device an IP address.
2. Unauthorised state: Because the user is not yet authenticated, the hotspot treats them as "unauthorised". At this stage, only permitted addresses (the walled garden) can be reached.
3. Redirection: When the user tries to visit a website, the HTTP request is intercepted and redirected to the login page. Because modern operating systems perform connectivity checks, the login screen usually opens automatically.
4. Authentication: The user enters their credentials on the login page. Authentication can be performed against RouterOS's local user database or against an external server via RADIUS.
5. Active session: If authentication succeeds, the user is added to the "active" list, and the speed limit, session timeout and idle timeout from the user profile are applied.
6. Accounting: During the session, traffic and time data are collected; if RADIUS is used, this data is sent to the external server.
7. End of session: Access ends when the time runs out, the user logs out or an administrator closes the session.

The core components of MikroTik Hotspot

Hotspot server

The hotspot service running on a particular interface (for example the guest VLAN or a bridge). This is where the address pool and the server profile to be applied are defined.

Server profile

The set of settings that defines login methods (HTTP CHAP, HTTP PAP, HTTPS, cookie, MAC, trial), the DNS name, RADIUS use and the login page files.

User profile

Contains the rules applied to groups of users, such as the speed limit (rate-limit), the number of shared users (shared-users), session timeout (session-timeout), idle timeout (idle-timeout) and address lists.

Users

If local authentication is used, usernames and passwords are stored here. In advanced scenarios, users are managed in an external system.

Walled garden

The domains and IP addresses that may be accessed before the user is authenticated. If an external captive portal, SMS verification service or social media login is used, the relevant addresses must be added to the walled garden; otherwise the portal will not load properly.

IP bindings

Allows specific devices (for example the reception printer, smart TVs or management devices) to pass without hotspot authentication (bypassed) or to be blocked entirely (blocked).

Login page files

RouterOS uses template files such as login.html, status.html and logout.html. These can be customised, or the user can be redirected to an external portal page.

Basic setup steps

A basic hotspot setup on MikroTik is generally performed in the following order:

1. Prepare the interface: Create a separate bridge or VLAN interface for the guest network.
2. Assign an IP address: For example, give the guest interface an address such as 10.10.0.1/22. Choose a subnet large enough for the number of users.
3. Run the Hotspot Setup wizard: Under IP > Hotspot > Hotspot Setup, define the interface, address pool, DNS servers and DNS name. The wizard automatically creates the required NAT and filter rules.
4. Create user profiles: For example, define a 5M/5M speed limit for a "standard" profile and 20M/20M for a "premium" profile; set the shared-users value according to your device policy.
5. Choose the authentication method: Select a local user list, vouchers or RADIUS-based external authentication.
6. Add walled garden entries: Add the domains of the external portal and authentication services.
7. Configure DNS and NTP: Enable the NTP client, as accurate time is critical for logging.
8. Test: Verify connection, redirection, authentication and post-login access with Android, iOS, Windows and macOS devices.
9. Back up: Take a backup (backup and export) of the working configuration.

MikroTik Hotspot vs. external hotspot software: dividing the work

MikroTik's built-in hotspot feature works well on its own for small-scale scenarios. But as business expectations grow, certain needs arise:

• A portal design that matches the corporate identity, is multilingual and easy to update
• Methods such as SMS verification, room number login and social media login
• Integration with the property management system (PMS)
• Management of multiple locations from a single panel
• User-friendly reporting and usage analytics
• Orderly, integrity-protected log management within the scope of legislation

At this point the healthiest approach is a clear division of tasks: the MikroTik device enforces network access, routes traffic and applies speed rules, while the hotspot software takes care of authentication, user and policy management, portal design, reporting and logging processes. The two systems usually communicate via RADIUS or the RouterOS API.

What is RADIUS and why does it matter for hotspots?

RADIUS (Remote Authentication Dial-In User Service) is a standard protocol that allows network devices to hand over user authentication, authorisation and usage accounting to a central server. When RADIUS is enabled on MikroTik Hotspot, the router asks the RADIUS server instead of looking up the user's credentials in its own database. The server replies with "accept" or "reject" and, in the case of acceptance, also sends attributes such as the speed limit and session time to be applied.

This setup has several important advantages for businesses. Users and policies are managed in one central place, so multiple routers or locations operate with the same rules. Accounting data such as session start, session end and traffic volume is collected centrally, which simplifies reporting and record keeping. In addition, complex authentication flows such as SMS verification or property management system queries can run in the software rather than on the router. In RADIUS communication, the shared secret should be strong and RADIUS traffic should only flow between trusted addresses.

An example MikroTik hotspot architecture for a hotel

Consider a 120-room city hotel with a restaurant and a meeting room. An example architecture could look like this:

• Gateway: A MikroTik router with processing power suited to the user load; a main internet line and a backup line on the WAN side.
• VLAN structure: VLAN 10 guests, VLAN 20 staff, VLAN 30 POS and management systems, VLAN 40 cameras and building automation.
• Hotspot server: Runs only on the guest VLAN, using a subnet large enough to hold more than 1,000 addresses.
• User profiles: Medium speed for standard rooms, higher speed for suites and VIP guests, and a voucher profile tied to event duration for meeting participants.
• Authentication: External hotspot software via RADIUS; room number and surname in rooms, vouchers in the meeting room and SMS or one-click login in the restaurant.
• Access points: Placed in corridors or inside rooms depending on room density and wall structure; the guest SSID is broadcast tagged to VLAN 10.
• Security: Access from the guest VLAN to other VLANs is blocked by the firewall; client isolation is enabled; management access is allowed only from specific addresses within VLAN 20.
• Time and logging: Time synchronisation via NTP; session and IP assignment records are kept centrally in the hotspot software.

This approach lets network access be enforced by MikroTik's strong routing and queueing capabilities, while the guest experience and management are handled by the hotspot software.

Common problems and solutions

The login page does not open

This is usually caused by DNS settings, HTTPS sites or missing walled garden entries. Check that the device uses the router as its DNS server, that the hotspot DNS name is correctly defined and that external portal addresses are in the walled garden.

No internet after login

Rule order, missing NAT or filter rules may be blocking access. Make sure that custom firewall rules do not conflict with the hotspot's dynamic rules.

Users keep dropping off

Idle-timeout and keepalive-timeout values may be too short, or roaming problems on the wireless side may cause sessions to be renewed.

The router slows down at peak times

The device's processing capacity may not be sufficient for the number of users. The number of queues, the complexity of firewall rules and concurrent sessions all increase CPU load. In capacity planning, the hardware model should be chosen to match this load.

Security and maintenance recommendations

• Remove the default "admin" user or set a strong password.
• Allow WinBox, SSH and WebFig access only from the management network.
• Keep RouterOS and RouterBOOT versions up to date; take a backup before updating.
• Disable unused services (such as telnet, ftp and api); if the API is used, allow only the address of the hotspot software.
• Separate the guest network from management and staff networks with VLANs and the firewall.
• Document configuration changes.

Frequently asked questions