MikroTik HotSpot and Captive Portal for Guest Networks

Introduction

MikroTik HotSpot is a built-in captive portal system perfect for hotels, cafes, schools, and public Wi-Fi deployments. Users authenticate through a web page before getting internet access. This guide covers a complete production HotSpot setup.

How MikroTik HotSpot Works

Client connects to Wi-Fi and gets an IP via DHCP
Client opens any website — MikroTik intercepts and redirects to login page
Client enters credentials
MikroTik creates a dynamic firewall rule allowing the client's IP
Client gets internet access until session timeout or manual logout

Step 1: Set Up the Interface

BASH

# Create a bridge for HotSpot clients
/interface bridge add name=bridge-hotspot

# Add wireless interface to bridge
/interface bridge port add bridge=bridge-hotspot interface=wlan1

# Assign IP to the bridge
/ip address add address=10.5.50.1/24 interface=bridge-hotspot

Step 2: Configure DHCP Server

BASH

/ip pool add name=hotspot-pool ranges=10.5.50.10-10.5.50.254
/ip dhcp-server add name=hotspot interface=bridge-hotspot address-pool=hotspot-pool lease-time=1h
/ip dhcp-server network add address=10.5.50.0/24 gateway=10.5.50.1 dns-server=8.8.8.8,8.8.4.4

Step 3: Run HotSpot Setup Wizard

BASH

/ip hotspot setup
# Follow the wizard:
# hotspot interface: bridge-hotspot
# local address: 10.5.50.1/24
# masquerade network: yes
# DNS name: hotspot.company.com
# create local hotspot user: admin / password123

Step 4: Create User Profiles

Profiles define session limits:

BASH

/ip hotspot user profile
add name="1hour-free" session-timeout=1h idle-timeout=10m shared-users=1
add name="daily-5mbps" session-timeout=24h rate-limit="5M/2M" shared-users=1
add name="premium-20mbps" session-timeout=0 rate-limit="20M/5M" shared-users=3

Step 5: Add Users

BASH

/ip hotspot user
add name=guest password=guest1234 profile=1hour-free
add name=john password=secure789 profile=daily-5mbps mac-address=AA:BB:CC:DD:EE:FF

Step 6: Customize the Login Page

BASH

# From your PC, SCP files to the router
scp login.html admin@192.168.88.1:/flash/hotspot/login.html

Key variables available in the HTML template:

$(link-login) — login form action URL
$(link-logout) — logout URL
$(username) — currently logged in user
$(error) — error message

Step 7: Walled Garden (Allow Pre-Auth Access)

Allow certain sites before login (e.g., company website, payment gateway):

BASH

/ip hotspot walled-garden
add dst-host=company.com action=allow
add dst-host=*.company.com action=allow
add dst-host=payment-provider.com action=allow

For IP-based rules:

BASH

/ip hotspot walled-garden ip
add dst-address=1.2.3.4 action=accept

Step 8: RADIUS Integration

For large deployments, use a RADIUS server instead of local users:

BASH

/radius
add service=hotspot address=192.168.1.100 secret=radiussecret

/ip hotspot
set [find] use-radius=yes

Monitoring Active Sessions

BASH

# View active HotSpot sessions
/ip hotspot active print

# View all users
/ip hotspot user print

# See host table (all connected devices)
/ip hotspot host print

Production Tips

Set idle-timeout to disconnect inactive users and free licenses
Use MAC address binding to remember returning customers
Enable HTTPS on the login page using a real certificate
Use RADIUS for environments with 100+ users
Set traffic-quota on profiles to prevent abuse