MikroTik Hotspot Setup Guide: Step by Step

A MikroTik hotspot is a captive portal system that redirects a connecting device to a login page and performs authentication. You run into it anywhere guest WiFi is needed: hotels, cafes, hospitals, shopping malls. In this guide we set up a hotspot from scratch on RouterOS 7.14+.

The vast majority of hotspot problems I have seen in the field are not hardware failures but configuration errors. Follow the steps properly and you avoid the common traps.

Hotspot or WPA2-Enterprise?

Hotspot is not the right choice for every guest WiFi need. Before deciding, look at this table:

Criterion	Hotspot (Captive Portal)	WPA2-Enterprise (802.1X)
User type	Guest, temporary	Staff, permanent
Authentication	Web form, voucher	Certificate, RADIUS
Setup difficulty	Medium	High
User experience	Browser opens, user logs in	Transparent, automatic
Legal logging (Law 5651)	Easy (built-in logging)	RADIUS logging required
Bandwidth control	Built-in (user profile)	External (RADIUS CoA)

The rule is simple: Guest network -> hotspot. Corporate network -> WPA2-Enterprise.

Preparation

Hardware Selection

Not every router can handle a hotspot. Choose the hardware based on the number of users:

Users	Model	CPU	RAM	Price Range
1-30	hAP ac² (RBD52G)	4x716 MHz	128 MB	~$70
30-100	RB4011iGS+	4x1.4 GHz	1 GB	~$170
100-300	CCR1009-7G	9x1.2 GHz	2 GB	~$500
300+	CCR2004-1G-12S+	4x1.7 GHz	4 GB	~$450

The hAP ac² is tailor-made for small cafes. It comfortably serves 20-25 people. But if you are planning for 50+ users, jump straight to the RB4011. Hotspot is a CPU-intensive job. The difference is noticeable especially if you are doing HTTPS redirect.

💡 When choosing hardware, think 2-3 years ahead. If you have 30 users now, tomorrow it becomes 60-80. Buying the right device from the start is cheaper than an upgrade later.

RouterOS Version

Use RouterOS 7.14 as a minimum. The hotspot service received serious improvements in the 7 series. Authentication is roughly twice as fast as v6. If you have an old v6 setup, back up the config before migrating. The v6 and v7 hotspot configurations are not one-to-one compatible.

⚠️ When migrating from RouterOS 6 to 7, the hotspot config does not come across in the migration package. Manual setup is required. If you use a custom login page, do not forget to re-upload the HTML/CSS files.

/system resource print

Check the version. If you are below 7.14, update first.

IP Planning

Plan a separate subnet for the hotspot network so it does not mix with your main network.

WAN: line from the ISP (dhcp-client or static)
LAN: 192.168.1.0/24 (management network)
HOTSPOT: 10.10.0.0/22 (1022 user capacity)

/22 subnet = 1022 usable IPs. More than enough for a 50-room hotel, even with 3-4 devices connecting per room. Do not use /24 and then come back because “the IPs ran out.” Keep it wide from the start.

🛡️ Strictly separate the hotspot subnet from the management network. Hotspot users must not be able to reach the router via SSH or Winbox. I explain the firewall rules below.

Step 1: Creating the IP Pool

The IP pool is the address pool that will be handed out to hotspot users.

/ip pool add name=hotspot-pool ranges=10.10.0.2-10.10.3.254

A pool of 1021 IPs from 10.10.0.2 to 10.10.3.254. The gateway address (10.10.0.1) must stay outside the pool. Some people get this wrong.

Make the pool size at least 3 times the planned number of users. As devices connect to and leave the WiFi, they keep holding an IP until the lease expires. A narrow pool = IPs run out, new devices cannot connect.

Step 2: Assigning an IP to the Hotspot Interface

Assign an IP to the interface on which you will run the hotspot:

/ip address add address=10.10.0.1/22 interface=bridge-hotspot network=10.10.0.0

If you are using your existing bridge, be careful: management traffic and hotspot traffic get mixed. Create a separate bridge:

/interface bridge add name=bridge-hotspot
/interface bridge port add bridge=bridge-hotspot interface=ether3
/interface bridge port add bridge=bridge-hotspot interface=ether4

ether3 and ether4 are now part of the hotspot bridge. The APs plugged into these ports will join the hotspot network.

Step 3: DHCP Server Setup

DHCP is mandatory for automatic IP distribution:

/ip dhcp-server add name=dhcp-hotspot interface=bridge-hotspot address-pool=hotspot-pool lease-time=1h disabled=no
/ip dhcp-server network add address=10.10.0.0/22 gateway=10.10.0.1 dns-server=10.10.0.1

Why a 1-hour lease time? On a guest network users change constantly. If you set 8 hours or 1 day, the IPs of departed devices stay busy for hours. 1 hour is ideal for most scenarios. In high-turnover places like cafes, drop it to 30 minutes.

We gave the gateway itself (10.10.0.1) as the DNS server. RouterOS’s internal DNS will be used for the hotspot redirect. If you give an external DNS (like 8.8.8.8), the login page redirect breaks. I have seen this a lot in the field: people struggle for hours because the login page will not open, and the problem is the DNS setting in DHCP.

Step 4: Creating the Hotspot Server

There are two ways: the setup wizard or manual. Do it manually. With the wizard you cannot solve problems without understanding what it did behind the scenes.

/ip hotspot profile add name=hotel-profile hotspot-address=10.10.0.1 dns-name=wifi.hotel.local html-directory=hotspot login-by=http-chap,http-pap rate-limit="2M/2M"

What these parameters do:

• hotspot-address: The IP on which the login page is served
• dns-name: When the user types wifi.hotel.local into the browser, the login opens
• html-directory: The folder for the login page files
• login-by: The authentication method. CHAP is more secure, PAP is the fallback
• rate-limit: The default speed limit. Can be overridden per profile

Create the server:

/ip hotspot add name=hotspot-hotel interface=bridge-hotspot address-pool=hotspot-pool profile=hotel-profile disabled=no

At this point the hotspot is active. Every device that connects to bridge-hotspot will be redirected to the login page.

Step 5: User Profiles

A single user type is not enough. In a hotel scenario you need at least 3 profiles:

/ip hotspot user profile add name=guest rate-limit="5M/5M" shared-users=3 session-timeout=24h idle-timeout=30m
/ip hotspot user profile add name=vip rate-limit="20M/20M" shared-users=5 session-timeout=72h idle-timeout=1h
/ip hotspot user profile add name=staff rate-limit="50M/50M" shared-users=unlimited session-timeout=none idle-timeout=2h

Profile	Download/Upload	Device Limit	Session Duration	Where
Guest	5M/5M	3	24 hours	Standard room
VIP	20M/20M	5	72 hours	Suite, meeting room
Staff	50M/50M	Unlimited	No limit	Employees

shared-users is critical. 3 means: with the same username/password, at most 3 devices connect at the same time. Think of it as phone + laptop + tablet per room.

idle-timeout matters too. If a device is connected but not generating traffic, it drops the session after the specified time. This keeps the IP pool from filling up needlessly.

Add users:

/ip hotspot user add name=room101 password=Smith2026 profile=guest server=hotspot-hotel
/ip hotspot user add name=meeting password=SiberKale! profile=vip server=hotspot-hotel

In a hotel scenario, room number + guest surname is practical. Reception issues a new password at each check-in, and the user is deleted at check-out.

Step 6: Login Page Customization

The default login page is functional but ugly. A brand-consistent page is a must.

File Structure

Go to the Files menu in WinBox. Copy the hotspot folder to your computer:

hotspot/
├── login.html      ← Main login page
├── alogin.html     ← Automatic login (via cookie)
├── status.html     ← Connection status
├── logout.html     ← Logout page
├── error.html      ← Error page
├── redirect.html   ← Redirect
├── rlogin.html     ← RADIUS login
├── img/            ← Images
│   └── logobottom.png
└── errors.txt      ← Error messages

Editing login.html

login.html contains RouterOS variables. Do not touch these:

<!-- DO NOT DELETE THESE: part of the authentication mechanism -->
$(if chap-id)
$(link-login-only)
$(link-orig)
$(identity)
$(if error)$(error)$(endif)

If you delete them, login stops working. You will debug for hours.

What you can safely change: CSS styles, logo, background, text content, extra HTML structure.

Minimal login template:

<body>
  <div class="login-container">
    <img src="img/hotel-logo.png" alt="Hotel Logo" class="logo">
    <h1>Welcome</h1>
    <form action="$(link-login-only)" method="post">
      <input type="hidden" name="dst" value="$(link-orig)">
      <input type="text" name="username" placeholder="Room Number" required>
      <input type="password" name="password" placeholder="Password" required>
      $(if chap-id)<input type="hidden" name="chap-id" value="$(chap-id)">$(endif)
      $(if chap-challenge)<input type="hidden" name="chap-challenge" value="$(chap-challenge)">$(endif)
      <button type="submit">Log In</button>
    </form>
    $(if error)<p class="error">$(error)</p>$(endif)
    <p class="footer">WiFi Powered by SiberKale</p>
  </div>
</body>

After editing, upload it to the router via FTP or WinBox drag-and-drop.

After changing the login page, restart the hotspot service: /ip hotspot disable 0 then /ip hotspot enable 0.

Step 7: Walled Garden

The walled garden is the set of addresses a user can reach without logging in. You add addresses like the payment page, social login, or company site here.

There are two types:

Type	What It Does	When
IP Walled Garden	IP/subnet-based allow	Payment gateways, APIs
HTTP Walled Garden	URL/domain-based allow	Websites, captive portal services

# Apple and Google captive portal detection: CRITICAL
/ip hotspot walled-garden add dst-host="captive.apple.com" action=allow comment="Apple CNA"
/ip hotspot walled-garden add dst-host="*.apple.com" action=allow comment="Apple CNA"
/ip hotspot walled-garden add dst-host="connectivitycheck.gstatic.com" action=allow comment="Android CNA"
/ip hotspot walled-garden add dst-host="*.google.com" action=allow comment="Google CNA"

# The hotel's own site
/ip hotspot walled-garden add dst-host="*.hotelname.com" action=allow comment="Hotel website"

The Apple and Google captive portal detection rules are non-negotiable. If you do not add them, the automatic login pop-up will not work on iPhone and Android devices. The user says “I cannot connect to the internet.” The real problem is that the captive portal cannot be detected. This is the most common complaint in the field.

NAT and Firewall Rules

Hotspot users need masquerade to reach the internet:

/ip firewall nat add chain=srcnat out-interface=ether1-wan action=masquerade comment="Hotspot NAT"

Block access from the hotspot network to the management network:

/ip firewall filter add chain=forward src-address=10.10.0.0/22 dst-address=192.168.1.0/24 action=drop comment="Block Hotspot -> LAN"
/ip firewall filter add chain=input src-address=10.10.0.0/22 dst-port=8291,22,80,443 protocol=tcp action=drop comment="Block Hotspot -> Router management"

The first rule: hotspot users cannot reach devices on the management network (server, printer, NAS). The second rule: they cannot reach the router’s management ports (WinBox, SSH, WebFig).

Do not say you will skip these two rules. This is the most frequent security hole I see in the field. The company server is reachable from the guest WiFi. After the config is done, test from a phone: connect to the hotspot, ping 192.168.1.1. There should be no reply.

Law No. 5651: Logging

In Turkey, every business offering public WiFi is obligated to keep logs under Law 5651. RouterOS’s built-in hotspot log is enough at a basic level:

/system logging add topics=hotspot action=disk

It writes hotspot events (login, logout, failed auth) to disk. But in a serious setup, send it to a syslog server:

/system logging action add name=syslog-server target=remote remote=192.168.1.10 remote-port=514
/system logging add topics=hotspot action=syslog-server

You need to keep logs for a minimum of 1 year. The router disk will not hold that. Keep centralized logs with Graylog or syslog-ng.

Data that must be retained:

• Username
• MAC address
• Connection start/end time
• Assigned IP address

Do not take this lightly. In an investigation, logs are requested, and if they are missing the business owner is held responsible. A Graylog setup takes 30 minutes and in return provides legal assurance.

RADIUS Integration

If you have more than 50 users or you are going to build a voucher system, move to RADIUS. RouterOS’s built-in user management is not practical at large scale.

/radius add address=192.168.1.10 secret=SuperSecretPassword123 service=hotspot
/ip hotspot profile set hotel-profile use-radius=yes radius-accounting=yes

FreeRADIUS does a good job as the RADIUS server. It sets up in 10 minutes with Docker:

docker run -d --name freeradius \
  -p 1812:1812/udp -p 1813:1813/udp \
  -v /etc/raddb:/etc/raddb \
  freeradius/freeradius-server

What RADIUS provides:

• Centralized user management: multiple hotspots, one database
• Voucher/coupon system
• Detailed accounting: who used how much data
• Dynamic rate-limit: change it instantly with CoA
• Third-party billing integration

If you have fewer than 50 users, do not bother; RouterOS’s own user management is enough.

Common Mistakes and Solutions

“The login page will not open”

90% a DNS problem. The hotspot redirects the user to the login page by doing DNS hijacking. If you gave an external DNS (8.8.8.8) in DHCP, this mechanism breaks.

/ip dhcp-server network set 0 dns-server=10.10.0.1

Change the DNS to the gateway IP and the problem is solved.

“I log in but there is no internet”

The masquerade rule is missing or in the wrong order.

/ip firewall nat print

Make sure the masquerade rule is in the srcnat chain and covers the hotspot subnet.

“The login page does not appear on some devices”

Add the Apple and Google captive portal detection URLs to the walled garden. See the walled garden section above. Also make sure you added http-pap to the login-by parameter. Some older devices only support PAP.

“The user rate limit is not working”

Rate-limit syntax: upload/download. Many people write it backwards. 5M/10M = 5 Mbps upload, 10 Mbps download.

# Correct: 5 Mbps up / 10 Mbps down
/ip hotspot user profile set guest rate-limit="5M/10M"

“The same user cannot log in more than once”

Check the shared-users parameter. The default is 1. If you want 3 devices per room:

/ip hotspot user profile set guest shared-users=3

Performance Tips

Automatic Login with Cookie

Users do not want to log in again on every connection. Set a cookie:

/ip hotspot profile set hotel-profile http-cookie-lifetime=1d

No re-login is required from the same device for 1 day. Ideal for hotels: the guest does not have to enter the password again after going up to the room and coming back down.

Logging Setting

Very detailed logging consumes CPU. In production, log only auth events:

/system logging set [find topics=hotspot] topics=hotspot,!debug

Trial (Free Trial)

Popular for cafes: 30 minutes of free internet, then require login.

/ip hotspot user profile add name=trial rate-limit="2M/2M" session-timeout=30m shared-users=1
/ip hotspot profile set hotel-profile trial-uptime=30m trial-user-profile=trial

A “Try Free” button appears on the login page. It gives 30 minutes at 2 Mbps, and when the time is up the user has to log in.

Full Configuration: Summary

The entire 50-room hotel scenario, copy-paste in one go:

# 1. Bridge
/interface bridge add name=bridge-hotspot

# 2. Port assignment
/interface bridge port add bridge=bridge-hotspot interface=ether3
/interface bridge port add bridge=bridge-hotspot interface=ether4

# 3. IP
/ip address add address=10.10.0.1/22 interface=bridge-hotspot

# 4. Pool
/ip pool add name=hotspot-pool ranges=10.10.0.2-10.10.3.254

# 5. DHCP
/ip dhcp-server add name=dhcp-hotspot interface=bridge-hotspot address-pool=hotspot-pool lease-time=1h
/ip dhcp-server network add address=10.10.0.0/22 gateway=10.10.0.1 dns-server=10.10.0.1

# 6. Hotspot profile
/ip hotspot profile add name=hotel-profile hotspot-address=10.10.0.1 dns-name=wifi.hotel.local html-directory=hotspot login-by=http-chap,http-pap http-cookie-lifetime=1d

# 7. Hotspot server
/ip hotspot add name=hotspot-hotel interface=bridge-hotspot address-pool=hotspot-pool profile=hotel-profile

# 8. User profiles
/ip hotspot user profile add name=guest rate-limit="5M/5M" shared-users=3 session-timeout=24h idle-timeout=30m
/ip hotspot user profile add name=vip rate-limit="20M/20M" shared-users=5 session-timeout=72h idle-timeout=1h
/ip hotspot user profile add name=staff rate-limit="50M/50M" shared-users=unlimited

# 9. Walled garden
/ip hotspot walled-garden add dst-host="captive.apple.com" action=allow
/ip hotspot walled-garden add dst-host="connectivitycheck.gstatic.com" action=allow
/ip hotspot walled-garden add dst-host="*.apple.com" action=allow

# 10. Security
/ip firewall filter add chain=forward src-address=10.10.0.0/22 dst-address=192.168.1.0/24 action=drop
/ip firewall filter add chain=input src-address=10.10.0.0/22 dst-port=8291,22,80,443 protocol=tcp action=drop
/ip firewall nat add chain=srcnat out-interface=ether1-wan action=masquerade

# 11. Logging
/system logging add topics=hotspot action=disk

Test the config in a lab environment first. Verify that it works, then move it to production. Always keep a backup with /export.

If you get stuck, reach out via the contact page.