A MikroTik hotspot gives you a login page, per-customer accounts, speed limits, and time limits, all from one router. It's what most voucher Wi-Fi businesses, boarding houses, and cafés use. This guide uses the Winbox app, and the menus are the same on RouterOS versions 6 and 7.
Before you start, get the concept from what a captive portal is. If your business sells internet access to others, also read licensing and obligations for paid Wi-Fi businesses.
Preparation before setting up the hotspot
| Part | Example setting |
|---|---|
| Internet port (WAN) | ether1, connected to the ISP's modem or ONT |
| Customer port or bridge | ether2 to ether5, or a bridge containing the access points |
| Customer network address | 10.5.50.1/24 (room for about 250 devices) |
| Access points | Access point mode only, DHCP off, since MikroTik hands out addresses |
- Connect a laptop to one of the MikroTik LAN ports, open Winbox, and log in from the Neighbors tab.
- Make sure the router has internet. For a modem that assigns IPs automatically, open IP, DHCP Client and add ether1. Test with Tools, Ping to any site.
- If you have more than one access point, create a Bridge and add the ports leading to the access points. The hotspot will run on this bridge.
On the access points, make sure DHCP is off. Otherwise customers get an IP from the access point and skip the login page. The idea is similar to setting up 2 Wi-Fi routers on one network.
Running Hotspot Setup
- Open IP, Hotspot, then click Hotspot Setup.
- Hotspot Interface: choose the customer port or bridge, not ether1.
- Local Address of Network: enter the gateway address, such as 10.5.50.1/24. Tick Masquerade Network.
- Address Pool of Network: keep the suggested range, such as 10.5.50.2 to 10.5.50.254.
- Select Certificate: choose none, unless you have a certificate for your own domain.
- IP Address of SMTP Server: leave it at 0.0.0.0.
- DNS Servers: enter your ISP's DNS or a public DNS.
- DNS Name: enter a name for the login page, such as login.yourbusiness.id. Avoid the .local suffix, as it often causes problems on phones.
- Name of Local Hotspot User: create a first user for testing, then click Next until done.
Connect a phone to the customer Wi-Fi, open a plain HTTP site, and the MikroTik login page should appear. Log in with the test user. If the page doesn't appear, see the common problems section below.
Creating user profiles and speed limits
A user profile is a plan. One profile can serve hundreds of users or vouchers. Open IP, Hotspot, the User Profiles tab, and add a new profile:
| Field | Purpose | Example |
|---|---|---|
| Name | Plan name | daily-3M |
| Shared Users | How many devices can log in with one account | 1 |
| Rate Limit (rx/tx) | Customer upload/download limit | 1M/3M |
| Session Timeout | How long one session lasts before logging in again | 1d |
| Idle Timeout | Disconnect automatically when unused | 15m |
In Rate Limit, the first number is the customer's upload and the second the customer's download, because MikroTik counts from the router's side. 1M/3M means 1 Mbps upload and 3 Mbps download. How to work out fair numbers for many users is in how to limit Wi-Fi speed and setting bandwidth priority.
Creating users and vouchers
In the Users tab, add a user: fill in Name and Password and choose a Profile. For time-based vouchers, set Limit Uptime on the Limits tab, such as 3h for a 3-hour voucher. For data-based vouchers, set Limit Bytes Total.
Creating hundreds of vouchers one by one isn't practical. Business owners usually use the user generator in MikroTik's User Manager or a third-party web app to create and print vouchers in bulk. The options and pricing math are covered in how to make Wi-Fi vouchers.
Walled garden and the login page
The walled garden lists sites that can be opened without logging in. Open IP, Hotspot, the Walled Garden tab, and add a Dst. Host, such as your business site or a payment page. Keep it short, since every site open without login is a gap that can be used for free.
The login page design lives in Files, the hotspot folder, file login.html. Download it, change the logo, colors, and text, then upload it back. Add terms of use like those in guest Wi-Fi terms and conditions. If you want the login page to double as a promotion tool, read Wi-Fi marketing for small businesses and rules for ads on captive portals.
Common MikroTik hotspot problems
| Problem | Common cause |
|---|---|
| Login page doesn't appear | The customer opened an HTTPS site, or the wrong hotspot interface was chosen |
| Internet works without logging in | Access point DHCP is still on, or there's a bypassed IP Binding |
| Logged in but no internet | The router has no internet, the NAT masquerade rule is missing, or DNS is wrong |
| One voucher used by many people | Shared Users is more than 1 |
| Customers keep being asked to log in again | Idle Timeout is too short or the access point signal is weak |
Customers who say the login page won't appear can be pointed to the Wi-Fi login page won't appear. Printing the DNS name as a QR code on tables also helps, as shown in how to make a Wi-Fi QR code.
Securing the MikroTik router
- Replace the default admin user under System, Users, and use a strong password.
- Disable unused services under IP, Services, such as telnet, ftp, and www if not needed.
- Restrict Winbox access to the management network, not the customer network.
- Update RouterOS under System, Packages. See also updating router firmware.
- Keep a backup in Files once setup is done, and record the configuration as in documenting your own network.
A MikroTik hotspot also logs who logged in and when. These logs help when problems come up, and for some businesses keeping them is required. Read log retention obligations for Wi-Fi providers and whether RT/RW Net is legal.
Frequently asked questions
How do I set up a MikroTik hotspot?
Make sure the router already has internet. In Winbox, open IP, Hotspot, then click Hotspot Setup. Choose the customer-facing interface, enter the gateway address and IP pool, set the DNS servers and DNS name, then create the first user. After that, create a user profile to control speed and devices per user.
How do I limit hotspot user speed on MikroTik?
Open IP, Hotspot, the User Profiles tab, then fill in Rate Limit, for example 1M/3M. The first number is the customer's upload limit and the second is their download limit. Assign that profile to the users or vouchers you create.
Why doesn't the MikroTik hotspot login page appear?
Common causes: the customer opened an HTTPS site so the redirect fails, the hotspot DNS name uses an unsuitable domain, or the wrong hotspot interface was chosen. Try opening a plain HTTP site or typing the hotspot DNS name directly into the browser.
What is a walled garden on MikroTik?
A walled garden is a list of sites customers can open before logging in. It's typically used for payment pages, your own business site, or an ordering app. Set it under IP, Hotspot, the Walled Garden tab.
