MikroTik setup guide

1. Before you start

These starter files target an existing RouterOS 7 HotSpot on an isolated test network. They do not install RouterOS, set up your ISP or replace an existing provider automatically.

• Choose a spare or isolated router that is not serving customers. Confirm its model, installed RouterOS version and HotSpot support.
• Use a deployed HTTPS portal and a gateway HTTPS login with valid trusted certificates. A local development address is not reachable from a guest phone.
• Your network operator must confirm a protected RADIUS path, the server address and ports, NAS identity, observed source address and a unique secret.
• Save a private backup and export, including the existing HotSpot files. Agree a specific configuration diff and rollback before applying changes.

A router brand describes the gateway controlling access. TP-Link access points behind a MikroTik gateway do not require an Omada integration.

2. Download the starter files

The package contains a read-only inventory helper, a guarded installation template, a portal HTML template and this guide. It contains no passwords or service tokens.

You can also download installation.rsc, readiness.rsc and the generic login.html separately. Extract the ZIP into a new folder on your computer.

3. Add your network in EngageMobile

1. Sign in and choose your organisation.
2. Open Locations → Add location. Enter the venue name, timezone, guest WiFi name and the router details confirmed by your network operator.
3. Save the location. Open Create portal, enter the welcome message and allowance, choose one-click or voucher access, and publish.
4. Open the location’s Prepare router page. Download its prepared login.html once the application has a fixed HTTPS origin.

Keep the NAS secret private. Configure the same value on the router and the registered FreeRADIUS client. The policy-service bearer token belongs on the server only.

4. Prepare the router with your network operator

1. Open the test router in WinBox. Record its version, identity, HotSpot server and profile. The optional readiness.rsc helper only reads inventory.
2. Copy the router’s existing HotSpot HTML directory to a dedicated new directory. Retain its other default files; replace only the copied login.html with the site file.
3. Review the installation template. Fill the exact profile/server, directory, trusted certificate, RADIUS address/ports and unique secret privately. It stops until every placeholder is replaced and siteReviewComplete is explicitly enabled.
4. Confirm the selected profile belongs only to the test server. Review existing local users and RADIUS entries; the template refuses an existing HotSpot RADIUS entry.
5. Allow only the exact portal hosts/assets needed before login. Confirm guest IPv6 is blocked or equivalently enforced. Do not allow unrestricted internet or expose router management.
6. Review the redacted diff and rollback. Only after the operator’s approval, import the completed template on the isolated target.

The template configures HTTPS HotSpot login and RADIUS accounting. It does not select your interface, create DHCP/NAT/firewall rules, install a certificate or configure a VPN. The server’s development ports are not a deployed transport configuration.

5. Prove the connection

1. Join the test WiFi on a phone. Confirm the right portal opens with trusted HTTPS.
2. Accept the WiFi terms and connect. If using a voucher, test an issued code and confirm a wrong code is rejected.
3. Confirm actual internet access and accounting in Sessions. An allowance or accepted request alone does not prove connectivity.
4. Check speed, time and data limits, reconnects, expiry, disabled access and wrong-password rejection.
5. Repeat on Android and iPhone captive assistants. Test the walled garden, guest IPv6, router restart, missing accounting and disconnect recovery.

The first real MikroTik acceptance remains open. Actual RouterOS accounting fields must match the installed server contract; passing software tests does not establish device compatibility.

Troubleshooting & rollback

• Portal does not open: check the uploaded directory, assigned portal URL, DNS, certificate and exact walled-garden rules.
• Login rejected: check PAP-over-HTTPS support, NAS/client identity, observed source, shared secret and server reachability. Do not change to an unencrypted login method.
• No accounting: check the accounting port and profile settings, Class correlation and the native packet fields against the installed contract.
• Installation stops: read the stated preflight failure. Do not bypass it on a customer router.
• Restore service: use the reviewed site rollback to restore the original HotSpot profile/files and remove only the newly added, marked RADIUS entry. Never factory reset as a troubleshooting step.

Share a redacted error description and version with support. Keep full exports, backups, passwords, tokens and private keys out of public messages.

Official references

MikroTik HotSpot · External portal customisation · RADIUS