# EngageMobile MikroTik setup guide Starter version 1 — prepared 27 October 2026. Profile: an existing RouterOS 7 HotSpot on an explicitly isolated test router. Hardware compatibility, phone captive assistants and actual WiFi enforcement are not yet field-verified. This is a configuration starter, not a firmware installer or automatic migration from another provider. ## 1. Prepare safely 1. Choose a spare or isolated test router that is not serving customers. 2. Record its model, RouterOS version, HotSpot server/profile, guest interface, NAS identity, RADIUS source address and the protected management path. 3. Save a private backup, configuration export and original HotSpot HTML files. 4. Confirm a fixed deployed HTTPS portal and gateway login origin, with valid trusted certificates and working DNS from the guest network. 5. Confirm the private RADIUS address and actual authentication/accounting ports. The repository's isolated server uses 28120/28130 internally; that does not establish deployed ports, routing, NAT or firewall configuration. 6. Register the exact NAS identifier, native FreeRADIUS client name and observed source CIDR. The unique NAS secret must match on router and server. 7. Prepare a redacted configuration diff and an exact rollback. Have the network operator approve these before applying any router configuration. ## 2. Register the site in EngageMobile 1. Sign in, choose the correct organisation and open Locations. 2. Select Add location. Enter the venue, timezone, guest SSID and verified router details. Enter the NAS secret privately; it is encrypted and never public. 3. Save. Open Create portal, choose the guest message, terms version, access methods and allowance, then publish. 4. Open Prepare router for that SSID. Download its site-specific login.html. This needs a fixed HTTPS APP_URL; a local development address cannot be used. The generic login.html in this package is a manual template. Replace only its REPLACE_WITH_HTTPS_PORTAL_URL placeholder with the assigned captive URL if a prepared site file is unavailable. Do not add a NAS secret, API key or password to HTML. The form passes only the RouterOS MAC variable as an untrusted hint. The server selects the registered HTTPS gateway destination itself. ## 3. Prepare the router with the network operator 1. Open the authorised test router in WinBox. Inspect the existing HotSpot and profile. readiness.rsc is an optional read-only inventory helper. 2. Copy the complete current HotSpot HTML directory to a new dedicated directory. Retain its default status/error/redirect files. Replace only the copied login.html with the file prepared for the SSID. 3. Review installation.rsc in a text editor. Privately enter the exact profile, server, directory, trusted TLS certificate name, RADIUS address/ports and NAS secret. Confirm the profile is not shared by a customer-facing server. 4. Existing local HotSpot users can take precedence over RADIUS. Review them without deleting customer accounts. Existing HotSpot RADIUS entries cause the starter to stop; migration requires a separately reviewed change. 5. Configure the exact portal/assets allowlist and prove guest IPv6 is blocked or equivalently enforced. Do not expose router management or open unrestricted internet before authorisation. Review captive-detection behaviour separately. 6. Complete the private server/client configuration and native accounting-field compatibility check. Current accounting expects explicit counter words, Class correlation, timestamps and a stable session/boot context. A real NAS may require a reviewed normalisation profile; missing fields are not a pass. 7. Only after site prerequisites, backup, redacted diff and rollback approval, set siteReviewComplete to true. The script remains guarded if placeholders are present. Import only the completed file on the isolated target. The template adds a marked HotSpot RADIUS entry and updates only the named existing HotSpot profile for HTTPS login and accounting. It does not reset RouterOS, fetch remote code, create administrators, change firmware, create DHCP/NAT/firewall rules, select an interface, install TLS or configure a VPN. It is not transactional: if an import fails after a change, use the reviewed site rollback and inspect the actual configuration before another attempt. ## 4. Verify actual operation 1. Join the test SSID on a phone. Confirm the correct portal opens under trusted HTTPS and the gateway handoff reaches the registered HTTPS login. 2. Accept terms, connect and confirm actual internet traffic. Try a valid voucher and confirm invalid/reused/foreign vouchers are rejected as specified. 3. Confirm correlated accounting appears in Sessions. An entitlement or accepted request alone is not proof of internet access or router health. 4. Verify time, combined data, upload/download speed and simultaneous-use limits. Reconnect without resetting remaining allowance; test expiry and disabled SSIDs. 5. Test Android and iPhone captive assistants, walled garden, IPv6, router restart, stale/missing accounting, lost Stop and real disconnect/recovery behaviour. 6. Record evidence before proposing any production migration. Downloading a file or importing configuration does not mark a gateway online or field-accepted. ## 5. Troubleshooting and rollback - Portal missing: check the selected HTML directory, prepared captive URL, DNS, certificates and exact pre-authentication allowlist. - Authentication rejected: inspect protected RADIUS reachability, NAS identity, native client name, actual source, secret and supported PAP-over-HTTPS profile. Do not solve this by allowing unencrypted guest login. - Accounting missing: check actual ports, enabled accounting/interim settings, Class and the native packet fields against the installed server contract. - Script stopped: inspect its preflight message. Do not bypass it on a live site. - Rollback: restore the recorded original HotSpot profile and HTML directory, and remove only the newly added RADIUS entry marked EngageMobile-starter-v1, using the reviewed site diff. Preserve unrelated configuration. A full backup restore is an operator-controlled last resort, not an automatic script action. Keep secrets, exports, backups and private keys out of public messages. Share only a redacted error description, versions and relevant non-secret identifiers. ## References Official documentation checked 27 October 2026. The manual's current version is not evidence of the installed router version. - https://manual.mikrotik.com/docs/authentication-authorization-accounting/hotspot-captive-portal/ - https://manual.mikrotik.com/docs/authentication-authorization-accounting/hotspot-captive-portal/hotspot-customisation/ - https://manual.mikrotik.com/docs/authentication-authorization-accounting/radius/ Future UniFi/Omada/other integrations will appear in the vendor catalogue after their adapters, installation flows and compatibility checks are implemented.