Hi, I need to give users of hotspot free access and then track usage time, problem is that I have to use radius for tracking.

Is there any way to say in user manager auth all users that begins with "bla-" and then disconnect users that used hotspot for more than 10h/week.

Radius is a must.

Any thoughts?

Thanks.

P.S. adding all MACs from 00:00:00:00:00 to FF:FF:FF:FF:FF as username by hand is not an option, script preferred

I don't think you can do this with User Manager, but you could certainly do this with FreeRADIUS with a SQL backend.

It's going to require you to customize the RADIUS server, though. The general approach could be something like this:

Use SQL for authentication as well as accounting. Have the router pass the client MAC address as the username and password. RADIUS asks SQL for authentication, which is successful when SQL spits back the same password the RADIUS server got from the router. SQL goes into the accounting database and adds up that MAC address's uptime for that week. If it's less than 10 hours, it selects back the MAC address, so auth goes through. RADIUS will then also use SQL for a reply query that fills out attributes, you can pass back Session-Timeout, which is the number of seconds the router will grant the user - set this to "(10 hours - client's uptime that week)" to dynamically enforce the hard 10 hour limit. The router will then do RADIUS accounting and inform you of uptime used so SQL can use that information for future authentications.

There's no canned solution for this, but with a bit of SQL and RADIUS knowledge it wouldn't be too hard to build.

Can I perform accounting without authorization in freeRadius or User Manager?
If I can than please point me into right direction.

Thanks.

No, but that's not because of the RADIUS server. RouterOS won't let you send RADIUS accounting records for non-RADIUS (local) accounts. A given RADIUS server like FreeRADIUS can certainly handle arbitrary RADIUS accounting records. The router just won't let you get them there.

Though I'm not sure why you'd want to in the scope of your original question? You certainly can't send CoA or RADIUS disconnects for accounts that didn't log on via that RADIUS server.

Though I'm not sure why you'd want to in the scope of your original question? You certainly can't send CoA or RADIUS disconnects for accounts that didn't log on via that RADIUS server.

Yes, stupid question. Sorry to you and all others that are going to be annoyed by it when they find this in search