hello everyone …
I just copy this guide from https://www.mikrotik.com/documentation/manual_2.6/IP/Hotspot.html
I plan to use the guide on my network. and by chance I use routerboard with ROS v6.15.
the big question for me is: how to apply the configuration from v2.6 to v6.15 configuration?
already several times I try to configure the configuration follow the guidelines but to no avail.
I really expect any help from colleagues on this forum to be able to guide me or explain how to convert the configuration.
thank you
HotSpot Step-by-Step User Guide
Planning the Configuration
First of all, make sure you have MikroTik RouterOS 2.6.2 or higher with hotspot and dhcp packages installed. Let us consider following example HotSpot setup:
There will be 2 hotspot IP address ranges used for clients on prism1 interface. You are free to choose the address ranges, just make sure you use masquerading for not routed ones. In our example, we are using
temporary addresses which must be masqueraded:
network: 192.168.0.0/24
gateway: 192.168.0.1
pool: 192.168.0.2-192.168.0.254real addresses which require routing:
network: 10.5.50.0/24
gateway: 10.5.50.1
pool: 10.5.50.2-10.5.50.254Temporary addresses are given out by DHCP server (configured within /ip dhcp-server), but real addresses are given out by hotspot dhcp configuration.
For hotspot client accounting, hotspot will add dynamic firewall rules in firewall hotspot chain. This chain has to be created manually. And all network packets (to/from hotspot clients) have to pass this chain.
Setup Example
Follow the steps below:
Your ether1 interface is configured with IP address 10.5.6.5/24 and the default route points to gateway 10.5.6.1
Your prism1 interface is configured for AP mode and can register IEEE 802.11b wireless clients. See the Prism Interface Manual for more details.
ARP should be set to ‘reply-only’ on prism interface, so no dynamic entries are added to the ARP table. DHCP server will add entries only for clients which have obtained DHCP leases./interface prism set prism1 arp=reply-only
Add two IP addresses to prism1 interface:
/ip address add address=192.168.0.1/24 interface=prism1
/ip address add address=10.5.50.1/24 interface=prism1add 2 IP pools:
/ip pool add name=temp ranges=192.168.0.2-192.168.0.254
/ip pool add name=hspot ranges=10.5.50.2-10.5.50.254add masquerading rule for temporary IP pool, which is not routed:
/ip firewall src-nat add src-address=192.168.0.0/24 action=masquerade
Make sure you have routing for authenticated address space. Try to ping 10.5.50.1 from your internet gateway 10.5.6.1, for example. See the Basic Setup Guide on how to set up routing.
Add dhcp server (for temporary IP addresses):
/ip dhcp-server add name=“hs_temp” interface=prism1 lease-time=14s
address-pool=temp netmask=255.255.255.0 gateway=192.168.0.1
dns-server=159.148.60.2,159.148.108.1 domain=“mt.lv” add-arp=yes disabled=noAdd hotspot server setup (for logged in IP addresses):
/ip hotspot server add name=hs_dhcp dhcp-server=hs_temp address-pool=hspot
netmask=255.255.255.0 gateway=10.5.50.1Add local hotspot user:
/ip hotspot user add name=ax password=ex
Setup hotspot service to run on port 80 (www service has to be assigned another port, e.g., 8081):
/ip service set www port=8081
/ip service set hotspot port=80Note! Changing www service to other port than 80 requires thet you specify the new port when connecting to MikroTik router using WinBox, e.g., use 10.5.50.1:8081 in this case.
redirect all TCP requests from temporary IP addresses to hotspot service:
/ip firewall dst-nat add src-address=192.168.0.0/24 protocol=tcp action=redirect
to-dst-port=80 comment=“redirect unauthorized hotspot clients to hotspot service”Allow DNS requests and ICMP ping from temporary addresses and reject everything else:
/ip firewall rule forward add src-address=192.168.0.0/24 protocol=icmp
/ip firewall rule forward add src-address=192.168.0.0/24 protocol=udp
dst-port=53
/ip firewall rule forward add src-address=192.168.0.0/24 action=reject
comment=“reject access for unauthorized hotspot clients”Add hotspot chain:
/ip firewall add name=hotspot
Pass all through going traffic to hotspot chain:
/ip firewall rule forward add action=jump jump-target=hotspot
If client has obtained temporary address, its lease is shown as:
[admin@HotSpot_GW] > ip dhcp-server lease print
Flags: X - disabled, D - dynamic, H - hotspotADDRESS MAC-ADDRESS EXPIRES-A… SERVER STATUS
0 D 192.168.0.254 00:40:96:13:B3:47 8s hs_temp bound
[admin@HotSpot_GW] >After successful authentication its DHCP address is changed, and it is listed under active hotspot users:
[admin@HotSpot_GW] > ip dhcp-server lease print
Flags: X - disabled, D - dynamic, H - hotspotADDRESS MAC-ADDRESS EXPIRES-A… SERVER STATUS
0 DH 10.5.50.2 00:40:96:13:B3:47 56s hs_temp bound
[admin@HotSpot_GW] > ip hotspot active printUSER ADDRESS UPTIME SESSION-TIMEOUT IDLE-TIMEOUT
0 ax 10.5.50.2 2m25s
[admin@HotSpot_GW] > /ip hotspot active print statsUSER UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 13m26s 145268 264282 475 494
[admin@HotSpot_GW] >User statistics show accumulated values prior to current session.
[admin@HotSpot_GW] > ip hotspot user print stats
Flags: X - disabledNAME UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 6m29s 9896 31156 80 77
[admin@HotSpot_GW] >User statistics values are updated after current session is closed. Values can be reset to ‘0’ using the reset command.
