Hi
How can I block certain websites and services from trial users only?
the problem is, I’ve got 1 router serving trials users and paid users. and only want to block stuff from trial users
Are you sure you need trial users ?
If you want to give access to some websites for the people who have not paid, you can use the walled garden feature instead.
easiest way is to separate them out, just add (I presume you are using wireless) virtual AP with different SSID and different address space where your trialists are connecting and manage their traffic completely separately from main AP.
I’m using wifi
Yea that’s the problem, I’m trying to do it via 1 AP with repeaters, and involving a virtual AP with another SSID will confuse the cr@p out the end client. ..phone calls all the time.. “how do we connect” “how do we connect” “how do we connect” 
I don’t understand why its not already a feature in mikrotik 
it is, and you have to use it. Either use separate SSID, where trial/unauthorized users can connect with limited access to internet resources, or use hotspot with walled garden, where limited/unauthorized users can access only certain pages.
Either this or “creative” users might get free internet access on expense of non-trial users.
Let me tell you something, some people don’t even know how to change SSID’s, their PC’s only connects to the strongest signal and then they continue and if they cant make it happened, they phone, I cant tell all the clients to go study IT before they use my hotspots, I’ll be busy 24/7 with desktop support when I’m doing this method.
most hotspot providers have a option on the landing page where you can switch between free or paid, but not mikrotik, you need to have 2 SSID’s… wtf? why man why?
How about creating 2 separate hotspot servers …and then bound it to specific IP ranges by using fancy rules that I don’t know how, forward, jump something like that?
they can register a free account on my radius server, and my radius server will give them a IP in the free range
everything on 1 SSID
please see the wiki.mikrotik.com on how this can be accomplished, of course you can implement 2 servers or even 2 separate networks. That is your choice. However, cost effective implementations are as described. I would go with this one: trial - without authorization, can only access pages you allow in the walled garden, authorized - can access everything. Also, you can create automatic MAC authorization so you single out full users while the rest of the bunch get limited treatment. Nothing changes for paid users as login is automatic for them.
the problem is, they buy vouchers via credit card and from voucher outlets, so they will need to login with username and password, so automatic login wont work here