Morning!
We provide Internet services for residential highrise buildings. We exclusively use RouterOS’s Hotspot feature with a RADIUS backend to facilitate authentication and access control. With the growing number of devices that don’t have a browser for users to login we’re desperate for a method to support these devices. The natural solution is to implement MAC exceptions. Users can list the MAC addresses of their devices in our customer portal and those devices then are automatically logged in.
The question is, how to effectively implement MAC exceptions in the router. It seems obvious, however:
The most-recommended solution is to use ip-binding’s bypass feature. This works, however has two caveats:
- rate-limits are not applied to bypass bindings - a manual IP mapping and queue would also need to be created for every device
- MAC addresses have to be manually added to the router, rather than existing on the RADIUS server
The alternate option is to use a server-profile with login-by=mac enabled. This however only works if the device makes a HTTP request initially before making requests on other ports. A device like a Sonosdoesn’t do this. It only makes requests on non-HTTP ports, therefore never authenticates and never works.
So, what’s the solution? Do I need to be using the router’s API and manually injecting bypass-bindings+queues for every device? Surely there’s a simpler solution.
