I have a need to separate address space for hotspot, example group1 will have ip 192.168.100.2 - 192.168.100.49 then group2 will have 192.168.100.50 - 192.168.100.254 and both groups taken from Entra ID.
I already create 2 profile on my NPS and for group1 I used frame-pool=group1 and group2 using frame-pool=group2. Also both pool already created in routerboard ip pool.
I can see in the log NPS already send ip from group1 (192.168.100.5) but why the client get ip from group2 (192.168.100.254)?
Client devices are usually assigned an IP address by a DHCP server from a local pool, this occurs before any hotspot activity as the client needs an IP address to be able to communicate with the hotspot.
There is no mechanism to revoke an address from a client and assign a new one, the hotspot performs 1:1 NAT between the local address and the address provided in the Access-Accept message.
hi, thanks you. But are you know how we can full fill my requirement? what i want is give group1 to unrestricted internet access and let group2 have limited internet access.
For PPP-like connections it is possible to add the client address and/or interface to an address or interface list respectively with settings in a PPP profile, and use the list to apply additional firewall rules. That isn't possible for hotspot connections, however you can include a Filter-Id attribute in the Access-Reply for group2 clients which causes that clients packets to pass through the named chain if it exist, e.g. Using mikrotik + radius Rules dinamicas Filter-Id - #2 by fewi
Otherwise you could use your current setup but change either the hotspot LAN address / DHCP server or the group1 / group2 pools not to overlap so it is obvious the addresses are being mapped, and apply firewall rules to the group2 range.
