Hi All, we are beginner to MT products and interested to use it a lot.
Currently we have setup HotSpot for our customer.
The problem is that CPU Usage touches 100% in minutes of starting devices.
In Profile we see, www,hotspot,web-proxy each consuming 30% and hence the usage goes 100%.
We have simple setup, where we authenticate users using radius.
/ip hotspot> print
Flags: X - disabled, I - invalid, S - HTTPS
The most likely cause is that you have a client/device that is on the network that is contstantly requesting a resource by HTTP and will keep on requesting it until it gets it. The hotspot redirects that HTTP request and uses the proxy to service it, the service doesn’t get what it wants so it asks for it again. The loop continues and increases CPU use.
Identify the device/user and prevent them, or set up a general firewall rule that will limit the number of connections the hotspot will process from a given user at a time.
The problem
Sometimes using the Hotspot feature in some Mikrotik devices can cause an increase in the CPU usage reaching up to 100% in some cases. Why does this happen? How do you fix this problem?
Summary
When a user (IP) has not signed into the hotspot the firewall places its packets in a chain “hs-unauth”.
Any packet in that chain going to port 80 (http) is automatically redirected to the internal port 64874, where the hotspot’s web server is listening, logically this shows the user how to log in. This results in a lot of requests that the web server must answer and most of them are not useful, causing the CPU usage to increase.
Proposed Solution and results
Redirect only the packets going to any direction used by web browsers/SO to detect the captive portal.
Once the redirecting condition is established, the amount of request going to the hotspot’s web server will decrease allowing only the necessary amount of answers to go out and bringing down the CPU usage.
Steps to apply this solution First step: copy the block of code found at the end, paste it in the terminal and press enter. Second step: create a scheduler that is executed at the “startup”, with interval 0 and put the following line in “On event”:
delay 10; ip firewall nat set dst-address-list=“DetHotspot” [find chain=hs-unauth && protocol=“tcp” && dst-port=“80” action=“redirect” to-ports=“64874”];
{
ip firewall address-list add address="www.msftconnecttest.com" list=DetHotspot;
ip firewall address-list add address="www.gstatic.com" list=DetHotspot;
ip firewall address-list add address="connectivitycheck.gstatic.com" list=DetHotspot;
ip firewall address-list add address="captive.apple.com" list=DetHotspot;
ip firewall address-list add address="detectportal.firefox.com" list=DetHotspot;
ip firewall address-list add address="connect.rom.miui.com" list=DetHotspot;
ip firewall nat set dst-address-list="DetHotspot" [find chain=hs-unauth && protocol="tcp" && dst-port="80" action="redirect" to-ports="64874"];
}