Hotspot User still has access after Uptime-limit reached - SOLVED.

I have a hotspot user with an Uptime-limit defined in their user. They connect via ethernet and login via MAC. It is set to 2 hours, and the counters are reset each night to give them 2 hours per day.
Here is their /ip hotspot user profile and hotspot server profile. The server=hotspot-wired uses the default server profile.

 >/ip hotspot user print detail
;;; CharliesPC;server=hotspot-wired name="30:9C:23:82:70:54" password="secret" mac-address=30:9C:23:82:70:54 profile=charlie-ethernet-profile limit-uptime=2h uptime=2h bytes-in=27224917
     bytes-out=1223886914 packets-in=324062 packets-out=1030056
    
>/ip hotspot profile print
Flags: * - default
 0 * name="default" hotspot-address=192.168.88.1 dns-name="seaview2.patroller.net" html-directory=hotspot html-directory-override="" rate-limit="" http-proxy=0.0.0.0:0 smtp-server=0.0.0.0
     login-by=mac,http-chap mac-auth-mode=mac-as-username mac-auth-password="secret" split-user-domain=no use-radius=no

When their limit-uptime=2h is reached they are logged off.

19:34:53 hotspot,debug hotspot-wired: dhcp host 192.168.88.249 removed: force mac login after client logged out

All good so far. Then the host tries to log back in and fails.

19:34:55 hotspot,debug hotspot-wired: new host detected 30:9C:23:82:70:54/192.168.88.249 by TCP :50838 -> 104.16.58.5:443
19:34:55 hotspot,info,debug 30:9C:23:82:70:54 (192.168.88.249): trying to log in by mac
19:34:55 hotspot,debug 30:9C:23:82:70:54 (192.168.88.249): using profile <charlie-ethernet-profile>
19:34:55 hotspot,info,debug 30:9C:23:82:70:54 (192.168.88.249): login failed: your uptime limit is reached

Still all good… but then the host is connected to the “hotspot-wired” server and is able to access the internet anyway.

19:34:55 hotspot,debug hotspot-wired: dhcp host 30:9C:23:82:70:54/192.168.88.249 added, ip 192.168.88.249

The user doesn’t show up in the /ip hotspot active list anymore, but still has a /ip dhcp-server lease and can stil access the internet.

I have solved the issue. It was of course a firewall issue.

I had a filter rule

chain=hs-unauth action=return src-address=192.168.88.0/24 in-interface=bridge2

This was one of several rules to allow hosts on (bridged) ethernet (192.168.88.0/24) to talk to hosts on wlan (192.168.123.0/24) without needing to be authorised by the hotspot. Adding dst-address=192.168.123.0/24 to this rule blocked the internet access for unauthorised connections.