I need help with step by step instructions to setup hotspot and vouicher system
what have you got so far, and which resources did you check>>
I have got it working up to the hotspot page and able to create vouchers , however I have a challenge with session not being timed out. example a voucher for 10 minutes does not automatically get disconnected after 10 minutes. thank you
This is the code or script
2026-08-03 10:15:50 by RouterOS 7.23.2
software id = WC8W-K86Q
model = RB5009UPr+S+
serial number = REMOVED !
/interface bridge
add admin-mac=D0:EA:11:38:D7:3A auto-mac=no comment=defconf name=bridge
add comment="Hotspot Bridge Interface" name=bridge-hotspot
/interface ethernet
set [ find default-name=ether2 ] comment="WAN2 - Secondary ISP"
set [ find default-name=ether4 ] comment="Hotspot - Port 4"
set [ find default-name=ether5 ] comment="Hotspot - Port 5"
set [ find default-name=ether6 ] comment="Hotspot - Port 6"
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip hotspot profile
add dns-name=hotspot.local hotspot-address=192.168.89.1 login-by=
cookie,http-chap,http-pap name=hsprof-um use-radius=yes
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=hs-pool-89 ranges=192.168.89.10-192.168.89.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=hs-pool-89 interface=bridge-hotspot name=dhcp-hotspot
/user-manager limitation
add download-limit=2000000000B name=Lim-Daily rate-limit-rx=1000000B
rate-limit-tx=2000000B uptime-limit=1d
add download-limit=6000000000B name=Lim-Weekly rate-limit-rx=1000000B
rate-limit-tx=2000000B uptime-limit=1w
add download-limit=15000000000B name=Lim-Monthly rate-limit-rx=2000000B
rate-limit-tx=5000000B uptime-limit=4w2d
add name=Peak-Limit rate-limit-rx=3000000B rate-limit-tx=3000000B
add name=OffPeak-Limit rate-limit-rx=10000000B rate-limit-tx=10000000B
add name=Lim-1Hour-Peak rate-limit-rx=2000000B rate-limit-tx=5000000B
uptime-limit=1h
add name=Lim-24Hour-Peak rate-limit-rx=3000000B rate-limit-tx=10000000B
uptime-limit=1d
add name=1Hour-Limit uptime-limit=1h
add comment="15 Minutes Uptime Limit" name=15-Min-Limit uptime-limit=15m
/user-manager profile
add name=Standard-Pass-1Day name-for-users="1 Day Voucher" validity=1d
add name=1Hour-Voucher name-for-users="1 Hour Ticket" validity=unlimited
add name=1Hour-Profile name-for-users="1 Hour Access" validity=unlimited
add name=15-Min-Pass name-for-users="15 Minutes Unlimited"
override-shared-users=1 validity=1d
/user-manager user
add attributes=Mikrotik-Total-Limit:10000 name=admin
add name=ocmwila
/user-manager user group
add inner-auths=ttls-pap,ttls-chap name=Standard-Group outer-auths=pap,chap
/user-manager user
add comment="Test Voucher User" group=Standard-Group name=voucher01
add group=Standard-Group name=15M-Ba03O
add group=Standard-Group name=15M-eRJh3
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge-hotspot comment="Hotspot Port" interface=ether4
add bridge=bridge-hotspot comment="Hotspot Port" interface=ether5
add bridge=bridge-hotspot comment="Hotspot Port" interface=ether6
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=192.168.89.1/24 comment="Hotspot Gateway IP" interface=
bridge-hotspot network=192.168.89.0
/ip dhcp-client
add comment=defconf interface=ether1 name=client1
add comment="Secondary ISP DHCP" default-route-distance=2 interface=ether2
name=client2
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
add address=192.168.89.0/24 comment="Hotspot Network" dns-server=
192.168.89.1,1.1.1.1 gateway=192.168.89.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment="Allow RADIUS Localhost UDP 1812-1813"
dst-address=127.0.0.1 dst-port=1812,1813 protocol=udp src-address=
127.0.0.1
add action=accept chain=input comment="Allow All Localhost Traffic"
dst-address=127.0.0.1 src-address=127.0.0.1
add action=accept chain=input comment="Allow RADIUS Localhost" dst-address=
127.0.0.1 src-address=127.0.0.1
add action=passthrough chain=unused-hs-chain comment=
"place hotspot rules here" disabled=yes
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
in-interface=lo src-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related src-address=!192.168.89.0/24
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
in-interface-list=WAN
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment=
"place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=
out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="NAT - Secondary ISP"
out-interface=ether2
add action=masquerade chain=srcnat comment="NAT for 192.168.89.0/24 Hotspot"
src-address=192.168.89.0/24
/ip hotspot
add address-pool=hs-pool-89 disabled=no interface=bridge-hotspot name=
Hotspot-UM profile=hsprof-um
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/radius
add address=127.0.0.1 comment="Connect Hotspot to User Manager" service=
hotspot timeout=5s
/radius incoming
set accept=yes
/system clock
set time-zone-name=Africa/Lusaka
/system logging
add comment="RADIUS Debug Log" topics=radius,debug
add comment="Hotspot Debug Log" topics=hotspot,debug
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/user-manager
set enabled=yes
/user-manager profile-limitation
add limitation=1Hour-Limit profile=1Hour-Profile
add limitation=1Hour-Limit profile=1Hour-Profile
add limitation=1Hour-Limit profile=1Hour-Profile
add limitation=1Hour-Limit profile=1Hour-Profile
add limitation=15-Min-Limit profile=15-Min-Pass
/user-manager router
add address=127.0.0.1 name=Local-RB5009
/user-manager user-profile
add profile=15-Min-Pass user=15M-Ba03O