Problem with 2.9.18 hotspot and local area shares

RouterOS General
1

Hi guys,

This question has been list before, but still have not got an solution yet, please us~!

The customer will kill me, if i can’t solve this :frowning:

I have setted up mikrotik 2.9.18 boxes for an Hotel that wanted hotspot access(for Plug & Play purpose that the guest don’t need change the ip settings), simple configuration nothing fancy, but we are experiencing a weird behaviour on the LAN shares, we lost comunications on windows mapped drives, shares and shared printer (this only happens when we enable the hotspot)

This is the scenario:

Internet <------> Mikrotik <-------> LAN
Mikrotik doing DHCP w/IP pool 192.168.0.1 - 192.168.0.200
LAN IP’s 192.168.0.0/24, mikrotik LAN IP 192.168.0.254 and is the gateway for the LAN.
192.168.0.0/24 masquerade
Some IP’s on the LAN are fixed in the range 192.168.0.201 thru 253
Mikrotik doing hotspot for the ip pool 192.168.0.1 thru 200, profile with transparent web-proxy enabled.
No firewall rules at all (yet)

Everything works just perfect with the hotspot disabled, after we enable the hotspot, the users have the hotspot login screen, they login without a problem and they can browse the internet, but after a little while around a couple of minutes all the windows shares and mapped drives in the LAN start to dissconnect, sometimes we are not able to ping, even in the same network… this happens both when user is logged or not logged in to the hotspot.

There are any firewall rules, only the ones that hotspot dynamically makes.

Any help ? Ideas? Please?

James Wang from China

2

Is it possible to separate the Hotspot users (and IP scope) from the local LAN machines? This is really something you should be doing anyway…do you want unknown hotspot users to be on the same (private) LAN anyway?

Add an additional IP/subnet to your inside interface (the hotspot interface) and either switch the Hotspot to that or change your local machines to that subnet. For example, 1982.168.2.1/24. Then, in the Hotspot Walled Garden, under IP list, add the src address scope for the LAN machines to allow so that they are bypassed from the Hotspot completely. Finally, add a src-nat rule for the new subnet with action=masq. Should do what you need unless I’m missing something.

The other alternative is to add each LAN machine’s IP in the Walled Garden (under the IP list). As I said before, you really should separate these machines from random users if you can.

3

If address-pool is specified for hotspot server, all (direct) communication
between hotspot clients is forbidden. Only bypassed hotspot hosts are allowed to communicate directly. Add all fixed IP’s (with their MAC as well) to hotspot bypassed binding list:

/ip hotspot ip-binding add mac-address=x:x:x:x:x:x address=y.y.y.y 
type=bypassed

All bypassed hosts will work as there would be no hotspot enabled.

4

hi
change your ip pool from 192.168.0.1 thru 200 to

192.168.0.2-192.168.0.200

i thank its work

5

sounds like he hotspot needs to be on its own interface with a different subnet the other interfaces.


Just my 2cents

6

Thanks all, i have change the settings , and now the customer more quite.

but i need test this for more days , and will post the result here,

Thanks again~!

7

Dear Jarosoup & normis

These 2 days , i have noticed that when the user try to print to network printer, sometimes will failure , and after retry several time , the printer work property, and the share floder has the same trouble.

And i have upgraded the RouterOS to version 2.9.19

Following is my setttings

192.168.0.x for access internet for hotspot & dhcp user (hs_pool1)
192.168.8.x fix ip for Local user witch have share resources
also i have setup the masq

# apr/06/2006 16:14:46 by RouterOS 2.9.19
#
/ ip hotspot 
add name="hs-LAN" interface=LAN address-pool=hs_pool1 profile=default \
    idle-timeout=5m keepalive-timeout=none addresses-per-mac=1 disabled=no 
/ ip hotspot service-port 
set ftp ports=21 disabled=no 
/ ip hotspot ip-binding 
add mac-address=00:50:FC:FE:F2:57 address=192.168.8.42 type=bypassed \
    comment="" disabled=no 
add mac-address=00:50:BA:B0:FB:04 address=192.168.8.31 type=bypassed \
    comment="" disabled=no 
add mac-address=00:50:FC:FF:7A:2B address=192.168.8.35 type=bypassed \
    comment="" disabled=no 
add mac-address=00:50:BA:BF:BF:64 address=192.168.8.32 type=bypassed \
    comment="" disabled=no 
add mac-address=00:05:5D:0D:BA:C9 address=192.168.8.33 type=bypassed \
    comment="" disabled=no 
add mac-address=00:14:85:E1:83:79 address=192.168.8.67 type=bypassed \
    comment="" disabled=no 
add mac-address=00:50:BA:69:D0:48 address=192.168.8.68 type=bypassed \
    comment="" disabled=no 
add mac-address=00:50:BA:69:5C:45 address=192.168.8.80 type=bypassed \
    comment="" disabled=no 
add mac-address=00:13:8F:3D:26:E1 address=192.168.8.97 type=bypassed \
    comment="" disabled=no 
add mac-address=00:50:BA:0C:5E:07 address=192.168.8.99 type=bypassed \
    comment="" disabled=no 
add mac-address=00:0A:EB:1E:12:E6 address=192.168.8.135 type=bypassed \
    comment="" disabled=no 
add address=192.168.8.0/24 type=bypassed comment="" disabled=no 
/ ip hotspot profile 
set default name="default" hotspot-address=192.168.0.2 \
    dns-name="hotspot.gnhotel.com" html-directory=hotspot rate-limit="" \
    http-proxy=192.168.0.2:8080 smtp-server=0.0.0.0 login-by=cookie,http-chap \
    http-cookie-lifetime=3d split-user-domain=no use-radius=no 
/ ip hotspot user 
add name="admin" password="123" profile=default comment="" \
    disabled=no 
/ ip hotspot user profile 
set default name="default" idle-timeout=none keepalive-timeout=2m \
    status-autorefresh=1m shared-users=1 transparent-proxy=yes \
    open-status-page=always advertise=no 
/ ip hotspot walled-garden 
/ ip hotspot walled-garden ip 
add src-address=0.0.0.0/0 action=accept comment="" disabled=no
8

Try to specify to-address and server for all bypassed ip-binding entries:
/ip hotspot ip-binding set 0 to-address=192.168.8.42 server=hs-LAN
…
/ip hotspot ip-binding set 10 to-address=192.168.8.135 server=hs-LAN

It will make those entries to appear in host list right away as Static
Bypassed hosts. It should fix that problem

9

Thanks u for u support, i will test for more days , and will replay result here,
Thanks again