For Filter-Id you pass on the name of a chain. When a user logs in and that attribute is received, two dynamic firewall filter rules are installed in the hotspot chain that jump to the chain named via Filter-Id for traffic to and from the user’s IP address.
Below a sample after logging in from IP 10.2.1.254 with RADIUS configured to pass back a value of ‘MT-Test’ for the Filter-Id attribute:
[admin@MikroTik] > /ip fire fil pri all where chain=hotspot
Flags: X - disabled, I - invalid, D - dynamic
26 I chain=hotspot action=jump jump-target=MT-Test src-address=10.2.1.254
27 I chain=hotspot action=jump jump-target=MT-Test dst-address=10.2.1.254
You can see the rules are invalid, that’s because the chain ‘MT-Test’ doesn’t exist. Once that chain is created, the rules turn on:
[admin@MikroTik] > /ip fire fil add chain=MT-Test action=drop
[admin@MikroTik] > /ip fire fil pri all where chain=hotspot
Flags: X - disabled, I - invalid, D - dynamic
26 D chain=hotspot action=jump jump-target=MT-Test src-address=10.2.1.254
27 D chain=hotspot action=jump jump-target=MT-Test dst-address=10.2.1.254