Mikrotik RouterOS
includes an excellent hotspot solution. Read on for details on getting a
basic hotspot going using RouterOS on any standard x86 PC hardware or a
RouterBOARD.
The RouterOS hotspot solution is very powerful and only the very
basics of the solution are covered here; just enough to get you started.
Introduction
This article assumes you want to set up a basic hotspot as shown in
the diagram below. If you have a DNS server integrated into your router
the same rule applies, just use the router IP for your DNS server as
well.
To help get you started MikroTik now include a combined RADIUS server
and simple web administration package for RouterOS called the User
Manager. This provides a much simpler means of user administration then
the command line or Winbox. The User Manager package is included
standard with all versions of RouterOS from about 2.9.35 onwards.
Advanced users might wish to provide their own RADIUS server, however this is outside the scope of this article.
Getting the Hotspot to Work
First of all you will need to have a copy of RouterOS. You can purchase a license or download a 24-hour trial from
Mikrotik.
RouterBOARDs also usually come with RouterOS pre-licensed and
installed. You will also need a computer with at least a 100MHz CPU,
32MB RAM and an IDE hard disk, or a
RouterBOARD.
Either method you choose will need a compatible wireless card and
Ethernet adapter, or two Ethernet adapters with one connected to a
standard wireless access point. You should check your hardware against
the
RouterOS compatibility list.
If you are installing RouterOS for the first time, download the ISO
image from Mikrotik and burn it to CD. Note that installation of
RouterOS will completely wipe the contents of the hard disk! Boot the PC
off this CD and install the following packages:
- System
- DHCP
- Wireless
- Hotspot
- Proxy
- User Manager (optional)
- Security (optional - recommended)
- Advanced tools (optional)
Now to get started. Log onto the PC as
admin with no password. If this box intended for deployment, change set a password by typing in
password at the prompt. Change the hostname by typing in
name.
Assign an IP address to each interface. As this is going to be set up
as a router, they will need to be on a different subnet. Substitute
wlan1 with
ether2 if you have a separate access point.
[admin@Mikrotik] > ip address add address=192.168.24.3/24 interface=ether1
[admin@Mikrotik] > ip address add address=192.168.30.1/24 interface=wlan1
Now we need to add a default route to the IP of the internet router.
[admin@MikroTik] > ip route add gateway 192.168.24.1
Enable the wireless interface and set it to run as an access point as
below. If you have an access point instead, ignore the command below,
make sure it is running with no security enabled, use a suitable SSID
and channel and change its admin password.
[admin@Mikrotik]> interface wireless set wlan1 ssid="My HotSpot" band=2.4ghz-b mode=ap-bridge
Run the hotspot setup as below. Substitute the values in italics to
suit your network. The user account bears no relation to the admin
account and is used for the hotspot service only. You may also need to
add a host record to your DNS server for the hostname of the hotspot
box. Make sure the address pool does not conflict with any devices using
static IPs, such as access points.
[admin@MikroTik] > ip hotspot setup
hotspot interface: wlan1
local address of network: 192.168.30.1/24
masquerade network: yes
address pool of network: 192.168.30.2-192.168.30.99
select certificate: none
ip address of smtp server: 0.0.0.0
dns servers: 192.168.24.2
dns name: hotspot.mydomain.net (or leave this blank)
name of local hotspot user: user
password for the user: password
That’s the guts of it there. Fire up your laptop, associate to the
network and try to access a web page. You should be redirected to the
hotspot login page instead where you can enter the user credentials you
set up earlier. Click the thumbnails for a full view of the default
page.
You should now be able to access the web normally and a pop-up window
will display your connection time and data usage as you go.
Bear in mind I have left out the certificate so usernames and
passwords will be sent as plain text. If you intend on deploying the
hotspot, you should install a certificate on it and set up SSL to
protect account data from being sniffed.
Setting up User Manager
The User Manager is a nice and simple web administration for setting
up user account for the MikroTik hotspot and other services. It can be
hosted on either the same box as the hotspot or located in a separate
box on the same local network. One User Manager package can control
multiple hotspots.
Before getting the User Manager set up, check for any existing
hotspot account and remove them. To do this, run the following command:
[admin@MikroTik] > ip hotspot user print
Flags: X - disabled, D - dynamic
# SERVER NAME ADDRESS PROFILE UPTIME
0 fred default 0s
If any items are listed (in this case
bob), run the following command to remove them:
[admin@MikroTik] > ip hotspot user remove 0
You can delete multiple items at the same time, simply separate each item number with a comma.
To get the User Manager working we first need to add a customer
login. This is used to access the UM web administration. Make sure you
substitute the values in italics to suit.
[admin@MikroTik] > tool user-manager customer add login=hs_admin password=password
Now we need to add the hotspot as a RADIUS client to the user
manager. This is done under the user manager router section. The shared
secret can be any string of text and should be reasonably long and
complex. If you are setting the user manager up on the same box as the
hotspot, use
127.0.0.1 for the IP address.
[admin@MikroTik] > tool user-manager router add ip-address=hotspot-ip shared-secret=12345 subscriber=hs_admin
In return, we need to set up the hotspot to use RADIUS for user
authentication. First this involves creating a RADIUS client to
communicate with the UM. Remember that if you have both services on the
same box, the IP address should be set to
127.0.0.1. The secret should be the same as you set up above.
[admin@MikroTik] > radius add service=hotspot address=ip-address secret=12345
Now we tell the hotspot itself to use a RADIUS client. First bring up a list of hotspot profiles:
admin@MikroTik] > ip hotspot profile print
Locate the profile in use and type the following command where
1 is the number of the profile to configure:
[admin@MikroTik] > ip hotspot profile set 1 use-radius=yes
Now we are done with configuration. Browse to
http://router-ip/userman where
router-ip is the IP address of the box you are configuring UM on. Login using the customer username and password created earlier.
Click on the
User menu and select
Add.
Enter in a username, password and any other details you wish. You can
limit the speed the client can access the internet by selecting the
Rate limits checkbox and typing in a suitable speed (e.g. for a flat 128kBps download/64kBps upload speed limit simply type in
128k in the
RX field and
64k in the
TX field).
Click
Add and you should be able to now access the
hotspot using the username and password you specified. If you want to
generate a printable ticket for the users you set up, click on the
Users link, select the users to make a ticket for, click
Generate and select the number of tickets per page.
Other Tips
You can also go a step further and play with some other available
options, as this only skims the surface of the hotspot capabilities.
I’ll post more notes as I play with additional options.
- To disable communication between wireless clients (recommended), disable the default forward option on the wireless interface.
interface wireless set wlan1 default-forward=disabled
- To set up a walled garden (pages people can access without authenticating), use the following command:
ip hotspot walled-garden add dst-host=www.website.com
- To limit client bandwidth type the following, replacing profilename with the current hotspot profile in use and speed with the rate limit in bits per second:
ip hotspot profile set profilename rate-limit=”speed“
- You can customise the login and status pages by editing the files in the hotspot directory of the Mikrotik box. You can access these via FTP.
