MikroTik Captive Portal Integration Guide

Hotspot using MikroTik

This guide walks you through configuring a MikroTik router to work with GATE as an external captive portal. Users register by entering their email and name through the web portal, with information stored in GATE's database (AAA server) and sent back to the MikroTik device. The MikroTik then sends an Access-Request to the server, which responds with an Access-Accept, granting internet access.

Hardware & Software Requirements

Configuration Overview

This configuration involves several key components:

  1. Bridge Setup - Creates a unified network interface
  2. Network Configuration - IP addressing, DHCP, and firewall rules
  3. RADIUS Integration - Connects to GATE's authentication server
  4. Hotspot Configuration - Portal pages, user profiles, and server setup

Bridge for Hotspot

The first step is creating a bridge interface to connect WiFi and Ethernet interfaces into a single network.

Creating a Bridge Interface

  1. Navigate to Bridge in the left menu and click New

    Select Bridge option

  2. In the new interface form:

    • Set Name to "bridge-for-hotspot"
    • Leave other settings at default values
    • Click Apply then OK

    Configure bridge interface

The bridge will connect your interfaces for hotspot functionality, allowing traffic to flow between interfaces and creating a unified network.

Assign WiFi Interfaces

Next, assign WiFi interfaces to the bridge to allow wireless clients to connect.

Adding WiFi Interfaces to the Bridge

  1. Go to Bridge then click the Ports tab

  2. For each wireless interface (wlan2GHz and wlan5GHz):

    • Click on the interface
    • From the Bridge dropdown, select "bridge-for-hotspot"
    • Click Apply then OK

    Configure WiFi interface

This creates a unified network for hotspot traffic, with all wireless clients connecting through these interfaces.

Network Configuration

Configure network settings to establish the foundation for your hotspot and ensure proper communication.

IP Address Assignment

First, assign an IP address to the bridge interface:

  1. Go to IP → Addresses

  2. Click New

  3. Configure the following:

    • Address: 10.5.50.1/24
    • Network: 10.5.50.0
    • Interface: "bridge-for-hotspot"
    • Click Apply then OK

    Configure IP address

This IP address (10.5.50.1) will serve as the gateway for all devices connecting to your hotspot.

IP Pool Configuration

Create an address pool for the hotspot:

  1. Go to IP → Pool
  2. Click New
  3. Configure:
    • Name: pool-hotspot
    • Addresses: 10.5.50.10-10.5.50.254
    • Click Apply then OK

Pool_Addresses.png

DHCP Server Setup

Configure the DHCP server to automatically assign IP addresses to clients.

DHCP Networks

  1. Go to IP → DHCP Server → Networks tab

  2. Click New

  3. Configure the network:

    • Address: 10.5.50.0/24
    • Gateway: 10.5.50.1
    • DNS Servers: 8.8.8.8,8.8.4.4 (Google DNS)
    • Click Apply then OK

    Configure DHCP network

DHCP Server

  1. Go to IP → DHCP Server → DHCP tab

  2. Click New

  3. Configure:

    • Name: "hotspot-dhcp"
    • Interface: "bridge-for-hotspot"
    • Address Pool: "pool-hotspot"
    • Leave other settings at defaults
    • Click Apply then OK

    Configure DHCP server

The DHCP server will now assign IP addresses to clients from the specified pool.

Firewall Configuration

Create a firewall rule to allow RADIUS authentication traffic:

  1. Go to IP → Firewall → Filter Rules tab

  2. Click New

  3. Under General tab:

    • Chain: input
    • Protocol: udp
    • Dst. Port: 1812,1813,3799

  4. Under Action tab:

    • Action: accept

  5. Click Apply then OK

    Set Action to accept

This rule allows communication between your MikroTik router and GATE's RADIUS server.

RADIUS Configuration

Configure RADIUS settings to connect to GATE's authentication server.

RADIUS Server Setup

  1. Go to RADIUS and click New

  2. Configure:

    • Under Service, enable only hotspot
    • Address: Enter your GATE server IP address
    • Secret: Enter the shared secret password
    • Authentication Port: 1812
    • Accounting Port: 1813
    • Click Apply then OK

    Configure RADIUS server

RADIUS Incoming Configuration

  1. Go to RADIUS and click Incoming

  2. Configure:

    • Enable Accept toggle
    • Port: 3799
    • VRF: Select "main"
    • Click Apply then OK

    Configure RADIUS incoming

Understanding RADIUS Ports

Hotspot Configuration

The Hotspot feature provides controlled internet access through a captive portal system integrated with GATE.

Custom Portal Files

Create custom HTML files for the external captive portal integration:

Required Files

Create these three files locally with the content below:

login.html

<!DOCTYPE html>
<html>
<head>
  <title>Redirecting to Registration Portal</title>
  <meta http-equiv="refresh" content="0;url=https://gate-dev.zequenze.com/page/demo-mikrotik/?mac=$(mac)&ip=$(ip)">
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
  <div style="text-align: center; margin-top: 100px; font-family: Arial, sans-serif;">
    <h2>Redirecting to registration portal...</h2>
    <p>If you are not redirected automatically, please click <a href="https://gate-dev.zequenze.com/page/demo-mikrotik/?mac=$(mac)&ip=$(ip)">here</a>.</p>
  </div>
</body>
</html>

logout.html

<!DOCTYPE html>
<html>
<head>
  <title>Logged Out</title>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <style>
    body { font-family: Arial, sans-serif; margin: 0; padding: 20px; }
    .container { max-width: 600px; margin: 0 auto; background-color: #f9f9f9; padding: 20px; border-radius: 5px; text-align: center; }
    .btn { display: inline-block; padding: 10px 20px; background-color: #0078d4; color: white; text-decoration: none; border-radius: 4px; margin-top: 20px; }
  </style>
</head>
<body>
  <div class="container">
    <h2>You have been logged out</h2>
    <p>Thank you for using our service.</p>
    <p>Session duration: $(uptime)</p>
    <p>Downloaded: $(bytes-in-nice) / Uploaded: $(bytes-out-nice)</p>
    <a href="$(link-login)" class="btn">Login Again</a>
  </div>
</body>
</html>

redirect.html

<!DOCTYPE html>
<html>
<head>
  <title>Redirecting</title>
  <meta http-equiv="refresh" content="0;url=https://gate-dev.zequenze.com/page/demo-mikrotik/?mac=$(mac)&ip=$(ip)">
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
  <div style="text-align: center; margin-top: 100px; font-family: Arial, sans-serif;">
    <h2>Redirecting to registration portal...</h2>
    <p>If you are not redirected automatically, please click <a href="https://gate-dev.zequenze.com/page/demo-mikrotik/?mac=$(mac)&ip=$(ip)">here</a>.</p>
  </div>
</body>
</html>

File Upload Process

  1. Connect to your MikroTik router using an FTP client
  2. Navigate to the /flash directory
  3. Create a new folder (e.g., myhotspot)
  4. Upload all three HTML files to this folder

Important: Use FTP to preserve MikroTik variables like $(mac) and $(ip). These variables are automatically replaced with actual values when users access the portal.

Walled Garden Configuration

Configure the Walled Garden to allow access to GATE's servers without authentication:

  1. Go to IP → Hotspot → Walled Garden tab

  2. Click New

  3. Configure:

    • Comment: "Wildcard zequenze"
    • Action: allow
    • Dst. Host: *.zequenze.com
    • Click Apply then OK

    Configure Walled Garden entry

This ensures users can reach GATE's registration page before authentication.

User Profiles

Create a user profile to define connection parameters:

  1. Go to IP → Hotspot → User Profiles tab

  2. Click New

  3. Configure:

    • Name: "profile-mikrotik"
    • Address Pool: "pool-hotspot"
    • MAC Cookie Timeout: "00:30:00" (30 minutes)
    • Click Apply then OK

    Configure User Profile

Server Profiles

Configure how the hotspot server operates:

  1. Go to IP → Hotspot → Server Profiles tab

  2. Click New

  3. Configure the following sections:

    General Settings:

    • Name: "Gate-html"
    • DNS Name: "hotspot.gateway"
    • HTML Directory: "flash/myhotspot" (path to your uploaded files)

    Login Settings:

    • Enable HTTP CHAP
    • Enable HTTP PAP

    RADIUS Settings:

    • Enable Use RADIUS
    • MAC Format: "XX:XX:XX:XX:XX:XX"
    • Enable Accounting
    • Interim Update: "00:05:00" (5 minutes)

  4. Click Apply then OK

    Configure RADIUS Settings

Hotspot Server Creation

Create the actual hotspot server:

  1. Go to IP → Hotspot → Servers tab
  2. Click New
  3. Configure:
    • Enable the Enabled toggle
    • Name: "hotspot1"

Zequenze Web Portal Setup

Introduction

This guide walks you through the complete process of setting up a dynamic web portal for your MikroTik hotspot using Zequenze GATE. The MikroTik device will redirect users to this external web portal, where they can register or log in to access your network services.

Table of Contents

Prerequisites

Before beginning this setup, ensure you have:

Creating a Dynamic Form

Dynamic forms collect user information during the registration process. This form will capture essential user data before granting network access.

Step 1: Access the Forms Section

  1. Navigate to Portals in the left sidebar menu
  2. Select Templates from the submenu
  3. Click on the Forms tab in the center of the screen
  4. Click the blue + Add button to create a new form

![Image: 1.1_form_1.png] Navigation path: Click (1) Portals in the sidebar, (2) Templates, (3) Forms tab, and (4) the Add button.

Step 2: Configure Basic Form Information

  1. Enter a descriptive name for your dynamic form (e.g., "hotspot-mikrotik-form-v1")
  2. Review the JSON data section where form components will be added
  3. Select your organization from the dropdown menu

1.1_form_2.png Form creation screen showing (1) Name field, (2) JSON data section, and (3) Organization selection.

Step 3: Add User Input Fields

Access User Fields Menu

  1. Click on User Fields in the left panel

![Image: 1.1_form_3.png] User Fields menu option highlighted.

Add Required Fields

  1. From the available user fields list, locate fields such as Email, First name, and Last name
  2. Drag and drop each desired field to the "Drag and Drop a form component" area

1.1_form_4.png Available User Fields options list.

Configure Email Field

  1. Drag the Email field from the list to the form area

1.1_form_4_1.png Dragging the Email field to the drop area.

  1. In the field properties popup:
    • Click the API tab
    • Verify or customize the Property Name (e.g., "email")
    • Click Save

1.1_form_5.png Selecting the API tab in field configuration.

1.1_form_6.png API configuration showing (1) Property Name field and (2) Save button.

  1. Repeat this process for First name and Last name fields

Step 4: Add Submit Button

  1. Click on Submit buttons in the left panel

1.1_form_7.png Submit buttons menu option.

  1. Drag and drop the Register button to the form area

1.1_form_8.png Selecting and dragging the Register button.

  1. Configure the register button:
    • Click the API tab in the popup window
    • Set the Property Name (e.g., "register_trigger")
    • Click Save

1.1_form_9.png Button API configuration showing (1) API tab, (2) Property Name field, and (3) Save button.

Step 5: Save Your Dynamic Form

  1. Click the blue Save button at the bottom left of the screen

1.1_form_10.png Save button highlighted at the bottom of the form creation screen.

  1. Verify successful creation - the form name and ID should appear at the top of the screen

1.1_form_11.png Saved form displaying (1) Form name and (2) Form ID at the top.

Form Verification Checklist

After saving, your dynamic form should include:

Advanced Customization Options

You can enhance your form with additional features:

Creating AAA User Profiles

AAA (Authentication, Authorization, and Accounting) user profiles define the network access parameters and bandwidth limitations that will be applied to users through RADIUS communication with your MikroTik device. These profiles use AVP (Attribute-Value Pair) attributes that will be sent to the MikroTik device.

Step 1: Access AAA User Profiles

  1. Click on AAA Services in the left sidebar menu
  2. Select Profiles from the submenu
  3. Click on the User profiles tab at the top
  4. Click the blue + Add button to create a new profile

2.1_AAA_Profiles_1.png Navigation path: (1) AAA Services in sidebar, (2) Profiles, (3) User profiles tab, and (4) Add button.

Step 2: Configure Basic Profile Information

  1. Enter a descriptive name for your profile (e.g., "MikroTik 1Mbps Profile" - typically referencing the speed or specific AVP attributes)
  2. Set a Short-name / code for system reference (e.g., "mktk-1m")
  3. Select your organization from the dropdown menu
  4. Click the Save button

2.1_AAA_Profiles_2.png Profile creation screen showing (1) Name field, (2) Short-name/code field, and (3) Organization selection.

Step 3: Add MikroTik RADIUS Attributes

After saving the basic profile information, configure the specific MikroTik attributes:

Required Attributes Configuration

  1. Mikrotik: Rate-Limit (8)

    • Set value to bandwidth limitation (e.g., "1M/1M" for 1 Mbps download/upload)

  2. Mikrotik: Mikrotik-Group (3)

    • Set value to "profile-mikrotik" (must match your MikroTik user profile name)

  3. Auth-Type (1000)

    • Set value to "Accept" for authentication verification

  4. Click Save to apply all changes

2.1_AAA_Profiles_3.png Attributes configuration showing (1) Rate-Limit attribute, (2) Mikrotik-Group attribute, (3) Rate-Limit value, (4) Mikrotik-Group value, (5) Auth-Type attribute, (6) Auth-Type value, and (7) Save button.

Important Configuration Notes

Critical: The "profile-mikrotik" value must match exactly with the user profile name created in your MikroTik device configuration.

Reference: For detailed MikroTik device configuration, see the official Zequenze documentation.

Bandwidth Configuration Examples

Profile Type Rate-Limit Value Description
Basic 1M/1M 1 Mbps download/upload
Standard 5M/5M 5 Mbps download/upload
Premium 10M/10M 10 Mbps download/upload
Unlimited 100M/100M High-speed access

Verification Checklist

After saving, verify your AAA user profile contains:

Adding RADIUS Clients

RADIUS clients represent your MikroTik devices in the GATE platform, enabling secure authentication and authorization communication between GATE and your network infrastructure.

Step 1: Access AAA Clients Section

  1. Click on AAA Services in the left sidebar menu
  2. Select Clients from the submenu
  3. Click the blue + Add button to create a new RADIUS client

3.1_AAA_Clients_1.png Navigation path: (1) AAA Services in sidebar, (2) Clients submenu, and (3) Add button.

Step 2: Configure RADIUS Client Parameters

  1. Short name: Enter an identifier for your MikroTik device (e.g., "mikrotik-hotspot-01")
  2. Organization: Select the appropriate organization from dropdown
  3. Hostname/IP Address: Enter your MikroTik device's IP address or hostname
  4. Secret: Create a strong shared secret for secure communication
  5. Enable debug: Check this option for development environments (disable in production)
  6. Click Save to create the RADIUS client

3.1_AAA_Clients_2.png RADIUS client configuration showing (1) Short name, (2) Organization selection, (3) IP address field, (4) Secret field, (5) Enable debug checkbox, and (6) Save button.

Network Connectivity Requirements

Critical Network Note: The IP address must have direct connectivity with GATE for bidirectional communication. NAT configurations can block return traffic from GATE to MikroTik, causing authentication failures.

Security Best Practices

Security Aspect Recommendation
Secret Strength Use minimum 16 characters with mixed case, numbers, and symbols
Secret Uniqueness Use a unique secret for each RADIUS client to maintain security
Secret Matching The secret used here must match exactly with the secret configured in your MikroTik RADIUS settings
Production Settings Disable debug mode in production to reduce unnecessary logging
**Firewall