Power over Ethernet (PoE) — технология, позволяющая передавать удалённому устройству электрическую энергию вместе с данными через стандартную витую пару в сети Ethernet. Данная технология предназначается для IP-телефонии, точек доступа беспроводных сетей, IP-камер, сетевых концентраторов и других устройств, к которым нежелательно или невозможно проводить отдельный электрический кабель.
Технология PoE описана стандартами IEEE 802.3af-2003 и IEEE 802.3at-2009. Существует несколько вариантов этой технологии, предшествующих первому стандарту, но они мало распространены.
Сегодня существует несколько видов технологии PoE и все они существенно отличаются. Причина этого в следующем. Когда IEEE все же решили перейти к стандартизации PoE технологии, прошло уже много времени после ее появления, а многие корпорации уже разработали и внедрили собственные решения PoE. Как пример, Cisco еще в далеком 2000-ом году представили реализацию питания по витой паре. Но даже после стандартизации IEEE 802.3af аж в 2003 году, а IEEE 802.3at в 2009-ом производители продолжают внедрять новые разработки в PoE. В основном из-за дороговизны полноценных стандартов 802.3af и 802.3at, а ведь клиентов все чаще нужны бюджетные решения.
Как результат существует несколько вариантов PoE:
– стандарт 802.3af,
– стандарт 802.3at,
– фирменные частные стандарты, из них наиболее известен в мире Passive PoE.
802.3af и 802.3at относится к активным PoE, а Passive PoE является пассивным.
Сама реализация питания по сетевому кабелю (витой паре) различается по типу распиновки. А еще в зависимости от напряжения на порт PoE делится на классы.
Всё это должно быть указано в техническом паспорте устройства для возможности правильного подбора оборудования.
Стандарты активного PoE – IEEE 802.3af и 802.3at
Основное преимущество таких PoE-источников – это их интеллектуальная рабочая схема, что помогает оборудованию работать дольше, экономить энергию и избегать поломок.
Так, перед тем, как подать питание на нужное устройство, сам активный PoE-источник стандарта 802.3af/at (может быть адаптер или коммутатор) проверяет и узнает следующее:
1. Есть ли поддержка в устройстве технологии PoE. При ее отсутствии электричество по витой паре просто подаваться не будет.
2. Проверит, какое напряжение потребляет устройство. И после установки класса питания подаст только нужное значение напряжения на подсоединенный порт.
3. Необходимо ли питание устройство, включено ли оно. При ответе нет, питание по кабелю не подается.
4. Не было ли перезагрузки устройства. При положительном ответе питание прекращается.
Параметры
Классы питания
Самым распространенным на сегодняшний день является 1-ый класс питания.
Passive PoE
Passive PoE – это существенно удешевленный аналог стандартов 802.3af и 802.3at. Пассивное питание позволяет существенно снизить цену оборудования. Но при этом такое оборудование не производит проверку нуждающегося в питании по витой паре устройства на потребляемую мощность и его состояние. То есть напряжение просто подается постоянно. Присутствует риск несовместимости оборудования, что приведет или к моментальной поломке или устройство сломается чуть позже из-за перегрева плат и их подгорания.
Ведущие производители делают дополнения технологии Passive PoE в виде полезных функций. Приведем пример устройства MikroTik с PoE out. Этот PoE out может определить есть ли подключение устройства к порту, а также узнает о коротком замыкании или перезагрузке. Еще некоторые устройства MikroTik позволяют управлять этими функциями. Можно включать и выключать PoE на портах, изменять режимы ну и так далее. Только в данном случае речь идет не об обычных PoE-шнурах, а о технологии PoE в маршрутизаторах, коммутаторах и прочем оборудовании.
Источники с Passive PoE варьируются по мощности, силе тока и напряжению. Наиболее часто производители их изготовляют непосредственно под определенное свое оборудование. По этой причине PoE-источник нужно подбирать специально под определенное устройство.
Типы распиновки
Также распиновка есть и по третьему типу, то есть когда с целью подачи питания задействована каждая жила кабеля из четырех пар. Но такая распиновка встречается редко и только в фирменной реализации PoE. Лучшим примером будет UPOE от Cisco.
Если в обоих концах сети Вы установите сетевое оборудование с поддержкой стандарта 802.3af или 802.3at, то в этом случае тип распиновки по факту не важен, так как установленное устройство-потребитель PoE будет работать с любым из них. Но, если стандарты разные, то это важно.
Кабель для PoE
Качество PoE очень зависит от качества кабеля и от длины витой пары. Витую пару следует выбирать следующую:
– должно быть четыре пары, то есть четырехпарная витая пара и не ниже cat.5e;
– витая пара должна быть медная, а не омедненная;
– толщина проводников должна быть не менее 0,51 мм (24 AWG);
– сопротивление в проводниках должно быть не выше 9,38 Ом/100 м (если больше, то будет большая потеря мощности);
– желательно известного производителя.
Длина PoE
Стандарты 802.3af и 802.3at говорят о длине витой пары для PoE именно равной 100м. Но на практике же максимальная длина витой пары будет зависеть от множества факторов. И все эти факторы могут быть заранее неизвестны:
– сечение проводников;
– металл проводников;
– наличие изгибов на линии;
– неравномерности витой пары, перегибы кабеля и т.д.
Беря во внимание вышеперечисленное, советуем максимальную длину кабеля PoE не больше 75м. Но если кабель качественный, то можно и больше.
А вот если Passive PoE, то длина должна быть не больше 30-60м. И рассчитывать линию необходимо, учитывая следующее:
– потребляемое напряжение устройством с учетом пиковой нагрузки;
– выдаваемое напряжение источником;
– сопротивление самой витой пары и размер потерь напряжения в этой линии.
Бюджет мощности PoE
Для расчета бюджета PoE необходимо:
1. Провести подсчет общей мощности всех без исключения потребителей PoE на обслуживаемой линии. Рассчитывать нужно по пиковой нагрузке каждого устройства и брать в расчет каждый работающий модуль оборудования.
2. Исходя из показателя мощности, подобрать PoE-источник. При этом необходимо обратить внимание на мощность отдельных портов, то есть, какое устройство к какому именно порту в будущем будете подключать, а также брать в расчет суммарную мощность источника, дабы не превысить общую мощность потребителей. И желательно приплюсовать 25% для резерва. Долгосрочная эксплуатация линии предусматривает, что подаваемая PoE-источником мощность будет терять ежегодно около 10%.
3. Учесть потерю мощности из-за длины кабеля от самого источника до непосредственно потребителя. Здесь главное именно сопротивление проводника. Кроме значений по умолчанию, не забывайте о том, что происходит увеличение сопротивления при нагреве кабеля.
The Dynamic Host Configuration Protocol (DHCP) is a client-server protocol that is used to assign an IP address and other network configuration parameters dynamically to each device on a network so that they can communicate with other IP networks. DHCP Server is popularly used in an Enterprise Office Network because in an office network various types of IP devices such as Laptop, Desktop, Tablet, Smartphone, IP Phone and so on are maintained and almost all IP devices support DHCP. An ISP Network can also be maintained with DHCP Server.
MikroTik Router has a built-in DHCP Service that can easily be used to manage DHCP enabled devices. Along with MikroTik DHCP Server, MikroTik User Manager Radius Server can also be used to manage DHCP clients and their bandwidth so efficiently. So, if you design your network with MikroTik DHCP Server and User Manager Radius Server, your network will be an easily manageable and smart network. In this article, I will discuss how to configure a static DHCP Server in MikroTik Router with User Manager Radius Server and manage DHCP clients/users so easily and efficiently.
Article Purpose
The purpose of this article is to design a smart and easily manageable network with
MikroTik DHCP Service and
MikroTik User Manager Radius Server.
Network Diagram
For the configuration of this article I am going to establish a network like below network diagram.
DHCP Network with Radius Server
This is a simple and basic network diagram. In real situation, your network might be larger than this network but the basic diagram will remain same. In this network, the WAN Distribution Switch is connected to internet gateway. MikroTik Router’s (NAS) WAN interface and MikroTik User Manager Radius Server are also connected to this WAN Distribution Switch. DHCP users will be connected to NAS Router through LAN Switch and will get internet access and MikroTik Router will communicate to Radius Server through WAN interface.
Core Devices and IP Information
To setup a Hotspot network according to above network diagram, I have installed and completed initial configuration of MikroTik User Manager Radius Server Package in a dedicated physical server where MikroTik RouterOS is running. I have also a physical MikroTik RouterOS (MikroTik RouterBOARD 1100AHX2) which is the NAS (Network Access Server) RouterOS of this network. IP information that I am using for this network configuration are given below.
Radius Server IP: 192.168.110.10/28
MikroTik RouterOS (NAS) WAN IP: 192.168.110.2/28
LAN IP Block: 192.168.10.0/24
LAN Gateway: 192.168.10.1/24
This IP information is just for my RND purpose. So, change this information according to your network requirements.
MikroTik static DHCP Server Configuration with User Manager Radius Server
We are now going to start our DHCP network configuration with User Manager Radius Server according to the above network diagram. The complete configuration can be divided into two parts.
Part 1: MikroTik RouterOS Configuration (NAS Router)
Part 2: MikroTik User Manager Radius Server Configuration
Part 1: MikroTik RouterOS Configuration (NAS Router)
In the first part, we will configure our MikroTik RouterOS (NAS) so that it can turn into a static DHCP Server and can communicate with Radius Server to authenticate DHCP clients. Complete RouterOS configuration can be divided into below topics.
Basic MikroTik RouterOS Configuration
DHCP Configuration in MikroTik RouterOS
Creating Firewall Rule to Block or Allow DHCP Clients
Radius Client Configuration in MikroTik RouterOS
Basic MikroTik RouterOS Configuration
MikroTik Router basic configuration includes WAN IP, LAN IP and DNS IP assigning and NAT and Default Gateway Configuration. The following steps will show how to perform these topics in your MikroTik RouterOS.
Login to your MikroTik Router using Winbox with full permission user such as admin user.
Go to IP > Addresses menu item. Address List window will appear. Click on PLUS SIGN (+). New Address window will appear.
Put RouterOS WAN IP (RouterOS WAN IP: 192.168.110.2/28) in Address input field and choose WAN interface from Interface dropdown menu and then click Apply and OK button.
Again click on PLUS SIGN and put LAN Gateway IP (LAN Gateway IP: 192.168.10.1/24 for this article) in Address input field and choose LAN interface (ether2 for this article) from Interface dropdown menu and click Apply and OK button.
Now go to IP > DNS. DNS Settings window will appear. Put your DNS server IP (Public DNS IP: 8.8.8.8 or 8.8.4.4) in Servers input field and then click Apply and OK button.
Go to IP > Routes. Route List window will appear. Click on PLUS SIGN (+). New Route window will appear. Click on Gateway input box and put your internet gateway IP (in this network: 192.168.110.1) in this input field. Click on Apply and OK button.
Go to IP > Firewall menu item and click on NAT tab and then click on PLUS SIGN. New NAT Rule window will appear.
In General tab, choose srcnat from Chain dropdown menu and click Action tab and then choose masquerade from Action dropdown menu.
Click on Apply and OK button.
MikroTik Router basic configuration has been completed. Now we will configure DHCP Server in our NAS RouterOS.
DHCP Configuration in MikroTik RouterOS
Now we will configure DHCP Server in our NAS RouterOS. The following steps will show you how to configure a DHCP Server in your MikroTik RouterOS.
Go to IP > DHCP Server menu item from your winbox. DHCP Server window will appear.
In DHCP Server window, click on DHCP Setup button and choose the interface (in this article: ether2) on which you want to setup DHCP server from DHCP Server Interface dropdown menu and then click on Next button.
Now put your LAN IP block (192.168.10.0/24 for this article) in DHCP Address Space input box and click Next button.
Put LAN gateway address (192.168.10.1 for this article) in Gateway for DHCP Network input box and then click Next button.
Provide IP range from which your DHCP client/LAN user will get IP in Address to Give Out input box and click Next button.
Provide preferred DNS server IP and click Next button.
Now provide IP lease time and click Next button. Default lease time is 3 days.
DHCP setup has been completed and a successful message will be shown. Your DHCP Server will be shown in DHCP Server List.
Click on your DHCP Server twice and you will find DHCP Server window. From Address Pool dropdown menu, choose static-only so that your DHCP Server turns into a static DHCP Server. In a static DHCP Server, IP address will not be provided until client MAC address is supplied and obviously an enterprise network will want it.
Go to IP > Pool and remove the automatic created pool from Pools list because in static DHCP server no need to have a pool. IP will be provided manually when any user will supply his device MAC address.
DHCP Server configuration has been completed. Now we will create two firewall rules so that only our permitted users can access internet via our MikroTik Router.
Creating Firewall Rule to Block or Allow DHCP Clients
We will now create two firewall rules so that only our permitted user can get internet access via our MikroTik Router. If any expert user wants to do any unfair connection, he will be rejected by these following rules.
Go to IP > Firewall and click on Filter Rules tab and then click on PLUS SIGN (+). New Firewall Rule window will appear.
In General tab, choose forward from Chain dropdown menu and choose your LAN interface from Interface dropdown menu.
Click on Action tab and choose drop from Action dropdown menu.
Click Apply and OK button.
Similarly, click on PLUS SIGN (+) and choose forward from Chain dropdown menu and choose LAN interface from Interface dropdown menu.
Click on Advanced tab and write permitted_users in Address List input box.
Click on Action tab and choose accept from Action dropdown menu.
Now click on Apply and OK button.
What we have done is that we have blocked all the users coming from LAN interface with the first firewall rule and then we have allowed all the users who have in permitted_users address list or group with the second firewall rule. Obviously, the second rule must place before the first rule otherwise permitted_users will not get internet access because they will go under first blocked rule. The permitted_users group will be supplied from Radius Server.
Radius Client Configuration in MikroTik RouterOS
The following steps will show you how to configure Radius client in MikroTik RouterOS.
Click on Radius menu item from left menu bar. Radius window will appear now.
Click on PLUS SIGN (+). New Radius Server window will appear now.
Click on dhcp checkbox from Service panel.
Put Radius Server IP address (in this article: 192.168.110.10) in Address input field.
Provide a password in Shared Secret input field. This password is important and has to provide when NAS router will be configured in User Manager Radius Server.
Click on Apply and OK button.
Now click on Incoming button and Radius Incoming window will appear.
Click on Accept checkbox and put 1700 in Port input box and then click on Apply and OK button.
Radius client configuration has been completed. Now MikroTik RouterOS is able to communicate with Radius Server to authenticate DHCP users.
Part 2: MikroTik User Manager Radius Server Configuration
MikroTik User Manager Radius Server installation and initial configuration has been discussed in my previous article. If you don’t have enough introduction with User Manager Radius Server installation and initial configuration, first spend some time to study that article and complete your Radius Server installation and initial configuration and then continue my below section. In this section, I will cover below topics in our Radius Server for DHCP user authentication, authorization and accounting.
Adding Client Router (NAS) in Radius Server
Profile Configuration for User Bandwidth Limitation and Permission
Adding User in Radius Server
Adding Client Router (NAS) in Radius Server
The following steps will show you how to add client router in User Manager Radius Server.
Click on Routers button from left button panel and then click on Add > New menu item from top menu bar. Router Details window will appear now.
In Main panel, put a meaningful name for your client router in Name input field. Also choose owner from Owner dropdown menu.
Put your client router IP address (RouterOS IP: 192.168.110.2) in IP address input field.
Now put shared secret password that you have provided at Radius client configuration in MikroTik RouterOS Shared secret input field.
In Radius incoming panel, click on CoA support check box and put 1700 in CoA port input box.
Click on Add button to add this router in Radius Server Router list.
MikroTik RouterOS has been added in User Manager Radius Server as a client router. Now User Manager will reply any query that will be asked by our MikroTik RouterOS.
Profile Configuration for User Bandwidth Limitation and Permission
Now we will create user profile so that we can manage our DHCP user’s bandwidth and permission. The following will show how to create user bandwidth limitation and maintain user permission with User Manager Radius Server.
Click on Profiles button and then click on Limitations
Now click on Add > New menu item. Limitation details window will appear.
Put your limitation package name in Name input box. I am providing Executive Package in Name field because I want to create a limitation package for Executives. Also choose owner from Owner dropdown menu.
In Rate limits panel, put your bandwidth limitation parameter. For a 512kbps bandwidth limitation, I am providing below information.
Parameter name
Rx
Tx
Rate limit
512k
512k
Burst rate
1M
1M
Burst threshold
512k
512k
Burst time
60
60
Min rate
32k
32k
Also choose priority from Priority dropdown menu. For my configuration I am choosing 8 that mean lowest priority.
In Constraints panel, put your permitted users address list name (in this article: permitted_users) in Address list input box.
Click Save button to save this limitation package.
Similarly, you can create as many limitation packages as you want.
Now click on Profiles tab and then click on PLUS SIGN (+). Create profile window will appear.
Put profile name what you want in Name input field. For my executive package, I am providing Executive as name. Click on Create Your created profile will be available in Profiles dropdown menu.
From Profiles dropdown menu, select your profile created profile. At the bottom of this profile, you will find Unlimited profile that mean there is no limitation for this profile. So, click on Add new limitationProfile part window will appear now.
You will find your limitation packages that you have created before in Limits Click on your desired Package’s checkbox and then click on Add button to add this limitation for this profile.
Similarly, you can create as many profiles as you want and can assign limitation for those profiles.
Profile configuration in User Manager Radius Server has been completed. Now we will create users who will be permitted to get internet access.
Adding User in Radius Server
Now we will add our DHCP clients in User Manager Radius Server. The following steps will show you how to add users/DHCP clients in your Radius Server.
Click on Users button and then click on Add > One menu item. User details window will appear.
In Main panel, put MAC address of your user’s device in Username input field.
In Constraints panel, put IP address that you want to assign for this user in IP address input field.
Now choose your desired profile for this user from Assign profile dropdown menu and then click on Add
First DHCP user has been created. Similarly, you can create as many users as you want following the above steps properly.
Our static DHCP server is ready. Now it is time to test our DHCP server. Connect the device that you added here in your network. If everything is OK, the device will be able to get internet access via your NAS Router.
Assigning IP Dynamically via Static DHCP Server
Normally, there is no option in MikroTik static DHCP Server to authenticate DHCP users by providing MAC address and then assign IP address dynamically. For example, a guest user comes to your office and provides his smartphone MAC address. Now you will add this MAC address and assign available IP address manually and then he will be connected to your network. But in this process, finding an available IP address may be a boring task. Using Radius Server, you can avoid this boring task if you want. The following steps will show how to provide IP dynamically via static DHCP Server using MikroTik User Manager Radius Server.
Login to MikroTik Router and go to IP > Addresses and then click on PLUS SIGN. Put a new IP block’s gateway IP (such as: 192.168.11.1/24) in Address input field and choose the interface where DHCP Server is enabled from Interface dropdown menu. Click on Apply and OK button.
Go to IP > Pool and click on PLUS SIGN. Put pool name (such as: guest_users_ip) in Name input field. In addresses input filed, put IP ranges from where IP will be assigned dynamically (such as: 192.168.11.2-192.168.11.254).
Go to IP > DHCP Server and click on Networks tab and then click on PLUS SIGN. Put your IP block (such as: 192.168.11.0/24) in Address input field and gateway IP (such as: 192.168.11.1) Gateway input field. You can also assign DNS server for this IP block from DNS Servers input field. Click Apply and OK button.
Now login to User Manager Web interface with customer credentials and click on Profiles button and then click on Limitation tab. Go to Add > New menu item and put name of this limitation package (such as: Guest Package) in Name input field and choose owner from Owner dropdown menu.
If you want to apply rate limit for this package, you can do that from Rate limit panel according to your requirements.
In Constraints panel, put IP Pool name (in this article: guest_users_ip) in IP pool input filed. Also put permitted user’s address list (in this article: permitted_users) in Address list window. Click Add button to add this new limitation package.
Click on Profiles tab and click on PLUS SIGN. Put profile name in Name input field and click on Create button. Your newly created profile will be available in Profiles dropdown menu. Select your newly created profile and from bottom click on Add new limitation You will find your newly created limitation package in Limits panel. Click on newly created package checkbox and then click on Add button.
Click on Users button from left button panel and click on Add > One menu item. Put MAC address of your user’s device in Username input field and then just select your newly created profile from Assign profile dropdown menu. Click add button to add this user. Similarly, you can create as many users for this profile as you want.
Now our static DHCP with Radius Server is ready to provide IP address dynamically to our desired users. Connect your desired device to your network. If everything is OK, your user will get IP address dynamically from your defined IP ranges.
I hope, it will be so easy to configure a static DHCP network with MikroTik User Manager Radius Server if follow the above steps properly. However, if you face any confusion to follow the above steps, feel free to watch my video tutorial about MikroTik static DHCP Server Configuration with User Manager Radius Server. I hope, it will reduce your any confusion.
MikroTik Static DHCP Server Configuration with User Manager Radius Server has been discussed in this article. I hope you will be able to configure your network with MikroTik DHCP Server and User Manager Radius Server so easily. However, if you face any confusion to design your DHCP network with User Manager Radius Server, feel free to contact with me from Contact page. I will try my best to stay with you.
If you are a network administrator and want to establish a network that will have data limitation package with prepaid billing system, MikroTik Hotspot Server with MikroTik User Manager Radius Server will be your best solution. Because, MikroTik User Manager is a poplar Radius application that will give facility to manage user data package as well as prepaid billing system efficiently. On the other hand, MikroTik Hotspot is a popular service that will help to connect your network user without any hassle.
So, it is time to know about MikroTik Hotspot Configuration with User Manager Radius Server and this article will guide you how to configure a Hotspot Server with User Manager Radius Server that will have Data Limit and Prepaid Billing System facility.
Article Purpose
The purpose of this article is to design a MikroTik Hotspot network with User Manager Radius Server that will have
Data Limitation Package and
Prepaid Billing System with Scratch Card.
Network Diagram
For the configuration of this article I am going to establish a network like below network diagram.
MikroTik Hotspot Network with User Manager Radius Server
This is a simple and basic network diagram. In real situation, your network might be larger than this network but the basic diagram will remain same. In this network, the WAN Distribution Switch is connected to internet gateway. MikroTik Router’s (NAS) WAN interface and MikroTik User Manager Radius Server are also connected to this WAN Distribution Switch. Hotspot users will be connected to NAS Router through LAN Switch and will get internet access and MikroTik Router will communicate to Radius Server through WAN interface.
Core Devices and IP Information
To setup a Hotspot network according to above network diagram, I have installed and completed initial configuration of MikroTik User Manager Radius Server Package in a dedicated physical server where MikroTik RouterOS is running. I have also a physical MikroTik RouterOS (MikroTik RouterBOARD 1100AHX2) which is the NAS (Network Access Server) RouterOS of this network. IP information that I am using for this network configuration are given below.
Radius Server IP: 192.168.110.10/28
MikroTik RouterOS (NAS) WAN IP: 192.168.110.2/28
LAN IP Block: 192.168.10.0/24
Hotspot Server IP: 192.168.10.1
This IP information is just for my RND purpose. So, change this information according to your network requirements.
MikroTik Hotspot and Radius Server Configuration with Data Limit and Prepaid Billing System
We are now going to start our Hotspot network configuration with User Manager Radius Server according to the above network diagram. The complete configuration can be divided into two parts.
Part 1: MikroTik RouterOS Configuration (NAS Router)
Part 2: MikroTik User Manager Radius Server Configuration
Part 1: MikroTik RouterOS Configuration (NAS Router)
In the first part, we will configure our MikroTik RouterOS (NAS) so that it can turn into a Hotspot Server and can communicate with Radius Server to authenticate users. Complete RouterOS configuration can be divided into below topics.
Basic MikroTik RouterOS Configuration
Hotspot Configuration in MikroTik RouterOS
Radius Client Configuration in MikroTik RouterOS
Basic MikroTik RouterOS Configuration
MikroTik Router basic configuration includes WAN IP Assign, DNS IP Assign and Default Gateway Configuration. The following steps will show how to perform these topics in your MikroTik RouterOS.
Login to your MikroTik Router using Winbox with full permission user such as admin user.
Go to IP > Addresses menu item. Address List window will appear. Click on PLUS SIGN (+). New Address window will appear.
Put RouterOS WAN IP (RouterOS WAN IP: 192.168.110.2/28) in Address input field and choose WAN interface from Interface dropdown menu and then click Apply and OK button.
Now go to IP > DNS. DNS Settings window will appear. Put your DNS server IP (Public DNS IP: 8.8.8.8 or 8.8.4.4) in Servers input field and then click Apply and OK button.
Go to IP > Routes. Route List window will appear. Click on PLUS SIGN (+). New Route window will appear. Click on Gateway input box and put your internet gateway IP (in this network: 192.168.110.1) in this input field. Click on Apply and OK button.
MikroTik Router basic configuration has been completed. Now we will configure Hotspot Server in our NAS RouterOS.
Hotspot Configuration in MikroTik RouterOS
After completing MikroTik Router basic configuration, we will now setup Hotspot Server in our MikroTik RouterOS. The following steps will show how to setup Hotspot Server in your MikroTik RouterOS.
Go to IP > Hotspot menu item. Hotspot window will appear.
Click on Hotspot Setup button from this window. Hotspot Setup will appear now.
Choose your LAN interface on which you want to setup Hotspot Server from Hotspot Interface drop-down menu. Now click Next button.
Put your LAN address (in this case: 192.168.10.1/24) in Local Address of Network input box. Also check the Masquerade Network checkbox is checked and then click Next button.
Now it is time to choose address pool for your Hotspot network from where IP address will be assigned to clients. Normally, it will show your network IP range without gateway IP. You can change default IP range as your wish or can keep the default range. Click Next button now.
If you have SSL certificate, you can import by choosing import other certificate option or select none if you do not have any SSL certificate. Now click Next button.
If you have SMTP server, you can put your SMTP server address in IP Address of SMTP Server input box or you can keep blank if you do not want to use SMTP server. Click Next button.
Now it is option to setup DNS. DNS servers that you have provided in basic configuration will automatically be selected here. So, nothing to do, just click Next button now.
Now it is time to put DNS name which is a mandatory field. DNS name will be used to get Hotspot login page. So, put a standard DNS name such as systemzone.mk or systemzone.hotspot etc. and click Next button.
Now put a local Hotspot user. By default it is admin. You can keep this user or can change as your wish. Also put password in Password for the User input box. Click Next button.
Hotspot server setup will be completed and you will get a successful message now.
Click on Servers tab and you will find a new server has been created. Click on it and change your automated created server name if you wish and then find what the server profile is from Profile dropdown menu.
Now click on ServerProfiles tab and you will find your Hotspot Server profile here. Click on it. Hotspot Server Profile window will come.
Under General tab, change your server profile name if you wish.
Click on Login tab and uncheck Cookie and check HTTP CHAP, HTTPS and HTTP PAP from Login By panel.
Click on RADIUS tab and click on Use RADIUS checkbox and Accounting checkbox and then click Apply and OK button.
MikroTik Hotspot server configuration has been completed. In the next step, we will configure Radius client in our MikroTik RouterOS.
Radius Client Configuration in MikroTik RouterOS
The following steps will show you how to configure Radius client in MikroTik RouterOS.
Click on Radius menu item from left menu bar. Radius window will appear now.
Click on PLUS SIGN (+). New Radius Server window will appear now.
Click on hotspot checkbox from Service panel.
Put Radius Server IP address (in this article: 192.168.110.10) in Address input field.
Provide a password in Shared Secret input field. This password is important and has to provide when client router will be configured in User Manager Radius Server.
Click Apply and OK.
Now click on Incoming button and Radius Incoming window will appear.
Click on Accept checkbox and put 1700 in Port input box and then click Apply and OK.
Radius client configuration has been completed. Now MikroTik RouterOS is able to communicate with Radius Server to authenticate Hotspot users.
Part 2: MikroTik User Manager Radius Server Configuration
MikroTik User Manager Radius Server installation and initial configuration has been discussed in my previous article. If you don’t have enough introduction with User Manager Radius Server installation and initial configuration, first spend some time to study that article and complete your Radius Server installation and initial configuration and then continue my below section. In this section, I will do below topics in our Radius Server for Hotspot user authentication, authorization and accounting.
Adding Client Router (NAS) in Radius Server
User Profile Configuration for Data Limitation
Creating Voucher Template
Adding User in Radius Server
Accessing User Page
Adding Client Router (NAS) in Radius Server
The following steps will show you how to add client router in User Manager Radius Server.
Click on Routers button from left button panel and then click on Add > New menu item from top menu bar. Router Details window will appear now.
In Main panel, put a meaningful name for your client router in Name input field. Also choose owner from Owner dropdown menu.
Put your client router IP address (RouterOS IP: 192.168.110.2) in IP address input field.
Now put shared secret password that you have provided at Radius client configuration in MikroTik RouterOS Shared secret input field.
In Radius incoming panel, click on CoA support check box and put 1700 in CoA port input box.
Click on Add button to add this router in Radius Server Router list.
MikroTik RouterOS has been added in User Manager Radius Server as a client router. Now User Manager will reply any query that will be asked by our MikroTik RouterOS.
User Profile Configuration for Data Limitation
We will now create two Data Limitation packages (512MB for 2 week validation and 1GB for 30 days validation) in User Manager Radius Server. The following steps will show how to create Data Limit packages in User Manager Radius Server.
Click on Profiles button from left button panel and then click on Limitations
Click on Add > New menu item from top menu bar. Limitation details window will appear now.
In Main panel, put your package name what you want in Name input field. As I am creating my first 512MB package, I am providing 512MB Package in name field. Also choose owner from Owner dropdown menu.
In limits panel, put 512M in Transfer input field. We don’t want to apply any download and upload limit. If total download and upload exceeds 512MB, the user will not be able to connect more.
We don’t also apply any bandwidth limitation because it is valueless to apply bandwidth limitation in Data Limit package.
In Constraints panel, put IP Pool name that you will find at IP > Pool window in your NAS RouterOS.
Click Save button to save this limitation package.
Similarly, create 1GB Package. Just put 1G in Transfer input filed and put this package name as your wish.
Now click on Profiles tab and click on PLUS SIGN (+). Create profile window will appear. Put profile name what you want in Name input field. For my configuration, I am providing 512MB as name. Click on Create Similarly, create 1GB profile.
From Profiles dropdown menu, select 512MB and put 1w in Validity input box. Choose package starting time At first logon from Starts dropdown menu. Put price of this package in Price input box and keep Shared users value 1 so that only one user can login at a time with a username and password.
Click Save profile button to save your information.
At the bottom of this profile, you will find Unlimited profile that mean there is no limitation for this profile. So, click Add new limitationProfile part window will appear now.
You will find your limitation packages that you have created in Limits Click 512MB Package checkbox and the click Add button to add this limitation for this profile.
Again select 1GB from Profiles dropdown menu and 4w2d in Validity input box. Choose package starting time At first logon from Starts dropdown menu. Put price of this package in Price input box and keep Shared users value 1 so that only one user can login at a time with a username and password. Click Save profile to save this information.
Now click Add new limitation button and click 1GB Package checkbox from Limits panel and then click Add button to add this limitation.
We have created two Data Limit packages in our profile configuration. Similarly you can create as many Limitation packages as you want following the above steps properly. In the next section, we will create Voucher or Scratch card Template in our Radius Server.
Creating Voucher Template
Now we are going to create scratch card template so that after creating users we can print scratch card according to this template. The following steps will show how to create scratch card or voucher template in User Manager Radius Server.
Click on Settings button from left button panel and then click on Templates
<div class="box"> <h2>System Zone - Internet Card $%u_moneyPaid%</h2> <div class="txtbox"> How to use this card? <br> Type systemzone.mk in your browser and <br> Put the <b>UsreName</b> & <b>Password</b> in required field and click <b>OK </b> button.</b> </br> </div> <p align="left"> UserName: <h3>%u_username%</h3> </p> <p align="left"> Password: <h3>%u_password%</h3></p> <h5 style="margin-top: -70px; margin-left: 195px; font: bold 25px Arial; color: #fff; text-shadow: black 0.1em 0.1em 0.6em;">%u_actualProfileName%/%u_timeLeft% </h5> <p style="margin-top: -40px; margin-left: 195px;"> Price: $%u_moneyPaid%</p> <h4>Contact for more info. sayeedsezan@gmail.com</h4> </div>
Click Save button to save this voucher template.
You can change this card design if you have a little HTML and CSS idea. If you need to change only card text, just change texts in Row textarea according to your requirement.
Adding User in User Manager Radius Server
The following steps will show how to add random users in your User Manager Radius Server.
Click on Users button from left button panel. Now click on Add > Batch menu item from top menu bar. User details window will appear.
In Main panel, choose owner from Owner dropdown menu and provide number of users you want to create at a time. You can also provide username prefix as well as username and password length in this panel.
Choose your desired profile package for these users from Assign profile dropdown menu and then click on Add button to add these users. All the created users will be available in Users
Now click on all the users checkbox for whom you want to create scratch card.
Click on Generate menu and then choose VouchersVouchers window will appear.
Now click on Generate button and you will find your entire scratch cards in a HTML page like below image.
Now sell these cards to your nearest shop and get auto revenue monthly or your desired time period.
Hotspot Server is now ready to authenticate users via User Manager Radius Server. Now it is time to test our Hotspot server. For this, connect any IP device to your network. After connecting, a dynamic IP will be assigned to your device from DHCP server that was created while installing Hotspot server. Usually, Hotspot uses DHCP server to assign IP address and other related information that are necessary to get login page. Now open any web browser and try to visit any web page. You can see the login page of your Hotspot server. If you do not get login page for any cause, type your DNS name that was provided while installing Hotspot server. Now you can see your Hotspot login page like below image.
Hotspot Login Page
Accessing User Page
Radius Server offers a user page where user can login their profile page and can show their account status as well as can change their account information and password. The following steps will show how to access this user page in your Radius Server.
Type https://radius_server_ip_address/user to get user login page if you have only one subscriber or customer in your Radius Server. But if you have more than one customer or subscribe, you have to type https://radius_server_ip_address/user/public_id where public_id is Public ID of the customer or subscriber. This Public ID must provide when customer or subscriber is created.
Type username and password of your desired user in Login and Password input field and then hit login button.
Now user can show his account status, profile, sessions and payment option from this page. Also he can change his password from Settings menu.
Following the above described method, you can easily create a data limitation and prepaid billing system network with MikroTik Hotspot and User Manager Radius Server. However, if you face any confusion to follow above method, watch my video about MikroTik Hotspot Configuration with Data Limit and Prepaid Billing System. I hope, it will reduce your any confusion.
MikroTik Hotspot Configuration with Data Limit and Prepaid billing System has been explained in this article. I hope you are now able to setup a Hotspot Server with Radius Server that will have data limitation and prepaid billing system. However, if you face any confusion, feel free to discuss in comment or contact with me from Contact page. I will try my best to stay with you.
Say, you are a network administrator and want to establish a network that will have user bandwidth package management facility with prepaid billing system as well as partner advertisement facility. Then, MikroTik Hotspot Server Configuration with MikroTik User Manager Radius Server will be a wise decision. Because, MikroTik User Manager Radius Server is a user authentication, authorization and accounting application that will give facility to manage user bandwidth package with prepaid billing system. On the other hand, you can easily advertise your partner banner using MikroTik Hotspot Server. Because, to get connected through MikroTik Hotspot Server, Hotspot client must provide login credentials in a HTML page and you can easily put your partner banner in this HTML page knowing basic HTML and CSS coding.
So, it is time to learn MikroTik Hotspot Server Configuration with MikroTik User manager Radius Server for managing a bandwidth limitation and prepaid billing system network. In this article, I will discuss how to configure MikroTik Hotspot Server with User Manager Radius Server bandwidth limitation and prepaid billing system.
Article Purpose
The purpose of this article is to design a Hotspot network with User Manager Radius Server that will have
User bandwidth package management and
Prepaid billing system with scratch card facility.
Network Diagram
For the configuration of this article I am going to establish a network like below network diagram.
MikroTik Hotspot Network with User Manager Radius Server
This is a simple and basic network diagram. In real situation, your network might be larger than this network but the basic diagram will remain same. In this network, the WAN Distribution Switch is connected to internet gateway. MikroTik Router’s (NAS) WAN interface and MikroTik User Manager Radius Server are also connected to this WAN Distribution Switch. Hotspot users will be connected to NAS Router through LAN Switch and will get internet access and MikroTik Router will communicate to Radius Server through WAN interface.
Core Devices and IP Information
To setup a Hotspot network according to above network diagram, I have installed and completed initial configuration of MikroTik User Manager Radius Server Package in a dedicated physical server where MikroTik RouterOS is running. I have also a physical MikroTik RouterOS (MikroTik RouterBOARD 1100AHX2) which is the NAS (Network Access Server) RouterOS of this network. IP information that I am using for this network configuration are given below.
Radius Server IP: 192.168.110.10/28
MikroTik RouterOS (NAS) WAN IP: 192.168.110.2/28
LAN IP Block: 192.168.10.0/24
Hotspot Server IP: 192.168.10.1
This IP information is just for my RND purpose. So, change this information according to your network requirements.
MikroTik Hotspot Server Configuration with User Manager Prepaid Billing System
We are now going to start our Hotspot network configuration with User Manager Radius Server according to the above network diagram. The complete configuration can be divided into two parts.
Part 1: MikroTik RouterOS Configuration (NAS Router)
Part 2: MikroTik User Manager Radius Server Configuration
Part 1: MikroTik RouterOS Configuration (NAS Router)
In the first part, we will configure our MikroTik RouterOS (NAS) so that it can turn into a Hotspot Server and can communicate with Radius Server to authenticate users. Complete RouterOS configuration can be divided into below topics.
Basic MikroTik RouterOS Configuration
Hotspot Configuration in MikroTik RouterOS
Radius Client Configuration in MikroTik RouterOS
Basic MikroTik RouterOS Configuration
MikroTik Router basic configuration includes WAN IP Assign, DNS IP Assign and Default Gateway Configuration. The following steps will show how to perform these topics in your MikroTik RouterOS.
Login to your MikroTik Router using Winbox with full permission user such as admin user.
Go to IP > Addresses menu item. Address List window will appear. Click on PLUS SIGN (+). New Address window will appear.
Put RouterOS WAN IP (RouterOS WAN IP: 192.168.110.2/28) in Address input field and choose WAN interface from Interface dropdown menu and then click Apply and OK button.
Now go to IP > DNS. DNS Settings window will appear. Put your DNS server IP (Public DNS IP: 8.8.8.8 or 8.8.4.4) in Servers input field and then click Apply and OK button.
Go to IP > Routes. Route List window will appear. Click on PLUS SIGN (+). New Route window will appear. Click on Gateway input box and put your internet gateway IP (in this network: 192.168.110.1) in this input field. Click on Apply and OK button.
MikroTik Router basic configuration has been completed. Now we will configure Hotspot Server in our NAS RouterOS.
Hotspot Configuration in MikroTik RouterOS
After completing MikroTik Router basic configuration, we will now setup Hotspot Server in our MikroTik RouterOS. The following steps will show how to setup Hotspot Server in your MikroTik RouterOS.
Go to IP > Hotspot menu item. Hotspot window will appear.
Click on Hotspot Setup button from this window. Hotspot Setup will appear now.
Choose your LAN interface on which you want to setup Hotspot Server from Hotspot Interface drop-down menu. Now click Next button.
Put your LAN address (in this case: 192.168.10.1/24) in Local Address of Network input box. Also check the Masquerade Network checkbox is checked and then click Next button.
Now it is time to choose address pool for your Hotspot network from where IP address will be assigned to clients. Normally, it will show your network IP range without gateway IP. You can change default IP range as your wish or can keep the default range. Click Next button now.
If you have SSL certificate, you can import by choosing import other certificate option or select none if you do not have any SSL certificate. Now click Next button.
If you have SMTP server, you can put your SMTP server address in IP Address of SMTP Server input box or you can keep blank if you do not want to use SMTP server. Click Next button.
Now it is option to setup DNS. DNS servers that you have provided in basic configuration will automatically be selected here. So, nothing to do, just click Next button now.
Now it is time to put DNS name which is a mandatory field. DNS name will be used to get Hotspot login page. So, put a standard DNS name such as systemzone.mk or systemzone.hotspot etc. and click Next button.
Now put a local Hotspot user. By default it is admin. You can keep this user or can change as your wish. Also put password in Password for the User input box. Click Next button.
Hotspot server setup will be completed and you will get a successful message now.
Click on Servers tab and you will find a new server has been created. Click on it and change your automated created server name if you wish and then find what the server profile is from Profile dropdown menu.
Now click on ServerProfiles tab and you will find your Hotspot Server profile here. Click on it. Hotspot Server Profile window will come.
Under General tab, change your server profile name if you wish.
Click on Login tab and uncheck Cookie and check HTTP CHAP, HTTPS and HTTP PAP from Login By panel.
Click on RADIUS tab and click on Use RADIUS checkbox and Accounting checkbox and then click Apply and OK button.
MikroTik Hotspot server configuration has been completed. In the next step, we will configure Radius client in our MikroTik RouterOS.
Radius Client Configuration in MikroTik RouterOS
The following steps will show you how to configure Radius client in MikroTik RouterOS.
Click on Radius menu item from left menu bar. Radius window will appear now.
Click on PLUS SIGN (+). New Radius Server window will appear now.
Click on hotspot checkbox from Service panel.
Put Radius Server IP address (in this article: 192.168.110.10) in Address input field.
Provide a password in Shared Secret input field. This password is important and has to provide when client router will be configured in User Manager Radius Server.
Click Apply and OK.
Now click on Incoming button and Radius Incoming window will appear.
Click on Accept checkbox and put 1700 in Port input box and then click Apply and OK.
Radius client configuration has been completed. Now MikroTik RouterOS is able to communicate with Radius Server to authenticate Hotspot users.
Part 2: MikroTik User Manager Radius Server Configuration
MikroTik User Manager Radius Server installation and initial configuration has been discussed in my previous article. If you don’t have enough introduction with User Manager Radius Server installation and initial configuration, first spend some time to study that article and complete your Radius Server installation and initial configuration and then continue my below section. In this section, I will do below topics in our Radius Server for Hotspot user authentication, authorization and accounting.
Adding Client Router (NAS) in Radius Server
User Profile Configuration for Bandwidth Limitation
Creating Voucher Template
Adding User in Radius Server
Accessing User Page
Adding Client Router (NAS) in Radius Server
The following steps will show you how to add client router in User Manager Radius Server.
Click on Routers button from left button panel and then click on Add > New menu item from top menu bar. Router Details window will appear now.
In Main panel, put a meaningful name for your client router in Name input field. Also choose owner from Owner dropdown menu.
Put your client router IP address (RouterOS IP: 192.168.110.2) in IP address input field.
Now put shared secret password that you have provided at Radius client configuration in MikroTik RouterOS Shared secret input field.
In Radius incoming panel, click on CoA support check box and put 1700 in CoA port input box.
Click on Add button to add this router in Radius Server Router list.
MikroTik RouterOS has been added in User Manager Radius Server as a client router. Now User Manager will reply any query that will be asked by our MikroTik RouterOS.
User Profile Configuration for Bandwidth Limitation
We will now create three bandwidth packages (512kbps package, 1Mbps package and 2Mbps package) in User Manager Radius Server so that different user gets different bandwidth. The following steps will show how to create bandwidth packages in User Manager Radius Server.
Click on Profiles button from left button panel and then click on Limitations
Click on Add > New menu item from top menu bar. Limitation details window will appear now.
In Main panel, put your package name what you want in Name input field. As I am creating my first 512kbps package, I am providing 512kbps Package in name field. Also choose owner from Owner dropdown menu.
In Rate limits panel, put your bandwidth limitation parameter. For a 512kbps package, I am providing below information.
Parameter name
Rx
Tx
Rate limit
512k
512k
Burst rate
1M
1M
Burst threshold
512k
512k
Burst time
60
60
Min rate
32k
32k
Also choose priority from Priority dropdown menu. For my configuration I am choosing 8 that mean lowest priority.
In Constraints panel, put IP Pool name that you will find at IP > Pool window in your NAS RouterOS.
Click Save button to save this limitation package.
Similarly, create 1Mbps and 2Mbps package limitations. Just change Rate limits parameter according to your package requirements.
Now click on Profiles tab and click on PLUS SIGN (+). Create profile window will appear. Put profile name what you want in Name input field. For my configuration, I am providing 512kbps users as name. Click on Create
First profile will be created and shown in Profiles dropdown menu.
Select your created profile from Profiles dropdown menu and then put your package validity value in Validity input box. For example, if you want 30 days validity, put 4w2d in Validity input field.
Choose package starting time At first logon from Starts dropdown menu.
Put price of this package in Price input box.
Keep Shared users value 1 so that only one user can login at a time with a username and password.
Click Save profile button to save your information.
At the bottom of this profile, you will find Unlimited profile that mean there is no limitation for this profile. So, click on Add new limitationProfile part window will appear now.
You will find your limitation packages that you have created in Limits Click on your desired package (512kbps package for 512kbps users) and click on Add button to add this limitation for this profile.
Similarly, create 1Mbps and 2Mbps user profile. In this case, just change price value and limitation package for these packages.
Creating Voucher Template
Now we are going to create scratch card template so that after creating users we can print scratch card according to this template. The following steps will show how to create scratch card or voucher template in User Manager Radius Server.
Click on Settings button from left button panel and then click on Templates
<div class="box"> <h2>System Zone - Internet Card $%u_moneyPaid%</h2> <div class="txtbox"> How to use this card? <br> Type systemzone.mk in your browser and <br> Put the <b>UsreName</b> & <b>Password</b> in required field and click <b>OK </b> button.</b> </br> </div> <p align="left"> UserName: <h3>%u_username%</h3> </p> <p align="left"> Password: <h3>%u_password%</h3></p> <h5 style="margin-top: -70px; margin-left: 230px; font: bold 30px Arial; color: #fff; text-shadow: black 0.1em 0.1em 0.6em;">%u_timeLeft%</h5> <p style="margin-top: -40px; margin-left: 250px;"> Price: $%u_moneyPaid%</p> <h4>Contact for more info. sayeedsezan@gmail.com</h4> </div>
Click Save button to save this voucher template.
You can change this card design if you have a little HTML and CSS idea. Card text can also be changed without having knowledge on HTML and CSS. In Row textarea, you just change card text according to your requirement.
Adding User in User Manager Radius Server
The following steps will show how to add random users in your User Manager Radius Server.
Click on Users button from left button panel. Now click on Add > Batch menu item from top menu bar. User details window will appear.
In Main panel, choose owner from Owner dropdown menu and provide number of users you want to create at a time. You can also provide username prefix as well as username and password length in this panel.
Choose your desired profile package for these users from Assign profile dropdown menu and then click on Add button to add these users. All the created users will be available in Users
Now click on all the users checkbox for whom you want to create scratch card.
Click on Generate menu and then choose VouchersVouchers window will appear.
Now click on Generate button and you will find your entire scratch cards in a HTML page like below image.
Now sell these cards to your nearest shop and get auto revenue monthly or your desired time period.
Hotspot Server is now ready to authenticate users via User Manager Radius Server. Now it is time to test our Hotspot server. For this, connect any IP device to your network. After connecting, a dynamic IP will be assigned to your device from DHCP server that was created while installing Hotspot server. Usually, Hotspot uses DHCP server to assign IP address and other related information that are necessary to get login page. Now open any web browser and try to visit any web page. You can see the login page of your Hotspot server. If you do not get login page for any cause, type your DNS name that was provided while installing Hotspot server. Now you can see your Hotspot login page like below image.
Hotspot Login Page
Put username and password that you find in your scratch card and then click OK button. You will now be able to visit any webpage if you provide correct username and password.
Accessing User Page
Radius Server offers a user page where user can login their profile page and can show their account status as well as can change their account information and password. The following steps will show how to access this user page in your Radius Server.
Type https://radius_server_ip_address/user to get user login page if you have only one subscriber or customer in your Radius Server. But if you have more than one customer or subscribe, you have to type https://radius_server_ip_address/user/public_id where public_id is Public ID of the customer or subscriber. This Public ID must provide when customer or subscriber is created.
Type username and password of your desired user in Login and Password input field and then hit login button.
Now user can show his account status, profile, sessions and payment option from this page. Also he can change his password from Settings
You will be able to configure a Hotspot network with bandwidth limitation and prepaid billing system if you follow the above steps properly. However, if you face any confusion to do above steps, watch my video about MikroTik Hotspot configuration with bandwidth limitation and prepaid billing system carefully. I hope, it will reduce your any confusion.
MikroTik Hotspot Configuration with Bandwidth Limitation and Prepaid billing System has been explained in this article. I hope you are now able to setup a Hotspot Server with Radius Server that will have bandwidth limitation and prepaid billing system. However, if you face any confusion, feel free to discuss in comment or contact with me from Contact page. I will try my best to stay with you.
Hotspot is one of the most popular services in MikroTik Router. It is popularly used in Hotel and Restaurant, Railway Station or Airport, School or University Campus and so on. Even ISP network and office network also use MikroTik Hotspot for authenticating network clients/users. Hotspot user can be managed with Hotspot’s local user database or with a Radius Server. Radius Server gives facility to manage Hotspot user’s bandwidth and accounting easily and centrally. So, Hotspot setup with Radius Server can be a wise decision. MikroTik User Manager Radius Server is a centralized user authentication and accounting application that gives the ISP or network administrator ability to manage PPP users, Hotspot users and login users from one server throughout a large network. It also has an awesome user bandwidth package management feature. So, network configuration with MikroTik Hotspot and MikroTik User Manager Radius Server will be a smart decision. For this, in this article I will discuss how to configure a smart network with MikroTik Hotspot and MikroTik User Manager Radius Server.
Article Purpose
The purpose of this article is to get ability to configure a Hotel and Restaurant network, Railway Station or Airport network, School or University Campus network, ISP network or Office network with MikroTik Hotspot and MikroTik User Manager Radius Server.
Network Diagram
For the configuration of this article I am going to establish a network like below network diagram.
MikroTik Hotspot Network with User Manager Radius Server
This is a simple and basic network diagram. In a real situation, your network might be larger than this network but the basic diagram will remain same. In this network, the WAN Distribution Switch is connected to internet gateway. MikroTik Router’s (NAS) WAN interface and MikroTik User Manager Radius Server is connected to this WAN Distribution Switch. Hotspot users will be connected to NAS Router through LAN Switch and will get internet access.
Core Devices and IP Information
To setup a Hotspot network according to above network diagram, I have installed and completed initial configuration of MikroTik User Manager Radius Server Package in a dedicated physical server where MikroTik RouterOS is running. I have also a physical MikroTik RouterOS (MikroTik RouterBOARD 1100AHX2) which is the NAS (Network Access Server) RouterOS in this network. IP information that I am using for this network configuration are given below.
Radius Server IP: 192.168.110.10/28
MikroTik RouterOS (NAS) WAN IP: 192.168.110.2/28
LAN IP Block: 192.168.10.0/24
Hotspot Server IP: 192.168.10.1
This IP information is just for my RND purpose. So, change this information according to your network requirements.
MikroTik Hotspot Configuration with MikroTik User Manager Radius Server
We are now going to start our Hotspot network configuration with User Manager Radius Server according to the above network diagram. The complete configuration can be divided into two parts.
Part 1: MikroTik RouterOS Configuration (NAS Router)
Part 2: MikroTik User Manager Radius Server Configuration
Part 1: MikroTik RouterOS Configuration (NAS Router)
In the first part, we will configure our MikroTik RouterOS (NAS) so that it can turn into a Hotspot Server and can communicate with Radius Server to authenticate users. Complete configuration can be divided into below topics.
Basic MikroTik RouterOS Configuration
Hotspot Configuration in MikroTik RouterOS
Radius Client Configuration in MikroTik RouterOS
Basic MikroTik RouterOS Configuration
MikroTik Router basic configuration includes WAN IP Assign, DNS IP Assign, Default Gateway Configuration and NAT Configuration. The following steps will show how to perform these topics in your MikroTik RouterOS.
Login to your MikroTik Router using Winbox with full permission user such as admin user.
Go to IP > Addresses menu item. Address List window will appear. Click on PLUS SIGN (+). New Address window will appear.
Put RouterOS WAN IP (RouterOS WAN IP: 192.168.110.2/28) in Address input field and choose WAN interface from Interface dropdown menu and then click Apply and OK button.
Now go to IP > DNS. DNS Settings window will appear. Put your DNS server IP (Public DNS IP: 8.8.8.8 or 8.8.4.4) in Servers input field and then click Apply and OK button.
Go to IP > Routes. Route List window will appear. Click on PLUS SIGN (+). New Route window will appear. Click on Gateway input box and put your internet gateway IP (in this network: 192.168.110.1) in this input field. Click on Apply and OK button.
MikroTik Router basic configuration has been completed. Now we will configure Hotspot Server in our NAS RouterOS.
Hotspot Configuration in MikroTik RouterOS
After completing MikroTik Router basic configuration, we will now setup Hotspot Server in our MikroTik RouterOS. The following steps will show how to setup Hotspot Server in your MikroTik RouterOS.
Go to IP > Hotspot menu item. Hotspot window will appear.
Click on Hotspot Setup button from this window. Hotspot Setup will appear now.
Choose your LAN interface on which you want to setup Hotspot Server from Hotspot Interface drop-down menu. Now click Next button.
Put your LAN address (in this case: 192.168.10.1/24) in Local Address of Network input box. Also check the Masquerade Network checkbox is checked and then click Next button.
Now it is time to choose address pool for your Hotspot network from where IP address will be assigned to clients. Normally, it will show your network IP range without gateway IP. You can change default IP range as your wish or can keep the default range. Click Next button now.
If you have SSL certificate, you can import by choosing import other certificate option or select none if you do not have any SSL certificate. Now click Next button.
If you have SMTP server, you can put your SMTP server address in IP Address of SMTP Server input box or you can keep blank if you do not want to use SMTP server. Click Next button.
Now it is option to setup DNS configuration. DNS servers that you have provided in basic configuration will automatically be selected here. So, nothing to do, just click Next button now.
Now it is time to put DNS name which is a mandatory field. DNS name will be used to get Hotspot login page. So, put a standard DNS name such as systemzone.mk or systemzone.hotspot etc. and click Next button.
Now put a local Hotspot user. By default it is admin. You can keep this user or change as your wish. Also put password in Password for the User input box. Click Next button.
Hotspot server setup will be completed and you will get a successful message now.
Click on Servers tab and you will find a new server has been created. Click on it and change your automated created server name if you wish and then find what the server profile is from Profile dropdown menu.
Now click on ServerProfiles tab and you will find your Hotspot Server profile here. Click on it and under General tab, change your server profile name if you wish and then Click on RADIUS tab and click on Use RADIUS checkbox and Accounting checkbox and then click Apply and OK button.
MikroTik Hotspot server configuration has been completed. In the next step, we will configure Radius client in our MikroTik RouterOS.
Radius Client Configuration in MikroTik RouterOS
The following steps will show you how to configure Radius client in MikroTik RouterOS.
Click on Radius menu item from left menu bar. Radius window will appear now.
Click on PLUS SIGN (+). New Radius Server window will appear now.
Click on hotspot checkbox from Service panel.
Put Radius Server IP address (in this article: 192.168.110.10) in Address input field.
Provide a password in Shared Secret input field. This password is important and has to provide when client router will be configured in User Manager Radius Server.
Click Apply and OK button.
Now click on Incoming button and Radius Incoming window will appear.
Click on Accept checkbox and put 1700 in Port input box and then click Apply and OK button.
Radius client configuration has been completed. Now MikroTik RouterOS is able to communicate with Radius Server to authenticate Hotspot users.
Part 2: MikroTik User Manager Radius Server Configuration
MikroTik User Manager Radius Server installation and initial configuration has been discussed in my previous article. If you don’t have enough introduction with User Manager Radius Server installation and initial configuration, first spend some time to study that article and complete your Radius Server installation and initial configuration and then continue my below section. In this section, I will do below topics in our Radius Server for Hotspot user authentication.
Add Client Router (NAS) in Radius Server Router list
User Profile Configuration in Radius Server
Add User in Radius Server
Add Client Router (NAS) in Radius Server Router list
The following steps will show you how to add client router in User Manager Radius Server.
Click on Routers button from left button panel and then click on Add > New menu item from top menu bar. Router Details window will appear now.
In Main panel, put a meaningful name for your client router in Name input field. Also choose owner from Owner dropdown menu.
Put your client router IP address (RouterOS IP: 192.168.110.2) in IP address input field.
Now put shared secret password that you have provided at Radius client configuration in MikroTik RouterOS Shared secret input field.
In Radius incoming panel, click on CoA support check box and put 1700 in CoA port input box.
Click on Add button to add this router in Radius Server Router list.
MikroTik RouterOS (NAS) has been added in User Manager Radius Server as a client router. Now User Manager will reply any query that will ask by our NAS RouterOS.
User Profile Configuration in Radius Server
The following steps will show how to isolate Hotspot users based on their bandwidth usage using Radius Server’s user profile.
Click on Profiles button from left button panel and then click on Limitations tab.
Click on Add > New menu item from top menu bar. Limitation details window will appear now.
In Main panel, put your package name what you want in Name input field. As I am creating my first 512kbps package, I am providing 512kbps Package in name field. Also choose owner from Owner dropdown menu.
In Rate limits panel, put your bandwidth limitation parameter. For a 512kbps package, I am providing below information.
Parameter name
Rx
Tx
Rate limit
512k
512k
Burst rate
1M
1M
Burst threshold
512k
512k
Burst time
60
60
Min rate
32k
32k
Also choose priority from Priority dropdown menu. For my configuration I am choosing 8 that is the lowest priority.
In Constraints panel, put IP Pool name that you will find at IP > Pool window in your NAS RouterOS.
Click Save button to save this limitation package.
Similarly, create 1Mbps or 2Mbps package limitations that you want. Just change Rate limits parameter according to your package requirements.
Now click on Profiles tab and click on PLUS SIGN (+). Create profile window will appear now. Put profile name what you want in Name input field. For my configuration, I am providing 512kbps users as name. Click on Create button.
First profile will be created and shown in Profiles dropdown menu.
At the bottom of this profile, you will find Unlimited profile that mean there is no limitation for this profile. So, click on Add new limitationProfile part window will appear now.
You will find your limitation packages that you have created in Limits panel. Click on your desired package (512kbps package for 512kbps users) and click on Add button to add this limitation for this profile.
Similarly, create more user profiles as you wish and assign limitation on your created profiles.
Radius user profile has been created successfully. In the next section, we will add user in our Radius Server.
Add User in User Manager Radius Server
The following steps will show how to add users in User Manager Radius Server.
Click on Users button from left button panel. Now click on Add > One menu item from top menu bar. User details window will appear.
In Main panel, put client’s username and password that will be used to connect to Hotspot Server. Also choose owner from Owner dropdown menu.
Choose your desired profile package for this user from Assign profile dropdown menu and then click on Add button to add this user.
You can add as many users as you want and can assign bandwidth package according to their demand following the above steps carefully.
Our Hotspot Server is ready to authenticate users via User Manager Radius Server. Now it is time to test our Hotspot server. For this, connect any IP device to your network. After connecting, a dynamic IP will be assigned to your device from DHCP server that was created while installing Hotspot server. Usually, Hotspot uses DHCP server to assign IP address and other related information that are necessary to get login page. Now open any web browser and try to visit any web page. You can see the login page of your Hotspot server. If you do not get login page for any cause, type your DNS name that was provided while installing Hotspot server. Now you can see your Hotspot login page like below image.
Hotspot Login Page
Put Radius username and password and then click OK button. You are now able to visit any webpage if you provide correct username and password.
I hope, you will be able to configure a Hotspot network with MikroTik User Manager Radius Server if you follow the above steps properly. However, if you face any confusion, watch my video tutorial about MikroTik Hotspot Configuration with User Manager Radius Server. I hope, it will reduce your any confusion.
MikroTik Hotspot Configuration with User Manager Radius Server has been explained in this article. I hope you are now able to setup a Hotspot Server with Radius Server in your network. However, if you face any confusion, feel free to discuss in comment or contact with me from Contact page. I will try my best to stay with you.
Сегодня разберём как подключить Debian к микротику посредствам OpenVPN. Ранее мы уже разбирали как поднять VPN сервер на микротике, поэтому будем разбирать как подключится к нему с Linux. Читать →
ем. Когда IEEE все же решили перейти к стандартизации PoE технологии, прошло уже много времени после ее появления, а многие корпорации уже разработали и внедрили собственные решения PoE. Как пример, Cisco еще в далеком 2000-ом году представили реализацию питания по витой паре. Но даже после стандартизации IEEE 802.3af аж в 2003 году, а IEEE 802.3at в 2009-ом производители продолжают внедрять новые разработки в PoE. В основном из-за дороговизны полноценных стандартов 802.3af и 802.3at, а ведь клиентов все чаще нужны бюджетные решения.
