Introduction

Setting up a MikroTik Hotspot integrated with a RADIUS server is one of the most powerful ways for ISPs to manage user authentication, session control, and bandwidth policies from a centralised platform. OneRADIUS by ARCR Technologies, Hyderabad, is purpose-built for Indian ISPs and makes this integration straightforward, reliable, and scalable.

In this guide, we walk you through the complete MikroTik Hotspot setup with OneRADIUS — from initial router configuration to RADIUS policy enforcement — so your hotspot network is fully managed and billing-ready.

---

What is MikroTik Hotspot and Why Use RADIUS?

MikroTik Hotspot is a feature built into RouterOS that allows ISPs and network administrators to provide authenticated internet access to end users via a captive portal login page. Without a RADIUS backend, user data is stored locally on the router — which is not scalable for ISPs managing hundreds or thousands of subscribers.

Why integrate MikroTik Hotspot with OneRADIUS?

  • Centralised user authentication across multiple MikroTik routers
  • Real-time session tracking and accounting
  • Automated plan enforcement — speed limits, data caps, expiry
  • Detailed usage reports and billing integration
  • Support for prepaid and postpaid subscriber models
  • Scalable for large ISP deployments across India
💡 OneRADIUS supports multiple NAS (Network Access Server) devices simultaneously, making it ideal for ISPs with distributed MikroTik infrastructure.

---

Prerequisites Before You Begin

Before starting the configuration, make sure you have the following ready:

  • A MikroTik router running **RouterOS v6.x or v7.x**
  • **OneRADIUS** installed and running on your server (Linux-based recommended)
  • A static IP address for your OneRADIUS server
  • Admin access to both MikroTik (via WinBox or WebFig) and OneRADIUS dashboard
  • Basic understanding of MikroTik Hotspot and IP addressing
⚠️ Ensure your OneRADIUS server is reachable from the MikroTik router on UDP ports 1812 (Authentication) and 1813 (Accounting). Check firewall rules before proceeding.

---

Step 1: Add MikroTik as a NAS Client in OneRADIUS

The first step is to register your MikroTik router as a NAS (Network Access Server) client inside OneRADIUS.

How to Add a NAS in OneRADIUS

  • Log in to your **OneRADIUS admin dashboard**
  • Navigate to **NAS Management** or **Client Configuration**
  • Click **Add New NAS**
  • Fill in the following details:
  • **NAS Name**: A friendly name (e.g., 'MikroTik-HQ')
  • **IP Address**: The WAN or LAN IP of your MikroTik router
  • **Shared Secret**: A strong password (e.g., 'Mikrotik@OneRADIUS123')
  • **NAS Type**: Select 'Mikrotik' from the dropdown
  • **Protocol**: RADIUS
  • Click **Save**
💡 The shared secret must match exactly what you configure on the MikroTik side. Any mismatch will cause authentication failures.

---

Step 2: Create Subscriber Plans in OneRADIUS

Before configuring MikroTik, set up your internet plans inside OneRADIUS. These plans will define the speed, data quota, and validity for each subscriber.

Creating a Plan in OneRADIUS

  • Go to **Plan Management** in the OneRADIUS dashboard
  • Click **Add New Plan**
  • Configure the plan parameters:
  • **Plan Name**: e.g., 'Basic-10Mbps-30Days'
  • **Download Speed**: 10 Mbps
  • **Upload Speed**: 5 Mbps
  • **Data Limit**: e.g., 50 GB (or Unlimited)
  • **Validity**: 30 Days
  • **Session Timeout**: Optional (e.g., 24 hours)
  • Save the plan
💡 OneRADIUS uses standard RADIUS attributes like 'WISPr-Bandwidth-Max-Down' and 'Mikrotik-Rate-Limit' to push speed policies directly to MikroTik hotspot sessions.

---

Step 3: Configure MikroTik Hotspot

Now let us configure the Hotspot feature on your MikroTik router.

3a: Set Up the Hotspot Interface

Open WinBox and connect to your MikroTik router.

  • Go to **IP > Hotspot**
  • Click **Hotspot Setup** wizard
  • Select the **interface** connected to your LAN or WiFi (e.g., 'bridge1' or 'ether2')
  • Set the **local address** for the hotspot network (e.g., '192.168.88.1/24')
  • Choose whether to use a **DHCP server** (recommended: Yes)
  • Set the DNS name for the login page (e.g., 'hotspot.myisp.in')
  • Complete the wizard

3b: Configure Hotspot Server Profile

  • In **IP > Hotspot**, go to the **Server Profiles** tab
  • Double-click your hotspot server profile
  • Under the **RADIUS** tab:
  • Check **Use RADIUS**
  • Check **Accounting** (important for session tracking)
  • Set **Accounting Interim Interval** to '60' seconds for real-time updates
  • Click **OK**
⚠️ If 'Use RADIUS' is not checked, MikroTik will use its local user database and OneRADIUS will not be contacted for authentication.

---

Step 4: Add OneRADIUS Server to MikroTik

Now tell MikroTik where to send RADIUS requests.

  • Go to **RADIUS** in WinBox (or via terminal: /radius)
  • Click **Add (+)**
  • Configure the RADIUS server:
  • **Service**: Check **hotspot**
  • **Address**: IP address of your OneRADIUS server (e.g., '103.x.x.x')
  • **Secret**: The same shared secret you configured in OneRADIUS (e.g., 'Mikrotik@OneRADIUS123')
  • **Authentication Port**: 1812
  • **Accounting Port**: 1813
  • **Timeout**: 3000ms (recommended)
  • Click **OK**

Alternatively, use the MikroTik terminal:

/radius add service=hotspot address=YOUR_RADIUS_IP secret=YOUR_SHARED_SECRET authentication-port=1812 accounting-port=1813

💡 You can add a secondary/backup OneRADIUS server for redundancy — MikroTik will failover automatically if the primary server is unreachable.

---

Step 5: Configure RADIUS Incoming for CoA and Disconnect

OneRADIUS supports Change of Authorization (CoA) and Disconnect Messages (DM) — these allow the server to disconnect a user or change their session parameters in real time (e.g., when a plan expires or is upgraded).

  • In WinBox, go to **RADIUS > Incoming**
  • Check **Accept**
  • Set **Port** to '3799' (standard CoA port)
  • Click **OK**
⚠️ Without CoA enabled, OneRADIUS cannot force-disconnect expired or suspended users in real time. Always enable this for production ISP deployments.

---

Step 6: Create Test Users in OneRADIUS

Let us create a test subscriber to verify the setup.

  • In OneRADIUS dashboard, go to **Subscriber Management**
  • Click **Add Subscriber**
  • Fill in:
  • **Username**: 'testuser1'
  • **Password**: 'Test@1234'
  • **Plan**: Select the plan you created earlier
  • **Expiry Date**: Set a future date
  • Save the subscriber

---

Step 7: Test MikroTik Hotspot Authentication via OneRADIUS

Testing from a Client Device

  • Connect a device to the MikroTik Hotspot network
  • Open a browser — the captive portal login page should appear automatically
  • Enter the test credentials: **Username**: 'testuser1', **Password**: 'Test@1234'
  • Click Login

Verifying in OneRADIUS

  • Go to **Active Sessions** in the OneRADIUS dashboard
  • You should see 'testuser1' listed with session start time, IP address, and NAS information
  • Check **Accounting Logs** to confirm interim updates are coming in every 60 seconds
💡 If authentication fails, check the OneRADIUS logs under 'RADIUS Logs' or 'Auth Logs' for detailed error messages like 'NAS not found' or 'Invalid secret'.

---

Step 8: Apply Bandwidth Policies via RADIUS Attributes

OneRADIUS automatically sends MikroTik-specific RADIUS attributes to enforce speed limits on authenticated sessions.

The key attribute used is:

Mikrotik-Rate-Limit = '10M/5M' (Download/Upload)

This is returned in the Access-Accept packet from OneRADIUS to MikroTik when a user logs in successfully. MikroTik applies this as a simple queue on the hotspot session automatically — no manual queue configuration needed on the router.

Additional Attributes Supported by OneRADIUS for MikroTik

  • **Session-Timeout**: Automatically disconnect user after X seconds
  • **Idle-Timeout**: Disconnect if user is idle for X seconds
  • **WISPr-Bandwidth-Max-Down / Up**: Alternative bandwidth attributes
  • **Framed-IP-Address**: Assign a static IP to a specific subscriber
  • **Mikrotik-Group**: Assign the user to a specific hotspot user profile
💡 Using 'Mikrotik-Group' attribute, you can pre-create hotspot user profiles on MikroTik with advanced queue trees, and OneRADIUS will assign users to the correct profile based on their subscribed plan.

---

Step 9: Monitor and Manage Sessions from OneRADIUS

OneRADIUS provides a comprehensive dashboard for ISPs to monitor all active hotspot sessions in real time.

Key Monitoring Features

  • **Active Sessions**: View all connected users, their IP, NAS, data used, and session duration
  • **Session History**: Full historical log of all user sessions for billing and dispute resolution
  • **Data Usage Reports**: Per-user and per-plan consumption analytics
  • **Online Subscriber Count**: Real-time count per NAS device
  • **Disconnect User**: Manually terminate a session from the dashboard (triggers CoA/DM to MikroTik)

---

Step 10: Automate Plan Expiry and Renewal

OneRADIUS handles plan expiry automatically. When a subscriber's plan expires:

  • The system sends a **Disconnect Message (DM)** to MikroTik via CoA
  • The user's session is terminated immediately
  • The user is redirected to the login page upon reconnection
  • If they attempt to authenticate with an expired plan, OneRADIUS returns an **Access-Reject** with reason 'Account Expired'
💡 OneRADIUS can also be integrated with ISP billing software to automate plan renewals and subscriber provisioning — eliminating manual work for your support team.

---

Troubleshooting Common Issues

Authentication Failing

  • Verify shared secret matches on both MikroTik and OneRADIUS NAS settings
  • Check UDP ports 1812/1813 are open between MikroTik and OneRADIUS server
  • Confirm the MikroTik NAS IP is correctly registered in OneRADIUS
  • Review RADIUS authentication logs in OneRADIUS dashboard

Sessions Not Appearing in OneRADIUS

  • Ensure 'Accounting' is enabled in the MikroTik Hotspot Server Profile
  • Check that port 1813 is not blocked by a firewall
  • Verify interim accounting interval is set in the server profile

CoA / Disconnect Not Working

  • Confirm RADIUS Incoming is enabled on MikroTik with port 3799
  • Check firewall rules allowing UDP 3799 from OneRADIUS server to MikroTik
  • Verify CoA feature is enabled in OneRADIUS settings

Speed Limits Not Applied

  • Check that OneRADIUS is returning the 'Mikrotik-Rate-Limit' attribute in Access-Accept
  • Use MikroTik terminal command '/ip hotspot active print' to see active sessions and assigned profiles
  • Review plan configuration in OneRADIUS to ensure speed attributes are correctly mapped
⚠️ Always test configuration changes in a staging environment before applying to a live production network serving paying subscribers.

---

Why OneRADIUS is the Best Choice for MikroTik ISPs in India

  • **Made for Indian ISPs**: Supports local billing cycles, Indian time zones, and ISP workflows
  • **MikroTik Native Support**: Full support for MikroTik RADIUS attributes out of the box
  • **Scalable Architecture**: Handles thousands of concurrent sessions without performance degradation
  • **Affordable Pricing**: Designed for small, mid-size, and large ISPs across India
  • **Local Support**: Dedicated technical support from ARCR Technologies, Hyderabad
  • **Easy Dashboard**: Non-technical staff can manage subscribers without CLI knowledge
  • **Regular Updates**: Continuously updated to support latest RouterOS versions

---

Conclusion

Integrating MikroTik Hotspot with OneRADIUS gives ISPs complete control over subscriber authentication, session management, bandwidth enforcement, and billing — all from a single centralised platform. By following this step-by-step guide, you can deploy a production-grade hotspot network that scales with your business.

Whether you are setting up a small locality hotspot or managing a large WISP network across multiple cities, OneRADIUS by ARCR Technologies is the reliable AAA backbone your MikroTik infrastructure needs.

Ready to get started? Visit [oneradius.com](https://oneradius.com) to request a demo or download your free trial today.