SMS Wi-Fi authorization on MikroTik: hotspot and an external portal

MikroTik is the most common hardware in Kazakhstan venues, and also the one people most often get stuck on when setting up a captive portal. Here is a working configuration and the three mistakes that eat an evening.

What you need before you start

Gather these first, or the setup will stall halfway:

• Access to the router over Winbox or WebFig, with the right to change the configuration
• The RouterOS version. Hotspot exists in every current branch, but the dialogs differ between 6.x and 7.x — follow what is on your screen, not screenshots from older guides
• The authorization server address and the shared RADIUS secret, issued when the portal is connected
• The list of walled garden addresses: the portal itself and the SMS gateway
• A test phone whose mobile data you can switch off. With LTE on you cannot tell whether interception works

One warning about configuring remotely. The hotspot comes up on an interface, and picking the wrong one can cut off your own access to the router. Work through a port that is not part of the guest bridge.

What we are building

The guest joins the guest SSID, gets an address, sees a login page, enters a phone number, receives an SMS code and reaches the internet. The session is written to a log. RouterOS hotspot intercepts traffic before authorization; the external server confirms the number and keeps the log.

Step 1. Guest bridge and addressing

/interface bridge add name=bridge-guest
/ip address add address=10.50.0.1/24 interface=bridge-guest
/ip pool add name=guest-pool ranges=10.50.0.10-10.50.0.254
/ip dhcp-server add name=guest-dhcp interface=bridge-guest address-pool=guest-pool disabled=no
/ip dhcp-server network add address=10.50.0.0/24 gateway=10.50.0.1 dns-server=10.50.0.1

Add the guest SSID to this bridge and keep the working SSID out of it. Why separation matters is covered in guest network isolation.

Step 2. Hotspot

/ip hotspot setup

The wizard asks for the interface (bridge-guest), the network, the pool, a certificate and the portal DNS name. Then switch the profile to external authorization:

/ip hotspot profile set [find name=hsprof1] \
    use-radius=yes \
    login-by=http-chap,http-pap \
    html-directory=hotspot

Step 3. RADIUS

/radius add service=hotspot \
    address=<auth-server-address> \
    secret=<shared-secret> \
    timeout=3s
/radius incoming set accept=yes
/ip hotspot profile set [find name=hsprof1] radius-interim-update=5m

radius-interim-update controls how often the router reports a live session. Without it a long session only reaches the log when the guest disconnects.

Step 4. Walled garden — the usual reason the portal will not open

/ip hotspot walled-garden add dst-host=*.thelink.kz action=allow
/ip hotspot walled-garden ip add dst-address=<server-address> action=accept

Also allow the SMS gateway domains if they are part of the flow.

How to confirm it works

The check takes five minutes and settles most of the questions that follow:

1. Connect to the guest SSID from a phone with mobile data switched off
2. Open any site over http. The login page should appear. Interception does not work over https, and a working setup will look broken
3. Request a code, sign in and confirm the internet opens
4. Find the session in the connection log: it should carry the number, the sign-in time and the device MAC
5. From the same phone, try to open the address of a till or a camera. It should not open — the guest segment is isolated

The last step is the one most often skipped, and it is the only one that tests security rather than convenience.

Three mistakes that cost an evening

• DNS not allowed. Hotspot intercepts DNS itself, but if DHCP hands the guest an external resolver and port 53 is filtered, no redirect happens. Hand out the router as the DNS server
• HTTPS redirect. An https request cannot be intercepted without a certificate warning. Test with an http page, not a favourite https site
• Sessions are not recorded. Authorization works, accounting is off, and there is nothing to show on request — see log retention

What goes into the log

After sign-in, each session stores the phone number, the start and end time, the device MAC address and the access point. That is the minimum needed to answer an inspector asking who was on the network at a given time. The log exports from the dashboard; no extra commands on the router are involved.

The router itself stores nothing — the logs live on the portal side. That matters when equipment is replaced: the history does not leave with the hardware. Which fields are worth keeping, and for how long, is covered in Wi-Fi log retention.

Next

The requirement itself is described on the page about the law and inspections. If SMS gets expensive, compare it with Aitu Passport. For cafes this setup is usually the whole job; for hotels room-number binding is added.