How a MikroTik hotspot works with xceed-wifi
A MikroTik router already contains a capable hotspot engine: it intercepts new devices, redirects them to a login page, and enforces bandwidth and session limits. What it lacks is everything around that: a way to verify who the user is, sell them a package, take payment, and keep audit-grade logs. That is the part xceed-wifi provides, over standard RADIUS.
The division of work is simple:
- RouterOS does the enforcement. The
/ip hotspotserver catches unauthenticated devices, applies the walled garden, and shapes traffic per session once RADIUS says yes. - xceed-wifi does identity, billing and logging. Our FreeRADIUS cluster answers every authentication request, checks the guest's OTP, voucher or MAC, assigns the right package and speed, and stores the accounting records.
- The login page is yours. The router fetches a branded
login.htmlfrom your location's splash page settings, so the portal shows your logo, colours and login methods rather than the MikroTik default.
Because the integration is plain RADIUS, nothing exotic is installed on the router and no RouterOS feature is bypassed. If xceed-wifi is ever unreachable, the hotspot simply denies new logins until it is back, exactly as it would with a local RADIUS server.
What the router gains after setup
| Capability | How it reaches the MikroTik |
|---|---|
| Mobile OTP login | Guest enters a phone number on the portal, receives a 6-digit code by SMS or WhatsApp, and RADIUS accepts the session once verified. Rate limits: 5 OTP generations per number, 6 verify attempts per OTP. |
| Voucher codes | Front desk prints codes from a VoucherSeries. The code is validated by RADIUS, bound to the device MAC on first use, and expires with its package. |
| MAC auto-login | login-by=mac in the hotspot profile lets returning devices skip the portal; RADIUS matches the MAC to the subscriber's active package. |
| Prepaid, postpaid and free packages | Speed limits and validity are sent as RADIUS reply attributes, so each session gets the bandwidth its package allows. |
| Online payment | Guests pay on the portal through Razorpay or AblePay (INR) or M-Pesa (KES); the package activates the moment the gateway confirms. |
| Session logs for compliance | RADIUS accounting with 3-minute interim updates records identity, start/stop time, IP and data used, retained for 12 months and exportable for audits. |
| Remote disconnect | /radius incoming on port 3799 lets the platform end a session when a package expires or a guest is blocked. |
Step-by-step: connecting a MikroTik router
The whole process is done from the xceed-wifi dashboard and the RouterOS terminal (Winbox, WebFig or SSH). You do not need to write RADIUS configuration by hand: the dashboard generates a script with your location's values already filled in.
- Create your operator account and a location. Sign up, add the venue as a location, and set up its splash page (logo, colours, login methods). The location ID is what ties the router to this portal.
- Prepare the router. Give it a working internet connection on the WAN side, set DNS, and update RouterOS to a current v6 or v7 release. Reserve the LAN or bridge interface you want guests on.
- Let the router announce itself. Point the router's RADIUS client at the xceed-wifi server (the address and shared secret are shown on the Routers page). The first authentication attempt appears under Unknown Dynamic Clients in your dashboard with its NAS identifier and MAC address.
- Approve it. Click Add to Dynamic Clients, give it a name, choose the location and set NAS type to MikroTik. You can also register the router manually first; either way the NAS identifier is fixed from this point on.
- Paste the generated script. Open the router's detail page, copy the RouterOS script, and paste it into the terminal. It sets the identity, creates the hotspot bridge, profile, pool and DHCP server, registers the RADIUS server, opens the walled garden and downloads your login page.
- Verify. The router should show Enabled with a recent last-contact time. Connect a phone to the guest SSID, complete an OTP login, then check the Access Requests log and the session in RADIUS accounting.
The RouterOS configuration script
This is the script the dashboard generates, with the per-router values shown as placeholders. Run it as a whole, or section by section if you want to see each result.
/system identity
set name=[NAS_IDENTIFIER]
/interface bridge
add name=hotspot-bridge
/ip hotspot profile
add dns-name=mywifi.com hotspot-address=10.5.50.1 login-by=mac,http-pap \
mac-auth-mode=mac-as-username-and-password name=xnwifi \
radius-interim-update=3m use-radius=yes
/ip pool
add name=hotspot-pool ranges=10.5.50.2-10.5.50.254
/ip dhcp-server
add address-pool=hotspot-pool disabled=no interface=hotspot-bridge \
lease-time=1h name=hotspot-dhcp
/ip hotspot
add address-pool=hotspot-pool disabled=no interface=hotspot-bridge \
name=server1 profile=xnwifi
/radius
add address=[RADIUS_SERVER_IP] secret=[RADIUS_SECRET] service=hotspot timeout=3s
/radius incoming
set accept=yes port=3799
/ip hotspot walled-garden
add dst-host=[PORTAL_SERVER_IP]
:delay 5
/tool fetch url="[API_URL]/get-login-file/[LOCATION_ID]" \
dst-path=hotspot/login.html duration=1mAdd your guest interfaces to the bridge. The script creates hotspot-bridge but does not know which physical or wireless interfaces carry guest traffic. Add them with /interface bridge port add bridge=hotspot-bridge interface=wlan1 (or whichever interface you use) so the hotspot sees them.
What each parameter does
| Parameter | Value | Purpose |
|---|---|---|
/system identity | NAS identifier from the dashboard | How RADIUS recognises this specific router. Must be unique per router. |
login-by | mac,http-pap | Try MAC auto-login first, fall back to the portal form. |
mac-auth-mode | mac-as-username-and-password | Sends the device MAC as credentials for seamless re-login. |
radius-interim-update | 3m | Accounting update interval; drives live usage and the compliance logs. |
/radius address | xceed-wifi RADIUS IP | Where authentication and accounting packets go (UDP 1812 and 1813). |
secret | Shared secret from the dashboard | Authenticates the router to the RADIUS server. Must match exactly. |
/radius incoming | port 3799 | Accepts disconnect and change-of-authorisation requests from the platform. |
walled-garden | Portal server IP | Lets unauthenticated guests reach the login page, OTP API and payment pages. |
/tool fetch | Login-file URL for your location | Downloads your branded login.html into the hotspot folder. |
Payment gateways need extra walled-garden entries. If guests buy packages online, also allow the gateway's checkout domains (for example Razorpay's api.razorpay.com and checkout.razorpay.com) so the payment page loads before the session is authorised.
Which MikroTik models work
Any MikroTik running RouterOS with the hotspot package works: the hAP range for cafes and small hotels, RB and RB4011/5009 class routers for larger venues, and CCR or CHR for campuses and ISPs that terminate many access points on one gateway. Access points from other vendors can sit behind the MikroTik in bridge mode, so a UniFi or TP-Link EAP estate can still be billed through a single MikroTik hotspot gateway.
The number of simultaneous hotspot users is set by the RouterOS licence level, not by xceed-wifi, so check the licence on the router you plan to use against the concurrency you expect.
Troubleshooting
The router never appears under Unknown Dynamic Clients
It has not reached the RADIUS server yet. Confirm internet connectivity, that the RADIUS address and secret are set, that UDP ports 1812 and 1813 are not blocked upstream, and that a device has actually attempted to log in (the first request is what creates the record).
It still shows as Unknown after approval
The router's identity does not match the NAS identifier in the dashboard. Run /system identity print, compare, and fix it with /system identity set name=[NAS_IDENTIFIER]. Allow a minute and test a login.
Guests cannot authenticate
Check, in order: the router is Enabled, its last-contact time is recent, the Access Requests log shows the reject reason, the guest's package is active, the shared secret matches on both sides, and the router can reach the RADIUS IP. RADIUS timeout messages in the router log usually mean the secret or a firewall.
The script errors out
Run it one section at a time to find the failing line. Most failures are a leftover placeholder, an interface name that does not exist on this model, or a hotspot bridge that already exists from an earlier attempt.
Two routers show as one
The same script was pasted on both, so they share a NAS identifier. Every router needs its own entry and identity; approve each one separately and set its identity from its own detail page.
Frequently asked questions
- Does xceed-wifi replace MikroTik User Manager?
- Yes. User Manager is a local RADIUS and billing database on the router. xceed-wifi moves that to the cloud, adds OTP identity, online payments, multi-location dashboards and compliance logs, and works the same way across every router you own.
- Do I need to buy new hardware?
- No. If you already run a MikroTik hotspot, keep it. The script reconfigures the hotspot profile to use RADIUS; your SSIDs, VLANs and WAN setup are untouched. Other brands of access point can stay in place behind the MikroTik.
- Can one router serve several portals?
- Each router belongs to one location and therefore one splash page. For a mall food court and a cinema with different branding, use one router (or hotspot server) per location, all managed under the same operator account.
- Where is the RADIUS server hosted, and what if it goes down?
- xceed-wifi runs the RADIUS service for you; you never operate FreeRADIUS yourself. If the router cannot reach it, new logins are refused until connectivity returns. Sessions already authorised keep running until their timeout.
- How long does onboarding take?
- Most venues go live within 24 hours of sharing their router and venue details, and a single router can be configured in well under two hours. Our team can also configure the router remotely during the free trial.
For the full administrator reference, including manual configuration for Cisco, Ubiquiti, TP-Link and Aruba, see the WiFi Routers & Network Access Servers guide in the product documentation.