A hotspot puts a login page between the visitor and the internet. Someone joining the network does get an address, but not yet a connection: their browser is sent to a portal where they fill in a username and a password. Only then does traffic pass.
That is not always what you need. If you only want visitors to have internet without reaching your own equipment, a guest SSID with a password is simpler and more reliable. See Example: a guest network. A hotspot starts to make sense when you want to hand out and take back access per person: a hotel guest with three days, a visitor with two hours, an account that stops after 2 GB.
Where it sits
The wizard has a role called Hotspot / guest portal. It sets up two VLANs for you: VLAN 10 for your own network and VLAN 20 for the hotspot, with the hotspot on 10.5.50.1/24 and isolation between the VLANs switched on. It then asks four things: the interface, the address, the rate limit and the accounts.
In advanced mode the part is called Hotspot, PPPoE server, RADIUS. Those three sit together because they can share the same account administration. The part is off by default.
The interface
This is the choice that matters most. The hotspot runs on one interface, and everything behind it has to log in. Pick a guest VLAN of its own. Pick your bridge or your LAN and your own laptop, your printer and your NAS get a login screen too, which you find out after you have pasted the script.
The address you enter belongs to that interface. If that VLAN already has a different address in the VLAN part, the configurator warns you: a second address would be added on top, which is almost never what you meant. Make them equal.
The rest follows from the address and the prefix: a pool with the addresses above the router's own, a DHCP server with a one hour lease, and a DHCP network in which the router is both gateway and DNS. That DNS is not a detail: the hotspot intercepts DNS in order to send the browser to the portal.
The user profile
All accounts share one profile, hs-default. It holds the limits that apply to everyone:
- Rate limit per user,
5M/20Mby default: upload before the slash, download after it. This is per logged-in user, not for the hotspot as a whole. - Simultaneous logins per account, 1 by default. At 1 an account works on one device at a time. For a shared account, a meeting room for instance, raise it.
- Max session time, a day by default, and the idle timeout, ten minutes. The idle timeout logs out someone who has left, so their slot comes free.
Accounts
The Users table holds the accounts. One is filled in for you, guest with the password guest, which should not end up on a device as it stands. The button next to the password field generates one.
The third column is a limit for that account, and the generator reads it strictly. A time is a number and a letter, for example 4h, 30m or 7d: that becomes limit-uptime. An amount of data is a number plus K, M or G, for example 2G: that becomes limit-bytes-total. Something like "2 GB" or "four hours" is not recognised, and that account simply ends up without a limit.
Login methods and the walled garden
HTTP CHAP and cookie are on by default: log in with a name and a password, then a cookie so the same browser does not have to do it again every hour. You can also pick MAC (a device is let through without logging in), MAC cookie and Trial. Trial gives every device free time without an account, half an hour by default.
The walled garden is the list of hosts that are reachable without logging in. What is in there by default is not decoration: phones and laptops check with Apple, Google and Microsoft whether they really have internet, and only when that answer comes back do they pop up the login screen by themselves. Remove those lines and the hotspot still works, but everyone has to type in a website to find the portal.
HTTPS and the certificate question
Pick HTTPS as a login method and a switch for a self-signed certificate appears. With it on, the script creates its own CA, signs a certificate for the portal name with it, and attaches that to the hotspot profile.
Be honest about what that buys you. Self-signed means every visitor gets a browser warning, and on a guest network that is exactly the wrong signal. A publicly trusted certificate for a portal name that only exists inside your network is not possible. The Let's Encrypt field under Services and tools does not solve it: that certificate goes to WebFig, not to the portal. In practice most people use HTTP CHAP and keep HTTPS for a setup with a real hostname and their own CA on the devices.
RADIUS
With RADIUS client the router does not take accounts from its own list but from a central server. You fill in the address and the shared secret, and tick what it applies to: hotspot, ppp, login for administrators, wireless or dhcp. With hotspot ticked the generator puts use-radius=yes in the hotspot profile. Incoming CoA lets the server change or cut a session while it is running, on port 3799.
The configurator writes the client only. The server itself, whether that is MikroTik's User Manager on this device or a FreeRADIUS elsewhere, is yours to install and fill.
What ends up in the script
/ip address,/ip poolnamedhs-pooland/ip dhcp-servernamedhs-dhcp, unless the interface already carries that address./ip hotspot profilehsprof1with the portal name, the login methods and, if chosen, the certificate./ip hotspot user profilehs-defaultwith the limits, and/ip hotspot userper account./ip hotspothotspot1on the interface you picked./ip hotspot walled-garden, one line per host.
There are no firewall rules for the portal itself, and that is correct: RouterOS adds its own as soon as the hotspot runs.
The limits
This is not a captive portal product. The configurator switches on the RouterOS hotspot with MikroTik's standard login pages. There is no field for a logo, no house style, no terms page and no button that generates or prints a batch of vouchers: accounts go in one at a time. If you want a portal of your own, you edit the files in the hotspot directory on the device itself, or you put a vendor in front of it.
There is also one hotspot per device. Two portals for two audiences is not something the tool can build.
Hotspot is one of the features RouterOS can hold behind device-mode. With hotspot set to no the device accepts the lines and does nothing with them. The checks above the script point this out; verify with /system/device-mode/print.
When it does not work
- The login screen does not appear by itself. Nearly always the walled garden or DNS. Check that the detection hosts are listed and that the client got the router as its DNS.
- No address. Use
/ip dhcp-server printto see whetherhs-dhcpis on the same interface as the hotspot. - Who is logged in?
/ip hotspot active printshows the running sessions,/ip hotspot host printthe devices that have not logged in yet. - Guests cannot reach the printer. That is the VLAN isolation doing its job. If you want an exception, make it in Firewall, deliberately.
Further reading: Example: a guest network, VLANs and PPPoE server and RADIUS.