Manual

Recipe: Wi-Fi for a campsite or holiday park

Many access points, a login page, and a fair share of a line that is never big enough.

Goal: every pitch or cabin has usable Wi-Fi, guests log in themselves, nobody can drain the line on their own, and guests cannot see each other.

What you need

  • A router that routes the whole park. The hotspot runs on the router, not on an access point. Count on an RB5009 or heavier; a small router runs out of room the moment you start shaping.
  • A switch per building or per field, and an access point per area you want to cover. Outside it is mostly distance and height; inside it is the walls.
  • A decision about logging in: one shared account, an account per pitch, or vouchers.
  • Your real line speed, measured, not the one from the brochure.

Step 1: the site and the networks

Pick Multiple devices and add the router, the switches and every access point. In Shared settings keep it simple:

  • VLAN 10 for reception, the till and the cameras. Mark it as management, or add a separate management VLAN next to it.
  • VLAN 50 for guests. That is the VLAN the hotspot runs on.

The guest network has to be big enough. A /24 is 254 addresses; a park with two hundred pitches easily sees eight hundred devices over a weekend. Take 10.50.0.1/21 or wider, and set the DHCP lease time to something short, 2h for example, so addresses of guests who left come back.

Step 2: the hotspot

In the Hotspot section:

  1. Hotspot interface: the guest VLAN.
  2. Router address on the hotspot: exactly the address you gave that VLAN in the VLAN table. If they differ the tool warns you, because the second address is added on top. Do not leave the VLAN address empty either: without an address the VLAN interface is never created and the hotspot has nothing to run on.
  3. Rate limit per user: the most important field in this chapter. 5M/20M is a reasonable start. Without a limit, one guest with a large download empties the whole park.
  4. Simultaneous logins per account: 1 for an account per pitch, higher for a shared account. A family has four devices, so 4 or 5 is realistic when the account belongs to a cabin.
  5. Max session time and idle timeout: they decide when somebody has to log in again. For a weekly rental a session of one day is irritating; set it to the length of the stay, or let the cookie do the work.
  6. Walled garden: leave the default list. It lets the captive portal detection of iOS, Android and Windows through; remove it and the login page stops opening by itself. Add your own website and your payment provider if guests have to reach those before they log in.

Step 3: vouchers

For a handful of accounts the user list is enough: name, password and optionally a time limit (4h) or a data limit (2G). Hundreds of one-time codes are not something the configurator generates. What it does do is set up the RADIUS client: server, shared secret and the hotspot service ticked, so the accounts can come from MikroTik User Manager or your own RADIUS server. User Manager itself you configure on the device afterwards.

Step 4: sharing the bandwidth fairly

A limit per guest says nothing about what happens when a hundred guests are on at once. So set a total in QoS as well:

  1. Method: Fair share per host + anti-bufferbloat.
  2. Algorithm: CAKE if you run RouterOS 7.1 or newer, otherwise fq_codel.
  3. Download and upload: your measured line speed, around 90 to 95 percent of it. Enter more than the line can carry and the queue sits in the modem, where the router can do nothing useful with it.

As soon as QoS is on, the firewall switches FastTrack off, because fasttracked traffic bypasses the queues. That costs throughput and CPU, and on a small router that is the ceiling you run into. The tool warns you about it.

To give reception priority over the guest network, use Limits per host/network in the same section: one row with the guest network as the target and a low priority, and the office network at priority 1.

Step 5: keeping guests apart

  • Turn on client isolation on the guest SSID. On a network full of strangers that is not a luxury: without it the neighbour sees your laptop and your shared folders.
  • Mark the guest VLAN as isolated, so guests get internet and nothing else.
  • Turn on Router manageable only from the management VLAN, so nobody reaches WinBox from a pitch.

Step 6: the access points

  1. One SSID on every access point, with identical settings. Manage them centrally with the role Router + CAPsMAN on the router and the role CAP on the access points; a changed SSID or passphrase then only has to be changed in one place.
  2. Channel width 2.4 GHz at 20 MHz. There are only three channels that do not overlap (1, 6 and 11); at 40 MHz you have even fewer.
  3. Channel width 5 GHz at 20/40 MHz when the access points can hear each other, and TX power lower rather than higher. An access point that shouts further than a phone can answer makes the coverage look better on paper and worse in practice.

Use the Wi-Fi floor plan to work out where they should hang before you hang them. It is an estimate based on walls and distance, not a measurement; see The Wi-Fi plan.

Testing

  1. Connect with a phone: the login page should open by itself. If it does not, look at the walled garden.
  2. Log in and check on the router with /ip hotspot active print that the session is there.
  3. Run a speed test. You should land on your limit, not above it.
  4. Log in with a second phone on the same account and see whether the number of simultaneous logins holds.
  5. From the guest Wi-Fi, try to reach a device on the office network. That should fail.
  6. Walk the park and note where the signal drops below -70 dBm. That is where the complaints come from.

What breaks at eight in the evening

This is the hour when everybody starts streaming, and the hour the park gets judged on. What goes wrong then, in order of how often it happens:

  • Airtime, not megabits. An access point talks to one device at a time. Thirty phones on one access point wait their turn, and one old device on 2.4 GHz holds up the rest because it talks slowly. More access points, closer to the guests, is the only real answer. A faster internet line changes nothing here.
  • The 2.4 GHz band fills up. Outdoors it carries further, so every access point hears every other one. Leave it on for reach, but do not expect speed from it.
  • The DHCP pool runs out. Every device that walks past takes an address; a short lease time and a roomy network absorb that.
  • The router's CPU. With FastTrack off for the queues, the hotspot on top and hundreds of connections at once, the router becomes the bottleneck before the line does. Look at /system resource print while it is busy, not while it is quiet.
  • The trunk to the furthest field. One cable carrying every access point is exactly as fast as that cable. Use the checks across the site to confirm that every device carries the VLANs it needs.

What else to watch out for

  • A hotspot SSID is open. Traffic through the air is unencrypted; the login page protects your network, not your guest. Say so in your terms.
  • Session records are personal data. A hotspot logs who, when and which MAC address. Decide up front how long you keep that. The tool gives no legal advice and writes no portal page or terms text; you write those and put them in the hotspot directory on the device.
  • There is no per-SSID rate limit in the tool. The limit per user lives in the hotspot profile and the total lives in QoS. If you want two guest networks at different speeds, that is two VLANs with their own row under Limits per host/network.

Further reading: Guest Wi-Fi with a login page, Channels and width and CAPsMAN.

Want to try it right away? Open the configurator