Recipe: guest Wi-Fi with a login page

Goal: guests get Wi-Fi through a login page, with a speed limit of their own, and no way into the office network or the till.

What you need

A router that also routes the guest network. The hotspot runs on the router, not on an access point.
A plan with at least two VLANs: office and guests.
A decision about how guests log in: one shared account, an account per room, or vouchers.
The text of your terms, if you want to show them.

Step 1: the role and the VLANs

Pick the Hotspot / guest portal role. It walks you through WAN, VLANs, hotspot, Wi-Fi, DNS and firewall.
In the VLAN table put your own network at the top, say 10, and the guests below it, say 20. The first VLAN in the table is what wired ports get by default; with guests at the top your till ends up on the guest network.
Mark the guest VLAN as isolated: guests then get internet and nothing else.

Step 2: the hotspot

In the Hotspot section, these are the fields that matter:

Hotspot interface — pick the guest VLAN.
Router address on the hotspot — 10.5.50.1/24 by default. Give the guest VLAN exactly the same address in the VLANs section. If they differ the tool warns you, because the second address is added on top. Do not leave the VLAN address empty either: without an address the VLAN interface is never created and the hotspot has nothing to run on.
Login methods — HTTP CHAP plus cookie is the ordinary choice. The cookie keeps a guest from logging in again with every coffee. Trial gives everyone a fixed amount of free time per MAC address without an account, which is often enough for a cafe.
Rate limit per user — 5M/20M by default (upload/download). This is the most important field in the whole chapter: without a limit, one guest with a large download empties the lobby.
Simultaneous logins per account — 1 for an account per room, higher for one shared account.
Max session time and idle timeout — they decide when somebody has to log in again.
Users — name, password and optionally a time limit (4h) or a data limit (2G).
Walled garden — hosts reachable without logging in. The default list lets the captive portal detection of iOS, Android and Windows through; remove it and the login page stops opening by itself. Put your own website or your payment provider here too if guests have to reach it before they log in.

Step 3: vouchers and accounts

For a handful of accounts the user list is enough. If you want hundreds of one-time codes, there has to be a system behind it that issues and prints them. This tool does not build that: it does set up the RADIUS client (server, shared secret, and the hotspot service ticked), so the accounts can come from MikroTik User Manager or your own RADIUS server. User Manager itself you configure on the device afterwards.

Step 4: guests away from the office

The guest VLAN set to isolated produces the firewall rule that blocks everything except internet.
For finer control, set Traffic between VLANs to Only what is ticked in the matrix, tick office towards guests and leave guests towards office unticked. Replies always come back.
Turn on client isolation on the guest SSID so guests cannot see each other either. On a network full of strangers that is not a luxury.
In the firewall, turn on Router manageable only from the management VLAN, so nobody in the lobby can reach WinBox.

Step 5: the total bandwidth

A limit per guest says nothing about what happens when sixty guests arrive at once. So set a total in QoS as well: Fair share per host with CAKE, using your real line speed rounded slightly down. Expect QoS to switch FastTrack off; on a small router that costs throughput.

Step 6: testing

Connect with a phone: the login page should open by itself. If it does not, look at the walled garden.
Log in and check on the router with /ip hotspot active print that the session is there.
Run a speed test and see whether you land on your limit.
From the guest phone, try to reach a device on the office network. That should fail.
Try WinBox to the router address from the guest network. That should fail too.

What to watch out for

A hotspot SSID is open. Traffic through the air is unencrypted; the login page protects your network, not your guest. Say so in your terms.
HTTPS portal. The tool can make a self-signed certificate, and that produces a warning in every browser. A real certificate is something you install yourself.
What you keep. A hotspot records sessions: who, when, which MAC address. That is personal data. Decide up front how long you keep it and say why in your terms. This tool gives no legal advice and writes no portal page or terms text; you write those and put them in the hotspot directory on the device.
Sometimes a passphrase is better. For a small cafe with no administration, an ordinary SSID with WPA2/WPA3 on an isolated guest VLAN is the better answer: the traffic is encrypted, there is nothing that can fall over, and the passphrase is on the board. A hotspot earns its keep once you want to charge per guest, cap time, or have terms accepted. See Example: a guest network and Recipe: limiting guests.