MikroTik Configuration Guide

Connect MikroTik to Antamedia WiFi Hotspot

This guide explains how to configure a MikroTik router to provide guest WiFi access using Antamedia WiFi Hotspot for captive portal authentication, Internet access management, and user accounting.

The instructions use MikroTik RouterOS 7 and WinBox.
The names and layout of certain controls may vary slightly between RouterOS and WinBox versions.

The router must already have a working Internet connection before you begin configuring the HotSpot.

1. Before You Start

Make sure you have:

- A MikroTik router running a supported RouterOS version with a HotSpot-capable license.
- WinBox installed on your computer.
- Administrator access to the MikroTik router.
- A working WAN connection.
- A dedicated guest LAN interface, bridge, or VLAN.
- An active Antamedia WiFi Hotspot account.
- The correct RADIUS server address and shared secret for your Antamedia deployment.
- An SSL certificate for the HotSpot login domain.

Important: Back up your router configuration before making changes. If the router is already in service, use WinBox Safe Mode where appropriate and avoid changing existing WAN, routing, DHCP, NAT, or firewall settings unless required.

This guide uses the following example network:

WAN interface

Guest network

Guest gateway

Guest subnet

Guest DHCP range

HotSpot login domain

ether1

bridge-guest

192.168.88.1

192.168.88.0/24

192.168.88.10 - 192.168.88.254

These are examples, not universal settings. Use the addresses and interface names from your network.

2. Connect to the MikroTik Router

Start WinBox.
Open the Neighbors tab.
Select your MikroTik router.
Enter the administrator username and password.
Click Connect.

If the router is not listed, enter its management IP address manually.

<escape>📷 SCREENSHOT 01 – WinBox connection</escape>

WinBox path: WinBox Connect Neighbors

Capture: The WinBox login window displaying the discovered router, connection address, username, and Connect button. Do not show passwords.

Once connected, check the RouterOS version and confirm you can access the router.

3. Verify the WAN and Guest LAN Interfaces

Before creating the HotSpot, identify the interface connected to the Internet and the interface or bridge used by guest devices.

Open Interfaces.
Identify the WAN interface.
Identify the guest-facing LAN interface or bridge.
Confirm that the interfaces are enabled and have an active link where applicable.

If access points are connected through a bridge or VLAN, use the correct logical interface that carries guest traffic.

<escape>📷 SCREENSHOT 02 – Interface list</escape>

WinBox path: Interfaces Interface

Capture: The complete interface list showing WAN and guest LAN interfaces, their names, types, and running status.

If you are using a bridge, check which physical ports belong to it.

<escape>📷 SCREENSHOT 03 – Guest bridge ports</escape>

WinBox path: Bridge Ports

Capture: The guest bridge and its member ports. The screenshot must match the same topology used throughout this guide.

4. Verify the Guest Network IP Address

The guest network requires a gateway IP address on the MikroTik router.

Open IP Addresses.

Check that the guest LAN interface has an appropriate IP address.

For this example, the gateway is 192.168.88.1/24 on bridge-guest.

If the correct address already exists, do not create another one.

<escape>📷 SCREENSHOT 04 – Guest LAN IP address</escape>

WinBox path: IP Addresses

Capture: The IP Address list showing 192.168.88.1/24 assigned to bridge-guest, alongside any existing WAN addresses.

Important: Use a different subnet if 192.168.88.0/24 conflicts with the WAN network or another internal network.

5. Configure Guest DHCP

Guest devices normally obtain their IP address automatically through DHCP.

If the guest network already has a working DHCP server, verify the settings instead of creating a duplicate.

Open IP DHCP Server.

Select the DHCP tab.

Check the DHCP server assigned to the guest LAN.

Confirm that its interface is bridge-guest in this example.

Make sure that the server is enabled.

<escape>📷 SCREENSHOT 05 – Guest DHCP server</escape>

WinBox path: IP DHCP Server DHCP

Capture: The active DHCP server and its assigned guest interface.

Next, open the Networks tab and confirm that the guest subnet has the correct gateway and DNS configuration.

Example:

Address: 192.168.88.0/24

Gateway: 192.168.88.1

DNS Servers: 192.168.88.1

<escape>📷 SCREENSHOT 06 – DHCP network settings</escape>

WinBox path: IP DHCP Server Networks double-click the guest subnet

Capture: The DHCP Network window showing Address, Gateway, and DNS Servers.

6. Verify DNS and Internet Access

MikroTik must be able to resolve public domain names, and guest devices must have a working DNS configuration.

Open IP DNS.
Verify that valid upstream DNS servers are configured.
If guest devices use the MikroTik gateway as their DNS server, enable Allow Remote Requests.
Save the settings.

<escape>📷 SCREENSHOT 07 – DNS settings</escape>

WinBox path: IP DNS Settings

Capture: The DNS settings window showing upstream servers and Allow Remote Requests.

Security: When DNS requests are enabled on the router, firewall rules must prevent unauthorized DNS access from the WAN.

If your router is responsible for guest Internet NAT, verify that an appropriate masquerade rule already exists.

<escape>📷 SCREENSHOT 08 – NAT masquerade</escape>

WinBox path: IP Firewall NAT double-click the existing masquerade rule

Capture: The NAT rule with Chain = srcnat, its WAN matching condition, and Action = masquerade on the Action tab. Capture both tabs separately if necessary.

Do not create a second masquerade rule when an existing one already covers the guest network.

7. Configure Antamedia RADIUS

Antamedia WiFi Hotspot uses RADIUS for authentication and accounting.

Open RADIUS in the WinBox main menu.

Click + to add a server.

Set Service to hotspot.

Enter the RADIUS server address associated with your Antamedia account.

Enter the shared secret provided for your deployment.

Set the authentication and accounting ports.

Save the configuration.

RADIUS server settings

Parameter

Portal
Address
Service
Protocol
Authentication Port Accounting Port
Timeout
Secret

Americas

app.antamedia.com 13.92.228.228
hotspot
UDP
1812
1813
9000 ms
Deployment-specific

Europe / Global

app.antamedia.net 109.245.64.94
hotspot
UDP
1812
1813
9000 ms
Deployment-specific

Important: Confirm the current RADIUS server address and shared secret for your account. Do not select a server based only on the geographical location of the router.

<escape>📷 SCREENSHOT 09 – RADIUS server configuration</escape>

WinBox path: RADIUS + General

Capture: The RADIUS configuration showing Service = hotspot, the appropriate Antamedia server address, UDP ports 1812 and 1813, and Timeout. Keep the Secret concealed.

You can verify RADIUS communication later using the RADIUS monitor after a test login.

8. Create the MikroTik HotSpot

The HotSpot must run on the guest-facing interface or bridge, not on the WAN interface.

Open IP HotSpot.

Select the Servers tab.

Click HotSpot Setup.

Select bridge-guest as the HotSpot interface in this example.

Confirm the guest network address.

Follow the setup wizard.

For this example:

Wizard settings

HotSpot Interface

Local Address of Network

Masquerade Network

Address Pool

SSL Certificate

SMTP Server

DNS Servers

DNS Name

Local HotSpot User

Example

bridge-guest

192.168.88.1/24

Yes, only if NAT is required

Use the existing guest pool

Select later if not yet imported

Default

Your configured DNS servers

Temporary administrator test user

Note: The HotSpot wizard may offer to create network services automatically. Review each selection carefully to avoid duplicate DHCP, NAT, address, or pool settings.

<escape>📷 SCREENSHOT 10 – HotSpot Setup wizard</escape>

WinBox path: IP HotSpot Servers HotSpot Setup

Capture: The HotSpot Setup window with bridge-guest selected as HotSpot Interface.

After completing the wizard, the HotSpot server should appear in the Servers list.

<escape>📷 SCREENSHOT 11 – HotSpot server</escape>

WinBox path: IP HotSpot Servers

Capture: The HotSpot Servers list showing the server name, guest interface, and selected server profile.

Identify the router in Antamedia

Use the WAN MAC address belonging to the MikroTik interface that identifies this device in your Antamedia deployment. Verify that the configured identifier matches the device registered in WiFi Hotspot.

To find the address, open Interfaces, double-click the WAN interface, and read its MAC Address.

<escape>📷 SCREENSHOT 12 – WAN MAC address</escape>

WinBox path: Interfaces Interface double-click the WAN interface General

Capture: The WAN interface properties showing its actual MAC Address.

Then edit the HotSpot server name if this identifier is required for the Antamedia configuration.

<escape>📷 SCREENSHOT 13 – HotSpot server name</escape>

WinBox path: IP HotSpot Servers double-click the HotSpot server General

Capture: The HotSpot Server window showing Name in MAC format, guest Interface, and the selected Profile.

9. Configure the HotSpot Server Profile

Open IP HotSpot.
Select Server Profiles.
Double-click the profile created for your guest HotSpot.
Review the General tab.

Confirm:

HotSpot Address matches the guest gateway.
DNS Name matches the SSL certificate hostname.
SSL Certificate is the certificate imported for HTTPS login.

<escape>📷 SCREENSHOT 14 – HotSpot Server Profile, General</escape>

WinBox path: IP HotSpot Server Profiles double-click the guest profile General

Capture: The General tab showing HotSpot Address, DNS Name login.wifihotspot.io, and the SSL Certificate selection.

Configure login methods

Open the Login tab.

For the standard Antamedia external Splash Page integration, configure the login methods appropriate to the installed Antamedia login page and your authentication scenario.

Enable HTTPS for secure login and configure HTTP PAP if required by the external portal workflow.

Do not use HTTP PAP over an unencrypted public login flow.
The HotSpot HTTPS configuration must be valid before putting the system into production.

Cookie and MAC Cookie options may be enabled when required by the intended returning-device behavior.

MAC login is a separate option for device-based authentication and should not be enabled indiscriminately.

<escape>📷 SCREENSHOT 15 – HotSpot Server Profile, Login</escape>

WinBox path: IP HotSpot Server Profiles double-click the guest profile Login

Capture: The Login tab showing the exact login methods enabled for the tested Antamedia configuration and the HTTPS Redirect setting if available in that RouterOS version.

Enable RADIUS authentication and accounting

Open the RADIUS tab of the same profile.
Enable Use RADIUS.
Enable Accounting.
Set MAC Format to XX-XX-XX-XX-XX-XX
Apply the changes.

<escape>📷 SCREENSHOT 16 – HotSpot Server Profile, RADIUS</escape>

WinBox path: IP HotSpot Server Profiles double-click the guest profile RADIUS

Capture: The RADIUS tab showing Use RADIUS, Accounting, MAC Format, and any configured accounting update settings.

10. Install the HTTPS Certificate

HTTPS login requires a valid certificate matching the login domain, including its private key and any required intermediate certificates.

For an Antamedia-hosted login domain, use the certificate materials and installation instructions supplied for your deployment.

Never publish a private key in documentation or screenshots.

Upload the certificate

Open Files in WinBox.
Upload the certificate files to the router.
Confirm that the files appear in the file list.

<escape>📷 SCREENSHOT 17 – Uploaded SSL certificate files</escape>

WinBox path: Files

Capture: The WinBox Files window showing the uploaded certificate filenames. The contents of private key files must not be visible.

Import the certificate

Open System Certificates.
Click Import.
Select the appropriate certificate or key file.
Enter the import passphrase if required.
Import any necessary intermediate certificates.
Verify that the server certificate has an associated private key.

<escape>📷 SCREENSHOT 18 – Certificate import</escape>

WinBox path: System Certificates Import

Capture: The certificate import window showing the selected certificate filename, without exposing a passphrase.

<escape>📷 SCREENSHOT 19 – Installed certificates</escape>

WinBox path: System Certificates

Capture: The installed certificate list showing the certificate for login.wifihotspot.io, its validity, and its private-key status.

Assign the certificate to the HotSpot

Open IP HotSpot Server Profiles.
Edit the guest profile.
Under General, select the installed SSL certificate.
Set DNS Name to login.wifihotspot.io
Under Login, enable HTTPS.
Apply the changes.

Important: The HotSpot HTTPS certificate is selected in the HotSpot Server Profile. Enabling the separate www-ssl management service is not a prerequisite for HotSpot HTTPS login.

11. Configure the HotSpot Login DNS Record

Guest devices must resolve the HotSpot login domain to the MikroTik guest gateway before authentication.

For this example:

Name: login.wifihotspot.io

Type: A

Address: 192.168.88.1

If the HotSpot setup has already created the correct DNS entry dynamically, do not add an unnecessary duplicate static record.

Open IP DNS Static.

Look for login.wifihotspot.io.

Verify that it resolves to the gateway address.

Add or correct a static record only when necessary...

<escape>📷 SCREENSHOT 20 – HotSpot DNS record</escape>

WinBox path: IP DNS Static double-click login.wifihotspot.io

Capture: The DNS record showing Name, Type, TTL, and Address. The screenshot should also make clear whether the entry is static or dynamically created.

12. Configure the Walled Garden

The Walled Garden allows guest devices to access specific services before completing authentication.

Antamedia WiFi Hotspot requires access to the relevant portal domains and supporting resources.

Open IP HotSpot.
Select Walled Garden.
Add the required domains individually.
Set Action to allow.
Save the rules.

Common Antamedia domains referenced in the existing documentation include:

The exact list may differ depending on your regional portal, Splash Page content, payment providers, and authentication methods.

Do not add unrelated or excessively broad wildcard domains without a specific requirement.

Note: Walled Garden hostname rules and Walled Garden IP rules serve different purposes. A bare IP address should not be treated as a DNS hostname rule. When access to an IP address must be allowed, use the appropriate Walled Garden IP configuration.

<escape>📷 SCREENSHOT 21 – Walled Garden domains</escape>

WinBox path: IP HotSpot Walled Garden

Capture: The domain whitelist showing required Antamedia destination hosts with Action = allow, without outdated or unrelated entries.

<escape>📷 SCREENSHOT 22 – Walled Garden IP settings (when required)</escape>

WinBox path: IP HotSpot Walled Garden IP

Capture: An actual IP-based pre-authentication rule, only if that rule is necessary in the tested deployment. Do not add one merely to produce a screenshot.

If you use an external payment gateway or social login, consult the corresponding integration guide for additional domains and test the entire authentication process.

13. Install the Antamedia Login Page

The MikroTik router must use the Antamedia-compatible login.html file to redirect guests to the external Splash Page.

Download the appropriate login.html file:
Americas Server app.antamedia.com - Download Here
Europpe/Global Server app.antamedia.net - Download Here

Open Files in WinBox.

Locate the active HotSpot HTML directory, commonly named hotspot.

Back up the existing login.html.

Upload the Antamedia version to the same active directory, replacing the existing file.

Confirm that the file was uploaded successfully.

The active HTML directory can be checked in the HotSpot Server Profile.

<escape>📷 SCREENSHOT 23 – HotSpot HTML directory</escape>

WinBox path: IP HotSpot Server Profiles double-click the guest profile General

Capture: The Server Profile showing the HTML Directory field.

<escape>📷 SCREENSHOT 24 – Antamedia login.html file</escape>

WinBox path: Files open the active HotSpot HTML directory

Capture: The router file manager showing the login.html file in its correct directory after upload.

Optional: Post-login page

Antamedia also provides an optional alogin.html file for adjusting the post-login experience on some mobile captive portal assistants.

Do not install the optional alogin.html replacement if your configuration depends on the portal's post-login URL redirection and the replacement would interfere with it.

14. Verify the HotSpot Configuration

Before connecting guest devices, verify the following:

WAN Internet connectivity is working.
Guest DHCP assigns the correct network configuration.
DNS resolution works.
HotSpot is enabled on the guest interface.
The correct HotSpot Server Profile is assigned.
HTTPS login uses a valid certificate.
RADIUS authentication and accounting are enabled.
The Antamedia login page is installed.
Required Walled Garden resources are accessible.

Test RADIUS

Use a guest device to attempt a real authentication.

Then inspect the RADIUS counters in WinBox.

<escape>📷 SCREENSHOT 25 – RADIUS status</escape>

WinBox path: RADIUS select the Antamedia RADIUS server Monitor

Capture: The RADIUS monitor showing authentication requests, accepts, rejects, and timeouts after a test authentication. A successful test should produce an appropriate response rather than repeated timeouts.

Test active sessions

Connect a test phone or laptop to the guest WiFi.
Open an HTTP website if the captive portal does not appear automatically.
Confirm that the Antamedia Splash Page opens.
Complete the login process.
Verify Internet access.
Open the HotSpot Active list.

<escape>📷 SCREENSHOT 26 – Active HotSpot user</escape>

WinBox path: IP HotSpot Active

Capture: A successfully authenticated test user with IP address, MAC address, login method, and uptime. Use a dedicated test user rather than exposing a customer's personal details.

Also confirm that the session appears correctly in the Antamedia WiFi Hotspot portal.

15. Troubleshooting

Splash Page does not appear

Check:

Guest device IP address and gateway

HotSpot interface and running status

The installed login.html file

DNS resolution for login.wifihotspot.io

Required Walled Garden entries

Browser captive portal detection

Try opening a plain HTTP website from an unauthenticated device. HTTPS websites cannot always be transparently redirected without browser certificate errors.

RADIUS authentication fails

Check:

RADIUS server address.
Shared secret
UDP ports 1812 and 1813
Firewall and upstream connectivity
HotSpot Server Profile settings
Authentication Requests, Rejects, and Timeouts

An increasing number of timeouts may indicate that the RADIUS server is unreachable or the response is blocked. Rejections indicate that the server received and rejected an authentication request, so investigate credentials and account restrictions.

HTTPS certificate warning

Verify that:

The certificate matches the HotSpot DNS Name
The certificate is valid and not expired
The private key is installed
Required intermediate certificates are present
Guest devices resolve the login domain correctly

Avoid configuring generic HTTPS interception as a solution to captive portal discovery problems.

Users lose Internet access unexpectedly

Review:

Internet Plan limits in Antamedia
HotSpot idle and keepalive settings
RADIUS Accounting
DHCP lease behavior
Router or AP connectivity
FastTrack and firewall rules when bandwidth limits are not enforced correctly

Guests are repeatedly asked to log in

Check the configured Cookie, MAC Cookie, and MAC authentication methods, together with the user's Internet Plan and returning-device settings.

Antamedia WiFi Hotspot supports MAC randomization handling with supported MikroTik configurations. Users should not be instructed to disable Private WiFi Address as a universal requirement.

16. Optional: Device MAC Authentication

Use this section only when devices without a browser need MAC-based authentication, such as supported printers, smart TVs, or similar equipment.

Before enabling it:

Verify that the device is registered appropriately in Antamedia WiFi Hotspot
Check the device authentication requirements for your deployment
Open the HotSpot Server Profile
Under Login, configure the required MAC authentication option
Set MAC Auth. Mode
Verify that the MAC address format and RADIUS credentials match the expected format
Test with a registered device

<escape>📷 SCREENSHOT 27 – Optional MAC Authentication</escape>

WinBox path: IP HotSpot Server Profiles double-click the guest profile Login

Capture: The Login tab showing MAC login and MAC Auth. Mode as configured for an actual tested device-authentication scenario.

Do not use this screenshot for the standard guest login setup unless MAC authentication is intentionally enabled.

Additional Resources

Official MikroTik setup guide:
https://go.starthotspot.com/help/mikrotik-configuration

WiFi Hotspot Internet Plans:
https://go.starthotspot.com/setup/internet-plans

MAC Randomization and Returning Devices:
https://go.starthotspot.com/setup/mac-randomization-and-returning-devices

MikroTik HotSpot reference:
https://help.mikrotik.com/docs/spaces/ROS/pages/56459266/HotSpot%20-%20Captive%20portal

Technical Support:
support@antamedia.com