What Is a MikroTik Captive Portal? How It Works and Basic Configuration

The short answer: a captive portal on MikroTik is the login page that pops up as soon as a phone joins the WiFi. RouterOS does this with its HotSpot feature: a device has to log in or accept the terms before it can reach the Internet. A basic setup means running the HotSpot wizard, creating users and user profiles, opening the Walled Garden for pages guests need before login, and then testing it like a real guest.

Want to try this on your own cafe WiFi? Try IWAS free for 14 days, then the Starter plan is 249,000 VND per month per location. IWAS works with MikroTik (RouterOS v7 or newer), OpenWrt and UniFi. Start your free trial

If you have ever connected to WiFi at a cafe and, instead of going straight to the Internet, your phone showed a page asking you to log in or tap “Connect,” you have used a captive portal.

On MikroTik, a captive portal is implemented through the HotSpot feature. HotSpot controls access for clients on the HotSpot network and requires authentication before normal Internet access.

This guide explains how MikroTik HotSpot and captive portals work, then walks through a basic lab configuration so you can understand and test the flow on your own router.

Note: The examples use a simple lab network. Your MikroTik may already have bridges, DHCP, firewall rules, VLANs, or WAN configuration in place. Do not remove an existing production configuration just to follow these examples.

1. What is a captive portal?

A captive portal is a web page shown before a user is allowed to access the Internet.

A simple flow looks like this:

Guest device
     ↓
   WiFi
     ↓
MikroTik HotSpot
     ↓
Captive Portal / Login
     ↓
Authentication
     ↓
 Internet

A captive portal is not a separate type of WiFi. The Access Point still provides normal WiFi connectivity. MikroTik controls the client's access on the HotSpot network.

For a cafe, the flow might be:

1. The guest connects to WiFi.
2. The device receives an IP address from DHCP.
3. The client is unauthenticated, so HotSpot controls its access.
4. MikroTik presents the login page.
5. The guest completes authentication.
6. MikroTik allows the authenticated session to access the Internet.

2. MikroTik HotSpot vs. captive portal

These terms are often used interchangeably, but they are not exactly the same.

MikroTik HotSpot is the RouterOS mechanism used to authenticate clients before allowing normal network access.

Captive portal is the web interface and user experience presented during that process.

In short:

HotSpot is the access-control mechanism; the captive portal is the authentication interface the guest sees.

HotSpot can use a local user database on the router or authenticate through RADIUS. RouterOS also supports a Walled Garden so selected resources can be reached before authentication.

3. How does MikroTik HotSpot work?

Think of an unauthenticated client like this:

Client connects to WiFi
       ↓
Receives IP via DHCP
       ↓
Sends a request to the Internet
       ↓
HotSpot checks the client
       ↓
Not authenticated?
       ↓
Show login page
       ↓
Authentication succeeds
       ↓
Allow Internet access

After login, MikroTik tracks the session under IP → HotSpot → Active. This lets an administrator inspect active users, addresses, login state, and session information.

4. Prepare a simple lab network

Start with a dedicated interface or bridge for the guest network.

Example:

Guest network: 10.5.50.0/24
Router:         10.5.50.1
DHCP pool:      10.5.50.2 - 10.5.50.254

These values are examples only. If your router already has a bridge, VLAN, or DHCP setup, use the existing topology instead of rebuilding the network.

Before configuring HotSpot, verify:

• The client receives an IP address.
• The client can reach the gateway.
• DNS is configured appropriately.
• The router has a working path to the Internet.

If these basics do not work, HotSpot is not the first layer to debug.

5. Create a HotSpot with the RouterOS wizard

RouterOS provides a HotSpot setup wizard:

/ip hotspot setup

The wizard asks for values such as:

• The interface where HotSpot should run.
• The HotSpot network address.
• Whether the network should be masqueraded.
• The client IP pool.
• A certificate if HTTPS is being configured.
• DNS information.
• The HotSpot DNS name.

For a lab, you might use values such as:

hotspot interface: ether3
local address of network: 10.5.50.1/24
masquerade network: yes
address pool: 10.5.50.2-10.5.50.254

Do not copy these values directly into a production router. The interface, subnet, and NAT behavior must match your actual topology.

After the wizard finishes, inspect the configuration:

/ip hotspot print
/ip hotspot profile print
/ip hotspot user print

You should see a HotSpot server associated with the intended interface/network.

6. Create a test user

HotSpot can use a local user database on the router.

For a lab:

/ip hotspot user add name=test password=test123

Connect a device to the HotSpot network and try to authenticate with this user.

To inspect active sessions:

/ip hotspot active print

A successfully authenticated client should appear in the Active list.

HotSpot users can have limits such as:

• limit-uptime: total allowed uptime.
• limit-bytes-in: received traffic limit.
• limit-bytes-out: transmitted traffic limit.
• limit-bytes-total: combined traffic limit.
• mac-address: restrict a user to a specific MAC address.
• profile: assign a HotSpot user profile.

For example:

/ip hotspot user add name=demo password=demo123 limit-uptime=1h

This is useful when each WiFi session should have a defined time limit.

7. What is a HotSpot User Profile?

If multiple users should share the same policy, you do not need to configure every user independently.

A HotSpot User Profile contains shared policy settings for users.

For example:

/ip hotspot user profile print

A user can then be assigned to a profile:

/ip hotspot user set [find name="demo"] profile=default

In production, design the access policy first and then create profiles around those policies rather than creating many profiles without a clear purpose.

8. What is a Walled Garden?

Some resources need to be reachable before the guest logs in.

Examples include:

• A service information page.
• WiFi instructions.
• A payment page.
• An authentication system's domain.

HotSpot provides a Walled Garden to allow selected resources without authentication.

Conceptually:

Unauthenticated
   │
   ├── Portal domain       → Allow
   ├── Payment domain      → Allow
   └── Other Internet      → Authentication required

RouterOS provides different Walled Garden mechanisms for different traffic types, so adding a domain to one list does not automatically mean every protocol will bypass authentication.

9. Where does the captive portal login page live, and what should it show?

HotSpot uses HTML servlet pages stored on the router. The default login page can be customized for a brand or authentication flow.

Common pages include:

• login.html
• redirect.html
• status.html
• logout.html
• pages used for authentication success or errors.

You can customize the HotSpot files, upload them to the router, and configure the HotSpot profile to use the appropriate HTML directory.

This lets a cafe, hotel, or business replace the default login page with its own experience.

What should a captive portal login page show?

For guests, the captive portal login page is the first thing they see of your WiFi, so the clearer the better. A page that's easy to use usually has:

• The cafe's name (and logo if you have one), so guests know they're on the right network.
• One obvious login or "Connect" button, with no long form to fill in.
• How long free WiFi lasts, for example 60 minutes, stated up front.
• If you sell extra time: the packages, prices and how to pay, for example by scanning VietQR.
• A short line on usage rules, or where to ask staff for help.

Keep the page light so it opens fast on a phone, because guests see it before they have Internet. Images, fonts or scripts loaded from other sites must be allowed in the Walled Garden, or the page will load half-broken.

For what to actually write so guests get it at a glance, see your cafe WiFi login page: what to show guests. If you'd rather not edit HTML files on the router, installing a captive portal + PayOS on MikroTik in 15 minutes shows how IWAS handles the login page for your cafe.

10. Does a captive portal need HTTPS?

This is an area where captive portal implementations are often misunderstood.

HotSpot supports HTTPS login. A proper HTTPS setup requires more than simply switching on one option. Consider:

• The HotSpot DNS name.
• A valid certificate for that DNS name.
• The selected login method.
• How the client operating system detects captive portals.

Current RouterOS also supports the DHCP mechanism associated with RFC 7710 for advertising captive portal information to clients. This depends on having the required HotSpot DNS name and a valid certificate.

If a phone does not automatically open the portal, that does not necessarily mean HotSpot is broken. Automatic captive-portal detection also depends on the client operating system and its detection behavior.

11. Test the complete flow

Do not stop after checking whether the login page appears.

Test 1 — DHCP

The client receives an IP address from the guest network.

Test 2 — Gateway

The client can reach the MikroTik gateway.

Test 3 — Portal

Unauthenticated traffic is handled by HotSpot.

Test 4 — Authentication

A valid user can log in.

Test 5 — Internet

After authentication, the client can access the Internet.

Test 6 — Session

Check:

/ip hotspot active print

Test 7 — Expiration

If the user has a limit-uptime, verify that the session ends when the limit is reached.

Test 8 — Logout

Log out and confirm that the client is no longer authenticated.

If one step fails, debug that layer instead of randomly changing firewall rules or portal HTML.

12. Common problems

Connected to WiFi but no IP address

Check DHCP and the bridge/interface before checking HotSpot.

Has an IP but no portal

Check whether the HotSpot server is running on the correct interface, along with DNS and the client's authentication state.

Portal opens but login fails

Check the local user database, password, user profile, and authentication method.

Login succeeds but there is no Internet

Check routing, NAT, firewall rules, and the upstream Internet connection.

A required domain is blocked before login

Check the Walled Garden. For services using protocols other than HTTP/HTTPS, check the corresponding IP Walled Garden configuration.

The phone does not automatically open the captive portal

Check DNS, certificates, and the client's captive-portal detection behavior. Do not assume every phone will automatically open a login page in every situation.

13. When do you need RADIUS or an external system?

The local HotSpot user database is a good fit for learning, testing, or a small deployment.

When you have multiple routers or need centralized authentication, RADIUS is a natural next step. Wondering whether a small venue really needs its own RADIUS server? Cloud RADIUS for small venues explains it in plain terms.

The flow becomes:

Client
  ↓
MikroTik HotSpot
  ↓
RADIUS
  ↓
Authentication / Policy
  ↓
Internet

An external portal can also be used when login or registration needs to run on a separate web system. MikroTik HotSpot supports this through custom login pages and the Walled Garden.

This is where a simple “router with a login page” can evolve into a centrally managed WiFi platform.

14. If you are deploying WiFi for a cafe

You do not have to start with a complex system. If you want to review the whole setup, from the internet line and router to daily running, follow the cafe WiFi setup and daily operation checklist.

A basic flow could be:

MikroTik
   ↓
HotSpot
   ↓
Captive Portal
   ↓
60 minutes of free WiFi
   ↓
Session expires
   ↓
Guest can purchase more time

When you need vouchers, VietQR payments, multi-site management, or centralized authentication, you can expand the architecture. When it's time to pick WiFi management software for your cafe, 8 questions to ask before you choose makes the comparison quicker.

IWAS is guest WiFi management software for cafes: guests get online through a login page (captive portal), the cafe sets its own plans by time, speed and data, and guests can buy more time with VietQR through the cafe's own PayOS account. IWAS works with MikroTik (RouterOS v7 or newer), OpenWrt and UniFi routers. Learn more about IWAS.

If you want to move from basic HotSpot configuration to a freemium WiFi + VietQR/PayOS flow on MikroTik, see:

Install Captive Portal + PayOS on MikroTik Cafe in 15 Minutes.

FAQ

What is a MikroTik captive portal?

It's the login page that shows up when a phone joins the WiFi, before it can use the Internet. On MikroTik, RouterOS handles this with its HotSpot feature: a device has to log in or accept the terms before it can get online. In short, a captive portal on MikroTik is RouterOS HotSpot plus the login page guests see.

Which RouterOS version do I need?

HotSpot is built into RouterOS, so there's nothing extra to install. If you plan to use MikroTik with IWAS, the router needs RouterOS v7 or newer. Not sure which version you're on? See how to check and upgrade MikroTik to RouterOS v7.

Should I use local users on the router or RADIUS?

RADIUS isn't required. For one router and a few test users, creating users on the router (/ip hotspot user) is enough. Once you have several routers or locations, or want to manage accounts, plans and sessions in one place, move to RADIUS.

What is a Walled Garden?

It's the list of pages guests can reach before logging in, for example a login page hosted outside the router, a payment page or a WiFi help page. If you forget the Walled Garden, the login page may load without images, look broken or fail at payment. RouterOS has a Walled Garden for web traffic (HTTP/HTTPS) and an IP Walled Garden for other kinds of traffic.

Which routers does IWAS work with?

IWAS works with MikroTik (RouterOS v7 or newer), OpenWrt and UniFi. The RouterOS v7 requirement applies to MikroTik only.

How much does IWAS cost?

You can try it free for 14 days, then the Starter plan is 249,000 VND per month per location.

Can WiFi sessions be time-limited?

Yes. HotSpot users support time limits (limit-uptime) and data limits.

Can the login page be customized?

Yes. HotSpot uses HTML pages on the router (login.html, status.html and so on) that you can edit to match your cafe.

Does a captive portal require a static IP?

Not always. Whether you need a public static IP depends on how the portal system is built and how its parts connect.

Can a MikroTik captive portal be used in a cafe?

Yes. HotSpot works well for guest WiFi: guests get online through a login page and you can limit how long they stay online. Bigger needs such as several locations or selling extra time usually call for RADIUS or an external system.

Conclusion

A MikroTik captive portal is essentially an access-control flow built on HotSpot:

Client → WiFi → HotSpot → Authentication → Internet.

Once you understand this flow, it becomes much easier to move from a simple guest WiFi network to systems with vouchers, session limits, RADIUS, and centralized management.

The key principle is simple: build the correct network flow first, then add the portal, authentication, and business logic.