Hotspot Setup

ISPBills integrates with the MikroTik Hotspot Server to provide a fully managed WiFi captive-portal experience. This guide walks you through the complete setup from router configuration to customer self-registration.

What Is Hotspot?

Hotspot is a WiFi access model where customers connect to a WiFi network and are redirected to a captive portal (a splash page) before they can access the internet. They register with their mobile number, purchase an internet package, and their device is automatically authenticated by ISPBills via RADIUS — no manual configuration required.

This model is ideal for:

  • Public WiFi zones (cafés, markets, waiting areas)
  • Apartment buildings and shared-access networks
  • Any location where self-service customer onboarding is preferred

Prerequisites

Before setting up hotspot in ISPBills, ensure the following are in place:

  • A MikroTik router is registered in ISPBills under Routers & Packages > Routers.
  • The router has API access enabled and is reachable by the ISPBills server.
  • The router has a working Hotspot Server configured on the interface connected to the WiFi access point.
  • At least one Hotspot package will be created in ISPBills (see Step 3).

Step 1: Configure the Router for Hotspot

The MikroTik router must have the Hotspot Server running before ISPBills can manage customers on it.

  1. Log in to your MikroTik router via Winbox or WebFig.
  2. Go to IP > Hotspot > Hotspot Setup and run the setup wizard on the interface connected to your WiFi access point.
  3. When prompted for the RADIUS server, enter the IP address and shared secret of your ISPBills RADIUS server. ISPBills will provide these details in Routers & Packages > Routers.
  4. Set the Hotspot Server profile to use RADIUS authentication.
  5. Ensure the hotspot login page is served from the ISPBills-provided URL (or leave it to redirect to the RADIUS-managed splash page).

The router's Hotspot Server acts as the Network Access Server (NAS). All authentication and accounting requests are forwarded to FreeRADIUS managed by ISPBills.

Step 2: Configure Walled Garden

The Walled Garden is a list of URLs and IP addresses that customers can access before they authenticate (e.g., the payment gateway, the ISPBills portal). Without the Walled Garden, customers cannot complete payment after connecting to WiFi.

  1. In ISPBills, navigate to Routers & Packages > Routers.
  2. Find your hotspot router and click Actions > Walled Garden.
  3. ISPBills will display the default Walled Garden entries required for the customer portal and payment gateways.
  4. Click Push to Router to automatically apply the Walled Garden rules to the MikroTik router.

Manually add any additional domains your payment provider requires (e.g., bKash, Nagad, SSL Commerz callback URLs).

Step 3: Create Hotspot Packages

Hotspot packages define the internet plans available for customers to purchase on the captive portal.

  1. Navigate to Routers & Packages > Packages.
  2. Click Add Package.
  3. Set Customer Type to Hotspot.
  4. Configure:
    • Package Name (e.g., "1 Hour — 5 Mbps" or "1 Day Unlimited")
    • Price (in your local currency)
    • Validity (hours, days, or data volume)
    • Download / Upload Speed
    • Associated Router
  5. Save the package.

Customers will see a list of available packages on the captive portal when they connect to WiFi.

Step 4: Customer Self-Registration Flow

Once the router and packages are configured, the end-to-end customer experience works as follows:

  1. Customer connects to the WiFi network (SSID).
  2. Browser opens automatically (or customer opens any URL). They are redirected to the ISPBills captive portal.
  3. Customer registers using their mobile number (an OTP is sent via SMS for verification).
  4. Customer selects a package and pays via the available payment method (bKash, Nagad, recharge card, etc.).
  5. ISPBills creates a RADIUS session for the customer's device MAC address.
  6. The MikroTik router grants internet access to the customer's device.
  7. When the session expires, the customer is redirected back to the portal to purchase another package.

Returning customers who have already registered are recognised by their mobile number and can log in directly.

MAC-Based Re-Authentication

When a customer completes a session and purchases a new package, ISPBills binds their device's MAC address to their account. On subsequent visits, the router identifies the device by MAC and re-authenticates them automatically if they have an active package — no login required.

Important: SSID Consistency

For MAC-based re-authentication to work across multiple access points, all hotspot routers in the same zone must broadcast the same WiFi SSID (network name). If the SSID differs between access points, the customer's device connects to a different network and re-authentication fails.

This is the most critical hotspot configuration requirement for multi-AP deployments.

How RADIUS Handles Hotspot Authentication

ISPBills uses FreeRADIUS to handle all hotspot authentication and accounting:

Event RADIUS Action
Customer buys a package ISPBills creates a RADIUS user with session limits (time/data).
Device connects to hotspot Router sends Access-Request to RADIUS; ISPBills validates and returns Access-Accept.
Session expires (time/data limit) RADIUS sends Disconnect-Request; router terminates the session.
Customer account has no active package RADIUS returns Access-Reject; router blocks internet access.

Troubleshooting

Customer is not redirected to captive portal

  • Verify the hotspot server is active on the correct interface in MikroTik (IP > Hotspot).
  • Check that the RADIUS server IP and shared secret are correctly entered in the MikroTik RADIUS client settings.

Customer cannot reach the payment page

  • Check the Walled Garden rules on the router. Navigate to Routers & Packages > Routers > Actions > Walled Garden and re-push the rules.

Authentication succeeds but no internet after payment

  • Verify the ISPBills RADIUS server is reachable from the router (test with ping from MikroTik to the RADIUS IP).
  • Check the FreeRADIUS logs in ISPBills under Logs > PPP Auth Log (hotspot sessions also appear here).

MAC re-authentication not working

  • Confirm all access points use the same SSID.
  • Check whether the customer's device MAC address is registered in ISPBills under Customers > Devices.