VPN Accounts

Overview

A VPN Account allows ISPBills to communicate with MikroTik routers that do not have a static public IP address. Many ISPs operate their routers behind a dynamic IP, carrier-grade NAT (CGNAT), or double-NAT setup, making it impossible for the ISPBills RADIUS server to reach the router directly. A VPN tunnel solves this by providing a stable, always-reachable private IP address for the router.

How It Works

  1. ISPBills provides a VPN endpoint (server).
  2. The MikroTik router creates a VPN tunnel to that endpoint using the provided credentials.
  3. Once the tunnel is established, the router is reachable from ISPBills via a stable VPN-assigned IP address.
  4. You register the router in ISPBills using this VPN IP address — the router is then fully managed regardless of its public internet connectivity.

When You Need a VPN Account

Situation VPN Required?
Router has a static public IP directly reachable from ISPBills ✗ No
Router has a dynamic public IP ✓ Yes
Router is behind NAT (e.g., ISP's CGNAT) ✓ Yes
Router is on a private network / branch office ✓ Yes

One VPN account per router. Each router requires its own dedicated VPN account.

Creating a VPN Account

  1. Navigate to Routers & Packages > VPN Accounts.
  2. Click the "New Account" button.
  3. A new VPN account is created with:
    • A unique VPN IP address (the IP you will use when registering the router in ISPBills)
    • A unique Winbox IP and port (for remote Winbox access to the router)
    • VPN credentials (username and password for the MikroTik VPN configuration)
  4. Note the provided IP address and credentials.

Setting Up the VPN on Your MikroTik Router

After creating a VPN account, configure the tunnel on your MikroTik router:

  1. In the VPN Accounts list, find your account and click Actions > Config Info.
  2. ISPBills displays step-by-step VPN configuration instructions specific to your account credentials.
  3. Follow the instructions to configure the VPN client on the MikroTik router (typically a PPTP, L2TP, or WireGuard tunnel — check the Config Info for the correct type and settings).
  4. Once the VPN connects, the router will be reachable from ISPBills at the assigned VPN IP.

Registering the Router Using the VPN IP

When adding the router to ISPBills (see Routers):

  • In the IP Address field, enter the VPN IP address shown in the VPN Accounts list for this account.
  • Do not enter the router's local or public IP — use the VPN-assigned IP only.

Remote Winbox Access

You can access your MikroTik router remotely via Winbox without a public IP using the VPN:

  1. In the VPN Accounts list, find the router's account.
  2. Note the Winbox IP and Port shown in the Winbox column.
  3. In Winbox, connect to [Winbox IP]:[Port] to reach the router from any network.

Important: Do not change the MikroTik router's default Winbox port (8291). Changing the port will break the pre-configured remote Winbox access through the VPN system.

Cost

Each active VPN account adds an additional 50 BDT per month to your ISPBills subscription bill. Monitor the number of active VPN accounts and remove any that are no longer in use.

Summary of Key Points

  • One VPN account per router.
  • Use the VPN IP (not the router's local or public IP) when registering the router in ISPBills.
  • Use Actions > Config Info to get router-specific VPN setup instructions.
  • Use the Winbox IP and port in the VPN account list for remote router access.
  • Keep the default MikroTik Winbox port (8291) unchanged.
  • Each VPN account costs an additional 50 BDT/month.