Wi-Fi and hotspot
Hotspot, CAPsMAN, wireless clients and Passpoint: Wi-Fi with MikroTik, from the hotel lobby to the radio link.
Image generated locally with ComfyUI from randomly selected elements. How the images are created
MikroTik Wi-Fi station and bridge: why nothing gets through behind it (and how to fix it)
A MikroTik connected as a client to another access point's Wi-Fi, with a camera behind it: why it doesn't work in station mode, how to fix it with station-pseudobridge and why the old bridge NAT trick breaks.
DojoHotspot and PPPoE MikroTik: the username in every log line
A hotspot's connection log contains IP addresses, not people: to know who was behind an address you have to cross-reference it with the logins. With a login and logout script you can create a log rule for every connected user, with the username in the log-prefix: every log line already contains the name. It works with the hotspot (on-login / on-logout of the user profile) and with PPPoE (on-up / on-down of the PPP profile).
DojoMikroTik hotspot: how to record your users’ traffic
In a hotspot the guests go out to the internet with a single public address: to know who did what, you need a connection log. With RouterOS 7 you generate it with a firewall action=log rule on new connections only and send it to an external syslog server, because the router's memory is not an archive. As an alternative, or in addition, there is Traffic Flow (IPFIX/NetFlow) toward a collector.
DojoHotspot 2.0 and Passpoint with MikroTik: interworking in the wifi package
Hotspot 2.0 (the commercial name is Passpoint, the standard underneath is 802.11u) lets a phone connect on its own and encrypted to a public Wi-Fi network, with no login page, recognizing its own carrier or its own organization. Back in 2017 I dug up an undocumented menu in RouterOS 6; today, in the wifi package of RouterOS 7, there's an official menu, /interface wifi interworking, to use together with a RADIUS server.
DojoWireless scan on a remote MikroTik without losing the result
A frequency scan stops the radio for a few seconds: if you reach the remote router through that very wireless link, you lose the connection and the result. The fix is to run the scan in the background on the router itself, with the result saved to a file you read when the link comes back up. In RouterOS 7 you do it with :execute and the file= parameter, which works with both the wifi package and wireless.
DojoCAPsMAN and RouterOS 7 WiFi: turning on client isolation
Client isolation stops devices connected to the same WiFi from talking to each other: on a hotspot or a guest network it's the first defense against anyone snooping on other people's phones. In RouterOS 7, with the new wifi package and its CAPsMAN, you turn it on with client-isolation=yes in the datapath; with the old wireless package there's still default-forwarding and, in CAPsMAN v1, client-to-client-forwarding.
DojoMikroTik hotspot: how to protect the LAN from WiFi clients
On a MikroTik hotspot the guest clients must not be able to reach the customer's network (servers, printers, NAS). A single firewall rule using the hotspot=from-client matcher does the job; and if the network to protect isn't known in advance, because the WAN gets its address over DHCP, a DHCP client script keeps it up to date in an address list.
DojoHow to create a WiFi hotspot with MikroTik and RouterOS 7
A WiFi hotspot with a captive portal on MikroTik is built in seven steps: reset, WAN, the guest network on a bridge, the radio, the /ip hotspot setup wizard, a test and the final cleanup. In RouterOS 7 the main change is the radio part, which on recent models uses the new wifi package instead of wireless. The addresses in the example are the ones from my lab: adapt them to your own network.