MikroTik

ofasa

Hello,

For the hotspot server to work correctly, there has to be MAC layer connectivity between the client and the hotspot gateway.
(I'm assuming the clients are connecting to the WRT300 routers)

ofasa

On a previous network I ran, I did same SSID across the network and used MAC ACL to control the connections as needed. This simplified installation and management considerably. All CPE's were setup at the office. This simplified the installers' jobs.

ofasa

Most likely, the ar5213 wifi card you have is b/g only. What's the make/model?

ofasa

Me too, please. ofasa {at} yahoo {dot} com.

Thanks.

ofasa

Hi Mikrotik,

I am having the same problem described above except that I can't ping 10.5.50.1. The only solution I have found is to uninstall IPv6; disabling it doesn't fix the problem.

Is there any other solution to this?

Thanks.

ofasa

Just use the MAC Address as the user name. And enable login by MAC in the hotspot server profile. It should work.

ofasa

Hi,

Can you add uptime-limit and up/download-limit to batch user creation? Also can you add these attributes to credits too?

Thanks.

ofasa

Can you add recharging accounts with prepaid vouchers?

Thanks.

ofasa

What you need can only be achieved in MT if bursting is added to PCQs. Possibly this can be added?

ofasa

Dear sergejs: I alrady use "shared-users=1" , and use login/password for the HotSpot authentication. The "bad users" stole IP/MAC-address by using scanning programs, and chose one of the active IP/MAC-address. If the stolen address is alrady autherized in the hotspot, then the &...

ofasa

You should be able to achive this using two virtual AP interfaces with the hotspot running on the inerface that's unencrypted.

ofasa

What you probably need is Nstreme2:
http://www.mikrotik.com/docs/ros/2.9/in ... ent#4.13.4

ofasa

Did it boot from the CD? What happened?

This may help: http://www.mikrotik.com/docs/ros/2.9/guide/netinstall

Regards

ofasa

Fortunally until now (3 days rolling) the new web-proxy package works just great.

Yes, the new web-proxy-test package seems to be much better. (pages load much faster!) Great job MT!

ofasa

You'll need two seperate wireless cards for this.

ofasa

have tried as u directed, but sill cant get the tickets to be accepted on my login page... my routerOS ip is 192.168.0.254 for the wired interface and 192.168.1.254 for the hotspot interface... which interface would serve as the radius client and what do i use for the usermanager.....[/list][/code]...

ofasa

Here's the config for one of my hotspot profiles with the trial feature working: / ip hotspot profile set default name="default" hotspot-address=0.0.0.0 dns-name="" \ html-directory=hotspot rate-limit="32k/128k 64k/256k 48k/96k 30/30 8 \ 24k/48k" http-proxy=0.0.0.0:0 sm...

ofasa

It would be nice to be able to add Upload and Download limits (in addition to Time) while creating new credit entries.

Thanks.

ofasa

You can't bridge a wifi interface thats in station mode.

ofasa

Do you use fixed IPs for your clients? You could these through DHCP and use the DHCP Rate-Limit.

ofasa

ofasa

I used to use squid now I use MT's built in Web Proxy. (Will be moving back to the external squid box because I need to use DansGuardian). If you just want to cache web pages and don't need the extra tweaking (and don't have lots of time to spare) go with the MT Web Proxy. They both work! With MT th...

ofasa

Try creating another radius server entry with the details of your backup server and check the 'Accounting Backup' box. (Haven't tried it, but I think that's swhat it's for).

ofasa

You can use 'rate-limit' under 'profiles' to achieve this.

ofasa

It should acording to this: http://www.mikrotik.com/docs/ros/2.9/ip/dhcp. See Rate-Limit under DHCP Server Setup.

ofasa

You can what you described with HotSpot MAC Authentication. 1. Enable Login by MAC and RADIUS Authentication. 2. Enter the CLient's MAC Address in the RADIUS/Billing Server. They should be loged in if their MAC Address is Authorised by the RADIUS/Billing Server, otherwise the'll be presented with th...

ofasa

How do you 'lock' the clients to 11 Mbps? At the AP?

Thanks.

ofasa

What of the RB 111? When will this be available? Can I run Nstreme on this as a CPE?

Thanks.

ofasa

You can use DHCP with radius. It'll handle this also.

ofasa

He wants to do MAC NAT. (Natting the MAC addresses behind the MT Client to the MT's MAC Address)

ofasa

should be like this /ip firewall filter add chain=input dst-address=!10.1.1.1/32 dst-port=!80 action=drop /ip firewall filter add chain=input dst-address=!10.1.1.1/32 dst-port=!443 action=drop 10.1.1.1 is the router ip so you can allow yourself to connect to the router without hassle Then port 443 ...

ofasa

If you remove the user manually make sure you remove he mac from the 'Hosts' section (Tab) too.

ofasa

There are logon / logoff scripts available with the HotSpot (I wish they were available with PPPoE too!) What you are describing should be done by the radius server. Radius server recieves an access request, OKs it, runs a script on the NAS (Mikrotik in this case) to do whatever you want. When the u...

ofasa

Hi,

You can use PPPoE with Rate-Limit (that's what I use). Queues get created when user logs in.

If you don't like this tell me what authentication scheme you use and I can tell how to create simple queues.

Do all users share bandwidth equally? Or do you have different classes of users?

ofasa

Thanks. Thats what I needed to confirm.

ofasa

Will an SR5 and an SR2 card work on a RB511? Or on an RB532?

Thanks

ofasa

Thanks. I see it now!

ofasa

How do we use this? *) added priority and min-rate fields in rate-limit attribute for Hotspot, PPP and DHCP; After experimenting: 64k/64k 256k/256k 128k/128k 10/10 6 32k/32k - rx/tx-max-limit=64000, rx/tx-burst-rate=256000, rx/tx-burst-threshold=128000, rx/tx-burst-time=10s priority=6 rx/tx-limit-a...

ofasa

Can someone please explain this? (What's trial user support?)
*) added complementary Hotspot feature (trial user support);

How do we use this?
*) added priority and min-rate fields in rate-limit attribute for
Hotspot, PPP and DHCP;

Thanks a lot.

ofasa

I wuld like to connect PPPoE (10.10.10.X) client to my local netvork (192.168.1.X). Now PPPoE server yust provides acces to the internet.
Is this possible?

Yes, but you'll need to give more information about your network layout.

ofasa

Create the profiles in the radius server or just add a Rate-Limit for each user. If SBR doesn't support Rate-Limit find out if there's a way to add custom reply attributes.

ofasa

Go through the Mikrotik Radius Client and AAA documentation, it's all explained there. Rate-Limit works only with Mikrotik so you'll have to include the dictionary.mikrotik (mentioned in the above documentation). FreeRADIUS should be more than enough, there's also a windows port of freeradius at htt...

ofasa

Use the Rate-Limit radius attribute to assign bandwidth to users when they login. You can create three radius groups with respective Rate-Limit and assign users to these groups.

MT will 'talk to' a radius server. It's not a radius server.

Hope this helps.

ofasa

You can just connect to the 2.8 router with ftp, copy over the 2.9 package files (or the single 2.9 upgrade packege) and reboot the router. It will be upgraded to 2.9.

ofasa

You'll have to do this by manually setting up simple queues and marking traffic from both users.
You possibly could do the marking part automatically withthe 'Filter-Id' radius attribute then set a filter rule for each group of users.
Hope I'm making sense!

ofasa

RouterOS accepts the "Advertise-URL" radius attribute.
Just configure your radius server to send it as a reply attribute when the customer logs on.

ofasa

is it possible to have mt check the mac of the user and then compare that to user accounts stored in a radius server for what to set the users queue to?

Just setup different radius groups with their various 'rate-limits' and assign users to these groups.

What do you use for authentication?

ofasa

ofasa

This'll be easily done with PPPoE.

ofasa

Can MikroTik RouterOS make Daynamic Bandwidth Allocate.?

Explain a little more what you want to do.

ofasa

He wants the customers to be redirected to a local web page if the internet link is down.

ofasa

Just put the limits on the interfaces (1.2Mbps on the LAN and 384Kbps on the WAN).

ofasa

Probably something to do with dns. Try using the built in setup 'wizard'. Also, try not setting a dns name for the hotspot router.

I think address clients are trying to reach should be 'resolvable' through internet or your local dns server before hotspot login page will be displayed.

ofasa

If locating the remote AP's isn't a problem, I'd go with the WDS setup. Should have better coverage.

ofasa

What would you be using as CPE's?

ofasa

What will your clients use as CPE's? Is the terrain flat?

ofasa

Don't assign an IP address to the PPPoE interface!

ofasa

Then just setup the PPPoE server to use the same RADIUS server and you would have achieved your aim.

ofasa

You just need to create a PPPoE server on the same interface as the hotspot, this should work.

How do you authenticate your hotspot clients? RADIUS?

ofasa

RouterOS 2.9 has provision for rate-limit in ppp profiles. This will allow for bursting in the individual queues.

ofasa

Sorry, was just trying to help! Do you use radius? From the manual: rate-limit (text; default: "") - rate limitation in form of rx-rate[/tx-rate] [rx-burst-rate[/tx-burst-rate] [rx-burst-threshold[/tx-burst-threshold] [rx-burst-time[/tx-burst-time]]]]. All rates are measured in bits per se...

ofasa

Yes, see the manual.

ofasa

Yes it's possible. Just setup the hotspot on the same interface. Authenticated PPPoE users won't see the hotspot login page.

ofasa

No hotspot login page, fom my experience, indicates no connection to the internet (specifically a dns server failure). No data to authenticated users probably confirms this.

ofasa

Possibly no rate-limit is being send by the radius server. Check the reply sent by the radius server to make sure!

ofasa

I have 1 client radio on an office building with multiple customers. I have the radio plugged into a hub then from the hub it goes to each customers router and the routers are using PPPoe to auth. This was working fine when I had only 1 customer using pppoe and 1 using hotspot to login, I added a 3...

ofasa

RADIUS

ofasa

You can just turn off all authentication on the proxim APs and use Mikrotik's Hotspot and PPPoE for authentication with Freeradius/MySQL.

AP
^
|
Mikrotik --> Intennet(?)
|
V
FreeRADIUS

Should Work.

ofasa

What's the power of the mikrotik AP?

At 15 miles you might want to go with a higher gain antenna!

ofasa

You could just enable mac pass through on the hotspot gateway for the cpe's you don't want to use the hotspot login.

ofasa

PPPoE works on the MAC layer so it won't work in a routed network.

If ROUTER and PPPOE SERVER are both mikrotik boxes then using an EOIP tunnel between them might solve your problem.

Give more details. Why do you HAVE to route and not bridge?

ofasa

With a RADIUS server, yes.

ofasa

Take a look at FreeSide (sisd.com/freeside).

ofasa

Enable 'Auth. MAC' and 'Auth. MAC Password' enter the user's MAC Address as his 'username' and 'password' and he should be let through without the login screen.

ofasa

What are some of the required features?

ofasa

Mark traffic to/from both ip's with the same flow-mark and setup a queue for that flow-mark.

ofasa

This should be possible.
I'm using HotSpot and PPPoE on the same interface.
(ThoughI tried it with PPtP and could'nt get it to work so I gave up!)

ofasa

Give more details:
PAP / CHAP. What radius server, what PPPoE Client?

ofasa

Try using PPTP for authentication instead of PPPoE and HotSpot.

ofasa

You'll need to get the radius server to send a 'Session-Timeout' along with the 'Access-Accept' to 'Mikrotik'!

ofasa

How do you setup your users? You could 'Group' users by assigning them to different subnets and use queue trees to manage the bandwidth across all groups. eg. subnet 1 - 192.168.0.0/24 - 64k with 128k burst subnet 2 - 192.168.1.0/24 - 64k with 256k burst subnet 3 - 192.168.2.0/24 - 128k with 256k bu...

ofasa

Are you using HotSpot or PPPoE?

ofasa

Maybe you should be asking for a windows/linux based Nstreme driver?

ofasa

Mikrotik has Nstreme.

ofasa

You could do this two ways: 1. Insert mac address in radius database and enable mac-auth and mac-auth-password. Thell be logged in automatically (wont see the hotspot login page) and you'll be able to do accounting through radius. 2. Set them up to use PPPoE with radius authentication. and a third! ...

ofasa

http://www.mikrotik.com/forum/viewtopic.php?t=1906

ofasa

What are you trying to achieve? Users with a fixed total login time? (As in prepaid cards?)

ofasa

You'll need to setup radius to handle the uptime limit by calculating remaining time and sending a session timeout to mikrotik.

With the local user database you won't get any data sent to radius!

Which radius server?

ofasa

Try increasing RAM, reducing diskspace used by cache, making sure drive doesn't have errors.

ofasa

Not unless you have wireless cards installed on Mikrotik.

ofasa

My longest nstreme2 link so far is about 85km.

85km! What are the tower heights?

ofasa

There's an option on the TR-CPE to use either the Radio's MAC orht the connected PC's MAC.

ofasa

Check 'auth mac' and 'auth mac password'.

Enter mac address as username and password in the format:

AA:BB:CC:DD:EE

Should work. I tried this a few days ago.

ofasa

Use the MAC address as the Calling-Station-id radius attribute.

test User-Password =: 'pppoe password'
calling-station-id := 'mac address'
... etc.
(of course translate for entry into your database)

ofasa

Cost of providing an Internet connection via satellite is up to $10,000 per month for 1Mbps. If everyone on that link uses skype then you will need 10 times this. Can't you just bill be the Gigabyte? Its the fairest way to everyone especially when the bandwidth is that expensive in that area. Matt ...

ofasa

proxy-arp?

ofasa

I use quick-r for my mikrotik hotspot administration:

http://www.q-linux.com/software/quick-r

ofasa

hi,

do you have some particular reason for using 3 MT boxes?

You could just do:

Sat Gateway ---> MT ---> PPPoE & HotSpot (on same interface)

I have a similar (not exact) setup.

ofasa

I think you'll be needing something like this (assuming the clients are connected to ether1):

/ ip firewall rule input add in-interface=ether1 out-interface=ether1 action=reject

ofasa

Sorry, that should be http://www.q-linux.com/software/quick-r/

ofasa

Hi,

If all you need to do is sell prepaid internet access, take a look at quick-r (http://www.qlinux.net/software/quick-r). That's what I'm using with my hotspot setup.

ofasa

Hi,

Is it possible to have hotspot and pppoe on the same interface?

I have a wireless setup and want some users to login using hotspot and others using pppoe.

Thanks.

Search found 102 matches

Re: Hotspot server problem with complex architecture.

Re: SSIDs -- same or different?

Re: best wireless band to use

Re: CPE-Antenna alignment via customer / Application available?

Re: Login Page Not Redirecting - Maybe IP Version 6

Re: Hotspot Radius problem

Re: new 2.9.29 web-proxy test package memory limitation

Re: usermanager help needed

Upload and Download Limits

Re: New Features in 2.9.11

New Features in 2.9.11

Re: PPPoE ..... plese HELP

Re: Multiple PPPoe clients behind one Client Radio

Hotspot and PPPoE on Same Interface