When deploying the MT hotspot service, I see that maps a user's IP address to a second address, presumable to enable some of the magic hotspot/NAT stuff to happen. This is mildly annoying, but acceptable when providing NATed service to mobile users, but I am using MAC auth for a number of fixed users, and these users are getting public IP addresses. Obviously burning two public IPs per user, or NATing a public IP address is somewhat self defeating, so is it possible to provide hotspot MAC authentication (used for billing purposes) without the two IP address scenario?

Set the address pools on the hotspot servers and user profiles to 'none'.

address-pool (name / none; default: none) : address space used to change HotSpot client any IP address to a valid address. Useful for providing public network access to mobile clients that are not willing to change their networking settings

http://wiki.mikrotik.com/wiki/Manual:IP ... ip_hotspot

address-pool (string |none; Default: none) IP pool name from which the user will get IP. When user has improper network settings configuration on the computer, HotSpot server makes translation and assigns correct IP address from the pool instead of incorrect one

http://wiki.mikrotik.com/wiki/Manual:IP ... operties_2
Those pools are unnecessary for address assignment via DHCP and result in Universal NAT, where each client - regardless of IP - is 1:1 translated to an address from thatnpool. It is useful when mobile users have static IPs that otherwise wouldn't work, but is generally unnecessary. That is what is causing two IPs to be used.