Hi,

I have setup the router as per the dhcp-pool for the hotspot setup, all works a treat, but I have 1 computer that needs unrestricted access to the network.

Currently this pc must login to access any network resources, but because it has a static IP addrss I cannot get it to login.

What I want to do is create a firewall rule to allow this IP address unrestricted access to the network.

I am sure its simple but any help is appreciated.

thankyou

under '/ip firewall mangle' add such a rule:
and move it above the HotSpot service rule with 'move' command.

You can use also cookies to accomplish this. See:
http://www.mikrotik.com/docs/ros/2.8/ip ... ent#7.41.9

Edgars[/code]

edzix,

I use the Hotspot enabled method for my users. I also would like to have the ability to select certain customers that can bypass the hotspot login page without using other authentication methods like PPPoE. Just to clarify, I would use the action accept for the above rule? And, I do not have to worry about mark-flow or any other rules? Thanks

Hey Hotspotsolutions did you get that mangle rule to work?

I have tried several mangle rules to do an automatic pass-thru to no avail

It has been my experience that most of the documentation examples dont work. I have yet to figure out how to do a simple one-to-one full nat so a hotspot client with a static ip address can accecpt incoming connections from the internet. When i find the person that can make that happen for me he will be rewarded!

Just my 2Cents

Adding just a mangle rule does not work. Instead of a mangle rule, you need to add a destination-nat rule (src-address = the internal static ip, dst-address=0/0, action=accept) and a forward rule (src-address = the internal ip, dst-address = 0/0, action=accept). Make sure both rules are at the top of their list. As for assigning a static, you can also set this client to dhcp, then add their MAC in the dhcp leases table...then that client will always get that static ip.

What I do is create a mangle rule with 'hs-auth' flow for the static IP I want unrestricted. This works great for me:

>ip firewall mangle add src-address=192.168.x.x/32 action=passthrough mark-flow=hs-auth

This assumes the ip you want to bypass the login page is 192.168.x.x

Sonny.

I have yet to figure out how to do a simple one-to-one full nat so a hotspot client with a static ip address can accecpt incoming connections from the internet. When i find the person that can make that happen for me he will be rewarded!

This is done through src-nat and dst-nat. You also have to add the public IP address to the Public interface.

dst-nat rules should look similar to this...
src-nat rules should look like this...
Remember to assign the additional IP addresses to the WAN interface on your MT router. That should be it, unless I've forgotten anything...

Wildbill, i think you have the DST and SRC rules correct but i think my problem is with the mangle rules for the hotspot authenication.

I have a wifi nic in my laptop hard coded for 10.5.50.244/24, gateway 10.5.50.1, with my ISP's dns numbers. It can access the internet (no login screen) and I can control it using vnc from a public IP address nat-ed to the private address. The 10.5.50.0 network is my hotspot, my AP is 10.5.50.100, hooks into a switch with the other port going to the MT router's nic at 10.5.50.1.

If I change the nic in the laptop to dhcp I get the hotspot login page before I get internet access.

Is this what you are tying to do?


>>this has to be first
ip firewall dst-nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Nat Rule to tunnel traffic to laptop
dst-address=xxx.yyy.100.48/32 flow=hs-auth action=nat
to-dst-address=10.5.50.244


>>standard hotspot rule
1 ;;; redirect unauthorized hotspot clients to hotspot service
in-interface=hotspot protocol=tcp flow=!hs-auth action=redirect
to-dst-port=80

ip firewall mangle> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; packets for laptop
dst-address=xxx.yyy.100.48/32 action=accept mark-flow=hs-auth

1 ;;; return data from laptop
src-address=10.5.50.244/32 action=accept mark-flow=hs-auth

ip firewall src-nat> print
Flags: X - disabled, I - invalid, D - dynamic
1 src-address=10.5.50.0/24 action=masquerade

Hope this helps.