Hotspot Menggunakan Mikrotik

Hotspot adalah tempat-tempat tertentu (biasanya tempat umum) yang memiliki layanan internet dengan menggunakan teknologi Wireless LAN, seperti pada perguruan tinggi, mall, plaza, perpustakaan, restoran ataupun bandara. Layanan internet seperti ini, ada yang berbayar dan sangat banyak yang menyediakan secara gratis.

Tutorial kali ini membahas bagaimana mudahnya membangun router+hotspot authentikasi
menggunakan Mikrotik OS.


Download Tutorial

Mikrotik Router OS - Setup and Configuration Guide for Aradial Radius Server

This e-book is created to provide a sample deployment guide for a centralized deployment utilizing
Aradial Radius server, Spotngo Payment module and Mikrotik Router OS Network Access Server.
The document contains information relevant to central, localized and distributed network deployments

download here

Setup DNS Mikrotik

ALTERNATIVE PROCEDURE IF YOU WANT TO INPUT A FIXED IP/GATEWAY/DNS SERVER ADDRESS
(instead of using DHCP on the ether1 port)

Caution:
Use care in selecting the DNS SERVER IP address in the setup below. You MUST select an actual DNS server or a router which provides DNS services. Some routers (such as the Hawking FR24) provide a "DNS RELAY" feature on the gateway address which redirects DNS service requests that are sent to the router Gateway Address to some downstream DNS Server. Such "dns relay" service is not always compatible with the Mikrotik system. Other routers (such as the NexLand 800 Turbo and many other router setups) do provide normal DNS Services on the gateway address. In many routers it may depend on user programming.

The Mikrotik router will NOT resolve DNS properly for the Hotspot unless the pointer to a DNS server source points to a "real" DNS Server or a router which actually provides DNS SERVICES on the Gateway address. The result of no DNS service will be that your hotspot login screen will not be loaded when "any URL" is transmitted to the ether2 (Hotspot) port via your browser. This problem can be very confusing to diagnose.

You can test what DNS address you should setup in the Mikrotik unit by running an ip configuration test on a Windows equipped computer connected to your router that you also intend your Mikrotik to use for internet access. Proceed as follows:

b) In your windows computer, in network settings, select tcp/ip properties, and select "obtain an IP address automatically" and "obtain DNS server address automatically". Click OK and exit and reboot if necessary to activate the new settings. Then execute Setup>Run>
then enter <winipcfg>, click OK, (windows 95/98), or <ipconfig>, (or perhaps wntipcfg), click OK, (windows XP/NT/2000), In Windows , you may have to download the winipcfg.exe (or similar) module from the resources folder on the install disk to get this to work. You will get a display such as the image below when you get the ip configuration display and click

Note in this example, the DNS SERVER reported is 192.168.168.1 which IS the same as the Default Gateway and the downstream router (not Mikrotik) IP address. THIS IS NOT ALWAYS SO! The DNS server found by the DHCP operation of your windows computer may be in an entirely different range from the default gateway IP address. Thus, if you use a fixed IP address/Gateway/DNS Server selection, your Mikrotik router DNS Server setup MUST use the DNS Server found by a computer with DHCP Client operating as above. You cannot assume it is the same as your router's default gateway address.

Once you have the downstream router's Gateway address and DNS Server address defined, select an IP address for your Mikrotik unit and proceed as follows. (Here, we are assuming that your Mikrotik System's IP address and mask is 128.1.1.120/255.255.255.0, Gateway of the downstream router is 128.1.1.1 and that the DNS Server's IP address is 207.69.188.186. Make any changes you deem necessary.)
29a) [admin@MikroTik] interface> /ip
(Note: The address 128.1.1.120 (below) represents the PUBLIC INTERNET side IP address of the Mikrotik Router. Change to your own suitable address as may be required.)
(All commands must be all in one continuous string (no carriage returns even if the red command characters are shown on multiple lines) when input and followed at the end by a carriage return. Be careful to look for parts of commands on second and even third lines in the listings below. The /24 after the IP address is equivalent to stating that the mask is 255.255.255.0)
29b) [admin@MikroTik] ip> address add address=128.1.1.120/24 comment="TechNet LAN to Internet" interface=ether1
29c) [admin@MikroTik] ip> route add gateway=128.1.1.1
(The following test will locate your public ethernet port . Proceed as follows. You may PING your gateway address (128.1.1.1 in the example) which pinging will occur out the ether1 NIC port. Notes: You may also ping some other address if you wish. You can stop the PING command by entering at any time.) Now we test to see that we are connected to the internet by pinging "some" known IP address such as:)

(Note: This next command normally sets your system up so that all DNS calls go directly to the ISP's DNS servers. If you are behind another router/firewall you could (probably) use the gateway address of your router (as is done in the example) as many do provide DNS service. However, pointing directly to the ISP's DNS servers is usually faster.)
29d) [admin@MikroTik] ip> /ip dns set primary-dns=128.1.1.1 (Change to YOUR ISPs DNS servers. Or- This may be the gateway IP address of a LAN router (as this actually is) which has DNS services. You may be able to change to YOUR ISP's recommended DNS server IP address if permitted by your router and operation will likely be faster.)
29e) [admin@MikroTik] ip> /ip dns set secondary-dns=207.69.188.186 (Add a secondary DNS server if your ISP has one. This example is one of earthlink's DNS servers.)

IF you wish to install a DNS Cache in your Hotspot router so DNS requests will be handled out of the local cache instead of going to the router (or external ISP) each time, enter the following line.
29f) [admin@MikroTik] ip> /ip dns-cache set primary-server=128.1.1.1 (This sets up the dns-cache to access from the LOCAL ROUTER’s DNS server. You may wish to change the above two IP addresses to your ISP’s DNS IP address if permitted by your router. You can also use the
/ip dns-cache set secondary-server=xxx.xxx.xxx.xxx
to set up a secondary DNS-CACHE server if you wish. )
29g) [admin@MikroTik] ip> dns print
resolve-mode: remote-dns
primary-dns: 128.1.1.1 (This should be your primary DNS server IP address.)
secondary-dns: 207.69.188.186 (You should setup a secondary-dns server if you have one.)
and then:
29h) [admin@MikroTik] ip> dns-cache print
enabled: no (You get to enable it later when you setup the hotspot.)
primary-server: 128.1.1.1 (This should be your primary DNS server IP address.)
secondary-dns: 0.0.0.0 (You should setup a secondary-dns server (in step #19) if you have one.)
running: no (It will start running if you enable "use DNS CACHE" when you setup the hotspot.)
usage: 0%
entries: 0

taken from http://www.gpsinformation.org/hotspot/fixedether1ipsetup.html

Mikrotik Hotspot Advantages/Limitations

I have been looking at various Hotspot Router Software offerings for several months. I wanted a more flexible system than NoCatAuth which could incorporate three NIC ports and which did not depend exclusively on remote authentication. The Mikrotik system was one of my first attractions, but after weeks of frustrated effort in March, I found that the Mikrotik HOTSPOT software would not work with external stand alone wireless Access Points I wanted to be able to use. In late May, I got an email from Mikrotik saying that the system would now work on other than the expensive routers. I have tested out the new version 2.7.4 software and it seems to have everything I have been looking for and at a reasonable price.

Mikrotik is a software company in Latvia that has been developing their version of a Linux router since about 1995. In 2002, they first offered a WiFi Hotspot capability which operated with specific internal (to the Linux computer) wireless cards and a few APs. In mid 2003, this range has expanded to allow working with a wide range of vendor’s standard Wireless Access Points. This recently includes the Dlink 900AP+ and similar inexpensive APs as well as the old standbys such as Cisco. Some specific features and advantages of the Mikrotik Router with HotSpot in (the latest) version 2.7.4 are:

1) It is supported software with a constant stream of feature enhancements and fixes for problems experience by users. Bug fixes are frequent and severe problems seem to be fixed pretty fast.The Mikrotik system has a very complete (500+ page) reference manual as the system has functions that allow it to do about everything an ISP could dream of doing and more than most casual users will ever need. But.. If you need some routing feature, likely it is already available.

2) The bad news is Mikrotik Tech Support is not the best even after you buy a license so they will assist. :( The Mikrotik technicians know a lot about their system but: Most answers to emailed questions seem to be references to the manual and if you send three questions, they likely will only answer part of them. Some answers I did receive had errors that are just killers for a beginning router programmer/user.

There are lots of command examples in the manual but almost zero overall application examples. The exception is a HotSpot example, but even with this, only someone already familiar with router ip table setup can get through the complete design without outside help. I did get some excellent help from Eje Gustaffason at who offers Mikrotik consulting for $100 per hour. Not Cheap... But a lot cheaper than spending weeks with a simple problem that you cannot work out. Eje is fast and efficient and best of all he gives workable answers with explanations a beginner can understand and use. The detailed three port application example plus the two port example that I have worked up are the only ones I know of. Let me know if there are improvements/clarifications needed.

3) The system software itself is inexpensive. A fully working basic software system with PPPoE and limited to 4 simultaneous Hotspot users and 4 total NAT entries is FREE to download and use from for evaluation and unlimited use but without any support whatsoever (which is quite reasonable). Other options include a solid state 64meg IDE FLASH "disk drive" with the fully Licensed Mikrotik Router + Hotspot software loaded on it with a one year free update service for US$125 from http://www.fament.com/catalog/product_info.php?products_id=39. This Flash drive system requires no floppy/CDROM/Hard Drive in a router system. The licensed software alone is about $75 from fament.com if you want to make a WiFi Hotspot authenticator/controller in a computer you already have and you wish to use your conventional disk drive (100meg or more). The system for local Hotspot use will run fine on a Pentium I-75mhz machine with 64megs of RAM.

4) The Mikrotik system is quite complex and will take most people a good while to learn in detail. HOWEVER, with the cook book application guide that I have worked up HERE, a three port Hotspot router can be assembled and made operational in one evening by someone who just knows how to do medium complexity software installs on a PC.

5) The system allows the HotSpot owner/operator (OO) to edit the locally stored html files used for login, FAQs, Help pages, etc. The user can freely add or change links between these pages and the main login page using FrontPage or Dreamweaver or even Netscape Composer except for the login.html page which has tables.

6) It is possible to allow internet access to specific websites (with fixed IP addresses) without login when desired.

7) Hotspot User Authentication can be done from a local list (default) or from a local or remote RADIUS authentication server. The system can be programmed to use local authentication when it is available and to query a RADIUS server when the desired entry is not in the local list. The RADIUS server is expected to periodically update the local list. If the RADIUS server or link should fail, the local authentication will continue uninterrupted. In my opinion, a feature like this is an essential ingredient for our growing Atlanta Free Net system.

6) The Mikrotik “UNIVERSAL CLIENT” optionally permits “any” roaming user with “any” normal IP address and gateway setup in his networking to access the Hotspot without changing his networking setup. I really like this feature. :) Note: The Universal Client feature is mutually exclusive with use of the DWL-900AP+ as a REPEATER of Mikrotik data packets. The "address mangling" done to accommodate the Universal Client confuses the DWL-900 Repeaters.

7) It is easy to give any number of user “groups” different privileges on the Hotspot. For instance, group “guests” could be given 32kbps internet service speed upon login. Registered Guests could be (for instance) given 144kbps. Members could be given 1mbps and Owners could be given “full” speed. It is possible to configure queues so that even if the higher speed users are using “all available” bandwidth, low priority users still get most of their allocated bandwidth. "Burst" modes can also be configured so that users get a "burst" of traffic for some seconds and then get throttled to some lower speed. This can give even low speed users the feel of higher speed, yet throttle their download speed on game or file download.

8) The Mikrotik system can be configured with multiple NICs with varying capabilities. In my “cook book” system design, I have the router configured to accept one “public” LAN (could be PPPoE) input for the internet connection. A second NIC is the connection for the Hotspot Access Point. A third NIC port is provided to connect the local home LAN to the internet. web-proxy and NAT filters are used to insure that users on the Hotspot cannot access computers on the home LAN and vice versa. This eliminates the need in most cases for a separate router as the Mikrotik system can provide full NAT and firewall services for both the Hotspot and for the local LAN services at the same time..

9) Inbound service via the Mikrotik OS Router can direct traffic to mail servers and/or other computers or servers on the home local LAN.

10) The Hotspot provided can accommodate multiple simultaneous logins with the same username and password. In my own setup, I instruct "roaming guests" to sign in as “guest” with a blank password. This gives internet connectivity and mail service at low speed. If a user registers with me, I will give him connectivity speeds as negotiated. For now, everyone is at DSL speed but I can change that at will.

11) The one thing I know of that the Mikrotik does not now offer that is provided in the NoCatAuth box is SELF REGISTRATION. With the Mikrotik box, registration and user enabling past the “guest” stage requires an email to the hotspot supervisor and manual input of a user ID and password. This input takes about half a minute via a windows based GUI.

12) The bandwidth throttling system allows the user to throttle bandwidth for individual user groups, and for entire NIC ports. Thus, you can prevent your hotspot users from using all of your bandwidth even if a number of users simultaneously download large files.

13) Perhaps most useful for the Owner/Operator of Hotspots, programming changes can be done by most any user who has a reasonable amount of computer skills in the area being changed. By this, I mean “anybody” can change a user name, password, and user group or setup a new usergroup with different capabilities and bandwidth allocations. But while changing the bandwidth offered a user group is straightforward, the OO understand the basic area of bandwidth allocation on a network. Other changes similarly require that the user understand what he is doing. Routing changes demand that the user understand at least the basics of Linux ip table operation and setup.

14) The Mikrotik is undoubtedly an extremely complex system overall, but straightforward if you just need to put up a three port system in accord with my new Hotspot Application Note. The draft document is available at the link below. I am continuing to add features and it will be fleshing out more in the weeks to come. The basic hotspot and authentication all work fine and I am in the process of refining the firewall features. I will also be adding PPPoE as an option so the router can connect directly to a DSL or Cable modem. You can manually input the commands in just a couple of hours. See http://www.gpsinformation.org/hotspot/mikrotik_hotspot_article.html

Setup Mikrotik used as a wireless Hotspot server/authenticator

What we are trying to do:

The Mikrotik Router OS system is software designed to run on an "IBM type" Personal Computer. It has many capabilities including operating as a Wireless HotSpot controller, router, firewall, PPPoE controller, among many other capabilities. This router basically can be used to operate a small ISP. In our example, we are setting up a three port system which is designed to have one port going to the internet, a second to provide HotSpot services via an external access point and a third port to serve the user's local LAN. Separation and firewall protection is provided to prevent intrusion from the internet and from the HotSpot port into the user's local LAN. Be sure to verify the firewall protection for yourself. Advantages/Limitations of the Mikrotik Hotspot System as seen by the author can be viewed HERE.

The basic features that I need in this Home Hotspot installation are:

* Provide isolation of computers on my home LAN from internet traffic and users on the WIRELESS HotSpot Access Point. This needed to be done without the use of encription on the wireless link so "anyone" could easily log in without first getting permission.
* Allow my normal household internet traffic to/from the internet to use the same connection as traffic from my wireless HotSpot
* Allow traffic on the Internet to access my mail server and any other servers on my Home LAN.
* Provide "Casual" users of the Home HotSpot to "log in" and access their WebMail and normal Internet while limiting their bandwidth usage.
* Allow "Trusted" users of the Home Hotspot to "log in" to access whatever ports and services may be allowed for them on an individual basis.
* Allow "Me" to access anything I want to over the Wireless Hotspot connection to the local LAN or to the Internet.
* Provide the capability to have a direct PPPoE connection to a DSL/Cable modem or alternatively a direct connection to a router LAN port. LOCAL

See complate tutorial

Membangun hotspot dengan mikrotik

The MikroTik HotSpot Gateway enables providing of public network access for clients using wireless or wired network connections.

HotSpot Gateway features:

• authentication of clients using local client database, or RADIUS server
• accounting using local database, or RADIUS server
• Walled-garden system (accessing some web pages without authorization)

Quick Setup Guide

The most noticeable difference in user experience setting up HotSpot system in version 2.9 from the previous RouterOS versions is that it has become in order of magnitude easier to set up a correctly working HotSpot system.

Given a router with two interfaces: Local (where HotSpot clients are connected to) and Public, which is connected to the Internet. To set up HotSpot on the Local interface:

1. first, a valid IP config is required on both interfaces. This can be done with /setup command. In this example we will assume the configuration with DHCP server on the Local interface
2. valid DNS configuration must be set up in the /ip dns submenu
3. To put HotSpot on the Local interface, using the same IP address pool as DHCP server uses for that interface: /ip hotspot add interface=local address-pool=dhcp-pool-1
4. and finally, add at least one HotSpot user: /ip hotspot user add name=admin

These simple steps should be sufficient to enable HotSpot system

Please find many HotSpot How-to's, which will answer most of your questions about configuring a HotSpot gateway, at the end of this manual. It is still recommended that you read and understand all the Description section below before deploying a HotSpot system.

for complete configuration please visit:
http://www.mikrotik.com/testdocs/ros/2.9/ip/hotspot.php