cAP, hAP, wAP (RouterOS, CAPsMAN)Router/APDirect
Hotspot-Box with MikroTik
MikroTik cAP, hAP and wAP devices on RouterOS connect to Hotspot-Box directly. The setup is more technical than with other brands: you carry the guest SSID to the box's LAN side with bridge VLAN filtering or CAPsMAN. In return the flexibility is high. Do not use RouterOS's own hotspot service; the login screen and Law 5651 records stay on the box. Menu and command names change between RouterOS versions, so we describe each setting by its function.
The one setting that changes on the AP
Bind the guest SSID to the VLAN that exits to the box's LAN using bridge VLAN filtering, and keep the RouterOS hotspot service off on that interface.
Step by step
- 1
Create a separate wireless interface / virtual AP for guests (a separate configuration in CAPsMAN) and give it the guest VLAN ID.
- 2
Enable VLAN filtering on the bridge; define the guest VLAN as tagged on the ethernet port towards the box and as access (pvid) on the guest wireless interface.
- 3
Keep the RouterOS hotspot service and any DHCP server on the guest interface off; the box provides addresses and the login screen.
- 4
Disable client-to-client traffic on the wireless interface (default forwarding off) so guest devices cannot see each other.
- 5
If you use CAPsMAN, push the same VLAN setting to all cAPs; local and centralised forwarding handle VLANs differently, pick one and stay consistent.
- 6
Join the guest SSID with a phone; the box's screen should open and the SMS code should get you online.
Common traps
The RouterOS hotspot service clashes with the box's login screen; it must be off on the guest interface.
Enabling bridge VLAN filtering before tagging the port towards the box can cut your own management access; work in safe mode first.
If the hAP acts as a router, the guest VLAN must not exit through its NAT; guest traffic has to reach the box's LAN.
Forcing DNS in RouterOS (dst-nat on port 53) breaks the box's login screen; leave DNS alone on the guest VLAN.
Most cAP models need passive PoE; check the model before powering it from an 802.3af/at switch.
Frequently asked
RouterOS has its own hotspot service. Why the box?
RouterOS hotspot alone does not provide the time-stamped, chained record structure and the SMS verification Law 5651 expects. The box takes that over; MikroTik only handles the Wi-Fi and VLAN side.
Can I use MikroTik as a RADIUS client?
Yes. RouterOS can be registered with the box's RADIUS server as a NAS. Most setups run in bridge mode; add RADIUS only if you need it.
Can one hAP both route behind the modem and serve guest Wi-Fi?
Yes: the hAP routes, the guest VLAN is carried to the box's LAN, and the box reaches the internet through the hAP. Since the setup is technical, ask your reseller or us for help.
Menu names and locations change with firmware versions; this page describes each setting by its function. Screenshots are available from your installer or from us.