Setting up Wi-Fi authentication using a phone number: A complete guide

Wi-Fi authentication using a phone number is a convenient way to control access to your network, combining ease of use for guests with a high level of security. Instead of handing out complex passwords or setting up separate accounts, users receive a one-time code via SMS. This method is widely used in hotels, coworking spaces, and offices, but it can also be implemented on a home network.

Today, we'll discuss how to set up this system on popular routers, which providers support SMS authentication, and how to avoid common mistakes. It's important to understand that implementation depends on the hardware model and your internet service provider's plan—some features may require a fee or additional modules.

In this article you will find:

• 🔧 Step-by-step instructions for routers TP-Link, Keenetic And MikroTik
• 📱 List of Russian providers supporting SMS authentication (updated 2026)
• 🔒 How to protect your network from unauthorized access when using phone authentication
• ⚡ Solutions to the 5 most common errors (from "SMS not arriving" to "router not detecting GSM module")

1. How does phone number authorization work: principles and diagrams

The SMS authorization system is built on the interaction of three components: router with CAPTIVE portal support, SMS gateway (service provider) and GSM module (or cloud service). When a user attempts to connect to Wi-Fi, they are redirected to a login page where they must enter their phone number. After that:

1. The router sends a request to the SMS gateway indicating the phone number.
2. The gateway generates a one-time code and sends it to the subscriber.
3. The user enters the code on the authorization page.
4. The router checks the code through the gateway and opens access to the network.

There are two main implementation schemes:

• 📶 Local: the router is connected to GSM module (For example, Huawei ME909s or Quectel EC25) and automatically sends SMS messages via a SIM card. Suitable for small networks, but requires purchasing equipment (~3,000–8,000 ₽).
• ☁️ Cloudy: the router is integrated with an external service (for example, SMS.RU, TurboSMS (Or specialized solutions from providers). There's no need for additional hardware, but there is a monthly subscription fee (from 500 rubles/month).

The key difference From the traditional password to temporary access. You can set up:

• ⏳ Session time (from 1 hour to 30 days)
• 📵 Traffic limit for guest users
• 🕒 Time of day restrictions (e.g. only from 9:00 AM to 6:00 PM)

⚠️ Attention: If you use cloud SMS gateway, make sure the service supports HTTP API for integration with your router. Some budget plans limit the number of SMS messages per month (for example, 100).

2. What equipment will you need: choosing a router and modules

Not every router supports SMS authentication. You'll need a model with:

• 🔄 CAPTIVE portal (welcome page upon connection)
• 📡 Possibility of integration with RADIUS server or SMS gateway
• 🔌 Slot for GSM module (if you choose a local scheme)

The table below shows tested router models and compatible modules:

For local scheme Additionally you will need:

• 📱 SIM card with an SMS tariff (preferably a corporate one to avoid being blocked for spam)
• 🔌 Powered USB hub (if the module is connected via USB and requires a lot of power)
• 🔧 GSM antenna (if the cellular network signal is weak in the room)

3. Step-by-step setup on TP-Link Omada routers

Routers of the series Omada allow you to set up SMS authorization via the built-in Controller or cloud service TP-Link CloudWe will consider a local option with a GSM module.

Step 1. Connecting the GSM module

1. Insert the SIM card into the module (e.g. Quectel EP06).
2. Connect the module to the USB port of the router (use a powered hub if necessary).
3. Go to Settings → System → USB modules and make sure that the device is detected.

Step 2. Setting up the CAPTIVE portal

1. Open Controller (web interface or application Omada App).
2. Go to Settings → Wireless → Guest Network.
3. Activate the option Enable the Welcome Portal.
4. In the section Authentication select SMS.

Step 3. Integration with the SMS gateway

IN Controller go to Settings → Portal → SMS Gateway and indicate:

• 📞 Phone number (from which SMS will be sent)
• 🔑 AT commands for your module (example for Quectel:

AT+CMGF=1
AT+CMGS="+7XXXXXXXXXX"
> Your access code: {code}
[Ctrl+Z]

Step 4. Testing

Connect to the guest network from your phone. You should see a page with a field to enter a number. After submitting the request, you will receive an SMS with a code. If you don't receive the code:

• 🔄 Reboot the GSM module (sometimes physically disconnecting/connecting it helps).
• 📶 Check the signal level in Settings → System → USB modules.
• 💰 Make sure you have enough funds on your SIM card (some operators block sending SMS messages if your balance is empty).

The GSM module is connected and detected in the system|The SIM card is activated and has a positive balance|The CAPTIVE portal is enabled in the router|AT commands for sending SMS are configured|The guest network is separated from the main network (VLAN)-->

4. Setting up Keenetic: cloud and local options

Routers Keenetic They offer two ways to implement SMS authorization: through their own cloud service or using an external GSM module. Let's look at both.

Option 1. Keenetic Cloud service (paid)

This method doesn't require a GSM module, but it does incur a subscription fee (starting at 300 rubles/month for 100 SMS messages). Instructions:

1. Register in Keenetic Cloud (link for example, not clickable in the article).
2. In the router's web interface, go to Guest Network → Authorization Portal.
3. Select SMS authorization via Keenetic Cloud.
4. Specify your monthly SMS limit and customize your message template.

Option 2. Local GSM module

For this method you will need a USB module (for example, SIM7600) and SIM card. Algorithm:

1. Connect the module to the USB port of the router.
2. IN System → Devices check that the module is identified as /dev/ttyUSB0 (or similar).
3. Install the component SMS gateway V General Settings → Components.
4. IN Guest Network → Portal → SMS configure the parameters:

Port: /dev/ttyUSB0
Speed: 115200
AT command to send: AT+CMGS="{phone}"{CR}{message}{Ctrl+Z}

Keenetic allows you to flexibly configure access rules. For example, you can:

• 📅 Limit the code's validity period (default: 5 minutes).
• 🚫 Block re-sending SMS to the same number more than once every 10 minutes.
• 📊 Maintain a connection log linked to phone numbers.

⚠️ Attention: When using SIM7600 in routers Keenetic may need to be disabled USB modem mode In the module settings via AT commands. Otherwise, the router will treat it as a 4G modem, not an SMS gateway.

5. MikroTik: Professional setup with RADIUS and SMS

Routers MikroTik offer maximum flexibility but require knowledge Winbox And CLIWe will set up authorization through RADIUS server (For example, FreeRADIUS) and SMS gateway.

Step 1. Installing FreeRADIUS on the server

On the server (can be used Ubuntu Server or Debian) execute:

sudo apt update
sudo apt install freeradius freeradius-utils
sudo systemctl enable freeradius
sudo systemctl start freeradius

Step 2. Configuring RADIUS in MikroTik

1. IN Winbox go to RADIUS → Clients and add a new client with your router's IP.
2. IN RADIUS → Servers Please enter the address of your RADIUS server.
3. IN IP → HotSpot Create a new profile with RADIUS authentication.

Step 3. SMS Gateway Integration

On the server with FreeRADIUS install the script for sending SMS (example on Python using SMS.RU API):

import requests

def send_sms(phone, code):
url = "https://sms.ru/sms/send"
params = {
"api_id": "YOUR_API_KEY",
"to": phone,
"text": f"Your access code: {code}"
}
response = requests.get(url, params=params)
return response.json()

Step 4: Setting up HotSpot in MikroTik

IN IP → HotSpot → Walled Garden Add exceptions for SMS gateway domains so that the authorization page loads without an internet connection:

/ip hotspot walled-garden
add dst-host=sms.ru

To test, connect to the network HotSpotYou should see a page with a field for a phone number. After entering the number, a request will be sent to the server, the script will send an SMS, and RADIUS will confirm access.

tail -f /var/log/freeradius/radius.log

6. Choosing an SMS gateway provider: comparing tariffs and features

If you don't want to mess with GSM modules, you can use cloud-based SMS gateways. Below is a comparison of popular services in Russia (data is current as of 2026):

When choosing, pay attention to:

• 🕒 SMS delivery speed (some providers have a delay of up to 30 seconds).
• 📡 Geography of numbers (not all services support sending to numbers in other countries).
• 🔒 Spam protection (For example, SMS.RU blocks sending identical messages to different numbers).

Important: service MQTT-SMS allows you to send messages via the MQTT protocol, which is convenient for integration with smart home systems (for example, Home Assistant). However, this will require setting up an MQTT broker on your server.

⚠️ Attention: Some telecom operators (eg Tele2) may block bulk SMS sending from new SIM cards. If you use a local GSM module, check with your mobile phone store in advance about messaging restrictions.

7. Security: How to protect your network from SMS hacking

Phone number authentication is convenient, but it has its vulnerabilities. Here are the key security measures:

1. Limit the number of attempts

Set a limit on the number of unsuccessful attempts to enter the code on your router (for example, 3 attempts in 10 minutes). MikroTik This is done through:

/ip hotspot user profile
set [find] shared-users=1 rate-limit=3/10m

2. Two-factor authentication (2FA)

Combine SMS with another verification method. For example, in Keenetic Can:

• 🔐 Require email confirmation after entering the SMS code.
• 🤖 Use Google Authenticator for regular users.

3. Network segmentation

The guest network with SMS authentication must be isolated from the main network. Configure:

• 🌐 Separate VLAN for guest devices.
• 🚫 Blocking access to local resources (printers, NAS).
• ⚡ Speed ​​limitation (e.g. 10 Mbps per user).

4. Monitoring connections

Keep a log of authorizations linked to:

• 📱 Phone number
• 🖥️ The device's MAC address
• ⏱️ Connection time

IN TP-Link Omada This is configured in Controller → Logs → Guest Network.

5. Protection against SIM-swap attacks

Attackers can reissue a victim's SIM card and gain network access. To mitigate this risk:

• 🔄 Update your list of allowed numbers regularly (for example, once a month).
• 📵 Send a notification to the network owner the first time a new number is connected.

8. Common mistakes and their solutions

When setting up SMS authentication, users encounter common issues. Let's look at the most common ones:

Additional tips:

• 🔄 If SMS messages stop being sent after updating the router firmware, reset the module settings to factory settings (AT&F).
• 📡 To improve GSM signal, use an external antenna with amplification 3–5 dBi.
• 🕒 If SMS messages are delayed, check the load on your SMS gateway (the request per second limit may have been reached).

⚠️ Attention: On routers ASUS and some models D-Link There is no built-in support for SMS authorization. These devices will require an additional server (for example, on Raspberry Pi) With FreeRADIUS and a script for sending SMS.

FAQ: Answers to frequently asked questions