Organizing guest internet access is a basic task for any network administrator, whether it's a small cafe, a corporate office, or a private home with frequent visitors. Guest network solves several problems at once: it separates visitor traffic from the owner's local resources, protects employees' personal data, and prevents overloading the main communication channel. In the ecosystem MikroTik The implementation of this functionality is flexible, allowing for the creation of both simple open access points and complex authorization systems with billing.
Unlike home routers, where the "Guest Network" feature often boils down to creating a separate SSID, RouterOS hardware offers deep control over each connected device. You can limit speeds, set session timeouts, redirect users to a login page, or simply block access to the local subnet. A critical aspect of designing such an architecture is the correct configuration of firewall rules, as errors in them can allow unauthorized access to the router's administrative panel.
In this article, we will look at two main approaches to implementation: creating an isolated guest network through VLAN and setting up a full-fledged portal HotSpotThe first option is ideal for situations where quick, unquestioned access is needed, while the second is better for commercial use or strict control. The choice of a specific method depends on security requirements and the required depth of user authentication.
Planning the topology and choosing an isolation method
Before configuring interfaces in WinBox or the terminal, it's important to clearly define the logical structure of the future network. The fundamental security principle is that guest devices should not be able to interact with devices on the main network. To implement this requirement, MikroTik The most commonly used technology is virtual local area networks VLAN or the creation of separate bridges Bridges with appropriate filtering rules.
If you are using a modern, affordable router that supports QuickSetA basic guest network can be deployed in a couple of clicks, but this method rarely provides the necessary level of traffic control. Professional setup requires isolating guest traffic to a separate IP range and enforcing strict rules. NAT And FirewallThis allows not only to isolate segments, but also to apply different routing policies.
- 📡 Separate Bridge: A simple method that creates a virtual switch for guest ports and Wi-Fi, but requires manual configuration of LAN access blocking rules.
- 🏷️ VLAN (802.1Q): A more complex, but correct approach that allows guest traffic to be transmitted over the same physical cables as the main traffic, but logically separating the data streams.
- 🔐 HotSpot: A system that requires authorization and, by its nature, isolates clients until they successfully log in.
When planning, it's important to consider the wireless interface's bandwidth. If you create a guest network on the same physical access point as the main network, the total airtime is shared among all clients. SSID The guest network will be broadcast at the same power as the main one, so physical separation here is impossible without installing additional equipment.
⚠️ Attention: The menu interfaces in RouterOS may differ depending on the firmware version (v6 or v7). In version 7.x, the menu structure Wireless has been significantly redesigned, and security settings have been moved to new configuration sections.
Creating a virtual interface and DHCP server
The first practical step is to create a logical interface that will serve guests. MikroTik This can be done by adding a virtual access point (Virtual AP) to an existing wireless interface or creating a new bridge. Let's start by looking at creating one. Virtual AP, as this is the most common scenario for expanding functionality without purchasing new hardware.
On the menu Wireless you need to create a new interface by selecting the type ap-bridge or station Depending on the task, but for the guest network we need access point mode. It's important to set a unique name. SSIDTo allow users to easily distinguish the guest network from the corporate one. Once the interface is created, it is assigned a separate IP address, which will serve as the gateway for all connected guests.
/interface wireless
add name="wifi-guest" master-interface="wifi1" ssid="Guest_Access" mode=ap-bridge band=2ghz-b/g/n frequency=2412
Next you need to configure DHCP server, which will automatically assign IP addresses to connecting devices. Without this component, clients will not be able to obtain network settings and access the internet. RouterOS has a user-friendly setup wizard. /ip dhcp-server setup, which allows you to quickly create an address pool, a network, and the server itself, binding them to a new interface.
- 📝 IP Pool: We create a pool of addresses, for example, 192.168.88.10-192.168.88.254, so that they do not intersect with the main network.
- 🌐 Network: We specify the gateway address (the router's IP in the guest interface) and DNS servers (you can use public ones from Google or your provider).
- 🖥️ Server: We start the DHCP service, binding it to the created pool and interface.
After setting up the DHCP server, it's worth testing its operation by connecting a mobile device to the new network. If the device receives an IP address from the created pool but there's no internet connection yet, this is normal, as routing and NAT rules haven't yet been configured. It's best to set the lease time for a guest network to a small value, such as 1 hour, so that addresses are released more quickly after visitors leave.
Configuring security and client isolation
The most important configuration step is ensuring security. By default, devices can attempt to communicate with each other even on different subnets unless restrictions are set. MikroTik the main instrument here is Firewall FilterWe need to create a rule that prohibits the initiation of connections from the guest network towards the local network (LAN).
The rule must be located in a chain forward, since the traffic passes through the router. We specify the source network (guest) and the destination address space (local), setting the action drop or rejectThe difference between them is that reject sends a notice of refusal, and drop simply ignores packets, which is often safer because it hides the presence of the filter.
| Parameter | Meaning | Description |
|---|---|---|
| Chain | forward | Processing chain for passing traffic |
| Src. Address | 192.168.88.0/24 | Guest network range |
| Dst. Address | 192.168.1.0/24 | Range of the protected local network |
| Action | drop | Connection blocking |
In addition, you need to activate the function Client-to-Client Forwarding (or its equivalent, depending on the software version) in the wireless interface settings. If this feature is disabled, clients connected to the same guest access point will not be able to "see" each other. This prevents the spread of viruses within the guest segment and protects users from port scanning by other visitors.
Don't forget to check your settings too Input Firewall chains. The guest network should not have access to router management services (WinBox, SSH, WebFig, API). The rule should block incoming connections from the guest interface to the router's IP address, with the possible exception of ICMP (ping) if you want to enable diagnostics.
⚠️ Attention: When setting up firewall rules, always add an allow rule for your IP address or trusted network before the deny rules. An error in the rule order can block you from managing the router, requiring a physical reset.
☑️ Checking guest network security
Setting up a HotSpot for user authorization
For high-traffic areas or commercial use, simply having a WPA2 password is often not enough. Protocol HotSpot V MikroTik Captive Portal allows all users to be redirected to a dedicated authorization page (Captive Portal) when attempting to access any website. It's the de facto standard for hotels, cafes, and airports, allowing them to collect statistics, display ads, or require a voucher code.
HotSpot setup begins with launching the wizard /ip hotspot setupIt will automatically create the necessary address pools, a DHCP server, DNS, and a HotSpot server. The key here is selecting the interface: it should be the interface created for guests (Virtual AP or Bridge). The wizard will also prompt you to select a login page template; the default template mikrotik can be replaced with custom HTML code for branding.
/ip hotspot
add address-pool=hs-pool-guest interface=bridge-guest name=hs1
Once HotSpot is activated, any HTTP request from a client will be intercepted by the router and redirected to the login page. HTTPS requests may not be redirected correctly due to encryption, so modern browsers often automatically open the login page when detecting a Captive Portal. You can create users locally through the menu. /ip hotspot user or connect an external server RADIUS for centralized access control.
A key HotSpot feature is the ability to set limits. You can limit the speed for each user, set account expiration dates, or set a traffic limit. For example, a guest can get one hour of free internet at 5 Mbps, after which the connection will be disconnected or a fee will be charged.
- 🕒 Uptime Limit: Limits the total time spent online (for example, 60 minutes per day).
- 📉 Rate Limit: Sets the maximum download and upload speed for one client.
- 💾 Data Limit: Terminates the connection after a certain amount of data has been transferred (e.g. 500 MB).
How do I change the appearance of the login page?
To replace the default login page, download the template files (including login.html) from the router directory via FTP or WinBox (Files). Edit the HTML code to include your company logo and any desired text, then upload the files back to the hotspot folder. The changes will take effect immediately after refreshing the page in the client browser.
Speed limiting and traffic management
Without speed monitoring, a guest network can become a bottleneck for the entire bandwidth. If one visitor starts downloading large files or watching 4K videos, it can paralyze the main office. MikroTik a mechanism is used to manage the bandwidth Simple Queues or more complex Queue TreeFor guest networks, simple queues are usually sufficient.
Create a new queue, specifying the guest subnet address or dynamically obtained addresses from the HotSpot pool as the Target. Set the parameters Max Limit for uploads and downloads. For example, a 10 Mbps limit for the entire guest network ensures that the main channel remains free for business tasks. If you need to limit each user individually, there's a field in the HotSpot settings Rate Limit.
Traffic prioritization is also worth considering. Even with limited bandwidth, some packets (such as VoIP or interactive requests) are prioritized over others. However, in guest networks, a "best effort" strategy with a hard speed cap is often used to keep the configuration simple. PCQ (Per Connection Queue) This can be useful if you want to distribute the remaining bandwidth evenly among all active guests.
Effective traffic management also includes blocking unwanted ports and protocols. Although modern internet traffic is predominantly encrypted (HTTPS), you can still block known ports for P2P networks or gaming servers at the firewall level if your organization's security policy requires it.
Diagnostics and monitoring of guest access
After setting up the system, you need to make sure that it works correctly. MikroTik There are powerful built-in monitoring tools. Window Wireless Table Shows all connected clients, signal strength (RSSI), connection speed, and uptime. This is the first line of diagnostics if a user complains of poor reception.
Use the tool to analyze traffic TorchIt allows you to see passing packets in real time, filtering them by interface, protocol, or address. By running Torch on the guest interface, you can see which websites users are visiting and how much data they are consuming. This helps identify anomalies, such as infected devices sending spam.
System logs also contain valuable information. In the log Log HotSpot authorization events (successful logins, password errors), interface state changes, and firewall rule triggers are displayed if action logging is configured. Regularly reviewing the logs helps identify unauthorized access attempts.
- 👁️ Wireless Table: Shows connection status, RSSI signal and CCQ (connection quality) for each client.
- 🔥 Torch: A real-time traffic sniffing tool, indispensable for finding "heavy" users.
- 📜 Logs: Contains a history of system events, including HotSpot login attempts and system errors.
Don't forget about remote monitoring. Configure logs to be sent to an external server or use SNMP to integrate with monitoring systems like Zabbix or PRTG. This will allow you to detect issues with your guest Wi-Fi even before the first customer complaint.
What if clients are not redirected to the HotSpot page?
Most often, the problem lies with DNS. Make sure the DHCP server is assigning the router's address as the DNS server. Also, check if your firewall is blocking DNS requests (port 53) from guests. If you're using HTTPS, your browser may be blocking the redirect. Try opening any HTTP site (e.g., example.com) to force the portal to open.
Is it possible to create a guest network without a password (Open Network)?
Yes, by setting the encryption mode to noneHowever, this is highly discouraged due to its low security. It's better to use HotSpot mode without a password (authorization by clicking "Login") or WPA2 with a shared simple password that is changed regularly.
How to limit access time for each guest?
In the HotSpot system, create a user and in the field Limit Uptime Specify the time (e.g. 01:00:00). After this time, the session will be automatically terminated. For time restrictions, you can also use the user profile with the parameter Uptime Limit.
Does a guest network affect the speed of the main network?
Physically, yes, since the airwaves are shared. Logically and in terms of priority, no, if queues are configured. Without speed limits ("Shape"), guests can take up the entire channel, so setting limits is essential for the main network to function comfortably.