HotSpot · Topic 4 of 5

HotSpot Server Profile

Learn the RouterOS HotSpot server profile: login by, DNS name, HTML directory, cookie lifetime, RADIUS and certificate settings, and the user profile.

4 min

In a nutshell

The server profile is at /ip hotspot profile and is used by the HotSpot server.
login-by and ssl-certificate live in the server profile.
dns-name gives the login page a stable name.

What it is

The HotSpot server profile holds the settings that describe how a HotSpot server behaves for all of its users.

It decides which login methods are allowed, which pages are shown, and whether users are checked locally or by RADIUS. A HotSpot server uses one profile, and several servers can share the same profile.

It should not be confused with the user profile, which sets limits for individual users.

How it works

The server points to a profile, and the profile controls login, pages, naming and authentication.

Where the profile is used

/ip hotspot profile print
/ip hotspot set hotspot1 profile=hsprof1

The wizard creates a profile and gives the server a reference to it. You can edit that profile or create a new one and point the server at it.

Main settings

Setting	What it does
`hotspot-address`	The address of the HotSpot on the interface.
`dns-name`	The name of the login page host.
`html-directory`	The folder that holds the login page files.
`login-by`	The login methods that are allowed.
`ssl-certificate`	The certificate used for HTTPS login.
`http-cookie-lifetime`	How long a login cookie stays valid.
`use-radius`	Checks users against RADIUS servers.
`split-user-domain`	Separates a name and a domain in the user name.
`smtp-server`	The mail server the service uses to relay mail.
`http-proxy`	An HTTP proxy used for client traffic.

Server profile and user profile

Feature	Server profile	User profile
Menu	`/ip hotspot profile`	`/ip hotspot user profile`
Applies to	The HotSpot server and all its users	Users who belong to it
Holds	Login methods, pages, DNS name, RADIUS	Rate limit, timeouts, shared users
Chosen by	The server	The user account

A common exam trap asks which profile holds login-by. The answer is the server profile.

DNS name and address

The dns-name gives the login page a stable name. Clients are sent to that name instead of an IP address.

/ip hotspot profile set hsprof1 dns-name=login.example.local hotspot-address=10.5.50.1

For HTTPS login, the certificate should match this name. Without a match, browsers show a warning.

Login methods and cookies

The login-by setting enables the methods covered on the login methods page. If you enable cookie, the http-cookie-lifetime setting sets how long the cookie stays valid.

RADIUS

With use-radius=yes, the router sends authentication requests to the RADIUS servers that are defined in /radius for the HotSpot service. The user then does not need a local entry.

/ip hotspot profile set hsprof1 use-radius=yes

RADIUS can also supply limits, such as a rate limit, for each user. The RADIUS chapter covers the client in detail.

HTML directory

The html-directory names the folder with the login page files. The default folder is created by the wizard. To customise the pages, copy that folder, edit the copy and point the profile at it.

/ip hotspot profile set hsprof1 html-directory=hotspot-custom

Sharing a profile

Two HotSpot servers on two interfaces can use one profile. They then share login methods and pages. Use separate profiles when the servers need different rules, for example a guest network and a staff network.

Verification

/ip hotspot profile print
/ip hotspot print

The profile list shows each profile with its main settings. The server list shows which profile each server uses.

What to remember for the exam

Seven facts cover most profile questions.

The server profile is at /ip hotspot profile and is used by the HotSpot server.
login-by and ssl-certificate live in the server profile.
dns-name gives the login page a stable name.
use-radius=yes checks users against RADIUS.
html-directory names the folder with the login pages.
http-cookie-lifetime sets how long a login cookie lasts.
The user profile sets limits for users and is a different object.

Exam tip

If a setting is about how users log in or what the page looks like, it belongs in the server profile.

Common mistakes

These four errors appear again and again.

Editing the wrong profile. Rate limits per user belong in the user profile, and login methods belong in the server profile.

A certificate that does not match the DNS name. Browsers warn, and users stop.

Enabling RADIUS with no RADIUS client. Logins fail because no server is defined.

Editing the default pages in place. A copy is safer, because the original is the one you can return to.

Watch out

Setting use-radius=yes without a working RADIUS server means RADIUS users cannot log in. Test with one user first.

Check yourself

Work through these three questions.

Which profile holds login-by, and which holds shared-users?
The server profile holds login-by. The user profile holds shared-users.
What does use-radius=yes do in the server profile?
The router checks users against the RADIUS servers defined in /radius.
What is html-directory for?
It names the folder that holds the login page files, so you can point the profile at a customised copy.

Topic 4 of 5 in HotSpot

Test yourself on HotSpot

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.