HotSpot · Topic 3 of 5

HotSpot Users and Monitoring

Create HotSpot users and user profiles on RouterOS, set limits for time, data and speed, and monitor logged in users with the active and host lists.

6 min

In a nutshell

Users are created in /ip hotspot user and take rules from a user profile.
User profiles are separate from server profiles.
rate-limit is written upload first and download second.

What it is

HotSpot users are the accounts that can log in, and monitoring shows who is connected and what they use.

Each user has a name and a password, and optional limits. A user profile groups settings so that many users share the same rules.

The active and host lists show the live state of the service, and they are the main tools for support work.

How it works

You create users and profiles, and then read the live lists to see what happens.

Creating users

/ip hotspot user add name=guest1 password=Pass123 profile=day-pass limit-uptime=1h

Setting	What it does
`name` and `password`	The login credentials.
`profile`	The user profile that holds shared rules.
`limit-uptime`	Total connected time allowed for the account.
`limit-bytes-in` and `limit-bytes-out`	Data limits in each direction.
`limit-bytes-total`	A combined data limit.
`address`	A fixed address for this user.
`mac-address`	Restricts the account to one device.
`server`	Restricts the account to one HotSpot server.
`comment`	A note, useful for room numbers or ticket ids.

When a limit is reached, the user can no longer log in. The account stays in the list with its counters.

User profiles

User profiles are different from server profiles. A user profile holds rules for users, not for the service.

/ip hotspot user profile add name=day-pass rate-limit=1M/4M session-timeout=4h idle-timeout=10m shared-users=1

Setting	What it does
`rate-limit`	Speed limit, upload first and then download.
`session-timeout`	Maximum length of one session.
`idle-timeout`	Drops a user after a period without traffic.
`keepalive-timeout`	Drops a user whose device stops answering.
`shared-users`	How many devices can use one account at once.
`add-mac-cookie`	Lets the router remember the device after login.

The difference between session-timeout and limit-uptime matters. The session timeout ends one session. The uptime limit is a total for the account across all sessions.

Profile settings that hook into the firewall

A user profile can also hand logged in users to the firewall and the queues. These settings are the same in RouterOS v6 and v7.

Setting	What it does
`address-list`	Adds the address of each logged in user to this firewall address list.
`incoming-filter`	Name of a firewall chain that checks packets coming from the user.
`outgoing-filter`	Name of a firewall chain that checks packets going to the user.
`incoming-packet-mark`	Packet mark put on packets coming from the user.
`outgoing-packet-mark`	Packet mark put on packets going to the user.

An address list lets one firewall rule act on a whole group of users.

/ip hotspot user profile set day-pass address-list=hs-day
/ip firewall filter add chain=forward src-address-list=hs-day protocol=tcp dst-port=25 action=drop

A filter chain is a chain you create yourself, named in the profile.

/ip hotspot user profile set day-pass incoming-filter=hs-in outgoing-filter=hs-out
/ip firewall filter add chain=hs-in protocol=udp dst-port=53 action=accept

A packet mark is matched later by a mangle rule or a queue. A queue tree entry can limit all traffic that carries the mark.

/ip hotspot user profile set day-pass incoming-packet-mark=hs-up outgoing-packet-mark=hs-down
/queue tree add name=hs-down parent=global packet-mark=hs-down max-limit=10M

Shared accounts

With shared-users=1, a second device that logs in with the same account is refused while the first is active. A higher value allows more devices to share the account.

Monitoring active users

/ip hotspot active print

The active list shows each logged in user with the address, the MAC address, the uptime, the idle time and the data used. To end a session, remove the entry.

/ip hotspot active remove [find user=guest1]

The user is logged out and must log in again.

SNMP for HotSpot users

The Simple Network Management Protocol (SNMP) lets a monitoring system poll the router for logged in users. Enable the service on the router first.

/snmp set enabled=yes

The HotSpot data is in the mtxrHotspot part of the MikroTik MIB (management information base). Load that MIB in the monitoring tool, and restrict who can poll the router with the SNMP community and firewall rules.

The host list

/ip hotspot host print

The host list shows every device the HotSpot has seen on the interface, whether or not it logged in. It shows the address and the MAC address of each. Flags show whether a host is authorised or bypassed.

Use the host list when a device has no access. If it is missing from the list, it never reached the HotSpot. If it is present but not authorised, it has not logged in.

Counters and limits

The user list shows the uptime and the bytes used by each account. Reset them when a new period starts.

/ip hotspot user reset-counters [find name=guest1]

Logging

The HotSpot can write login and logout events to the log. Turning on the HotSpot topic in logging helps when you have to prove or trace who used the service.

/system logging add topics=hotspot action=memory

What to remember for the exam

Seven facts cover most user and monitoring questions.

Users are created in /ip hotspot user and take rules from a user profile.
User profiles are separate from server profiles.
rate-limit is written upload first and download second.
limit-uptime is a total for the account, and session-timeout is for one session.
shared-users controls how many devices can use one account at once.
/ip hotspot active print shows logged in users, and removing an entry logs the user out.
/ip hotspot host print shows all devices seen, logged in or not.

Exam tip

When a guest says they have no access, look in the host list first, and then in the active list.

Common mistakes

These four errors appear again and again.

Mixing up the two profile types. A user profile holds rules for users. A server profile holds service settings.

Confusing session timeout with uptime limit. One ends a session, and the other caps the whole account.

Leaving shared-users at one for families. A second device is refused while the first is still on.

Forgetting to reset counters. A limited account stays blocked until you reset or replace it.

Watch out

Removing an active entry logs the user out at once. Do it only when you mean to.

Check yourself

Work through these three questions.

What is the difference between limit-uptime and session-timeout?
limit-uptime caps the total connected time of the account. session-timeout ends a single session.
What does shared-users=1 do?
It allows only one device at a time to use the account.
Which two lists help find out why a device has no access?
/ip hotspot host print shows every device seen, and /ip hotspot active print shows logged in users.

Topic 3 of 5 in HotSpot

Test yourself on HotSpot

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.