{"id":1690,"date":"2026-09-21T11:54:44","date_gmt":"2026-09-21T08:54:44","guid":{"rendered":"https:\/\/pawa.co.ke\/blog\/?p=1690"},"modified":"2026-09-21T11:54:44","modified_gmt":"2026-09-21T08:54:44","slug":"mikrotik-router-setup-for-hotspot-kenya","status":"publish","type":"post","link":"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/","title":{"rendered":"MikroTik Router Setup for Hotspot Kenya: 2026 Guide"},"content":{"rendered":"<div>\n<div>\n<div role=\"feed\" aria-label=\"Chat messages\" aria-describedby=\"_r_1es_\">\n<div>\n<div>\n<div tabindex=\"0\" role=\"article\" aria-setsize=\"78\" aria-posinset=\"78\" aria-label=\"Message 78 of 78\">\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<h2 dir=\"ltr\"><a href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-network-monitoring-nairobi\/chatgpt-image-sep-2-2026-11_43_24-am\/\" rel=\"attachment wp-att-1581\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1581\" src=\"https:\/\/pawa.co.ke\/blog\/wp-content\/uploads\/2026\/09\/ChatGPT-Image-Sep-2-2026-11_43_24-AM.png\" alt=\"MikroTik router setup for hotspot Kenya\" width=\"1254\" height=\"1254\" srcset=\"https:\/\/pawa.co.ke\/blog\/wp-content\/uploads\/2026\/09\/ChatGPT-Image-Sep-2-2026-11_43_24-AM.png 1254w, https:\/\/pawa.co.ke\/blog\/wp-content\/uploads\/2026\/09\/ChatGPT-Image-Sep-2-2026-11_43_24-AM-300x300.png 300w, https:\/\/pawa.co.ke\/blog\/wp-content\/uploads\/2026\/09\/ChatGPT-Image-Sep-2-2026-11_43_24-AM-1024x1024.png 1024w, https:\/\/pawa.co.ke\/blog\/wp-content\/uploads\/2026\/09\/ChatGPT-Image-Sep-2-2026-11_43_24-AM-150x150.png 150w, https:\/\/pawa.co.ke\/blog\/wp-content\/uploads\/2026\/09\/ChatGPT-Image-Sep-2-2026-11_43_24-AM-768x768.png 768w\" sizes=\"auto, (max-width: 1254px) 100vw, 1254px\" \/><\/a><\/h2>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#MikroTik_Router_Setup_for_Hotspot_Kenya_Configuring_the_Box_That_Runs_Your_Business\" >MikroTik Router Setup for Hotspot Kenya: Configuring the Box That Runs Your Business<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#What_the_Router_Actually_Does_in_a_Hotspot\" >What the Router Actually Does in a Hotspot<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Choosing_Hardware_by_Concurrent_Users\" >Choosing Hardware by Concurrent Users<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#RouterOS_Licence_Levels\" >RouterOS Licence Levels<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Before_You_Start_Updates_Backups_and_IP_Planning\" >Before You Start: Updates, Backups and IP Planning<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#MikroTik_Router_Setup_for_Hotspot_Kenya_The_Base_Configuration\" >MikroTik Router Setup for Hotspot Kenya: The Base Configuration<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Running_the_Hotspot_Setup\" >Running the Hotspot Setup<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#User_Profiles_Speeds_and_Shared_Devices\" >User Profiles, Speeds and Shared Devices<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Queues_and_Fairness_Across_the_Whole_Network\" >Queues and Fairness Across the Whole Network<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#The_Walled_Garden_and_the_Payment_Flow\" >The Walled Garden and the Payment Flow<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Connecting_to_a_Billing_Platform_API_and_RADIUS\" >Connecting to a Billing Platform: API and RADIUS<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Access_Points_and_CAPsMAN\" >Access Points and CAPsMAN<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Client_Isolation\" >Client Isolation<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Securing_a_MikroTik_Router_Setup_for_Hotspot_Kenya\" >Securing a MikroTik Router Setup for Hotspot Kenya<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Time_DNS_and_Logging\" >Time, DNS and Logging<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Running_PPPoE_Alongside_the_Hotspot\" >Running PPPoE Alongside the Hotspot<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Diagnosing_a_Slow_Network\" >Diagnosing a Slow Network<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Monitoring_and_Remote_Management\" >Monitoring and Remote Management<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Compliance_and_Doing_It_Properly\" >Compliance and Doing It Properly<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#When_to_Get_Help_With_MikroTik_Router_Setup_for_Hotspot_Kenya\" >When to Get Help With MikroTik Router Setup for Hotspot Kenya<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Mistakes_Operators_Make\" >Mistakes Operators Make<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/pawa.co.ke\/blog\/mikrotik-router-setup-for-hotspot-kenya\/#Frequently_Asked_Questions\" >Frequently Asked Questions<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"MikroTik_Router_Setup_for_Hotspot_Kenya_Configuring_the_Box_That_Runs_Your_Business\"><\/span>MikroTik Router Setup for Hotspot Kenya: Configuring the Box That Runs Your Business<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p dir=\"ltr\"><a href=\"https:\/\/pawa.co.ke\">MikroTik router setup for hotspot Kenya<\/a> is where most WiFi businesses are quietly won or lost. The access points get the attention because they are visible. The billing platform gets the attention because it takes the money. But the router in the cabinet decides whether users actually get the speed they paid for, whether one heavy streamer can flatten a whole building, whether payment pages load before login, and whether a curious student can walk into your admin interface. A network that feels slow for reasons nobody can diagnose is almost always a router configured in a hurry.<\/p>\n<p dir=\"ltr\"><a href=\"https:\/\/zama.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> is not difficult, but it rewards doing things in the right order.<\/p>\n<p dir=\"ltr\">This guide walks through hardware, licensing, the base configuration, the hotspot itself, billing integration and security. Commands are illustrative and based on RouterOS v7; syntax differs between versions, so check against your own device before running anything. The principles of <a href=\"https:\/\/dexa.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> hold regardless of version.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"What_the_Router_Actually_Does_in_a_Hotspot\"><\/span>What the Router Actually Does in a Hotspot<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">In a hotspot network the MikroTik is doing five jobs at once, and weakness in any one of them shows up as a customer complaint.<\/p>\n<p dir=\"ltr\">It is the gateway, routing traffic between your users and the upstream internet connection. It hands out IP addresses through DHCP. It runs the captive portal that stops unauthenticated users and presents the login or payment page. It enforces speed limits and session limits per user. And it talks to your billing platform so that payments turn into access automatically. <a href=\"https:\/\/pawa.co.ke\">MikroTik router setup for hotspot Kenya<\/a> has to get all five right together.<\/p>\n<p dir=\"ltr\">The hotspot feature itself intercepts unauthenticated traffic and redirects it to a login page. Once a user authenticates \u2014 by voucher, by payment, or by username and password \u2014 the router applies their profile and lets traffic through.<\/p>\n<p dir=\"ltr\">Behind that simple description sit decisions about addressing, DNS, NAT, queues, walled gardens and security, each of which can be done well or badly. Most slow-network complaints in <a href=\"https:\/\/pms.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> trace back to one of those decisions rather than to bandwidth.<\/p>\n<p dir=\"ltr\">Understanding the five jobs also tells you where to look when something breaks. Users who cannot see the login page have a DNS or redirect problem. Users who pay and stay offline have a billing-integration problem. Users who log in and crawl have a queue or capacity problem. That diagnostic map is worth more than any single command in <a href=\"https:\/\/estateadmin.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Choosing_Hardware_by_Concurrent_Users\"><\/span>Choosing Hardware by Concurrent Users<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">The most common hardware mistake is buying a router sized for today&#8217;s user count rather than next semester&#8217;s.<\/p>\n<p dir=\"ltr\">Size by concurrent active users at peak, not by total registered customers. A hostel with four hundred customers may have two hundred online at nine in the evening, and that evening number is what the router must handle. <a href=\"https:\/\/churchesadmin.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> planning starts from your survey figures for the busiest hour.<\/p>\n<p dir=\"ltr\">Small sites \u2014 a rental plot, a caf\u00e9, a small office \u2014 run comfortably on MikroTik&#8217;s hAP range. They are inexpensive, low-power and adequate for modest concurrent users.<\/p>\n<p dir=\"ltr\">Medium sites with a few hundred concurrent users need more processing headroom, particularly once queues, firewall rules and hotspot authentication are all running. The RB5009 and RB4011 families are common choices at this level. Undersizing here produces exactly the slowness nobody can diagnose, which is why <a href=\"https:\/\/vega.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> should err toward more capacity rather than less.<\/p>\n<p dir=\"ltr\">Large sites, multi-building networks and small ISPs move into the CCR range, where processing capacity matters more than wireless features.<\/p>\n<p dir=\"ltr\">Separate the router from the wireless. A dedicated router in the cabinet plus separate access points across the building scales far better than trying to make one device do everything, and it is the standard architecture for any serious <a href=\"https:\/\/dereva.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Buy from established Kenyan distributors with warranty support. Counterfeit and grey-market networking equipment circulates in the local market and fails early.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"RouterOS_Licence_Levels\"><\/span>RouterOS Licence Levels<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">RouterOS licences carry a level, and that level affects how many hotspot users can be active at once \u2014 a detail that catches many new operators.<\/p>\n<p dir=\"ltr\">Each MikroTik device ships with a licence level determined by its model. Lower levels cap concurrent active hotspot users; higher levels raise or remove that cap. <a href=\"https:\/\/jaat.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> should begin by checking the licence level of the exact device you intend to use against your expected peak concurrent users.<\/p>\n<p dir=\"ltr\">You can see the level in the system licence menu once the device is running. Check it before you commit to a hardware model, not after the site fills.<\/p>\n<p dir=\"ltr\">Licence levels on RouterBOARD hardware are tied to the device rather than purchased separately in most cases, which means choosing the right model is the practical way to get the right level for your <a href=\"https:\/\/wito.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>. MikroTik&#8217;s own documentation lists current limits by level, and it is worth checking there directly since details can change.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Before_You_Start_Updates_Backups_and_IP_Planning\"><\/span>Before You Start: Updates, Backups and IP Planning<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">Three pieces of preparation save hours of rework later.<\/p>\n<p dir=\"ltr\">Update RouterOS and the RouterBOARD firmware before configuring anything. Running an old version on a new install means fixing known bugs and security issues you did not need to inherit. <a href=\"https:\/\/awasam.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> should always begin on a current stable release.<\/p>\n<p dir=\"ltr\">Reset to a clean configuration if the device came from elsewhere or has a factory default you do not intend to use. Building on a half-understood default is how conflicting rules end up in production.<\/p>\n<p dir=\"ltr\">Plan your IP addressing. Decide the subnet for hotspot users, sized for peak concurrent devices with room to grow, and a separate subnet for management and any staff or point-of-sale devices. A \/24 hotspot subnet is too small for many hostels once each student brings two devices, and resizing a live network is disruptive, which is why address planning matters in any <a href=\"https:\/\/saseni.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Take a backup the moment the base configuration works, and another after each significant change. Export the configuration as text as well as saving a binary backup, because a readable export is what lets you rebuild on replacement hardware quickly \u2014 a habit that protects every <a href=\"https:\/\/prim.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Label the physical ports and document which one is WAN, which feeds the access points and which is management. A technician attending an outage at night should not have to guess.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"MikroTik_Router_Setup_for_Hotspot_Kenya_The_Base_Configuration\"><\/span>MikroTik Router Setup for Hotspot Kenya: The Base Configuration<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\"><a href=\"https:\/\/rentaldesk.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> needs a working routed network before the hotspot is layered on top, and skipping this step is where most problems begin.<\/p>\n<p dir=\"ltr\">First, the WAN. Configure the upstream interface to receive its address from your ISP, either by DHCP client, static assignment or PPPoE client depending on the connection. Confirm the router itself can reach the internet before going further.<\/p>\n<p dir=\"ltr\">Second, the LAN. Create a bridge for the interfaces that will carry user traffic, assign the router an address on the hotspot subnet, and configure a DHCP server for that subnet with a sensible lease time. Shorter leases suit busy transient sites like caf\u00e9s; longer ones suit hostels. Getting lease time right is a small but real part of <a href=\"https:\/\/fama.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Third, DNS. Point the router at reliable upstream resolvers and allow it to answer DNS for clients. The hotspot relies on DNS behaving correctly to redirect unauthenticated users.<\/p>\n<p dir=\"ltr\">Fourth, NAT. Add a masquerade rule on the WAN interface so traffic from the private hotspot subnet can reach the internet.<\/p>\n<p dir=\"ltr\">An illustrative sequence on RouterOS v7 looks like this, with interface names and addresses adapted to your site:<\/p>\n<div>\n<div tabindex=\"0\" role=\"group\" aria-label=\"Code\">\n<div>\n<div><\/div>\n<\/div>\n<div>\n<pre><code>\/interface bridge add name=bridge-hotspot\r\n\/ip address add address=10.10.0.1\/22 interface=bridge-hotspot\r\n\/ip pool add name=hs-pool ranges=10.10.0.10-10.10.3.250\r\n\/ip dhcp-server add name=hs-dhcp interface=bridge-hotspot address-pool=hs-pool lease-time=2h\r\n\/ip dhcp-server network add address=10.10.0.0\/22 gateway=10.10.0.1 dns-server=10.10.0.1\r\n\/ip dns set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8\r\n\/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<p dir=\"ltr\">Test that a device plugged into the LAN gets an address and can browse before enabling the hotspot. If it cannot, the hotspot will not fix it, and debugging two layers at once is the slowest way through a <a href=\"https:\/\/spacekits.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Running_the_Hotspot_Setup\"><\/span>Running the Hotspot Setup<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">Once the base network works, the hotspot itself is quick to enable.<\/p>\n<p dir=\"ltr\">RouterOS includes a hotspot setup wizard that walks through the interface, address pool, SSL certificate, DNS name and an initial user. For most operators the wizard produces a sound starting configuration, which you then refine. <a href=\"https:\/\/dexa.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> through the wizard is perfectly acceptable practice.<\/p>\n<p dir=\"ltr\">Choose the hotspot interface carefully: it should be the bridge carrying user traffic, not the WAN or a management port.<\/p>\n<p dir=\"ltr\">Set a DNS name for the hotspot login page if you intend to use HTTPS on the portal, and install a valid certificate for it. A login page that triggers browser security warnings looks suspicious to users and reduces payment completion, so certificate handling deserves attention in any <a href=\"https:\/\/pawa.co.ke\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Replace the default login page with your own branded portal or the one supplied by your billing platform. The default MikroTik page works, but users trust a page that clearly belongs to the provider they are paying.<\/p>\n<p dir=\"ltr\">Configure login methods to match how you sell: HTTP CHAP or PAP for username and password, MAC-based convenience where appropriate, and whatever your billing platform expects for voucher or payment-based login.<\/p>\n<p dir=\"ltr\">Set idle and session timeouts deliberately. An idle timeout that is too long holds sessions open for devices that left hours ago; one that is too short forces paying users to log in repeatedly, which generates support tickets. Balancing the two is a practical judgement in <a href=\"https:\/\/pms.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"User_Profiles_Speeds_and_Shared_Devices\"><\/span>User Profiles, Speeds and Shared Devices<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">User profiles are where packages become enforceable, and getting them right is what makes selling tiers possible.<\/p>\n<p dir=\"ltr\">Each hotspot user profile carries a rate limit, a shared-users count and session parameters. A user who buys a basic package is assigned the basic profile; one who buys a premium package gets the premium profile. <a href=\"https:\/\/estateadmin.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> with well-defined profiles turns your price list into router behaviour automatically.<\/p>\n<p dir=\"ltr\">The rate-limit field uses upload\/download notation from the client&#8217;s point of view, so a value such as 2M\/5M gives two megabits up and five down. Check the direction on your RouterOS version before deploying, because reversing it is a common and confusing mistake.<\/p>\n<p dir=\"ltr\">The shared-users setting controls how many devices can log in simultaneously on one account. It is how you enforce device limits per package without confrontation.<\/p>\n<p dir=\"ltr\">Burst settings let a user briefly exceed their limit for short tasks like loading a page, which makes a capped connection feel faster without increasing sustained load. Used modestly, bursts are one of the most noticeable improvements in perceived speed for any <a href=\"https:\/\/churchesadmin.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">An illustrative profile:<\/p>\n<div>\n<div tabindex=\"0\" role=\"group\" aria-label=\"Code\">\n<div>\n<div><\/div>\n<\/div>\n<div>\n<pre><code>\/ip hotspot user profile add name=basic-2m rate-limit=1M\/2M shared-users=2 idle-timeout=15m\r\n\/ip hotspot user profile add name=premium-10m rate-limit=3M\/10M shared-users=3 idle-timeout=30m<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<p dir=\"ltr\">Keep profile names aligned with the packages in your billing platform so the two never drift apart. A profile renamed on the router but not in billing produces users who pay for one speed and receive another, which is the kind of silent error that damages trust in a <a href=\"https:\/\/vega.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Queues_and_Fairness_Across_the_Whole_Network\"><\/span>Queues and Fairness Across the Whole Network<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">Per-user limits stop individuals from exceeding their package. They do not, on their own, share capacity fairly when the upstream link is full.<\/p>\n<p dir=\"ltr\">When hundreds of users are online and the total demand exceeds your upstream bandwidth, you need an overall queue that divides the available capacity fairly among active users. PCQ \u2014 per-connection queuing \u2014 does this automatically without a rule for each person. <a href=\"https:\/\/dereva.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> on any busy site should include a PCQ-based parent queue sized just below your real upstream capacity.<\/p>\n<p dir=\"ltr\">Sizing the parent queue slightly below the actual link speed matters. It keeps the queuing happening on your router, where you control it, rather than in the upstream provider&#8217;s equipment, where you do not.<\/p>\n<p dir=\"ltr\">Priority can be layered on top, so that interactive traffic such as browsing, messaging and video calls moves ahead of large downloads. Users perceive responsiveness far more than raw throughput, and prioritisation is often the single biggest improvement in how fast a network feels.<\/p>\n<p dir=\"ltr\">Test queues under realistic load. A configuration that looks correct with five devices can behave very differently with two hundred, so review behaviour during the first busy evening after deployment of any <a href=\"https:\/\/jaat.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"The_Walled_Garden_and_the_Payment_Flow\"><\/span>The Walled Garden and the Payment Flow<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">The walled garden lists destinations users can reach before logging in, and it is essential for any paid hotspot.<\/p>\n<p dir=\"ltr\">A user who has not yet paid must still be able to load your payment page, reach the M-Pesa or billing platform endpoints, and receive the STK Push prompt response. If those destinations are not in the walled garden, the user is stuck: they cannot log in without paying and cannot pay without logging in. <a href=\"https:\/\/wito.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> with a broken walled garden is the most common cause of &#8220;I can&#8217;t buy a package&#8221; tickets.<\/p>\n<p dir=\"ltr\">Your billing platform should provide the exact list of domains or addresses to allow. Add them precisely rather than opening the walled garden broadly.<\/p>\n<p dir=\"ltr\">Keep the walled garden tight. Allowing too much before login lets users reach services without paying, and some sites have discovered users browsing freely through an over-generous walled garden for months. Tightness here is an ordinary revenue control in <a href=\"https:\/\/awasam.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Test the full payment journey from a fresh device every time you change the walled garden, the billing platform or RouterOS version.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Connecting_to_a_Billing_Platform_API_and_RADIUS\"><\/span>Connecting to a Billing Platform: API and RADIUS<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">Manual user creation does not scale past a few dozen customers. Billing integration is what turns the router into a business.<\/p>\n<p dir=\"ltr\">There are two common approaches. With the RouterOS API, the billing platform connects to the router and creates, modifies and removes users and profiles directly. With RADIUS, the router asks a central server whether each user may log in and what limits apply. <a href=\"https:\/\/saseni.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> with most Kenyan billing platforms uses the API, while larger multi-site operators often prefer RADIUS.<\/p>\n<p dir=\"ltr\">If using the API, enable the encrypted API service rather than the plain one wherever the platform supports it, and restrict access to the billing platform&#8217;s addresses only. An API port open to the whole internet is an invitation to anyone who finds it.<\/p>\n<p dir=\"ltr\">Create a dedicated router user for the billing platform with only the permissions it needs, rather than handing over the main administrator account. If that credential is ever compromised, the damage is limited, which is a basic control in any <a href=\"https:\/\/prim.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">If using RADIUS, configure the RADIUS client on the router with the server address and a strong shared secret, and enable RADIUS for the hotspot. Test both authentication and accounting, since accounting data is what tracks usage and session time.<\/p>\n<p dir=\"ltr\">Confirm what happens when the connection to billing drops. Users already online should continue; new purchases may queue until the link returns. Understanding that behaviour in advance prevents panic during an upstream outage and is part of responsible <a href=\"https:\/\/rentaldesk.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Access_Points_and_CAPsMAN\"><\/span>Access Points and CAPsMAN<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">The router handles authentication and control; access points deliver the signal into rooms and corridors.<\/p>\n<p dir=\"ltr\">MikroTik access points can be managed individually, but across more than a handful of units, central management through CAPsMAN is far more practical. It lets you push wireless settings, channels and security from the router to every access point at once. <a href=\"https:\/\/fama.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> on multi-floor buildings benefits enormously from it.<\/p>\n<p dir=\"ltr\">Plan channels to reduce interference between neighbouring access points, especially on the crowded 2.4 GHz band. Automatic channel selection helps but benefits from review in dense buildings.<\/p>\n<p dir=\"ltr\">Use 5 GHz for capacity where devices support it and 2.4 GHz for range through walls. Most modern student and resident devices handle both.<\/p>\n<p dir=\"ltr\">Power access points through PoE where possible, and include them in your backup power plan. A router on battery backup does little good if every access point dies with the lights, which is an easy oversight in a <a href=\"https:\/\/spacekits.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Client_Isolation\"><\/span>Client Isolation<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">On a shared network, users should not be able to reach each other&#8217;s devices.<\/p>\n<p dir=\"ltr\">Without isolation, any user on the hotspot can see other users&#8217; phones and laptops on the local network, which exposes them to snooping, file-sharing mistakes and attacks. Isolating clients so that each device can reach the internet but not its neighbours is a basic protection every public or shared <a href=\"https:\/\/dexa.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> should enable.<\/p>\n<p dir=\"ltr\">On the wireless side, disable client-to-client forwarding on access points. On the wired and bridged side, bridge horizon settings or firewall rules prevent traffic between user ports.<\/p>\n<p dir=\"ltr\">Test isolation from two devices on the network. If one can ping or discover the other, isolation is not working.<\/p>\n<p dir=\"ltr\">Isolation also protects your equipment. Users unable to see other local devices are also far less likely to stumble onto management interfaces, which strengthens the security of the whole <a href=\"https:\/\/pawa.co.ke\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Securing_a_MikroTik_Router_Setup_for_Hotspot_Kenya\"><\/span>Securing a MikroTik Router Setup for Hotspot Kenya<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\"><a href=\"https:\/\/pms.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> security is non-negotiable, because a compromised router exposes every customer on it and can be used to attack others.<\/p>\n<p dir=\"ltr\">Change the default administrator account immediately. Create a new admin user with a strong, unique password and disable or remove the default account.<\/p>\n<p dir=\"ltr\">Disable services you do not use. Telnet, FTP, the plain HTTP interface and the unencrypted API should be off unless you have a specific reason. Leave only what you need, preferably encrypted, and restrict each to management addresses. Every open service is an entry point, and closing them is the first rule of <a href=\"https:\/\/estateadmin.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Restrict management access to known addresses or a separate management network. Users on the hotspot subnet should never be able to reach Winbox, WebFig, SSH or the API.<\/p>\n<p dir=\"ltr\">Build a firewall on the input chain that accepts established and related connections, allows management only from permitted addresses, and drops everything else destined for the router itself. An illustrative outline:<\/p>\n<div>\n<div tabindex=\"0\" role=\"group\" aria-label=\"Code\">\n<div>\n<div><\/div>\n<\/div>\n<div>\n<pre><code>\/ip firewall filter\r\nadd chain=input connection-state=established,related action=accept\r\nadd chain=input src-address-list=mgmt action=accept\r\nadd chain=input in-interface=ether1 action=drop\r\nadd chain=input in-interface=bridge-hotspot protocol=udp dst-port=53,67 action=accept\r\nadd chain=input in-interface=bridge-hotspot action=drop<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<p dir=\"ltr\">Keep RouterOS updated. Security fixes are released regularly and routers left on old versions are routinely compromised. Schedule updates during quiet periods and take a backup first, because patching is ongoing work in any <a href=\"https:\/\/churchesadmin.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Do not use the router to inspect what customers are doing. Your job is to authenticate, limit and route traffic, not to monitor individual browsing, and building features for that purpose creates legal and ethical exposure you do not need.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Time_DNS_and_Logging\"><\/span>Time, DNS and Logging<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">Small settings with outsized effects.<\/p>\n<p dir=\"ltr\">Configure NTP so the router&#8217;s clock is accurate. Session expiry, time-based rules, logs and certificate validation all depend on the correct time, and a router with a drifting clock produces bizarre, hard-to-diagnose faults. <a href=\"https:\/\/vega.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> should synchronise time before anything time-dependent is configured.<\/p>\n<p dir=\"ltr\">Use reliable DNS resolvers and consider caching on the router to speed up lookups for users.<\/p>\n<p dir=\"ltr\">Log what you need to operate and troubleshoot the network \u2014 authentication failures, errors, interface changes \u2014 and send logs to a remote server if you want them to survive a reboot. Avoid logging user browsing, both because it is unnecessary for operations and because it creates personal data obligations under the Data Protection Act 2019. Confirm your obligations with a qualified legal professional or the ODPC before retaining anything user-identifiable, since logging policy is part of every <a href=\"https:\/\/dereva.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Running_PPPoE_Alongside_the_Hotspot\"><\/span>Running PPPoE Alongside the Hotspot<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">Many operators serve both hotspot customers and dedicated home connections, and a MikroTik can run both.<\/p>\n<p dir=\"ltr\">PPPoE suits customers wanting a dedicated line with their own router, typically on monthly plans. The hotspot suits shared, pay-as-you-go access. Running both on one router lets you serve a hostel&#8217;s common areas by hotspot and individual rooms or nearby homes by PPPoE, which gives a <a href=\"https:\/\/jaat.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> a natural upgrade path for customers.<\/p>\n<p dir=\"ltr\">Keep them on separate interfaces or VLANs with separate address pools and profiles, and make sure your billing platform manages both from one place, so that one <a href=\"https:\/\/wito.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> serves two customer types without two administrative systems.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Diagnosing_a_Slow_Network\"><\/span>Diagnosing a Slow Network<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">&#8220;The internet is slow&#8221; is the most common complaint, and it has several distinct causes a router can help identify.<\/p>\n<p dir=\"ltr\">Check the router&#8217;s CPU load during peak hours. Sustained high load means the device is undersized for the traffic, the firewall rules, the queues or all three, and no amount of bandwidth will help. <a href=\"https:\/\/awasam.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> that has outgrown its hardware shows it here first.<\/p>\n<p dir=\"ltr\">Check the upstream link. If total traffic is pinned at your purchased capacity, you are bandwidth-limited and need either more capacity or better fairness through queues.<\/p>\n<p dir=\"ltr\">Check the wireless. Poor signal, channel interference and overloaded access points cause slowness that looks like bandwidth shortage but is not.<\/p>\n<p dir=\"ltr\">Check DNS response times, which are frequently overlooked and make browsing feel sluggish even when throughput is fine.<\/p>\n<p dir=\"ltr\">Use the router&#8217;s traffic tools to identify whether a small number of users are dominating capacity, then address it with queues rather than guesswork. Systematic diagnosis in that order solves most problems in <a href=\"https:\/\/saseni.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> within an hour.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Monitoring_and_Remote_Management\"><\/span>Monitoring and Remote Management<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">You cannot be at every site, so you need to know about problems before customers tell you.<\/p>\n<p dir=\"ltr\">Monitor each router&#8217;s availability, CPU, memory, interface traffic and active user count, ideally through your billing platform&#8217;s router health dashboard or a dedicated monitoring tool. Alerts when a router goes offline let you respond before the support queue fills, which is the operational difference between an amateur and a professional <a href=\"https:\/\/prim.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">Remote management should run through secure, restricted channels \u2014 a VPN to your management network rather than exposed services \u2014 so that reaching your routers never means exposing them to everyone else, a standard any <a href=\"https:\/\/rentaldesk.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> serving paying customers should meet.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Compliance_and_Doing_It_Properly\"><\/span>Compliance and Doing It Properly<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">Configuration is only part of running a legitimate hotspot.<\/p>\n<p dir=\"ltr\">Selling internet access commercially in Kenya is regulated, and your licensing position should be confirmed directly with the Communications Authority of Kenya before you begin selling. Radio equipment used should be type-approved, and operating within the permitted frequency bands and power limits is part of <a href=\"https:\/\/fama.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>, not an afterthought.<\/p>\n<p dir=\"ltr\">Customer phone numbers and usage records are personal data, so collect only what the service needs, restrict access, and confirm your obligations with a qualified legal professional or the Office of the Data Protection Commissioner. Business registration and tax obligations should be confirmed with a qualified tax professional, since those duties apply alongside every technical choice in a <a href=\"https:\/\/spacekits.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"When_to_Get_Help_With_MikroTik_Router_Setup_for_Hotspot_Kenya\"><\/span>When to Get Help With MikroTik Router Setup for Hotspot Kenya<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\"><a href=\"https:\/\/dexa.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> is well within reach of a technically comfortable operator for a small site, and genuinely demanding at scale.<\/p>\n<p dir=\"ltr\">Get experienced help when you are serving hundreds of concurrent users, running multiple sites, combining hotspot and PPPoE, integrating RADIUS, or configuring VLANs across buildings. The cost of a professional configuration is small compared with a month of complaints and churn.<\/p>\n<p dir=\"ltr\">Get help immediately if you suspect a router has been compromised: unexplained configuration changes, unknown users, unusual traffic or disabled services you did not touch. Isolate it, restore from a known-good backup and change every credential, which is the right emergency response in any <a href=\"https:\/\/pawa.co.ke\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Mistakes_Operators_Make\"><\/span>Mistakes Operators Make<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">The first is enabling the hotspot before the base network works, then debugging two layers at once.<\/p>\n<p dir=\"ltr\">The second is buying hardware for today&#8217;s users rather than next semester&#8217;s, and discovering the CPU is pinned every evening. Undersized hardware is the most expensive saving in <a href=\"https:\/\/pms.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\">The third is ignoring the licence level and hitting the concurrent hotspot user limit as the site fills.<\/p>\n<p dir=\"ltr\">The fourth is a broken or overly generous walled garden \u2014 either users cannot pay, or they browse without paying.<\/p>\n<p dir=\"ltr\">The fifth is leaving default credentials, unused services and open management ports, which is how networks are compromised.<\/p>\n<p dir=\"ltr\">The sixth is no backups. A failed router without a recent exported configuration turns a thirty-minute hardware swap into a day of rebuilding from memory, which no <a href=\"https:\/\/estateadmin.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> should risk.<\/p>\n<p dir=\"ltr\">The seventh is forgetting client isolation, leaving every customer&#8217;s device visible to every other customer.<\/p>\n<h3 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\"><strong>Which MikroTik should I buy for a hotspot?<\/strong><br \/>\nSize by peak concurrent users: hAP range for small sites, RB5009 or RB4011 class for a few hundred, CCR for large or multi-building networks. Check the device&#8217;s licence level too, since it affects concurrent hotspot users \u2014 a detail many overlook in <a href=\"https:\/\/churchesadmin.com\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\"><strong>Do I need to know the command line?<\/strong><br \/>\nNo. Winbox and the hotspot wizard handle most setups. Understanding the concepts matters more than memorising commands, and commands differ between RouterOS versions.<\/p>\n<p dir=\"ltr\"><strong>Why can users connect but not reach the payment page?<\/strong><br \/>\nAlmost always the walled garden. Add the exact domains and addresses your billing and payment providers require, then test from a fresh device.<\/p>\n<p dir=\"ltr\"><strong>How do I set different speeds for different packages?<\/strong><br \/>\nCreate hotspot user profiles with different rate limits and shared-user counts, and map them to your billing platform&#8217;s packages by matching names.<\/p>\n<p dir=\"ltr\"><strong>How do I stop one user slowing everyone down?<\/strong><br \/>\nA PCQ-based parent queue sized just below your upstream capacity, plus per-profile rate limits. Together they handle fairness far better than any manual intervention.<\/p>\n<p dir=\"ltr\"><strong>Should I use the API or RADIUS?<\/strong><br \/>\nMost Kenyan billing platforms use the API; larger multi-site operators often prefer RADIUS. Use whatever your platform supports, secured and restricted either way.<\/p>\n<p dir=\"ltr\"><strong>How do I stop users seeing each other&#8217;s devices?<\/strong><br \/>\nDisable client-to-client forwarding on access points and apply bridge horizon or firewall isolation on wired segments. Test with two devices.<\/p>\n<p dir=\"ltr\"><strong>How often should I update RouterOS?<\/strong><br \/>\nWhenever stable security updates are released, during a quiet period, after taking a backup. Old versions are a leading cause of compromised routers, so updates are ongoing in any <a href=\"https:\/\/vega.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a>.<\/p>\n<p dir=\"ltr\"><strong>Can I run hotspot and PPPoE on one router?<\/strong><br \/>\nYes, on separate interfaces or VLANs with separate pools and profiles, managed from one billing platform.<\/p>\n<p dir=\"ltr\"><strong>What should I log?<\/strong><br \/>\nOperational events needed to troubleshoot, not user browsing. Confirm data obligations with a qualified legal professional or the ODPC.<\/p>\n<p dir=\"ltr\"><strong>What is the single most important habit?<\/strong><br \/>\nBackups \u2014 binary and exported text \u2014 after every significant change. It is what turns a hardware failure into a short interruption, and it separates a careful <a href=\"https:\/\/dereva.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> from a fragile one, which is ultimately what every <a href=\"https:\/\/jaat.co.ke\" target=\"_blank\" rel=\"noopener\">MikroTik router setup for hotspot Kenya<\/a> is judged on.<\/p>\n<hr \/>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div aria-hidden=\"true\"><\/div>\n<\/div>\n<\/div>\n<div>\n<div>\n<div>\n<div>\n<div><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div aria-hidden=\"true\"><\/div>\n<\/div>\n<div aria-hidden=\"true\"><\/div>\n<div><\/div>\n<div aria-hidden=\"true\"><\/div>\n<\/div>\n<div aria-hidden=\"true\"><\/div>\n<div>\n<div>\n<div aria-hidden=\"true\">\n<div><\/div>\n<div><\/div>\n<\/div>\n<p><button aria-label=\"Scroll to bottom\" aria-hidden=\"false\"><\/button><\/div>\n<div aria-hidden=\"true\"><\/div>\n<div>\n<div>\n<div><\/div>\n<\/div>\n<div role=\"presentation\">\n<fieldset>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div><\/div>\n<\/div>\n<div tabindex=\"-1\">\n<div role=\"status\" aria-live=\"polite\" aria-atomic=\"false\"><\/div>\n<\/div>\n<\/div>\n<div role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/div>\n<div role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/div>\n<\/div>\n<\/div>\n<div><\/div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div>\n<div tabindex=\"0\" role=\"textbox\" contenteditable=\"true\" translate=\"no\" aria-multiline=\"true\" aria-required=\"false\" aria-invalid=\"false\" aria-label=\"Write your prompt to Claude\" aria-describedby=\"claude-code-nudge-body\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/fieldset>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>MikroTik Router Setup for Hotspot Kenya: Configuring the Box That Runs Your Business MikroTik router setup for hotspot Kenya is where most WiFi businesses are quietly won or lost. The access points get the attention because they are visible. The billing platform gets the attention because it takes the money. But the router in the [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,4,3,5,2,37,8,21],"tags":[93],"class_list":["post-1690","post","type-post","status-publish","format-standard","hentry","category-wifi-hotspot","category-isp-billing","category-mikrotik-hotspot","category-pawa-updates","category-wifi-billing","category-wifi-billing-software","category-wifi-billing-systems","category-wifi-business-solutions","tag-mikrotik-router-setup-for-hotspot-kenya"],"_links":{"self":[{"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/posts\/1690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/comments?post=1690"}],"version-history":[{"count":1,"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/posts\/1690\/revisions"}],"predecessor-version":[{"id":1691,"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/posts\/1690\/revisions\/1691"}],"wp:attachment":[{"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/media?parent=1690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/categories?post=1690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pawa.co.ke\/blog\/wp-json\/wp\/v2\/tags?post=1690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}