What you are actually building
A MikroTik hotspot is five pieces working together, and almost every failed setup is one of them missing. A bridge groups the ports your WiFi clients arrive on. An IP pool and DHCP server hand those clients an address. The hotspot server intercepts their first HTTP request and shows the login page. A server profile decides how they log in and where the login page lives. User profiles set the speed and time limits each package gets. Get those five right, in that order, and the rest is detail. This guide walks through each one on RouterOS 6 and 7, with the exact commands — then shows the shortcut.
Step 1-2 — Bridge, IP address and pool
Create a bridge for the interfaces your hotspot users connect through, give it a gateway address such as 10.5.50.1/24, then add an IP pool (10.5.50.10-10.5.50.254) for DHCP to hand out. Never put the hotspot on your WAN interface — that is the single most common way to lock yourself out.
Step 3-4 — DHCP and the hotspot server
Add a DHCP server on the bridge using that pool, then run the hotspot setup against the bridge itself. RouterOS asks for the address, pool, certificate, SMTP, DNS servers, a DNS name and the first user. Leave the certificate as none unless you have one, and set a DNS name you own or leave it blank.
Step 5-6 — Profiles and the free zone
The server profile controls the login method and HTML directory. User profiles are your packages: rate limit, session timeout, shared users. A walled garden or a second free-zone bridge lets people reach your payment page or Facebook without a voucher — set it up now, because adding it later means editing DHCP and bridge ports by hand.
Step 7 — Test, then automate
Connect a phone, confirm the login page appears, log in with the test user and check traffic passes. If the page never opens, the cause is almost always device mode on RouterOS 7, a bridge port used instead of the bridge, or DNS. Once it works, MikroMan can repeat the identical setup on every other router in one click.
The whole setup as a RouterOS script
Keep reading
Guides for MikroTik hotspot and ISP owners.
Skip the manual steps →
Let MikroMan build the bridge, ports, DHCP and captive portal for you in about twenty seconds.
Hotspot voucher system →
Turn the working hotspot into sellable voucher packages, printed or sent on WhatsApp.
Hotspot invalid or not working? →
Device mode, bridge ports, DNS — the real causes and the fixes, on RouterOS 6 and 7.
Manage the hotspot online →
Vouchers, PPPoE billing and live monitoring for every router from one dashboard.
Mikhmon alternative →
What Mikhmon does, where it stops, and what to use when one PC is no longer enough.
MikroTik hotspot setup FAQ
How long does MikroTik hotspot setup take by hand?
A first setup in Winbox realistically takes 30 to 60 minutes including the mistakes — picking an IP range that clashes with your LAN, running the hotspot on a bridge port instead of the bridge, or forgetting the walled garden. The second router is faster, but you repeat every step. MikroMan does the same work in about twenty seconds per router, and it scans the router first so the ranges it picks cannot collide with anything already configured.
Which interface should the hotspot run on?
The bridge, never a bridge port and never the WAN. Put your WiFi and LAN ports into one bridge, then run the hotspot on that bridge. Running it on a single port means only that port is captured; running it on the WAN interface exposes the login page to the internet and can lock you out of the router.
Why does my hotspot show "invalid" in red?
On RouterOS 7 the usual cause is device mode — a newer security feature that blocks the hotspot service until the mode is set to advanced. Other causes are the interface being a bridge port rather than the bridge, the interface being disabled, or the hotspot being bound to an interface that is not running. We wrote a full guide to this: see the MikroTik hotspot troubleshooting post.
Do I need a public IP to set up a hotspot?
No. The hotspot itself is entirely local to the router — your users connect to it over WiFi, not over the internet. A public IP only matters if you want to manage the router remotely, and even then it is not required: MikroMan reaches routers behind CGNAT through a built-in VPN tunnel, so a router with no public IP is managed exactly like one with.
Does this work on RouterOS 6 and RouterOS 7?
Yes. The commands in this guide are the same on both. RouterOS 7 adds device mode, which must allow the hotspot service, and moves a few menu items in WinBox, but the underlying configuration is identical. MikroMan supports both, and detects which one a router runs before it changes anything.
Can I set up a hotspot on a hAP lite or other cheap MikroTik?
Yes, and it is the most common starting point. A hAP lite, hAP ac lite or RB941 handles a small café or shop hotspot fine. The limit is throughput and concurrent users, not features — the hotspot configuration is exactly the same as on a bigger board. Keep an eye on CPU once you pass roughly 20 to 30 simultaneous users.
What is a walled garden and do I need one?
A walled garden is a list of destinations a user can reach before logging in. You need it if customers pay through a website, scan a QR code, or need to reach your Facebook page or WhatsApp to buy a voucher — without it they cannot reach the very page that sells them access. Add your payment domain and any support channel.
How do I sell vouchers once the hotspot works?
Vouchers are hotspot users generated in bulk against a user profile that defines the package — one day at 2 Mbps, one week, and so on. Doing that by hand in Winbox does not scale past a few dozen. MikroMan generates hundreds of codes at once, prints them on A4 with your own template, sends batches over WhatsApp as a PDF, and tracks which codes are sold, used or expired.
Skip the manual setup
MikroMan scans your router, picks IP ranges that do not collide with anything already on it, and builds the bridge, pool, DHCP, hotspot server, profiles and free zone in one click — on RouterOS 6 and 7, with or without a public IP. Nothing already configured is touched.