Setting Up a Secure Captive Portal on MikroTik: A Step-by-Step Guide

MikroTik’s built-in captive portal (Hotspot) is an exceptionally powerful network service that handles client redirection, session cookies, and login authentication. However, deploying a default hotspot without proper security layers leaves your local router network exposed to IP spoofing, routing loops, and unauthorized access to your private administration panels.

In this tutorial, we will walk through the configuration steps required to create a secure MikroTik captive portal setup, configure Walled Gardens for billing, and connect it to a cloud management system.

Phase 1: Create a Dedicated guest Bridge

Never run your hotspot captive portal on your primary default bridge (`bridge1`). You must isolate guest WiFi traffic from your local office computers, printers, and router administration ports.

1. Open WinBox and navigate to Bridge → Click + → Name it bridge-guest.
2. Go to the Ports tab → Click + → Assign the specific Ethernet interface connected to your outdoor WiFi APs (e.g. ether5) to bridge-guest.
3. Go to IP → Addresses → Click + → Assign a separate IP address block (e.g., 172.16.50.1/24) to bridge-guest.

Phase 2: Initialize the Hotspot Setup Wizard

Using the built-in wizard ensures that all required firewall NAT mappings, DHCP servers, and pool records are created automatically:

1. Navigate to IP → Hotspot → Click Hotspot Setup.
2. Select bridge-guest as the Hotspot interface → Click Next.
3. Keep the default local address and masquerade settings checked.
4. Set the Address Pool range (e.g., 172.16.50.10-172.16.50.254).
5. For the SSL Certificate, choose none (VoucherBeam handles standard HTTP redirects smoothly).
6. Set the SMTP server IP to 0.0.0.0 and configure public DNS servers (e.g. 8.8.8.8, 1.1.1.1).
7. Specify a local DNS Name (e.g., volta.wifi). This domain name will resolve to your router's login landing page.

Phase 3: Secure the Guest Firewall & Isolate Access

By default, any connected guest user can navigate to 172.16.50.1 in their browser and see your WinBox web login page. We must block this:

1. Navigate to IP → Firewall → Filter Rules.
2. Click + to add a new rule:
   • Chain: input
   • Src. Address: 172.16.50.0/24
   • Dst. Port: 80,443,8291,21,22,23 (HTTP, HTTPS, Winbox, FTP, SSH, Telnet)
   • Protocol: tcp
   • Action: drop

This rule blocks guests from accessing the router's local management endpoints while keeping standard internet routing intact.

Phase 4: Configure the Walled Garden for Payments

If you charge for access using Mobile Money or credit cards, customers must be able to load the payment gateway checkout pages *before* they authenticate. We must allow these domains in the **Walled Garden**:

/ip hotspot walled-garden
add dst-host=*.paystack.com
add dst-host=*.paystack.co
add dst-host=*.pstk.co
add dst-host=*.google.com
add dst-host=*.gstatic.com
add dst-host=*.googleapis.com

This allows unauthenticated guest clients to establish secure TLS handshakes with Paystack and Google Libraries to complete payments without getting blocked by the portal.

Phase 5: Connect with VoucherBeam

Instead of managing individual users locally inside WinBox, VoucherBeam automates the entire flow:

• One-Click RSC Setup: Download the pre-built setup script from your VoucherBeam Settings dashboard, paste it into the MikroTik Terminal, and your captive portal login files are instantly updated to support QR code login and online payments.