You want guests or paying customers to see a login page before they get internet access — a captive portal — instead of an open network anyone can join. MikroTik's Hotspot feature builds exactly that, and the fastest way to get one running correctly is the built-in setup wizard, as long as you understand what it's actually configuring for you.
Run the Hotspot setup wizard
From the terminal or the Hotspot Setup window in WinBox:
/ip hotspot setupIt walks through: which interface faces your guest network, the address pool clients will get, whether to use an SSL certificate for the login page, the DNS name for the portal, and the local DNS server. Accepting the defaults is fine for a first pass — you can adjust everything afterward.
Know what the wizard actually created
Behind that one command, RouterOS set up a Hotspot server bound to your chosen interface, an IP pool for hotspot clients (IP > Pool), and a hotspot profile with the login page and session settings (IP > Hotspot > Server Profiles). Anyone who connects to that interface gets redirected to the login page until they authenticate.
Open a walled garden for sites that don't need login
Sometimes you want a specific site reachable before login — a payment page, your own status page, a captive-portal detection endpoint. Add it to the walled garden:
/ip hotspot walled-garden add dst-host=example.comCreate user profiles with time or data limits
Under IP > Hotspot > User Profiles, you can cap a session by time, total data, or shared bandwidth, then assign that profile to individual hotspot users or a group. This is how you turn "open guest wifi" into something with actual session control.
Why do it this way
A captive portal on the guest-facing interface separates those clients from your management network entirely — they get their own address pool and their own firewall context, so a compromised or careless guest device never lands on the same broadcast domain as your infrastructure. It also gives you session control (time limits, data caps, forced re-authentication) that a simple open bridge can't: an unauthenticated open network has no way to expire access or measure who used what, while a hotspot ties every session to an identity you control.
How MoniTik helps
Once the hotspot is running, knowing who's connected and how much they're using usually means logging in and checking the active users list by hand. MoniTik monitors connected clients and their usage as part of the device it's already watching, so that visibility is there without a separate trip into the hotspot menu every time you want to check.
Camila focuses on routing, VPNs, and hardening MikroTik deployments for small and mid-size networks.