Built for MikroTik, down to the RouterOS details.
Hotspot vouchers, PPPoE subscribers and an M-Pesa captive portal on the RouterOS box you already own. We talk to it over its own secure API through a private tunnel, so it works behind any NAT, with nothing to paste into Winbox.
What we do on your MikroTik
Everything below is done through RouterOS itself. No firmware changes, no FTP, no scripts left running on the router.
Reached behind any NAT
An encrypted WireGuard tunnel from the router to us. No public IP, no port forwarding, no dynamic DNS.
Set up in steps you can watch
Hotspot, profile, address pool, DNS name and walled garden created one step at a time, each one reported as it finishes.
Your portal, on the router
The login page is pushed to the router and loads instantly, even before a customer has internet.
A padlock, not a warning
The login page is served over HTTPS with a trusted certificate we renew for you, so phones stop saying Not secure.
Codes made at payment
A voucher is created on the router the moment M-Pesa confirms, so there is no printed stock to run out of or leak.
Sessions ended on time
Three clocks: time from purchase, time online and an activation deadline. Expired users are removed from the router with a reason.
PPPoE for monthly homes
Secrets and profiles managed for you, due-date reminders by SMS, and suspend or restore from the dashboard.
TVs and decoders too
A customer can attach a device that cannot open a login page to the code they bought.
Adopt a router in business
A read-only scan imports the profiles, users and PPPoE secrets already there.
Works with the models in the field
- hAP ac², ac³, ax
- hEX and hEX S
- RB750Gr3
- RB951, RB952
- RB2011
- CCR1009 and up
- Cloud Hosted Router
- Any RouterOS 7
RouterOS 7 is required for the REST API we use. RouterOS 6 routers can be upgraded first.
Safe by design
- Router passwords are stored encrypted and used only at the moment we connect.
- Management goes over RouterOS's HTTPS API inside the tunnel, never plain HTTP.
- The walled garden opens only our payment address, pinned by IP, not a whole domain.
MikroTik questions
Which MikroTik routers are supported?
Any MikroTik on RouterOS 7 with the REST API: hAP, hEX, RB750, RB951, RB2011, CCR and Cloud Hosted Router. RouterOS 6 does not have the REST API we use.
My router is behind the ISP's NAT. Does that matter?
No. Each router keeps an encrypted WireGuard tunnel to us, so it never needs a public address or an open port. Management, voucher pushes and health checks all go through that tunnel.
I already sell vouchers on this router. Do I start over?
No. A read-only scan finds the hotspot profiles, users and PPPoE secrets already there and offers to bring them across as packages, so codes your customers are holding keep working.
Will it change my existing configuration?
Only what you ask for. Setting up from scratch creates a hotspot, profile and walled garden step by step; adopting an existing router only reads until you choose to deploy the portal.