MikroTik Hotspot in Bridge Mode: The Right Way

Why bridge mode?#

Running a MikroTik hotspot in bridge mode lets you drop the box into an existing L2 network without renumbering anything. Done right, it's invisible. Done wrong, half your clients can't authenticate and the other half bypass the splash page entirely.

The minimum working config#

/interface bridge
add name=bridge-hotspot use-ip-firewall=yes vlan-filtering=yes

/ip hotspot profile
set [find default=yes] use-radius=yes login-by=http-chap,mac

/ip hotspot
add interface=bridge-hotspot profile=default address-pool=hs-pool name=hotspot1

The single most important line is use-ip-firewall=yes. Without it, bridged traffic skips the IP firewall — and the hotspot lives in the firewall.

Walled-garden essentials#

Skip the walled-garden setup and 30% of your users will see a "no internet" warning even after logging in.

Verifying#

Run /ip hotspot active print after a client logs in. If you see the MAC but no IP, your DHCP server is upstream of the hotspot — move it onto the RouterOS box or relay through it.