Running a MikroTik hotspot in bridge mode lets you drop a RouterOS box into an existing layer-2 network without renumbering a single subnet. Done right, it is invisible to the network and obvious to the user. Done wrong, half your clients never see the splash page and the other half walk straight past it.
This is the exact configuration I deploy on cafés, hostels, and small ISP hotspot zones, plus the mistakes that cost me the most call-outs.
When bridge mode is the right choice#
Use bridge mode when:
- The gateway and DHCP already exist and you cannot change them (hotel, campus, shared building).
- You need the hotspot to be removable — pull the box and the network still works.
- Multiple APs already share one flat VLAN and re-addressing them is not on the table.
Use routed mode instead when you own the whole edge. Routing is simpler to reason about, and every "clients are invisible" ticket disappears.
The minimum working config#
/interface bridgeadd name=bridge-hotspot protocol-mode=none/interface bridge settingsset use-ip-firewall=yes/interface bridge portadd bridge=bridge-hotspot interface=ether2add bridge=bridge-hotspot interface=ether3/ip pooladd name=hs-pool ranges=10.20.0.10-10.20.0.254/ip dhcp-serveradd address-pool=hs-pool interface=bridge-hotspot name=hs-dhcp disabled=no/ip hotspot profileset [find default=yes] use-radius=yes login-by=http-chap,mac-cookie html-directory=hotspot/ip hotspotadd address-pool=hs-pool interface=bridge-hotspot name=hotspot1 profile=default
The single most important line is use-ip-firewall=yes. Without it, bridged frames never enter the IP firewall — and the hotspot's redirect rules live in the IP firewall. Everything else can be perfect and clients will still ride straight past the login page.
Trade-off worth knowing:
use-ip-firewallpushes bridged traffic through the firewall path, which raises CPU on low-end hardware. On an hEX or hAP ac² you will feel it above roughly 150–200 concurrent users. Plan a CCR or RB5009 above that.
Where the DHCP server must live#
This is the second most common failure. The hotspot only sees a client as "active" if it learns the client's IP-to-MAC binding. If an upstream router hands out addresses, RouterOS sees MAC addresses with no leases and the session table stays empty.
Two valid options:
- Move DHCP onto the RouterOS box (shown above) — simplest, most reliable.
- Keep upstream DHCP and add
/ip dhcp-relayon the bridge so leases pass through RouterOS.
Walled garden essentials#
Modern devices probe a known URL to decide whether they are behind a captive portal. Block the probe and the user sees "connected, no internet" even after a successful login.
| Host | Why it matters |
|---|---|
connectivitycheck.gstatic.com | Android and ChromeOS portal detection |
captive.apple.com | iOS and macOS portal detection |
www.msftconnecttest.com | Windows 10/11 portal detection |
| Your payment gateway domain | Paid vouchers must load before auth |
/ip hotspot walled-gardenadd dst-host=connectivitycheck.gstatic.comadd dst-host=captive.apple.comadd dst-host=*.msftconnecttest.com
Add DNS to the IP-level walled garden too, otherwise name resolution for those hosts fails before HTTP is ever attempted:
/ip hotspot walled-garden ipadd action=accept dst-address=8.8.8.8 protocol=udp dst-port=53
Closing the common bypasses#
MAC cloning. A user copies the MAC of an authorised device and inherits the session. Bind sessions to MAC and IP, and keep mac-cookie lifetimes short (a working day, not a month):
/ip hotspot profileset [find default=yes] mac-cookie-timeout=1d
Static IP self-assignment. A user sets a manual address in your subnet and skips DHCP. Drop unauthenticated forwarding at the firewall:
/ip firewall filteradd chain=forward src-address=10.20.0.0/24 hotspot=!auth action=drop \comment="Block non-authenticated hotspot subnet"
DNS tunnelling. Restrict outbound port 53 to the router itself and force clients through it:
/ip firewall natadd chain=dstnat protocol=udp dst-port=53 action=redirect to-ports=53 \in-interface=bridge-hotspot
Verifying the deployment#
Work down this list before you leave site:
/ip hotspot active print— a freshly logged-in client shows MAC and IP. IP missing means DHCP placement is wrong./ip hotspot host print— unauthenticated devices should appear here. Empty table meansuse-ip-firewallis off.- Connect an iPhone and an Android handset. Both should auto-open the portal. Only one working means a walled-garden entry is missing.
- Set a manual IP on a laptop. It must have no internet.
/tool profileunder load — if the firewall process is pegged, the hardware is undersized for bridge mode.
RADIUS: when to add it#
For a single site, local hotspot users are fine. Move to RADIUS the moment you have more than one site, need per-plan bandwidth profiles, or want usage accounting for billing. FreeRADIUS with a MySQL or PostgreSQL backend handles thousands of concurrent sessions on modest hardware, and rate limits arrive as a Mikrotik-Rate-Limit attribute rather than being hard-coded per router.
That is exactly the layer NexaLink automates — plans, vouchers, and per-user rate limits pushed to every RouterOS box from one panel.
Field checklist#
-
use-ip-firewall=yeson bridge settings - DHCP on the RouterOS box or relayed through it
- Walled garden covers Android, iOS, Windows, DNS, payment gateway
- Forward drop rule for
hotspot=!auth - Portal tested on two phone platforms and a laptop
- Configuration exported and stored off-box
Get those six right and the hotspot stops generating tickets.
