How to Reconfigure Two Adjacent MikroTik Routers to Fix a Missing Captive Portal on Your ISP Billing System

One of the most common and frustrating problems ISP operators face when deploying MikroTik RouterOS-based networks is a scenario where the captive portal (hotspot login page) from their ISP billing system is not appearing to subscribers — even though the billing system is running correctly and internet is technically flowing. The root cause is almost always the same: two adjacent routers are both performing NAT, DHCP, and routing independently, so subscriber traffic bypasses the hotspot engine entirely before it can redirect to the captive portal.

This guide walks through the exact reconfiguration steps to fix the problem — covering the correct architecture, RouterOS hotspot configuration, NAT rules, DHCP scope separation, and inter-router routing to ensure every subscriber sees the captive portal login page from your ISP billing system on every new connection.

Why Two Adjacent Routers Break the Captive Portal

When two routers sit in series on the same subscriber path — for example, a MikroTik hEX S as the core gateway and a MikroTik hAP or hAP Lite as a downstream access point/router — the following conflict arises:

• Router 1 (upstream/core): Runs the hotspot server and billing API. Expects subscribers to receive IP addresses from its DHCP server in the hotspot pool, so it can intercept HTTP requests and redirect to the captive portal.
• Router 2 (downstream): Has its own DHCP server and NAT masquerade rule running. Assigns private IPs to subscriber devices, then NAT-masquerades all outbound traffic behind its own WAN IP before it reaches Router 1.
• Result: Router 1 sees all traffic coming from Router 2's WAN IP as a single source. The hotspot engine cannot match individual subscribers to sessions, so it never redirects them to the captive portal. Subscribers get internet access without authenticating.

The Correct Architecture: One Hotspot Router + One AP (Not Two Routers)

• Router 1 (hotspot/billing router): Runs the RouterOS hotspot server. Manages subscriber DHCP pool. Enforces captive portal. Connects to your ISP billing system via RouterOS API. Has internet WAN uplink.
• Router 2 (access point/switch role): Should be reconfigured as a pure Layer 2 wireless access point or switch — with its own DHCP server disabled and NAT masquerade rule removed. Subscriber devices connect to Router 2 over WiFi, but receive their IP directly from Router 1's hotspot DHCP pool.

Step-by-Step Reconfiguration

Step 1 — Identify Which Router Runs the Hotspot

Log into both routers via Winbox or SSH. On the router running the hotspot (Router 1), go to IP → Hotspot and confirm the hotspot server is active on the correct interface. Note the hotspot DHCP pool range.

Step 2 — Disable DHCP Server on Router 2 (Downstream)

• Go to IP → DHCP Server
• Select the DHCP server instance running on the LAN interface
• Click Disable (do not delete — you may need to re-enable for testing)

Step 3 — Remove NAT Masquerade on Router 2

On Router 2, go to IP → Firewall → NAT and find the srcnat masquerade rule. Either disable it or change the out-interface to only apply masquerade on the WAN uplink — not on traffic being forwarded toward Router 1.

Step 4 — Configure Router 2 as a Wireless AP (Bridge Mode)

• Go to Bridge → Ports and ensure the WiFi interface (wlan1) and the Ethernet port connecting to Router 1 are both members of the same bridge
• Assign Router 2 a static management IP on the bridge interface in the same subnet as Router 1's LAN
• Set Router 2's default gateway to Router 1's LAN IP so Router 2 itself has internet access for NTP, DNS, and firmware updates
• Disable Router 2's IP → DNS server if it was set to allow remote requests

Step 5 — Verify Router 1 Hotspot Interface Binding

• The hotspot server is bound to the bridge interface that connects toward Router 2
• The address pool covers the subscriber IP range
• The DNS name field is set (e.g. hotspot.netedge.ug)
• The login page is configured to call your ISP billing system API for authentication

Step 6 — Test Subscriber DHCP and Portal Redirect

• Connect a test device to Router 2's WiFi SSID
• Check that the test device receives an IP from Router 1's hotspot DHCP pool
• Open any HTTP URL in a browser (not HTTPS)
• Confirm you are redirected to the captive portal login page from your ISP billing system
• Authenticate with a test subscriber account and confirm internet access is granted

Common Issues and Fixes After Reconfiguration

Subscriber gets 169.x.x.x or no IP address

• Router 2's bridge must include both the WAN (uplink to Router 1) and LAN/WiFi ports
• No firewall rule on Router 2 should block DHCP broadcast traffic (UDP port 67/68)
• The cable between Router 1 LAN and Router 2 WAN must be on the correct port

Portal appears but authentication fails

• Router 1 must reach your ISP billing system API endpoint
• RADIUS or API credentials in the hotspot server profile must match those in the billing system
• The billing system's allowed IP whitelist must include Router 1's WAN IP

Portal appears on HTTP but not HTTPS sites

This is expected — HTTPS sites cannot be intercepted without triggering a certificate warning. Instruct subscribers to open http://hotspot.yourdomain.com or http://neverssl.com to trigger the redirect manually.

Some subscribers bypass the portal after reconfiguration

Check for overly permissive Walled Garden entries under IP → Hotspot → Walled Garden, or static IP bypass rules in IP → Hotspot → IP Bindings that may pre-authorise certain MAC addresses.

Recommended Hardware for Stable Captive Portal Deployments

• MikroTik hEX S RB760iGS — The recommended core hotspot/billing router. Gigabit ports, SFP fibre uplink, RouterOS Level 4 with unlimited hotspot users and full API access for billing system integration.
• MikroTik hEX RB750Gr3 — Reliable 5-port gigabit hotspot router for zone-level deployments. Same RouterOS Level 4 feature set without the SFP uplink.
• MikroTik hAP RouterBOARD with PoE — Ideal as the downstream wireless access point in AP bridge mode — dual-band WiFi with PoE output.
• MikroTik hAP Lite RB941-2nD — Lightweight 2.4GHz AP for subscriber premises in AP bridge mode.

Frequently Asked Questions