Documentation Series

Learn About VISP App Dashboard

Help Documentations / Networks / Mikrotik DHCP Configuration

Mikrotik DHCP Configuration

Configure RADIUS Servers

Follow the instructions on this page to configure the RADIUS servers.

These instructions assume that you have a new Mikrotik with little to no existing configuration.

Configure IP Addresses

  1. Add the IP addresses on the customer-facing interface that will be used as the gateway IP for active subscribers (probably the bridge named ‘Customers`).
    • Address: Ex: 100.64.1.1/24. This is the IP range for active subscribers.
  2. Optional: Add  Subscriber Management IP addresses on the appropriate VLAN interface.
    • Address: Ex: 10.2.1.1/24
  3. It is also best practice to document the subnet with meaningful comments.

DHCP server setup

  1. Using winbox, navigate to `IP > DHCP Server` on the router where you will control customer access 
  2. In the DHCP Server window, click on the DHCP Setup button and choose the interface in which you want to set up the DHCP server from the DHCP Server Interface drop-down menu, and then click on the Next button.
  3. Put your LAN network block in the DHCP address space input box, then click the Next button.  
  4. Choose the gateway address for the given network in the DHCP network gateway input box and then click the Next button.
  5. Provide the IP range for the address pool and click the Next button.
  6. Provide preferred DNS server IP and click the Next button.
  7. Now provide IP lease time and click the Next button. The suggested lease time is 10 minutes.
  8. Once the DHCP setup is complete, set the RADIUS option to “YES”.
  9. Lastly, rename the DHCP server, and add a  “-VISPv4(case sensitive) suffix to it. IE: “Lastmile-VISPv4”

Mikrotik DHCP Configuration - Visp App

Critical Note: When using UBNT devices, the radio acts as a DHCP relay when option-82 is enabled. Because of this, we have to set a DHCP relay (255.255.255.255) on the server to process all incoming requests from any radio.

Optional: ARP Payment Enforcement Protection

This will cause the router to work only with clients who have received their IP Addresses via the DHCP server, which are entered as static entries in the IP/ARP table. This ensures that customers can’t set static IPs to their devices to bypass the RADIUS suspension process.

  • Set ARP to Reply-Only on a customer-facing interface (on the general tab of the bridge or physical interface)
  • Check the “Add ARP for Leases” checkbox on the customer access DHCP Server.

Navigate to the Firewall/NAT tab and add the Masquerade rule for Active Subscribers

Assuming you are using private IP, you will need to configure NAT either at the tower or at your core. The example below is to configure NAT at the tower. On the “NAT” tab, add a new rule with the following settings (If using private IP’s):

  • General / Chain: srcnat
  • General / Src Address: 100.64.1.0/24 (adjust for customers Private IP pool)
  • Action / Action: masquerade (or src-nat with specified to-address)

Note: It is more router resource efficient to use src-nat action in place of masquerade if you are able to configure it with a Public IP.

Configure Firewall and Redirection Page for Suspended Subscribers.

  1. Generate Firewall rules by clicking the button below.
  2. After downloading the file, upload it to the Mikrotik router by dragging it to the file directory.
  3. Open the terminal window and run the following command:

/import verbose=yes file-name=firewall.cfg.rsc

 

Configure Queues

  1. Select the Queue Types tab, and then double-click the default-small queue to open it.
  2. Change the default-small queue Kind value to ‘sfq’ and leave the default settings.

Important Reminder: When using Option82 authentication, the multi-mac option in VISP package should be enabled.

1. Allow Pre-signup Authentication

Let’s say you have a building that buys internet access from you that it supplies free and anonymously for all tenants. You earn revenue from the main connection but also when tenants upgrade to faster packages. Before, each of those tenants could not connect their…

2. Set-up SmartSession Authentication

VISP’s HyperRadius has many unique powerful features, one of which is SmartSession. SmartSession will allow you to make changes to your subscribers that are authenticated on Mikrotik devices, on the fly, including disconnects and package speed changes, right from…

3. Assigning a Static IP Address

When assigning static IP addresses through Visp.net, we recommend setting the IP into static if it is not included in the DHCP server’s address pool. Visp can’t tell Mikrotik which IP is not available for leases. When the static option is enabled, the RADIUS will…

4. Location ID

Setting up a location ID for your internet package allows you to: Restrict the location where the package is displayed on the signup page. Apply location-based authentications. Use the location ID of the customer’s subscribed package to filter the upgrade package list…

5. RADIUS Configuration

This section configures your Mikrotik router to communicate with the Visp.net HyperRADIUS servers. Critical Note: For the Multi-ISP setup, you must use these proxy servers: 52.37.68.81 and 52.11.17.135. Primary Click Radius (left) and click (+) symbol to add a radius…

6. Mikrotik DHCP Configuration

Client Isolation Recommendations AP’s should use Client-Isolation. This reduces load and improves reliability. Repeating broadcast messages between subscribers increases network load and can allow for rogue DHCP servers or other broadcast services to exist on the…

7. PPPoE Configuration

These instructions assume that you have a new Mikrotik with little to no existing configuration. It specifies certain IP ranges which are commonly used; however, you can replace the IP ranges referenced below with your own custom ranges if you wish. Likewise, if you…

8. Mikrotik Hotspot Configuration

Initial Setup If you’re using a new Mikrotik router, we recommend resetting the device to remove the preinstalled configuration as it contains settings you will probably not need. You may also need to upgrade your RouterOS to the latest stable version, from…

9. Automation Profile: Low Stock Notification or Reordering

If you’re running low on certain equipment or devices, set up an automation profile to refill your stocks. This feature will either alert you when inventory drops below a certain level or it can automatically create a purchase order in Visp to the supplier. Follow…
?