Agent skill · software engineering · aiskillstore
routeros-hotspot
RouterOS hotspot captive portal for wired/wireless access control. Use when: configuring hotspot on RouterOS, setting up captive portal, writing hotspot profiles or instances, configuring walled garden, setting DHCP option 114 (RFC 8910 captive portal URI), integrating RADIUS with hotspot, or when the user mentions /ip/hotspot, walled-garden, hotspot profile, or captive portal on MikroTik.
Why this skill is useful
Provides specific RouterOS commands and configurations for setting up a hotspot that are not commonly known or documented.
What it needs
About 6k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
RouterOS Hotspot How Hotspot Chains Work Hotspot traffic intercept runs before the regular firewall input/forward chains. This is the single most important fact to internalize: /ip/hotspot binds to a bridge or interface — all traffic on that interface enters the hotspot chain first Firewall rules blocking TCP 80/443 from the hotspot interface do NOT block the captive portal login page — hotspot handles it before the firewall sees it RouterOS automatically injects dynamic firewall rules (hs-unauth, hs-auth chains) — do not manually create, remove, or interfere with these hotspot-managed rules Common mistake: Adding a DROP rule for port 443 from bridge-hotspot to "fix a security gap" — this breaks the HTTPS login page silently. Hotspot Profile Key properties: ssl-certificate= — reference the name after import (RouterOS appends 0 to imported certificate names) nas-port-type= — use ethernet for wired hotspots and wireless-ieee-802-11-g for wireless hotspots html-directory-override= — must match the exact folder name on the router's filesystem login-by=https — serves the login page over HTTPS; requires www-ssl service enabled with the same certificate use-radius=yes — when set, local /ip/hotspot/user entries are bypassed; adding them has no effect Hotspot Instance Note: keepalive-timeout=none disables the keepalive. keepalive-timeout=0 is NOT valid — it is ignored. Note: RouterOS hotspot relies on NAT and is IPv4-only. IPv6 clients are not supported by the hotspot subsystem. DHCP Option 114 — Captive Portal API (RFC 8910) Option 114 (standardized 2020, RFC 8910) signals the captive portal URI to clients. It is underrepresented in LLM training data. Option value syntax: outer double quotes, inner single quotes — "'https://...'". Missing inner quotes cause the option to be sent as a binary blob, not a string URI. api.json timing: RouterOS creates hotspot/api.json only after the first client CAPPORT probe — not at hotspot enable time. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/routeros-hotspot