MikroTik Management
Running MikroTik devices from the panel — setup wizard, guest network, speed limits and advanced device settings
- MikroTik Management
- Overview
- My Devices and Logs
- Setup Wizard
- Guest Wi-Fi and Useroam Connection
- Speed Limits and IP Distribution
- Device (Advanced)
MikroTik Management
MikroTik Management is the module for running the MikroTik devices registered to Useroam from the panel. Without connecting over SSH or Winbox you can build the guest network, configure hotspot and RADIUS, switch on 5651 logging and watch the device's health.
How do I open this screen? Choose MikroTik Management in the left menu. The heading shows which device you are on and its address.
1. Two warnings first
Changes apply immediately. Everything you change in this module is written straight to the device and cannot be undone. If you are unsure, do not change anything. The same warning appears at the top of the screens.
Device requirement: The device must run RouterOS 7.1 or newer with the web service (www-ssl) enabled. Otherwise the screens show "Cannot reach the device" and cannot display data.
2. Menu map
The module has three groups:
STATUS
- Overview: Device health and the three most common actions.
- Logs: The device's own event records.
- My Devices: A single-screen summary of every MikroTik registered to you.
GUEST NETWORK
- Setup: The wizard that generates the guest network, hotspot, RADIUS and 5651 logging.
- Guest Wi-Fi: Connected guests, guest accounts, IP/MAC permissions.
- Useroam Connection: Checks whether sign-ins are reaching Useroam's records.
- Speed Limits: Download and upload limits per user or network.
- IP Distribution: DHCP pools and who holds which address.
DEVICE (ADVANCED)
- Ports, IP and Routing, Firewall, VPN, Device Accounts, Backup.
The Back to device link at the top right returns you to the device's main page in the panel.
Related pages: MikroTik Management → Overview, Setup Wizard; Installation Guides.
Overview
Overview is the module's landing screen: device health at the top, and below it the three quick actions that cover most day-to-day work.
How do I open this screen? MikroTik Management → STATUS → Overview.
1. Device health
Shows the device's model, software version, how long it has been running and its current load. The Hardware and Firmware section below gives the detail.
If the device cannot be reached, these areas read "Cannot reach the device. It must run RouterOS 7.1 or newer and have the web service (www-ssl) enabled."
2. Block a guest
Removes a disruptive device from the network.
- MAC address: The device's MAC (e.g. 88:DC:96:50:49:81). You can copy it from the connected-guest list in the Guest Wi-Fi section.
- Type: blocked.
- Note: Why you blocked it — useful when you come to lift the block.
Add writes the rule to the device immediately.
3. Give a device a fixed IP
For devices that must always keep the same address, such as a POS computer, cash register or camera.
- IP address: The fixed address to assign.
- MAC address: The device's MAC.
- Note: What the device is.
4. Set a speed limit
Limits the speed of a single device or of the whole guest network.
- Name: The rule's name.
- Target (IP or network): A single address or a network block (e.g. 10.99.1.1/24). Enter the guest network as the target and the limit applies to everyone.
- Speed limit (download/upload): Written as 10M/2M.
For finer-grained limits, see the Speed Limits screen.
Related pages: MikroTik Management → Guest Wi-Fi, Speed Limits and IP Distribution.
My Devices and Logs
This page covers the two status screens: My Devices, where several devices appear in one list, and Logs, the first place to look when investigating a problem.
1. My Devices
How do I open it? MikroTik Management → STATUS → My Devices.
A summary of every MikroTik registered to you. The columns:
- Device: The device number. The one you are working on is marked "you are on this device".
- Address: The device's IP address.
- Status: Three values — online (connected and running), unreachable (connection details exist but the device cannot be reached), not connected (no connection details entered yet).
- RouterOS: The software version on the device (e.g. 7.23.3 (stable)).
- Uptime: How long the device has been running.
- CPU: Current processor usage.
What does "not connected" mean? No connection details have been entered for that device yet. You can set the connection up from the device's own page.
2. Logs
How do I open it? MikroTik Management → STATUS → Logs.
Shows the device's own event records. This is the first place to look when investigating a problem: the Recent events list gives what the device did, in time order.
If the device cannot be reached, the "Cannot reach the device" warning appears instead of the list.
Related pages: MikroTik Management → Overview, Setup Wizard.
Setup Wizard
The Setup Wizard builds the guest network from scratch. Reading the device's current configuration, it generates what is needed for the guest network, hotspot, RADIUS and 5651 logging. Your existing settings are preserved — the wizard fills the gaps rather than overwriting.
How do I open this screen? MikroTik Management → GUEST NETWORK → Setup.
1. Current state of the device
Before the wizard starts it lists what the device already has:
- Internet uplink (WAN)
- Hotspot server
- DHCP server
- RADIUS definition
- NAT for the internet uplink
Each row reads present / none, or ? if the device cannot be reached. Come back to this list after setup to confirm the result.
2. The wizard's three steps
The steps appear at the top: 1. Selection → 2. Script approval → 3. Code. So the wizard does not apply anything directly — it takes your choices and then puts the configuration destined for the device in front of you for approval.
3. Step 1 — Selection
- Which interface will carry the guest network: The interfaces read from the device are listed. Ports that are members of a bridge cannot be selected — choose the bridge itself instead.
- Guest gateway address: If the chosen interface already has an address, it appears here and is preserved. Change it and the address on the device is updated. The DHCP range is derived from this network automatically (e.g. 10.99.1.1/24).
- Portal domain: The name guests will see in their browser address bar. Do not define it in public DNS — it only needs to resolve inside the guest network.
4. Security and compliance steps
The same step carries four checkboxes:
- 5651 logging: forward records to the Useroam server — mandatory, it cannot be switched off. This is the basis of legal logging in Türkiye.
- DNS enforcement, blocking DoH, DoT and QUIC: Stops a guest bypassing logging with encrypted DNS or QUIC.
- Close device management ports from the guest network: Prevents guests reaching the router.
- Isolate the guest network from internal networks: Keeps guest traffic away from the office or POS network.
All four are recommended: the first three protect the 5651 obligation directly, the last protects your internal network.
Next takes you to the script approval step.
Related pages: MikroTik Management → Guest Wi-Fi and Useroam Connection; Analytics and Reports → 5651 Logs.
Guest Wi-Fi and Useroam Connection
This page covers two guest-network screens: Guest Wi-Fi, the network guests connect to, and Useroam Connection, which shows whether sign-ins are reaching Useroam.
1. Guest Wi-Fi
How do I open it? MikroTik Management → GUEST NETWORK → Guest Wi-Fi.
The screen has four sections:
Guest Wi-Fi servers
The hotspot servers defined on the device.
Guests connected right now
Devices currently on the network. When you want to block a guest, this is where you copy the MAC address from.
Guest accounts
Hotspot users defined on the device. A new account takes three fields:
- Username
- Password
- Profile (may be left empty)
IP and MAC permissions
Sets how specific addresses behave on the network. Type takes three values:
- bypassed: Passes through without signing in.
- blocked: Blocked.
- regular: Normal sign-in required.
A separate Addresses reachable without signing in section holds the addresses a guest may reach before authenticating (a payment provider or your own site, for instance).
2. Useroam Connection
How do I open it? MikroTik Management → GUEST NETWORK → Useroam Connection.
The screen where you check whether guest Wi-Fi sign-ins are reaching Useroam's records. If the device is unreachable, the top reads "Status could not be read — the Useroam connection could not be checked because the device could not be reached."
RADIUS servers
Lists the RADIUS servers defined on the device. A new server takes three fields:
The shared secret is never displayed, for security. If you lose it, you have to enter it again.
Guest Wi-Fi profiles
Lists the hotspot profiles, so you can confirm which profile RADIUS is working through.
Related pages: MikroTik Management → Setup Wizard, Overview; Captive Portal → Portal Settings.
Speed Limits and IP Distribution
This page covers two technical guest-network screens: Speed Limits, which divides up bandwidth, and IP Distribution, which shows how addresses are handed out.
Warning: Changes on both screens are applied to the device immediately and cannot be undone.
1. Speed Limits
How do I open it? MikroTik Management → GUEST NETWORK → Speed Limits.
Holds download and upload limits per user or network, in two sections:
- Simple limits: Applied directly to a single target. This covers everyday use.
- Tree limits: Hierarchical limits — used to share total bandwidth between groups.
To put a quick limit on one device or on the whole guest network, you can also use the Set a speed limit box on the Overview screen.
2. IP Distribution
How do I open it? MikroTik Management → GUEST NETWORK → IP Distribution.
The device hands out addresses automatically to computers and phones on the network (DHCP). This screen shows who holds which IP address, in three sections:
- IP pools: The address ranges to hand out. The setup wizard derives this range from the guest gateway address automatically.
- DHCP servers: Which pool is served on which interface.
- Connected devices: Devices currently holding an address.
To keep a device on the same address permanently, use the Give a device a fixed IP box on the Overview screen.
Related pages: MikroTik Management → Overview, Device (Advanced).
Device (Advanced)
This page covers the five screens in the module's DEVICE (ADVANCED) group. They touch the device's core network configuration; they are not needed for day-to-day operation, but are used when troubleshooting or verifying a setup.
Warning: Changes on these screens are applied to the device immediately and cannot be undone. If you are unsure, do not change anything.
1. Ports
The device's ports and wireless interfaces: which are up, and how much data has passed through them.
The This device's connections box at the top answers two questions: which interface carries the internet uplink, and which carries the guest network. If the device cannot be read, both show undetermined. Checking here before running the setup wizard makes choosing the right interface easier.
2. IP and Routing
The device's IP addresses, its route to the internet and its DNS settings, in three sections: IP addresses, routing table and DNS setting.
3. Firewall
Shows the rules by which the device passes or blocks traffic, in three sections: Rules, NAT and Address lists.
What not to touch: Automatically created rules cannot be changed. Rules tagged Useroam are required for guest Wi-Fi and 5651 logging — removing them breaks legal logging.
4. VPN
Settings for secure remote access: WireGuard, IPsec and PPP accounts.
WireGuard already ships built into your device; it only needs defining. The Set up VPN button creates the interface, the address and the required firewall permission in one go. The sections below list WireGuard interfaces, WireGuard peers, PPP accounts and IPsec peers.
5. Device Accounts
The device's own management accounts, listed as management accounts and permission groups. Guest Wi-Fi users are not here — they are in the Guest Wi-Fi section.
You cannot change anything here. Useroam's API account on the device does not hold the user-management permission. This is a deliberate security boundary: even if the panel were compromised, the device's management accounts could not be altered. If you need to change them, connect to the device directly.
Related pages: MikroTik Management → Setup Wizard, Speed Limits and IP Distribution.