# MikroTik Management Running MikroTik devices from the panel — setup wizard, guest network, speed limits and advanced device settings # MikroTik Management MikroTik Management is the module for running the MikroTik devices registered to Useroam **from the panel**. Without connecting over SSH or Winbox you can build the guest network, configure hotspot and RADIUS, switch on 5651 logging and watch the device's health. > **How do I open this screen?** Choose **MikroTik Management** in the left menu. The heading shows which device you are on and its address. ![MikroTik Management screen](https://help.useroam.com/uploads/images/gallery/2026-08/mt-genel.png) --- ## 1. Two warnings first > **Changes apply immediately.** Everything you change in this module is written straight to the device and **cannot be undone**. If you are unsure, do not change anything. The same warning appears at the top of the screens. > **Device requirement:** The device must run **RouterOS 7.1 or newer** with the **web service (www-ssl) enabled**. Otherwise the screens show *"Cannot reach the device"* and cannot display data. --- ## 2. Menu map The module has three groups: ### STATUS - **Overview:** Device health and the three most common actions. - **Logs:** The device's own event records. - **My Devices:** A single-screen summary of every MikroTik registered to you. ### GUEST NETWORK - **Setup:** The wizard that generates the guest network, hotspot, RADIUS and 5651 logging. - **Guest Wi-Fi:** Connected guests, guest accounts, IP/MAC permissions. - **Useroam Connection:** Checks whether sign-ins are reaching Useroam's records. - **Speed Limits:** Download and upload limits per user or network. - **IP Distribution:** DHCP pools and who holds which address. ### DEVICE (ADVANCED) - **Ports**, **IP and Routing**, **Firewall**, **VPN**, **Device Accounts**, **Backup**. The **Back to device** link at the top right returns you to the device's main page in the panel. --- > **Related pages:** **MikroTik Management → Overview**, **Setup Wizard**; **Installation Guides**. # Overview Overview is the module's landing screen: device health at the top, and below it the three quick actions that cover most day-to-day work. > **How do I open this screen?** **MikroTik Management → STATUS → Overview**. ![MikroTik Management – Overview](https://help.useroam.com/uploads/images/gallery/2026-08/gvbmt-genel.png) --- ## 1. Device health Shows the device's **model**, **software version**, **how long it has been running** and its **current load**. The **Hardware and Firmware** section below gives the detail. If the device cannot be reached, these areas read *"Cannot reach the device. It must run RouterOS 7.1 or newer and have the web service (www-ssl) enabled."* --- ## 2. Block a guest Removes a disruptive device from the network. - **MAC address:** The device's MAC (e.g. *88:DC:96:50:49:81*). You can copy it from the connected-guest list in the **Guest Wi-Fi** section. - **Type:** *blocked*. - **Note:** Why you blocked it — useful when you come to lift the block. **Add** writes the rule to the device immediately. --- ## 3. Give a device a fixed IP For devices that must **always keep the same address**, such as a POS computer, cash register or camera. - **IP address:** The fixed address to assign. - **MAC address:** The device's MAC. - **Note:** What the device is. --- ## 4. Set a speed limit Limits the speed of a single device or of the whole guest network. - **Name:** The rule's name. - **Target (IP or network):** A single address or a network block (e.g. *10.99.1.1/24*). **Enter the guest network as the target and the limit applies to everyone.** - **Speed limit (download/upload):** Written as *10M/2M*. For finer-grained limits, see the **Speed Limits** screen. --- > **Related pages:** **MikroTik Management → Guest Wi-Fi**, **Speed Limits and IP Distribution**. # My Devices and Logs This page covers the two status screens: **My Devices**, where several devices appear in one list, and **Logs**, the first place to look when investigating a problem. --- ## 1. My Devices > **How do I open it?** **MikroTik Management → STATUS → My Devices**. ![MikroTik Management – My Devices](https://help.useroam.com/uploads/images/gallery/2026-08/mt-filo.png) A summary of every MikroTik registered to you. The columns: - **Device:** The device number. The one you are working on is marked *"you are on this device"*. - **Address:** The device's IP address. - **Status:** Three values — *online* (connected and running), *unreachable* (connection details exist but the device cannot be reached), *not connected* (no connection details entered yet). - **RouterOS:** The software version on the device (e.g. *7.23.3 (stable)*). - **Uptime:** How long the device has been running. - **CPU:** Current processor usage. > **What does "not connected" mean?** No connection details have been entered for that device yet. You can set the connection up from the device's own page. --- ## 2. Logs > **How do I open it?** **MikroTik Management → STATUS → Logs**. Shows the device's own event records. This is the first place to look when investigating a problem: the **Recent events** list gives what the device did, in time order. If the device cannot be reached, the *"Cannot reach the device"* warning appears instead of the list. --- > **Related pages:** **MikroTik Management → Overview**, **Setup Wizard**. # Setup Wizard The Setup Wizard builds the guest network from scratch. Reading the device's current configuration, it generates what is needed for the **guest network, hotspot, RADIUS and 5651 logging**. **Your existing settings are preserved** — the wizard fills the gaps rather than overwriting. > **How do I open this screen?** **MikroTik Management → GUEST NETWORK → Setup**. ![MikroTik Management – Setup Wizard](https://help.useroam.com/uploads/images/gallery/2026-08/mt-kurulum.png) --- ## 1. Current state of the device Before the wizard starts it lists what the device already has: - **Internet uplink (WAN)** - **Hotspot server** - **DHCP server** - **RADIUS definition** - **NAT for the internet uplink** Each row reads *present* / *none*, or *?* if the device cannot be reached. Come back to this list after setup to confirm the result. --- ## 2. The wizard's three steps The steps appear at the top: **1. Selection** → **2. Script approval** → **3. Code**. So the wizard does not apply anything directly — it takes your choices and then puts the configuration destined for the device **in front of you for approval**. --- ## 3. Step 1 — Selection - **Which interface will carry the guest network:** The interfaces read from the device are listed. **Ports that are members of a bridge cannot be selected** — choose the bridge itself instead. - **Guest gateway address:** If the chosen interface already has an address, it appears here and is preserved. Change it and the address on the device is updated. The **DHCP range is derived from this network automatically** (e.g. *10.99.1.1/24*). - **Portal domain:** The name guests will see in their browser address bar. **Do not define it in public DNS** — it only needs to resolve inside the guest network. --- ## 4. Security and compliance steps The same step carries four checkboxes: - **5651 logging: forward records to the Useroam server** — **mandatory**, it cannot be switched off. This is the basis of legal logging in Türkiye. - **DNS enforcement, blocking DoH, DoT and QUIC:** Stops a guest bypassing logging with encrypted DNS or QUIC. - **Close device management ports from the guest network:** Prevents guests reaching the router. - **Isolate the guest network from internal networks:** Keeps guest traffic away from the office or POS network. All four are recommended: the first three protect the 5651 obligation directly, the last protects your internal network. **Next** takes you to the script approval step. --- > **Related pages:** **MikroTik Management → Guest Wi-Fi and Useroam Connection**; **Analytics and Reports → 5651 Logs**. # Guest Wi-Fi and Useroam Connection This page covers two guest-network screens: **Guest Wi-Fi**, the network guests connect to, and **Useroam Connection**, which shows whether sign-ins are reaching Useroam. --- ## 1. Guest Wi-Fi > **How do I open it?** **MikroTik Management → GUEST NETWORK → Guest Wi-Fi**. ![MikroTik Management – Guest Wi-Fi](https://help.useroam.com/uploads/images/gallery/2026-08/mt-hotspot.png) The screen has four sections: ### Guest Wi-Fi servers The hotspot servers defined on the device. ### Guests connected right now Devices currently on the network. When you want to block a guest, this is where you **copy the MAC address** from. ### Guest accounts Hotspot users defined on the device. A new account takes three fields: - **Username** - **Password** - **Profile** (may be left empty) ### IP and MAC permissions Sets how specific addresses behave on the network. **Type** takes three values: - **bypassed:** Passes through without signing in. - **blocked:** Blocked. - **regular:** Normal sign-in required. A separate **Addresses reachable without signing in** section holds the addresses a guest may reach before authenticating (a payment provider or your own site, for instance). --- ## 2. Useroam Connection > **How do I open it?** **MikroTik Management → GUEST NETWORK → Useroam Connection**. The screen where you check whether guest Wi-Fi sign-ins are **reaching Useroam's records**. If the device is unreachable, the top reads *"Status could not be read — the Useroam connection could not be checked because the device could not be reached."* ### RADIUS servers Lists the RADIUS servers defined on the device. A new server takes three fields: - **Server address** - **Shared secret** - **Service** > **The shared secret is never displayed, for security.** If you lose it, you have to enter it again. ### Guest Wi-Fi profiles Lists the hotspot profiles, so you can confirm which profile RADIUS is working through. --- > **Related pages:** **MikroTik Management → Setup Wizard**, **Overview**; **Captive Portal → Portal Settings**. # Speed Limits and IP Distribution This page covers two technical guest-network screens: **Speed Limits**, which divides up bandwidth, and **IP Distribution**, which shows how addresses are handed out. > **Warning:** Changes on both screens are applied to the device immediately and cannot be undone. --- ## 1. Speed Limits > **How do I open it?** **MikroTik Management → GUEST NETWORK → Speed Limits**. ![MikroTik Management – Speed Limits](https://help.useroam.com/uploads/images/gallery/2026-08/mt-hiz.png) Holds download and upload limits per user or network, in two sections: - **Simple limits:** Applied directly to a single target. This covers everyday use. - **Tree limits:** Hierarchical limits — used to share total bandwidth between groups. To put a quick limit on one device or on the whole guest network, you can also use the *Set a speed limit* box on the **Overview** screen. --- ## 2. IP Distribution > **How do I open it?** **MikroTik Management → GUEST NETWORK → IP Distribution**. The device hands out addresses automatically to computers and phones on the network (DHCP). This screen shows **who holds which IP address**, in three sections: - **IP pools:** The address ranges to hand out. The setup wizard derives this range from the guest gateway address automatically. - **DHCP servers:** Which pool is served on which interface. - **Connected devices:** Devices currently holding an address. To keep a device on the same address permanently, use the *Give a device a fixed IP* box on the **Overview** screen. --- > **Related pages:** **MikroTik Management → Overview**, **Device (Advanced)**. # Device (Advanced) This page covers the five screens in the module's **DEVICE (ADVANCED)** group. They touch the device's core network configuration; they are not needed for day-to-day operation, but are used when troubleshooting or verifying a setup. > **Warning:** Changes on these screens are applied to the device immediately and **cannot be undone**. If you are unsure, do not change anything. ![MikroTik Management – advanced screens](https://help.useroam.com/uploads/images/gallery/2026-08/mt-guvenlik.png) --- ## 1. Ports The device's ports and wireless interfaces: which are up, and how much data has passed through them. The **This device's connections** box at the top answers two questions: which interface carries the **internet uplink**, and which carries the **guest network**. If the device cannot be read, both show *undetermined*. Checking here before running the setup wizard makes choosing the right interface easier. --- ## 2. IP and Routing The device's IP addresses, its route to the internet and its DNS settings, in three sections: **IP addresses**, **routing table** and **DNS setting**. --- ## 3. Firewall Shows the rules by which the device passes or blocks traffic, in three sections: **Rules**, **NAT** and **Address lists**. > **What not to touch:** Automatically created rules cannot be changed. **Rules tagged Useroam are required for guest Wi-Fi and 5651 logging** — removing them breaks legal logging. --- ## 4. VPN Settings for secure remote access: **WireGuard**, **IPsec** and **PPP accounts**. WireGuard already ships built into your device; it only needs defining. The **Set up VPN** button creates the interface, the address and the required firewall permission **in one go**. The sections below list **WireGuard interfaces**, **WireGuard peers**, **PPP accounts** and **IPsec peers**. --- ## 5. Device Accounts The device's **own management accounts**, listed as **management accounts** and **permission groups**. Guest Wi-Fi users are not here — they are in the **Guest Wi-Fi** section. > **You cannot change anything here.** Useroam's API account on the device does not hold the user-management permission. This is a **deliberate security boundary**: even if the panel were compromised, the device's management accounts could not be altered. If you need to change them, connect to the device directly. --- > **Related pages:** **MikroTik Management → Setup Wizard**, **Speed Limits and IP Distribution**.