Ana içeriğe geç

Setup Wizard

What is it for?

The Setup section (Setup WizardWizard) buildsgenerates the configuration that sets up the guest networknetwork, fromguest scratch.login Reading(hotspot), the device'sUseroam currentconnection configuration, it generates what is needed for the guest network, hotspot, RADIUS(RADIUS) and 5651 logging on your MikroTik device, made for your device. YourIt existingdoes settingsnot areuse preserveda —fixed template: it reads your device first, asks which port should carry the wizardguest fillsnetwork, shows you the gapsfull ratherscript thanit overwriting.generated and only after you approve it gives you the single line to paste into the device.

How do I open this screen? With the Open the setup screen button on Device Settings > Setup, or in the MikroTik Management →console from the left menu: GUEST NETWORK →> Setup.

MikroTik Management – Setup Wizard

When
do you use it?

  • You connected the device to the panel (Connected.) and are setting up guest Wi-Fi for the first time.
  • You want to move the guest network to another port or bridge.
  • You stopped halfway or the code expired and you want to generate it again.

1.Before Currentyou statestart

  • The device must be connected to the panel. If it is not, first do steps 1-6 of the deviceMikroTik

    BeforeIntegration Guide. Without a connection the wizard starts it lists whaton this screen are empty and Cannot reach the device... warnings appear.

  • Decide which port the guest network will use. You will pick the port your guest access point (AP) is plugged into, or the bridge that port belongs to.
  • On RouterOS 7.23.3 and above you must have enabled device mode beforehand (the yellow box in step 3). Otherwise the device alreadyrejects has:the hotspot setup.
  • You need to be able to connect to the device with Winbox or SSH and open a terminal.

Wizard steps

Three steps are shown at the top of the screen: 1. Choose, 2. Review script, 3. Code. The current step has a blue badge, finished steps green and upcoming steps grey. The wizard itself writes nothing to the device; the settings are only applied when you paste the line from step 3 into the device terminal.

to

Eachreach rowthe readsinternet, e.g. presentether1 / none, or; ? if the deviceit cannot be reached.read), ComeHotspot server, DHCP server, RADIUS entry and NAT for internet access. Each line reads Present or Missing. On a first setup most are Missing; after setup you can come back to this list after setup to confirm the result.

2. The wizard's three steps

The steps appear at the top: 1. Selection → 2. Script approval → 3. Code. So the wizard does not apply anything directly — it takes your choicescard and thencheck putsthey theare configuration destined for the deviceall in front of you for approvalPresent.

3. Step 1 — Selection

    Current State of the Device card and the top of the Setup Wizard card

  • Choose the guest network port. In the Setup Wizard card open the Which interface will carry the guest network:network list. The interfaceslist is read from the devicedevice; areeach listed.line shows the port name, type and address if any (e.g. bridge-misafir (bridge · 10.99.1.1/24)). Ports that arebelong members ofto a bridge are grey and cannot be selectedselected, —with choosemember of: ... next to them; pick the bridge itself instead.

  • Ports without a cable show down.

    The Guest gateway address:address field fills in automatically with the selected port's address if it has one (otherwise 10.99.1.1/24 is suggested). If theyou chosenchange interface already has an address, it appears here and is preserved. Change it andit, the address on the device is updated. The DHCPIP range handed out to guests is derived from this network automatically(.10 (e.g.to .254 on a 10.99.1.1//24) network).

  • Portal domain:domain name Theis the name guests will see in theirthe browser address bar.bar; the default is hotspot.useroam.local. Do not defineregister it in public DNSDNS.

    —

    Which interface will carry the guest network list, Guest gateway address and Portal domain name

    • it only needs to resolve inside

  • Check the guestsecurity network.

    • steps
and
press

4.Next. Security and compliance steps

 has four boxes (explained in the table below). The first is mandatory and cannot be unticked; the other three come ticked and we recommend leaving them ticked. Press Next. This button writes nothing to the device; it generates the script and prepares a setup code valid for 60 minutes. Any earlier unused setup codes for this device become invalid.

Security and compliance step boxes and the Next button

  • Read and approve the script. The sameScript That Will Run on the Device card opens. The yellow warning at the top reads This script changes the device configuration. Its first action is to back up the current settings; the backup file name is written inside the script. Read the script before applying it. What the script does is explained in plain words in the "What does the script do?" table below. After reading, tick I have read the script and approve running it on this device.; only then can you press I approve, show the code. Press Go back to cancel.

    Script That Will Run on the Device card, approval box and I approve, show the code button

  • Copy the line. The Setup Code card reads Script approved. Paste the line below into the device terminal. Below it are the device mode warning (for 7.23.3 and above) and the Single line to paste into the device terminal box. Press Copy (the button briefly shows Copied). Apply it before the time shown in Code valid until. To generate it again, press Start over.

    Setup Code card with the command box and Copy button

  • Paste the line into the device terminal. Connect to the device with Winbox or SSH, open a New Terminal, paste the line and press Enter. The script runs step carriesby fourstep checkboxes:and prints a line starting with Useroam: ... for each step. At the end it prints a result line from the panel and Test: connect a device to ... and open any web page - the Useroam portal should appear.

      Sample terminal output of the guest network setup

      The image is a sample terminal output; the lines are the script's own messages (some are in Turkish without special characters).

    • Check the result. Open the Setup section in the console again: the lines in Current State of the Device should read Present. The Useroam Connection section should read The Useroam connection appears to be in place. Finally connect a phone to the guest network and open a web page; the Useroam welcome page should appear.

      Useroam Connection section showing the connection is in place

      • Fields and buttons on the screen

      off.
    • Field / buttonWhat it doesExample
      Which interface will carry the guest networkThe port or bridge for the guest network. Only interfaces read from the device can be chosen; bridge member ports cannot.bridge-misafir
      Guest gateway addressThe guest network address on the device, with its size. A network (.0) or broadcast address is not accepted.10.99.1.1/24
      Portal domain nameThe name guests see in the address bar. Letters, digits, dot, hyphen and underscore only; an invalid name falls back to hotspot.useroam.local.hotspot.useroam.local
      5651 logging: forward records to the Useroam server (mandatory)Sends —hotspot, mandatory,DHCP itand cannotconnection records to Useroam for signing. Cannot be switchedunticked.ticked
      Force ThisDNS, is the basis of legal logging in Türkiye.
    • DNS enforcement, blockingblock DoH, DoT and QUIC:QUIC (prevents logging from being bypassed) Stops a
      		• Forces guest bypassingDNS loggingqueries withthrough the device; blocks encrypted DNS or(DoT) and QUIC.ticked
      CloseBlock device management ports from the guest network:network PreventsStops guests reaching the router.device's
    • SSH, Telnet, Winbox and API ports (80 and 443 stay open for the welcome page).
      		• ticked
      Isolate the guest network from internal networks:networksStops guests reaching internal networks such as office, till or cameras. Guests cannot reach each other either.ticked
      NextGenerates the script and moves to step 2. Writes nothing to the device.
      I approve, show the codeShows the code when the approval box is ticked.
      Go back Keeps/ guestStart trafficoverReturns awayto step 1.
      CopyCopies the line to the clipboard.

      What does the script do?

      The script itself is written without special characters (the RouterOS terminal does not show them reliably). In order:

      PartWhat it doesYour existing settings
      BackupWrites the current configuration to useroam-oncesi-<date-time>.rsc.Unchanged.
      1. Guest network addressAdds the gateway address to the chosen port.If the port already has an address it is changed.
      2. DHCPSets up the useroam-pool pool and useroam-dhcp server (1 hour lease).An existing DHCP server on the port is kept.
      2b. Old entry cleanupRemoves DHCP option 114 (captive portal announcement) entries left from older Useroam setups.Only Useroam's own entries are removed.
      3. DNSLets the device answer DNS for guests; adds 8.8.8.8 and 1.1.1.1 if no server is set; blocks DNS queries coming from the officeinternet.Your orDNS POS network.

      All fourservers are recommended:kept.

      4. Internet access (NAT)Creates an interface list named WAN and adds a NAT rule for the firstguest threenetwork. protectWorks with several internet lines.An old Useroam NAT rule is replaced.
      5. RADIUSAdds the 5651Useroam obligationRADIUS directly,server (panel.useroam.com first, the lastIP protectsif yourthe internalname network.

      is

      not accepted).

      		An old Useroam RADIUS entry is Nextremoved and added again; takesother youRADIUS entries are not touched.
      6. HotspotSets up the useroam-profile profile and useroam-hotspot server (RADIUS on, 30 minute idle timeout).An existing hotspot on the port is attached to the Useroam profile.
      7. Welcome pagesDownloads the Useroam welcome pages into the device's hotspot folder.Files with the same names are overwritten.
      8. Pre-login accessAdds the addresses guests need before logging in (Useroam, WhatsApp, Facebook, Google and Apple sign-in). The phones' "is there internet" check addresses are deliberately left out; if allowed, the login screen does not open.Old Useroam entries are renewed.
      9. 5651 loggingSets up syslog forwarding to Useroam and a rule that logs every new guest connection (useroam-5651-log), moved to the top of the list.Does not block traffic.
      10. DNS bypass block(If ticked) redirects DNS to the device, blocks DoT and QUIC.
      11. Management ports(If ticked) blocks guest access to the device's management ports.
      12. Isolation(If ticked) blocks guest access to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
      DoneTells the panel the setup is complete and prints the test instruction.

      If a part fails, the script approvalprints step.USEROAM WARNING: ... step failed, continuing. and carries on. If you see such a line, check that section in the console or contact support.

      Warnings

      MessageWhen it appearsWhat to do
      The selected interface was not found on the device. Refresh the page and try again.The chosen port changed or was removed on the device meanwhile.Reload the page and choose again.
      The gateway address is invalid. Example: 10.99.1.1/24The address is incomplete, or a network or broadcast address.Enter an address with its size as in the example.
      The setup code could not be saved.A temporary problem on the panel side.Press Next again; contact support if it continues.
      The setup code was not found or has expired. Please start over.You waited more than 60 minutes at step 2, or generated a newer code meanwhile.Generate a new code with Start over.
      Session verification failed. Please refresh the page and try again.The page was open for a long time or the session was renewed in another tab.Reload the page.
      Cannot reach the device. It must run RouterOS 7.1 or newer and have the web service (www-ssl) enabled.The panel cannot read the device; the list is empty.Check the connection status on Device Settings > Setup.

      The setup code was not found or has expired warning

      What if I want to go back?

      The comment at the top of the script contains a rollback command: /system reset-configuration run-after-reset=useroam-oncesi-<date-time>.rsc. This command resets the device and loads the backup file again; remote access to the device may be lost meanwhile. This rollback has not been tested by Useroam. Only use it when you are at the device and sure; otherwise contact support. To undo a single change, the Undo button in the console is a safer way (MikroTik Management).

      Frequently asked questions

      The list is empty, no ports are shown.
      The panel cannot read the device. Check that the card on Device Settings > Setup reads Connected.

      The port I want is grey and cannot be selected.
      The port belongs to a bridge. Choose the bridge itself; the guest network then works on every port of the bridge.

      After setup the login page does not open on the guest's phone.
      First check the Useroam Connection section. If it looks fine, disconnect the phone from Wi-Fi, reconnect and open an address starting with http in the browser. On RouterOS 7.23.3 and above, if device mode was not enabled the hotspot may not have been set up at all.

      What happens if I run the wizard a second time?
      The script finds and updates Useroam's own entries; it does not add the same entries twice. A new backup is still taken on every run.

      The code expired.
      Press Start over and generate it again with the same choices.

    • Başa dön