User Manager: Built-in RADIUS Server for Hotspot and PPP

User Manager is a RouterOS package that provides a built-in RADIUS server. It authenticates and accounts subscribers connecting through Hotspot and PPP services, replacing the need for an external RADIUS server for most small-to-medium deployments.

The internal data model has four core entities: routers (NAS devices sending RADIUS requests), profiles (service tiers with validity), limitations (bandwidth/time/transfer quotas attached to profiles), and users (subscriber accounts).

Prerequisites

RouterOS v6: user-manager extra package installed and matching the RouterOS version.
RouterOS v7: user-manager extra package installed (available in the MikroTik download archive for your board architecture).
The router running User Manager must be reachable by the NAS router(s) on UDP 1812 (authentication) and UDP 1813 (accounting).

Installation

RouterOS v6

Download the user-manager package matching your RouterOS version from mikrotik.com/download.

Upload it to the router:

/tool fetch url="http://<host>/user-manager-6.x.x-mipsbe.npk" dst-path=user-manager.npk

Reboot to install:
```
/system reboot
```

RouterOS v7

Download the user-manager extra package for your architecture.

Drag-and-drop upload via WebFig, or:

/tool fetch url="http://<host>/user-manager-7.x.x-arm64.npk" dst-path=user-manager.npk

Reboot:
```
/system reboot
```

Verify Installation

After reboot the /user-manager command tree is available:

/user-manager print

         enabled: yes
authentication-port: 1812
    accounting-port: 1813
        certificate: none
       use-profiles: no
require-message-auth: yes-access-request

If enabled: no, enable it:

/user-manager set enabled=yes

Core Configuration

Step 1: Register the NAS Router

User Manager must trust each router (NAS) sending RADIUS requests. Register NAS devices with their shared secret:

/user-manager router add \
    name=nas1 \
    address=192.168.1.1 \
    shared-secret=s3cr3tkey \
    comment="Hotspot router — building A"

Property	Description
`name`	Friendly label for this NAS
`address`	IP address the NAS sends RADIUS packets from
`shared-secret`	Must match the secret configured on the NAS RADIUS client

Verify:

/user-manager router print

Step 2: Create a Profile and Limitation

Profiles define the service tier and validity period. Limitations define the actual constraints (rate, uptime, traffic volume) and are linked to profiles via the profile-limitation sub-menu.

Create a limitation:

/user-manager limitation add \
    name=10M-30days \
    rate-limit-rx=10M \
    rate-limit-tx=10M \
    uptime-limit=0 \
    transfer-limit=0

Property	Description
`rate-limit-rx` / `rate-limit-tx`	Download / upload rate cap. Uses RouterOS rate notation (`k`, `M`, `G`).
`uptime-limit`	Maximum cumulative connected time. `0` = unlimited.
`transfer-limit`	Maximum cumulative bytes transferred. `0` = unlimited.

Create a profile and link the limitation to it:

/user-manager profile add \
    name=basic \
    validity=30d

/user-manager profile-limitation add \
    profile=basic \
    limitation=10M-30days \
    from-time=0s \
    till-time=23h59m59s \
    weekdays=sunday,monday,tuesday,wednesday,thursday,friday,saturday

The from-time/till-time/weekdays fields control when the limitation is active — set the full range for always-on access.

Note: Validity (how long after activation the profile is valid) is set on the profile, not the limitation. Use /user-manager profile add name=... validity=30d.

Step 3: Create Users

/user-manager user add \
    name=alice \
    password=a1ice2026

/user-manager user-profile add \
    user=alice \
    profile=basic

user-profile add assigns the profile and starts the validity clock. Always call this after adding a user, or the user has no active profile and will be rejected.

Verify:

/user-manager user print detail where name=alice

RADIUS Integration

Configure the NAS RADIUS Client

On each router that will send authentication requests to User Manager, add the RADIUS server entry:

/radius add \
    service=hotspot \
    address=<user-manager-ip> \
    secret=s3cr3tkey \
    authentication-port=1812 \
    accounting-port=1813 \
    protocol=udp \
    timeout=3000ms

For PPP services, add a second entry:

/radius add \
    service=ppp \
    address=<user-manager-ip> \
    secret=s3cr3tkey \
    authentication-port=1812 \
    accounting-port=1813 \
    protocol=udp \
    timeout=3000ms

When User Manager runs on the same router as the NAS, use 127.0.0.1 as the address and set the same shared secret in both the NAS RADIUS client and the User Manager router entry.

Enable RADIUS on HotSpot

/ip hotspot profile set [find name=default] \
    use-radius=yes \
    nas-port-type=wireless-802.11

Property	Description
`use-radius=yes`	Forwards HotSpot login requests to the configured RADIUS server(s)
`nas-port-type`	NAS-Port-Type attribute sent in Access-Request. Use `ethernet` for wired or `wireless-802.11` for Wi-Fi deployments.

Accounting for HotSpot is automatically sent when use-radius=yes is set — there is no separate accounting toggle. User Manager receives Accounting-Start when a client logs in, Accounting-Interim-Update at regular intervals, and Accounting-Stop on logout or disconnection.

To set the interim accounting interval on the HotSpot profile:

/ip hotspot profile set [find name=default] \
    use-radius=yes \
    radius-accounting=yes \
    radius-interim-update=5m

Tip: When User Manager runs on the same router as the HotSpot, use 127.0.0.1 as the RADIUS server address. The loopback path bypasses inter-router routing complexity.

Enable RADIUS on PPP

/ppp aaa set \
    use-radius=yes \
    accounting=yes \
    interim-update=5m

Property	Description
`use-radius=yes`	Consult RADIUS for authentication and authorization
`accounting=yes`	Send Accounting-Start/Stop/Interim-Update packets
`interim-update`	Frequency of usage updates to User Manager. 5m is typical; shorter intervals improve precision at higher overhead.

Enable Incoming RADIUS Messages (CoA / Disconnect)

User Manager can send Change-of-Authorization (CoA) and Disconnect-Message (DM) packets to terminate or modify active sessions when a profile changes or a user is deleted. Enable on the NAS:

/radius incoming set accept=yes

Bulk User Import

User Manager does not have a native CSV import command. The standard approach is a RouterOS script that reads a delimited file and calls the User Manager API in a loop.

Prepare the CSV File

Create a plain-text file on the router (e.g., via FTP/SCP). Use comma as the delimiter, one user per line:

alice,a1ice2026
bob,b0b2026
carol,carol99

Upload the file to the router root as users.csv.

Import Script

:local profile "basic"
:local filename "users.csv"

:local data [/file get $filename contents]
:local lines [:toarray $data]

:foreach line in=$lines do={
    :local sep [:find $line "," -1]
    :if ($sep > 0) do={
        :local uname [:pick $line 0 $sep]
        :local upass [:pick $line ($sep + 1) [:len $line]]

        /user-manager user add \
            name=$uname \
            password=$upass

        /user-manager user-profile add \
            user=$uname \
            profile=$profile

        :log info "Added user: $uname"
    }
}

Paste and run in the terminal or save to a file and run with /import. Check /log print for per-user confirmation or errors.

Voucher-Based Access

Vouchers are pre-generated username/password credentials printed on slips and handed to users. User Manager supports voucher workflows through batch user creation and a built-in voucher export command.

Generate a Batch of Voucher Users

/user-manager user add-batch-users \
    number-of-users=20 \
    username-length=8 \
    password-length=8 \
    username-characters=lowercase,numbers \
    password-characters=lowercase,uppercase,numbers

Property	Description
`number-of-users`	How many voucher accounts to create in one batch
`username-length`	Character length of the generated username
`password-length`	Character length of the generated password
`username-characters`	Character set for usernames: `lowercase`, `uppercase`, `numbers`
`password-characters`	Character set for passwords: `lowercase`, `uppercase`, `numbers`

This creates randomised users but does not assign a profile. Activate a profile on each new user before they can authenticate.

Assign a Profile to All New Voucher Users

:foreach u in=[/user-manager user find] do={
    :local uname [/user-manager user get $u name]
    /user-manager user-profile add \
        user=$uname \
        profile=basic
}

Run this immediately after add-batch-users. Users without an active profile receive Access-Reject.

Export Vouchers for Printing

/user-manager user generate-voucher [find] voucher-template=printable_vouchers

User Manager writes the voucher output to um5files/PRIVATE/TEMPLATES/vouchers/printable_vouchers.html in the router’s file system. Download it via Winbox Files or FTP, then print.

To customise the voucher layout, replace or edit the template file at um5files/PRIVATE/TEMPLATES/vouchers/. The template receives substitution variables for name, password, profile, and uptime/transfer limits from the attached limitation.

Single-User Voucher

/user-manager user generate-voucher [find where name=alice] voucher-template=printable_vouchers

Generates a voucher for one specific user.

Voucher Workflow Summary

Create batch users with add-batch-users.
Activate a profile on each user with user-profile add.
Export with generate-voucher → download the HTML file → print.
Give each printed slip to a subscriber; they log in through the HotSpot portal using the credentials on the slip.
When the profile expires the voucher is consumed. Re-activation requires assigning a new profile.

Session Tracking

User Manager stores session history for each user, populated from RADIUS Accounting packets.

View Active Sessions

/user-manager session print where status=active

View Session History for a User

/user-manager session print where user=alice

Key columns:

Column	Description
`user`	Subscriber identifier
`status`	`active` or `closed`
`uptime`	Duration of session
`upload` / `download`	Bytes transferred this session
`nas-ip`	NAS router that reported this session
`calling-station-id`	Client MAC address (Hotspot) or calling number (PPP)

View User Remaining Quota

/user-manager user-profile print detail where user=alice

The user-profile record shows the active profile, state, and end-time (expiry) based on the validity set on the profile.

User Manager vs External RADIUS

Capability	User Manager	External RADIUS (e.g. FreeRADIUS)
Installation effort	Install one NPK package	Install + configure a separate server
User database	Local SQLite, managed via RouterOS CLI/WebFig	External database (MySQL, PostgreSQL, LDAP, AD)
High availability	None — single point of failure	Redundant servers, database replication
Scale	Suitable for hundreds to low thousands of users	Scales to millions of users
Voucher support	Built-in batch generation and HTML export	Requires custom scripts or a RADIUS front-end
Attribute flexibility	Fixed attribute set; no EAP methods	Full RFC 2865/2866 + EAP, vendor extensions, custom attributes
802.1X / WPA-Enterprise	Not supported	Supported (EAP-TLS, PEAP, EAP-TTLS)
CoA / Disconnect-Message	Supported for active session termination	Fully supported
Reporting and billing	Basic session history in RouterOS CLI	Full billing systems (DALORADIUS, RADIUSdesk, custom)
Cost	Free (bundled with RouterOS)	Free (software) + server infrastructure cost

Choose User Manager when:

Single-router or small multi-router deployment.
No external server infrastructure is available or desirable.
Voucher or captive-portal-only use case.
Subscriber count stays below a few thousand.

Choose external RADIUS when:

High availability is required (no single point of failure).
Active Directory or LDAP integration is needed.
802.1X wireless or wired port authentication is required.
Deployment will exceed several thousand simultaneous users.
A billing or self-care portal is needed.

Limitations and Caveats

No IPv6 support in legacy builds: Some older User Manager versions do not handle IPv6 Framed-IPv6-Prefix attributes. Verify against your build.
No native bulk export: Exporting all users requires a script reading /user-manager user and writing to a file.
Single database, no replication: User Manager stores its database locally. For high-availability, deploy a separate external RADIUS server (FreeRADIUS) instead.
Large deployments: Performance degrades with very large user databases (tens of thousands of users) and high interim-update frequencies. Tune interim-update to 5–15 minutes for large installations.
PPP vs HotSpot attribute differences: Hotspot always sends accounting; PPP requires explicit accounting=yes. Rate-limit enforcement is via MikroTik-Rate-Limit RADIUS attribute returned in Access-Accept — verify your limitation’s rate fields are set correctly.
Profile changes take effect at next session: Modifying a profile limitation does not disconnect active sessions; the new limits apply when the user reconnects or when a CoA/DM is sent.
v6 vs v7 CLI differences: The command path changed from /tool user-manager (v6) to /user-manager (v7). The customer hierarchy from v6 is not present in v7. Always confirm with ? inline help on your installed version.

Troubleshooting

Users Cannot Authenticate

Verify User Manager is enabled:
```
/user-manager print
```
Confirm the NAS router address and shared secret match:
```
/user-manager router print
```
Check firewall — UDP 1812 must reach the User Manager interface:
```
/ip firewall filter print where dst-port=1812
```

Confirm the user exists and has an active profile:

/user-manager user print detail where name=<user>
/user-manager user-profile print detail where user=<user>

Sessions Not Tracked / Quotas Not Decremented

Confirm accounting is enabled on the NAS (PPP):
```
/ppp aaa print
```
Confirm interim-update is non-zero.
Check User Manager sessions for closed sessions with zero bytes — this indicates accounting start/stop was received but no interim updates:
```
/user-manager session print where user=<user>
```

User Rejected After Profile Expires

Expired profiles cause Access-Reject. To renew:

/user-manager user-profile add \
    user=<user> \
    profile=basic

Verification

# User Manager status
/user-manager print

# Registered NAS routers
/user-manager router print

# Profiles
/user-manager profile print

# Profile-limitation links
/user-manager profile-limitation print

# All users
/user-manager user print detail

# User profile assignments and expiry
/user-manager user-profile print detail

# Active sessions
/user-manager session print where status=active

User Manager: Built-in RADIUS Server for Hotspot and PPP

User Manager: Built-in RADIUS Server for Hotspot and PPP

Prerequisites

Installation

RouterOS v6

RouterOS v7

Verify Installation

Core Configuration

Step 1: Register the NAS Router

Step 2: Create a Profile and Limitation

Step 3: Create Users

RADIUS Integration

Configure the NAS RADIUS Client

Enable RADIUS on HotSpot

Enable RADIUS on PPP

Enable Incoming RADIUS Messages (CoA / Disconnect)

Bulk User Import

Prepare the CSV File

Import Script

Voucher-Based Access

Generate a Batch of Voucher Users

Assign a Profile to All New Voucher Users

Export Vouchers for Printing

Single-User Voucher

Voucher Workflow Summary

Session Tracking

View Active Sessions

View Session History for a User

View User Remaining Quota

User Manager vs External RADIUS

Limitations and Caveats

Troubleshooting

Users Cannot Authenticate

Sessions Not Tracked / Quotas Not Decremented

User Rejected After Profile Expires

Verification

See Also