WiFi Routers & Network Access Servers

Manage and monitor your WiFi routers and Network Access Servers (NAS) that connect to your RADIUS authentication system.

Overview

The Dynamic NAS feature allows you to register, configure, and monitor WiFi routers that handle customer authentication through your RADIUS server. The system automatically detects new routers and provides configuration scripts for easy deployment.

Key Concepts:

• NAS (Network Access Server) - Your WiFi router/hotspot device that handles user authentication
• Dynamic Client - A registered and approved NAS device in your network
• Unknown Client - A NAS device that contacted the system but hasn't been approved yet
• RADIUS - Authentication protocol used for centralized access control
• NAS Identifier - Unique ID assigned to each router (e.g., "123-45678")

Navigate to WiFi Routers in the sidebar to manage your network devices.

---

Understanding Network Access Servers (NAS)

What is a NAS?

In WiFi hotspot management, a Network Access Server (NAS) is:

• Your physical WiFi router or access point
• The device that customers connect to for WiFi access
• Equipment that communicates with your RADIUS server for authentication
• Hardware from brands like Mikrotik, Cisco, Ubiquiti, TP-Link, Aruba, or Juniper

How NAS Authentication Works

Customer Device
    ↓
Connects to WiFi Router (NAS)
    ↓
Router sends authentication request to RADIUS Server
    ↓
RADIUS checks: Is customer valid? Is package active?
    ↓
RADIUS responds: Accept or Reject
    ↓
Router grants or denies internet access
    ↓
Session tracking begins (data usage, time)

---

Viewing WiFi Routers

Router List

The WiFi Routers page displays all registered NAS devices in your network.

Available Columns:

• ID - Unique router identifier
• Name - Friendly name you assigned (e.g., "Main Office Router")
• Location - Where the router is deployed
• NAS Identifier - Unique RADIUS ID (auto-generated)
• MAC Address - Physical hardware address (Calling Station ID)
• NAS Type - Router brand (Mikrotik, Cisco, etc.)
• Status - Enabled/Disabled
• Last Contact IP - IP address of last authentication request
• Last Contact Time - When router last contacted the system
• Time Since Contact - Human-readable time since last contact (e.g., "2 hours ago")

Features:

• Search - Find routers by name, NAS ID, or MAC address
• Filter - View only enabled or disabled routers
• Sort - Click column headers to sort
• Actions - View details, Edit, Delete, View audit log

---

Adding a New Router

Method 1: Approve Unknown Router (Recommended)

When a new router contacts your RADIUS server for the first time, it appears in "Unknown Dynamic Clients".

Steps:

1. Go to Unknown Dynamic Clients page
2. Review the unknown device details:
   • NAS Identifier
   • MAC Address (Calling Station ID)
   • Last Contact Time
   • Last Contact IP
3. Click Add to Dynamic Clients
4. Configure the router:
   • Name - Friendly identifier (e.g., "Branch Office Mikrotik")
   • Location - Select from dropdown
   • NAS Type - Choose router brand
   • Status - Enable or Disable
5. Click Save

What Happens:

• System creates a Dynamic Client record
• NAS Identifier and MAC address are copied automatically
• Router is now authorized for authentication
• Unknown client entry is removed

Method 2: Manual Registration

Create a router entry manually before deployment.

Steps:

1. Go to WiFi Routers page
2. Click + Add Router
3. Fill in the form:
   • Name (required) - Router name
   • Location (required) - Deployment location
   • Calling Station ID - MAC address of the router
   • NAS Type (required) - Select brand
   • Status - Enable/Disable
4. Click Save

Note: NAS Identifier is auto-generated in format: operator_id-random_number

---

Router Details & Configuration

Click any router to view comprehensive details and configuration scripts.

Router Information

Basic Details:

• Name and NAS Identifier
• Location assignment
• MAC Address (Calling Station ID)
• NAS Type (brand)
• Enabled/Disabled status

Contact Information:

• Last Contact IP Address
• Last Contact Time
• Time Since Last Contact

Audit Information:

• Created By (user)
• Updated By (user)
• Created At timestamp
• Updated At timestamp

Mikrotik Configuration Script

For Mikrotik routers, the system auto-generates a complete RouterOS configuration script.

Copy and paste this script into your Mikrotik terminal:

/system identity
set name=123-45678

/interface bridge
add name=hotspot-bridge

/ip hotspot profile
add dns-name=mywifi.com hotspot-address=10.5.50.1 login-by=mac,http-pap \
    mac-auth-mode=mac-as-username-and-password name=xnwifi \
    radius-interim-update=3m use-radius=yes

/ip pool
add name=hotspot-pool ranges=10.5.50.2-10.5.50.254

/ip dhcp-server
add address-pool=hotspot-pool disabled=no interface=hotspot-bridge \
    lease-time=1h name=hotspot-dhcp

/ip hotspot
add address-pool=hotspot-pool disabled=no interface=hotspot-bridge \
    name=server1 profile=xnwifi

/radius
add address=[RADIUS_SERVER_IP] secret=xceednet service=hotspot timeout=3s

/radius incoming
set accept=yes port=3799

/ip hotspot walled-garden
add dst-host=[SYSTEM_SERVER_IP]

:delay 5
/tool fetch url="[API_URL]/get-login-file/[location_id]" \
    dst-path=hotspot/login.html duration=1m

What the Script Does:

• Sets router identity to your NAS Identifier
• Creates hotspot bridge interface
• Configures hotspot profile with RADIUS authentication
• Sets up IP pool and DHCP server
• Configures RADIUS server connection
• Enables RADIUS incoming for session tracking
• Adds walled garden for login page access
• Fetches custom login page from your server

Script Features:

• Copy Button - One-click copy to clipboard
• Pre-configured - Uses your router's NAS ID and location
• RADIUS Secret - Matches your server configuration
• MAC Authentication - Enables seamless user login
• Login Page - Auto-downloads your branded login page

---

Editing Routers

Update router configuration after deployment.

Editable Fields:

• Name - Change friendly name
• Location - Move router to different location
• Calling Station ID - Update MAC address
• NAS Type - Change router brand
• Status - Enable/Disable the router

NAS Identifier Cannot Change

The NAS Identifier is permanent and cannot be edited. If you need a different NAS ID, delete the router and create a new one.

---

Router Status

Enabled vs Disabled

Enabled (Active):

• Router can authenticate users
• Appears as active in the list
• RADIUS accepts authentication requests
• Users can connect and access internet

Disabled (Inactive):

• Router cannot authenticate users
• RADIUS rejects all authentication requests
• Existing sessions may be terminated
• Use for temporary deactivation or maintenance

Use Cases for Disabling:

• Router maintenance or troubleshooting
• Temporary location closure
• Security incident response
• Router replacement in progress

---

Supported Router Brands

The system supports the following NAS types:

Brand	Type Code	Common Models	Config Script
Mikrotik	mikrotik	hAP, RB series, CCR	Auto-generated ✓
Cisco	cisco	Aironet, Catalyst	Manual
Ubiquiti	ubiquiti	UniFi, EdgeRouter	Manual
TP-Link	tp-link	Omada, EAP series	Manual
Aruba	aruba	Instant, Controller	Manual
Juniper	juniper	EX, SRX series	Manual
Other	other	Generic RADIUS client	Manual

Mikrotik Auto-Configuration

Mikrotik routers receive auto-generated configuration scripts. For other brands, configure RADIUS settings manually using your router's admin interface.

---

Unknown Dynamic Clients

What Are Unknown Clients?

When a router contacts your RADIUS server but isn't registered in the system, it's captured as an Unknown Dynamic Client.

Common Causes:

• New router deployed without pre-registration
• Router MAC address changed
• Router reset to factory defaults
• Unauthorized router attempting to connect

Reviewing Unknown Clients

Information Available:

• NAS Identifier - ID the router is using
• MAC Address - Hardware address
• Last Contact Time - When it attempted to connect
• Last Contact IP - Router's IP address
• Time Since Contact - How long ago

Actions for Unknown Clients

Add to Dynamic Clients:

1. Review the device details
2. Verify it's a legitimate router (check MAC, IP, contact time)
3. Click "Add to Dynamic Clients"
4. Provide name, location, and NAS type
5. Approve and register

Delete:

• Remove if it's an unauthorized or invalid device
• Use if router was incorrectly configured
• Remove duplicates or test entries

Security Consideration

Review unknown clients carefully. Unauthorized routers could be security threats. Verify MAC address and contact IP before approving.

---

Access Request Monitoring

Track all authentication attempts from your routers.

What Are Access Requests?

Every time a customer tries to connect, the router sends an Access-Request to your RADIUS server. These are logged for monitoring and troubleshooting.

Logged Information:

• Username - Customer attempting to authenticate
• NAS IP Address - Which router originated the request
• NAS Identifier - Router's unique ID
• Client MAC Address - Customer's device MAC
• Client IP Address - Customer's device IP
• Reply Type - Accept or Reject
• Reply Message - Why accepted/rejected
• Timestamp - When request occurred

Viewing Access Requests

Navigate to Access Requests to view authentication logs.

Filtering Options:

• By username
• By NAS IP address
• By reply type (Accept/Reject)
• By date range

Use Cases:

• Troubleshooting - Why is customer unable to connect?
• Security - Monitor failed authentication attempts
• Usage Patterns - See peak authentication times
• Router Health - Verify routers are sending requests

---

Session Accounting

Track active customer sessions and data usage.

RADIUS Accounting (radacct)

The system maintains detailed session records in the RADIUS accounting table.

Session Data:

• Session ID - Unique identifier for each connection
• Username - Customer account
• NAS IP Address - Which router handled the session
• Start Time - When session began
• Stop Time - When session ended (if completed)
• Duration - Total session time in seconds
• Download Bytes - Data downloaded (Input Octets)
• Upload Bytes - Data uploaded (Output Octets)
• Total Bytes - Combined data usage
• Called Station ID - Router MAC/SSID
• Calling Station ID - Customer device MAC

Session Status

Active Session:

• Start time recorded, no stop time
• Interim updates sent periodically (every 3 minutes by default)
• Data usage tracked in real-time
• Customer currently connected

Completed Session:

• Both start and stop times recorded
• Final data usage calculated
• Session duration finalized
• Historical record

---

Router Deployment Workflow

Complete Setup Process

Step 1: Physical Installation

Purchase router (Mikrotik recommended)
    ↓
Connect to power and internet
    ↓
Configure basic network settings
    ↓
Set static IP or DHCP reservation

Step 2: Initial Router Configuration

Access router admin interface
    ↓
Configure WAN (internet) connection
    ↓
Set DNS servers
    ↓
Update router firmware

Step 3: First Contact (Unknown Client)

Router attempts first authentication
    ↓
System doesn't recognize NAS ID
    ↓
Creates Unknown Dynamic Client record
    ↓
(Optional: System sends notification)

Step 4: Approval

Log into WiFi Management frontend
    ↓
Go to Unknown Dynamic Clients
    ↓
Click "Add to Dynamic Clients"
    ↓
Fill: Name, Location, NAS Type
    ↓
Save (router now authorized)

Step 5: Apply Configuration

Go to router details page
    ↓
Copy Mikrotik configuration script
    ↓
Log into router terminal (SSH or Winbox)
    ↓
Paste script
    ↓
Wait for configuration to apply
    ↓
Router reboots (if needed)

Step 6: Verification

Check router status shows "Enabled"
    ↓
Verify last contact time is recent
    ↓
Test customer connection
    ↓
Check access requests log
    ↓
Verify session accounting

---

Mikrotik-Specific Configuration

Manual Configuration Steps

If you prefer manual configuration instead of the auto-generated script:

1. System Identity

/system identity
set name=[YOUR_NAS_IDENTIFIER]

2. Hotspot Profile

/ip hotspot profile
add name=xnwifi \
    hotspot-address=10.5.50.1 \
    dns-name=mywifi.com \
    login-by=mac,http-pap \
    mac-auth-mode=mac-as-username-and-password \
    use-radius=yes \
    radius-interim-update=3m

3. RADIUS Server

/radius
add address=[RADIUS_SERVER_IP] \
    secret=xceednet \
    service=hotspot \
    timeout=3s

4. RADIUS Incoming

/radius incoming
set accept=yes port=3799

5. Walled Garden

/ip hotspot walled-garden
add dst-host=[SYSTEM_SERVER_IP]

6. Fetch Login Page

/tool fetch \
    url="[API_URL]/get-login-file/[LOCATION_ID]" \
    dst-path=hotspot/login.html

Key Configuration Parameters

Parameter	Value	Purpose
System Identity	NAS Identifier from system	Identifies router to RADIUS
RADIUS Server IP	Your server IP	Where to send auth requests
RADIUS Secret	xceednet (default)	Shared secret for security
RADIUS Service	hotspot	Which service uses RADIUS
MAC Auth Mode	mac-as-username-and-password	Seamless MAC-based login
Interim Update	3 minutes	How often to send session updates
RADIUS Incoming Port	3799	Port for accounting messages

---

Troubleshooting

Router not appearing in Unknown Clients

Cause: Router hasn't contacted RADIUS server yet.

Fix:

1. Verify router has internet connectivity
2. Check RADIUS server IP configuration on router
3. Ensure router is attempting to authenticate a test user
4. Check firewall rules allow UDP ports 1812 (auth) and 1813 (accounting)
5. Verify router has correct RADIUS secret configured

---

Router shows as "Unknown" even after approval

Cause: NAS Identifier mismatch between router and system.

Fix:

1. Check router's system identity: /system identity print
2. Compare to NAS Identifier in system
3. Update router identity: /system identity set name=[NAS_ID]
4. Wait 1-2 minutes and test authentication
5. Check "Last Contact" time updates

---

Customers cannot authenticate

Cause: Multiple possible issues.

Fix:

1. Check router status - Must be "Enabled"
2. Verify last contact - Should be recent (within hours)
3. Check Access Requests log - Look for Reject messages
4. Verify customer package - Must be active and valid
5. Check RADIUS secret - Must match on router and server
6. Test RADIUS connectivity - ping [RADIUS_SERVER_IP] from router
7. Review router logs - Look for RADIUS timeout errors

---

Configuration script doesn't work

Cause: Environment variables or RouterOS version issues.

Fix:

1. Check RouterOS version (v6.x or v7.x)
2. Manually replace placeholders in script:
   • [RADIUS_SERVER_IP] → Your actual IP
   • [SYSTEM_SERVER_IP] → Your server IP
   • [API_URL] → Your API URL
   • [location_id] → Your location ID
3. Run commands one section at a time
4. Check for error messages after each section
5. Verify RADIUS service is licensed on your Mikrotik

---

Last Contact time not updating

Cause: Router not sending authentication requests or accounting updates.

Fix:

1. Verify customers are attempting to connect
2. Check router RADIUS configuration is applied
3. Enable RADIUS interim updates: radius-interim-update=3m
4. Test with a customer login attempt
5. Check if router can reach RADIUS server
6. Review router logs for RADIUS communication errors

---

MAC address changed but NAS ID same

Cause: Router hardware replaced but reusing NAS ID.

Fix:

1. Edit the router in WiFi Routers page
2. Update "Calling Station ID" to new MAC address
3. Save changes
4. Verify router continues to authenticate

---

Multiple routers with same NAS ID

Cause: Configuration script copied to multiple routers.

Fix:

1. Each router must have unique NAS Identifier
2. Delete duplicate routers
3. For each router, get unique NAS ID from system
4. Set unique system identity on each router
5. Re-approve each router as Unknown Client

---

Best Practices

Use descriptive names - Name routers by location and purpose: "Main Office - Floor 1 Mikrotik"

Monitor last contact - Routers should contact system at least every few hours. Investigate if stale.

Enable interim updates - Set radius-interim-update=3m for real-time session tracking.

Keep firmware updated - Update router firmware regularly for security and stability.

Document MAC addresses - Keep a spreadsheet of router MAC addresses for hardware tracking.

Use static IPs - Assign static IPs or DHCP reservations to routers for consistent monitoring.

Test before deployment - Verify authentication works before deploying router to remote location.

Backup router config - Export router configuration after setup: /export file=backup

Monitor access requests - Review failed authentication attempts for issues or security threats.

Disable unused routers - Set status to "Disabled" instead of deleting for historical records.

Secure RADIUS secret - Use strong, unique RADIUS secrets in production environments.

Walled garden configuration - Always whitelist your server IP for login page access.

---

Integration with Other Features

Subscribers

• Routers authenticate subscribers via RADIUS
• Each access request includes subscriber username
• Session accounting tracks per-subscriber data usage

Packages

• RADIUS checks if subscriber has active package
• Package bandwidth limits enforced by router
• Package expiration prevents authentication

Locations

• Each router assigned to a location
• Sales and usage reports by location
• Multiple routers can share same location

Access Requests

• Every authentication attempt logged
• Links router (NAS IP) to subscriber (username)
• Accept/Reject decisions tracked

Session Accounting (radacct)

• Tracks active and historical sessions
• Links to router via NAS IP Address
• Data usage and duration per session

---

Security Considerations

RADIUS Secret - Keep the RADIUS shared secret confidential. Anyone with the secret can impersonate a NAS.

Unknown Clients - Review unknown clients carefully. Verify MAC address and IP before approving.

Firewall Rules - Restrict RADIUS ports (1812, 1813) to known router IPs only.

Router Access - Secure router admin interfaces with strong passwords and disable remote access.

Regular Monitoring - Check access request logs for unusual patterns or failed attempts.

Disable Unused Routers - Deactivate routers that are no longer in service.

Audit Trail - Review router modification history regularly in audit logs.

---

API Reference

For developers integrating with the WiFi router API:

Endpoints:

• GET /api/v1/dynamic_clients - List routers
• GET /api/v1/dynamic_clients/:id - Get router details
• POST /api/v1/dynamic_clients - Create router
• PATCH /api/v1/dynamic_clients/:id - Update router
• DELETE /api/v1/dynamic_clients/:id - Delete router
• GET /api/v1/dynamic_clients/:id/audit_log - Get audit trail
• GET /api/v1/unknown_dynamic_clients - List unknown clients
• POST /api/v1/unknown_dynamic_clients/:id/add_to_dynamic_clients - Approve unknown client
• GET /api/v1/access_requests - List access request logs

Query Parameters:

• search - Search by name, NAS ID, or MAC
• enabled - Filter by enabled status
• location_id - Filter by location
• page - Page number (default: 1)
• per_page - Results per page (default: 25)

---

Next Steps

Start Deploying Routers

After understanding WiFi routers:

1. Purchase Mikrotik router (recommended for beginners)
2. Connect router and let it create an Unknown Client entry
3. Approve the router in Unknown Dynamic Clients
4. Copy the auto-generated Mikrotik script
5. Paste script into router terminal
6. Test customer authentication
7. Monitor Access Requests and Session Accounting

See also:

• Subscribers - Manage customer accounts
• Packages - Create access packages
• Locations - Organize by location
• Settings - Configure RADIUS settings