Connect MikroTik to ISPbills Without a Public IP: SSTP VPN Step-by-Step Guide

The Problem: No Public IP, No API Access

ISPbills communicates with your MikroTik routers through the RouterOS API. For that to work the billing server must be able to open a TCP connection to your router. If your router only has a private IP — 192.168.x.x or 10.x.x.x assigned by your upstream provider — the server simply cannot reach it.

This affects a large number of operators:

• Small ISPs sharing one upstream public IP among many devices (CGNAT)
• Branch or remote routers behind a head-office NAT
• Home labs and test environments
• Any router where the upstream provider does not supply a static public IP

ISPbills solves this with a dedicated SSTP VPN server. Your MikroTik initiates an outbound tunnel to that server. Once connected, your router gets a fixed private VPN IP. ISPbills uses that VPN IP as the router address — all API traffic flows through the tunnel, not the public internet.

What is SSTP and Why Does It Work Behind Any NAT?

SSTP (Secure Socket Tunneling Protocol) wraps PPP traffic inside a standard HTTPS connection on port 443. Because it looks identical to normal web traffic, it passes through virtually every firewall and NAT device without any configuration on your side — no port forwarding, no special firewall rules on your network.

MikroTik RouterOS includes a native SSTP client. ISPbills runs the SSTP server. When the tunnel is up:

• Your router gets a fixed VPN IP (e.g. 10.8.0.5) — always the same one
• ISPbills stores that VPN IP as your router address in the billing system
• API commands, provisioning, queue management, and monitoring all flow through the encrypted tunnel
• RouterOS reconnects the tunnel automatically if it drops — no watchdog scripts needed

Step 1 — Create a VPN Account in ISPbills

Log in to ISPbills. In the left sidebar open Network → VPN. You will see the VPN Accounts list. Click New Account.

The create page shows a single Create button — there are no fields to fill in. ISPbills auto-generates everything:

• A unique username and a random secure password for SSTP tunnel authentication
• A fixed VPN IP address from the client pool — this becomes your router address in ISPbills
• The RADIUS records required to authenticate and assign the fixed IP on the VPN server
• A Winbox forwarding port on the VPN server, so you can open Winbox remotely without any port forwarding on your own network

After clicking Create, ISPbills immediately redirects you to the Config Info page. This page shows four RouterOS commands with all values already filled in — your credentials, IP addresses, and server details are pre-populated. You only need to copy and paste.

Step 2 — Open the MikroTik Terminal

You need a RouterOS terminal to paste the commands. Any of these methods works — use whichever you already have access to:

• Winbox — connect to the router on your local LAN, then click New Terminal in the left menu
• SSH — ssh admin@192.168.88.1 from your PC
• WebFig — open the router's IP in a browser and navigate to Terminal

You should see the RouterOS prompt: [admin@MikroTik] >

Step 3 — Copy the Script and Paste It Into the MikroTik Terminal

The Config Info page shows a ready-to-use script with all values — your credentials, IP addresses, and server details — already filled in for your account. Copy it and paste it directly into the MikroTik terminal. That's it.

Step 4 — Verify the Tunnel is Running

After pasting all four commands, wait a few seconds, then run:

/interface sstp-client print

Look for the R (running) flag and running=yes:

Flags: X - disabled, R - running
 0 R  name="sstp-42"  connect-to="..."  running=yes

Back in ISPbills, the Tunnel column on the VPN Accounts list will show a green Connected badge once the tunnel is established.

Step 5 — Add the Router in ISPbills Using the VPN IP

The Config Info page shows a yellow notice card at the bottom:

Click the Add Router button on that page (or go to Network → Router → Add Router) and fill in:

• Router IP — the VPN IP from the Config Info page (e.g. 10.8.0.5), not the LAN or WAN IP
• API Port — 8728 (default RouterOS API port)
• API Username / Password — your MikroTik admin credentials

ISPbills tests the API connection through the tunnel. On success the router shows as Online and is ready for subscriber provisioning, queue management, and billing automation.

Bonus — Remote Winbox Access Without Port Forwarding

When ISPbills creates your VPN account it also sets up a dedicated port-forwarding rule on the VPN server MikroTik, mapping a unique external port directly to your router's Winbox port (8291). On the VPN Accounts list you will see a Winbox column showing a value like vpn-server-ip:5001.

Enter that address in Winbox's Connect To field from anywhere on the internet — no port forwarding, no firewall changes on your side.

What ISPbills Automates for You

ISPbills handles the entire VPN lifecycle automatically — from creation to cleanup:

• Credentials generation — unique username and password for each account, no manual entry
• Fixed IP assignment — a Framed-IP-Address RADIUS reply attribute ensures your router always gets the same VPN IP on reconnect
• Winbox port forwarding — a dst-natrule on the VPN server maps a dedicated port to your router's Winbox
• Pre-filled terminal commands — the Config Info page generates all four RouterOS commands with your real values; nothing to edit manually
• Tunnel health monitoring — ISPbills polls the SSTP client state via the RouterOS API and shows Connected / Disconnected status in the dashboard
• Auto-cleanup on delete — removing a VPN account also removes the RADIUS records, Winbox port-forwarding rule, and all four RouterOS configurations from the router automatically

Troubleshooting Common Issues

Tunnel shows "D" (disabled) instead of "R" (running)

The command sets disabled=no so the interface starts immediately. If it still shows disabled, enable it:

/interface sstp-client enable sstp-<id>

Tunnel is connected but ISPbills API test fails

Verify the RouterOS API service is enabled:

/ip service print
/ip service enable api

Also confirm no firewall INPUT rule is blocking port 8728 from the VPN subnet:

/ip firewall filter
add chain=input src-address=<vpn-subnet>/24 protocol=tcp dst-port=8728 action=accept comment="allow-billing-api" place-before=0

Router cannot reach the VPN server on port 443

Test outbound HTTPS connectivity from the router terminal:

/tool fetch url="https://<vpn-server-ip>" mode=https

If this fails, your upstream provider may be blocking outbound port 443. Contact them — standard HTTPS outbound should never be blocked.