Separate Hotspot Login from RADIUS Policy
A clean architecture for captive portal identity, authorization, accounting and billing.
A clean architecture for captive portal identity, authorization, accounting and billing.
The portal is only the front door
A branded login page can collect credentials, but RADIUS should make the authorization decision and accounting should describe what happened afterward. Mixing these concerns inside portal code makes access hard to audit and unsafe to retry.
Authentication
Prove the presented identity through an explicit method.
Authorization
Return time, rate and policy attributes for this session.
Accounting
Record start, updates and stop with stable session identity.
Define the session contract
Choose the NAS identity, username normalization, interim interval and attributes the router must honor. Reject unknown NAS clients. Keep shared secrets unique and rotate them through a controlled window.
Keep commercial state upstream
RADIUS policy may consult an active entitlement, but it should not silently create invoices or mutate package prices during authentication. Commercial changes need their own authorized transaction.
Design for missing stops
Power loss and network partitions can prevent Stop records. Use interim updates, NAS reboot evidence and stale-session reconciliation. Never bill unlimited time simply because a final packet never arrived.
Make rejection explainable
Classify expired service, invalid credential, blocked device and system failure separately. Show the customer a safe message while preserving detailed operator evidence.
Put it into operation
- Register NAS. Set unique identity, source and secret
- Map policy. Document every returned attribute and RouterOS effect
- Enable accounting. Use interim updates suitable for recovery needs
- Exercise failure. Drop packets, reboot the NAS and repeat requests
- Reconcile. Compare active router sessions with accounting state
Research basis: IETF RFC 2865; IETF RFC 2866; MikroTik RouterOS HotSpot documentation. Implementation details must be verified against the deployed release and local policy.