Router Setup Guide

This guide walks you through setting up a MikroTik router to connect with NettPortal. The entire process is automated — you just need to download Winbox, connect to your router, and run a single command.

🔐 Automatic WireGuard Configuration

NettPortal automatically handles all WireGuard VPN setup. You don't need to manually configure WireGuard — the system generates keys, creates the tunnel, and establishes the secure connection automatically during provisioning.

✨ New: Connect Existing Router

If you already have a MikroTik router in use with active configurations, you can now connect it to NettPortal without disrupting your existing setup. The system will only add minimal necessary configurations (API access, WireGuard VPN, walled garden) while preserving all your current settings.

Prerequisites

Step 1: Download Winbox

Winbox is MikroTik's official management tool for configuring routers. You'll need it to connect to your router and run the provisioning command.

Visit the official MikroTik download page: https://mikrotik.com/download/winbox
Scroll down to the "Winbox" section
Download Winbox for your operating system (Windows, macOS, or Linux)
Install Winbox on your computer

📚 Additional Resources

Step 2: Connect to Your Router

Before you can set up the router with NettPortal, you need to connect to it using Winbox.

Open Winbox on your computer
Enter your router's IP address (usually 192.168.88.1 for default MikroTik routers)
Enter your router's username (default is admin)
Enter your router's password
Click Connect to establish the connection

⚠️ Important

Make sure your computer is on the same network as the router, or that the router is accessible from your network. If you can't connect, check your router's IP address and network settings.

Router Setup Options

Option A: New Router Setup

Use this option if you have a brand new router or a router that hasn't been configured yet. This will perform a full setup including network configuration, bridges, IP addresses, DHCP, and services.

Step 1: Add Router to NettPortal

Navigate to Routers in the sidebar
Click Add Router button
Select "New Router" mode (default option)
Enter a friendly name for your router (e.g., "Main Office Router", "Branch Router #1")
DNS Name (Optional): Enter a DNS name for the Hotspot captive portal. This is the domain name users will see when they connect to your WiFi and get redirected to the login page. Examples: mynetwork.wifi or company.wifi. The DNS name must include a domain (must have a dot), so enter something like "name.wifi" not just "wifi". If you leave this empty, NettPortal will automatically generate one for you.
Click Next to continue

💡 What is the DNS Name for?

The DNS name is used for the Hotspot captive portal. When users connect to your WiFi and need to log in, they'll see this DNS name in their browser. For example, if you set it to mynetwork.wifi, users connecting to your WiFi will see "mynetwork.wifi" as the domain they're accessing when redirected to the login page. This makes your network look more professional and branded. You can leave this empty if you don't need a custom DNS name—NettPortal will automatically generate one for you.

Option B: Connect Existing Router

Use this option if you already have a MikroTik router in use with active configurations, users, and services. This mode will only add minimal necessary configurations for NettPortal management without disrupting your existing setup.

✅ What Gets Added (Minimal Configuration)

API user and API services for NettPortal access
Firewall rules to allow API access
WireGuard VPN tunnel for secure communication
Walled garden rules for payment gateways and portal access

🔒 What Stays Untouched (Your Existing Configuration)

All existing bridges and network interfaces
IP addresses and network configurations
DHCP servers and pools
NAT rules and routing
Hotspot configurations and users
All other existing services and settings

Step 1: Add Router to NettPortal

Navigate to Routers in the sidebar
Click Add Router button
Select "Existing Router" mode
Enter a friendly name for your router
DNS Name (Required): Enter the exact DNS name you're currently using on your router for the Hotspot captive portal. This is crucial for the captive portal theme to work correctly. Make sure to enter it exactly as it appears on your router (e.g., mynetwork.wifi or company.wifi). The DNS name must include a domain (must have a dot).
Click Next to continue

📝 Finding Your DNS Name

To find your current DNS name on the router:

Open Winbox and connect to your router
Go to IP → Hotspot → Servers
Check the DNS Name field in your Hotspot server configuration
Copy that exact name and paste it in NettPortal

Step 3: Run Provisioning Command on Router

After adding the router, NettPortal will display a provisioning command. Copy this command and run it in your MikroTik router's terminal using Winbox.

/tool fetch url="https://your-nettportal-url.com/api/provision/TOKEN" dst-path=nettportal.rsc;:delay 2s;/import nettportal.rsc

How to Run the Command in Winbox:

Make sure Winbox is connected to your router (from Prerequisites Step 2)
In Winbox, click on the Terminal icon (or press Ctrl + T)
Copy the provisioning command from NettPortal
Paste the command into the Winbox terminal window
Press Enter to execute the command
Wait for the command to complete (usually 10 - 30 seconds)
You'll see output indicating the script is downloading and executing
The router will automatically connect to NettPortal once the script completes

💡 Alternative Methods

You can also run the command using:

WebFig: Access your router's web interface and use the Terminal/Console section
SSH/Telnet: Connect via SSH or Telnet and run the command in the terminal

⚠️ Important Notes

The provisioning token expires after a certain time for security. If it expires, generate a new one from the router details page
Make sure your router has internet connectivity before running the command
For existing routers, the command will only add minimal configurations and won't affect your current setup
The router will check in with NettPortal every 5 minutes automatically

Step 4: Verify Connection

After running the provisioning command, NettPortal automatically checks if the router is connected. You'll see a status indicator showing:

Connected ✅ - Router is online and ready to use
Disconnected ❌ - Router hasn't connected yet (wait a few seconds and check again)

The system checks connection status automatically every 5 seconds. Once connected, you can proceed to configure services (PPPoE, Hotspot) or start managing customers.

Step 5: Configure Services (New Routers Only)

After your router is connected, you can configure PPPoE and Hotspot services. Note: This step is only for new routers. If you connected an existing router, your services are already configured and this step can be skipped.

ℹ️ For Existing Routers

If you connected an existing router, your PPPoE and Hotspot services are already configured and working. You don't need to configure them again. You can skip this step and proceed to managing your network through NettPortal.

Service Configuration Options:

PPPoE Server - Enable for Point-to-Point Protocol over Ethernet
Hotspot - Enable for MikroTik Hotspot authentication
Both - Enable both services simultaneously
Custom Subnet - Configure custom IP subnet (default: 192.168.90.0/24)
Ethernet Ports - Select ports for Hotspot-bridge (ether1 and ether2 are reserved)
Anti-Sharing - Enable Hotspot anti-sharing protection

Service configuration is also fully automated — the system will create bridges, IP addresses, DHCP pools, and configure all necessary RouterOS settings for you.

What You Don't Need to Do

❌ Manually configure WireGuard interfaces or peers
❌ Create API users or manage passwords
❌ Set up firewall rules for API access
❌ Configure routing or IP addresses
❌ Manage WireGuard keys or certificates
❌ Set up port forwarding or NAT rules

✅ All of these are handled automatically by NettPortal during provisioning!

Troubleshooting

Router Status Shows "Disconnected"

Wait 5-10 seconds after running the provisioning command
Ensure the router has internet connectivity
Verify the router can reach the NettPortal server
Check if firewall rules allow outbound connections to NettPortal
Click "Check Now" button to manually verify connection

"Device Mode Not Allowed" Error

This happens if the router is in "factory" mode instead of "advanced" mode
Run this command in router terminal: /system/device-mode update mode=advanced
Unplug router power for 10 seconds, then restore power
Retry the provisioning command after router reboots

Provisioning Command Fails

Ensure router has internet access
Verify router can download files from the internet (test with: /tool fetch url="https://www.google.com")
Check if firewall allows HTTPS outbound connections
Verify the provisioning token hasn't expired (generate a new one if needed)

Additional Resources

Official MikroTik Documentation

• RouterOS Documentation - Complete RouterOS reference
• Winbox Guide - How to use Winbox
• First Time Configuration - Initial router setup
• Hotspot Documentation - MikroTik Hotspot guide
• PPPoE Documentation - PPPoE server configuration

NettPortal Documentation

Learn more about managing your network with NettPortal:

• Router Management - Comprehensive router management guide
• Voucher Management - Create and manage vouchers
• Customer Management - Manage your customers
• Router Settings - Configure router settings

Next Steps

Once your router is connected:

For new routers: Configure services like PPPoE and Hotspot if needed
For existing routers: Start managing your network immediately through NettPortal
Create profiles for your customers
Add customers and assign profiles
Import existing vouchers from your router (if applicable)
Start managing your network remotely