Wibizpro

Entegre Wibizpro nan rezo ou

Konekte bòn ou a ak Wibizpro epi kòmanse vann aksè WiFi nan kèk minit.

1 Jwenn paramèt Wibizpro ou yo
  1. Kreye yon sit nan dashboard Wibizpro ou.
  2. Ouvri paj sit la — de valè w bezwen yo montre la :
  • URL pòtay la : https://wibizpro.online/portal/?token=dt_your-site-token
    Se yon egzanp — URL la pa reyèl jiskaske w kreye yon sit. Pa w la ap pote pwòp token li.
    Gade kijan pòtay la ye →
  • Sekrè RADIUS : sit ou a rad_xxx
Chak sit gen pwòp sekrè l. Sekrè sa a se li ki di Wibizpro nan ki sit yon kliyan ye — e kidonk ki pase ki valab la.

2 Konfigire routeur MikroTik ou

In RouterOS, open New Terminal. Do the blocks below in order — each one depends on the previous.

2.1 — Unlock device-mode (physical, once per router)

Recent MikroTik routers ship with the hotspot disabled at a level below user permissions. No password and no API can unlock it.

/system/device-mode/update mode=advanced

Then, within 5 minutes: unplug the power, wait 30 seconds, plug it back in.

Do not hold the reset button. A long press during boot restores factory settings and erases everything. And never run the update command twice — each retry increments a counter that eventually blocks the change.

Verify:

/system/device-mode/print # expected: mode=advanced hotspot=true fetch=true

2.2 — Separate the interfaces (hotspot on ethernet only)

The hotspot applies to the interface you give it. On a factory router, the bridge also carries the built-in WiFi — so the hotspot would cover it too. Move the Ethernet ports to their own bridge:

/interface bridge add name=bridge-clients /interface bridge port set [find interface=ether2] bridge=bridge-clients /interface bridge port set [find interface=ether3] bridge=bridge-clients /interface bridge port set [find interface=ether4] bridge=bridge-clients /interface bridge port set [find interface=ether5] bridge=bridge-clients /ip address add address=192.168.90.1/24 interface=bridge-clients /ip pool add name=clients-pool ranges=192.168.90.10-192.168.90.254 /ip dhcp-server add name=dhcp-clients interface=bridge-clients \ address-pool=clients-pool disabled=no /ip dhcp-server network add address=192.168.90.0/24 \ gateway=192.168.90.1 dns-server=192.168.90.1 /ip dns set allow-remote-requests=yes # Stable name printed on ticket QR codes (resolves to this hotspot) :if ([:len [/ip dns static find where name="wifi.wibizpro"]] > 0) do={ \ /ip dns static remove [find where name="wifi.wibizpro"] } /ip dns static add name=wifi.wibizpro address=192.168.90.1
The router's own WiFi stays outside the hotspot, so it gives free internet to anyone who joins it. Secure it with WPA2 or disable it. If you want the hotspot on the built-in WiFi too, put wifi1/wifi2 in bridge-clients instead.
wifi.wibizpro is only the local DNS name for the tickets. It resolves to 192.168.90.1 on this router. It is NOT the hotspot profile's DNS Name field — that one must stay empty (see 2.4). If you change the client subnet, change the address in this record too.

2.3 — RADIUS

/radius add address=144.202.47.181 secret=rad_xxx service=hotspot \ authentication-port=1812 accounting-port=1813 timeout=2s # Keep the default — never set this to "no" /radius set [find address=144.202.47.181] require-message-auth=yes-for-request-resp # so the server can disconnect a client immediately /radius incoming set accept=yes port=3799
Never set require-message-auth=no. That value disables protection against Blast-RADIUS (CVE-2024-3596): an attacker placed on the network path could turn a Reject into an Accept and give free internet without knowing the shared secret. Wibizpro sends the Message-Authenticator, so the default value works — leave it as is.

Ranplase rad_xxx ak sekrè sit ou. Hotspot la viv sou routeur la — pa janm sou pwen aksè yo.

2.4 — Hotspot profile and hotspot

/ip hotspot profile add name=wibizpro hotspot-address=192.168.90.1 \ use-radius=yes radius-accounting=yes \ radius-interim-update=1m login-by=mac,http-pap /ip hotspot add name=wibizpro interface=bridge-clients \ address-pool=clients-pool profile=wibizpro disabled=no
Leave DNS Name empty. A DNS name such as wifi.local ends up in the login URL, and modern browsers upgrade it to https://wifi.local/login — which lands on the router's own web interface, not the portal. The result is a blank page.
Mete entèval entèmedyè a a 1m klèman. Pa defo, RouterOS tann sèvè a di l konbyen tan, epi Wibizpro pa voye sa. San liy sa a, ou pèdi konsomasyon done an dirèk, badj « an liy » a, ak pwoteksyon « yon sèl aparèy aktif » — san okenn mesaj erè.

2.5 — The captive login pages

Run these after the hotspot exists — it is what creates the files. Both are required: login.html is the page the client opens, redirect.html is the one the operating system shows automatically when it detects a captive portal.

/file set [find name~"login.html"] contents="<html><head></head><body><script>(function(){var portal='https://wibizpro.online/portal/?token=dt_your-site-token&clientMac=\$(mac-esc)&ap=wibizpro';var code='';try{var m=(window.location.href+'&').match(/[?&]code=([^&]+)/);if(m)code=decodeURIComponent(m[1]);}catch(e){}if(!code){try{var orig='\$(link-orig)';var m2=(orig+'&').match(/[?&]code=([^&]+)/);if(m2)code=decodeURIComponent(m2[1]);}catch(e){}}if(code)portal+='&code='+encodeURIComponent(code);window.location.replace(portal);})();</script><noscript><a href='https://wibizpro.online/portal/?token=dt_your-site-token&clientMac=\$(mac-esc)&ap=wibizpro'>Ouvrir le portail</a></noscript></body></html>" /file set [find name~"redirect.html"] contents="<html><head></head><body><script>(function(){var portal='https://wibizpro.online/portal/?token=dt_your-site-token&clientMac=\$(mac-esc)&ap=wibizpro';var code='';try{var m=(window.location.href+'&').match(/[?&]code=([^&]+)/);if(m)code=decodeURIComponent(m[1]);}catch(e){}if(!code){try{var orig='\$(link-orig)';var m2=(orig+'&').match(/[?&]code=([^&]+)/);if(m2)code=decodeURIComponent(m2[1]);}catch(e){}}if(code)portal+='&code='+encodeURIComponent(code);window.location.replace(portal);})();</script><noscript><a href='https://wibizpro.online/portal/?token=dt_your-site-token&clientMac=\$(mac-esc)&ap=wibizpro'>Ouvrir le portail</a></noscript></body></html>"
The URL needs three parameters. token identifies your site. clientMac is filled in by the router. ap identifies the access point — without it the portal opens in Preview Mode and never creates a session, even for a real customer.

If the command refuses to run — some firmware versions object to the nested quotes — edit both files by hand: Winbox → Files → hotspot folder → open the file → replace its whole contents.

2.6 — Verify

/system/device-mode/print # mode=advanced hotspot=true /radius/print # require-message-auth=yes-for-request-resp /ip/hotspot/print # invalid=false disabled=false /log/print where topics~"hotspot"

The expected log line for a client without a pass is: login failed: No active pass — buy one at wibizpro.online. If you see RADIUS server is not responding instead, the server is not returning the Message-Authenticator — contact us rather than changing any router setting.

Fini. Kliyan ki pa peye yo rejte epi yo wè pòtay Wibizpro la ; kliyan ki peye yo aksepte ak tan ki rete yo.

The WireGuard tunnel and the CoA operations are covered in the full runbook: docs/mikrotik-site-setup.md

3 Kite kliyan yo rive sou pòtay la

Kliyan ki pa peye yo bloke jiskaske yo otantifye — ansanm ak paj Wibizpro a li menm. Pèmèt li nan jaden klò a :

/ip hotspot walled-garden add dst-host=wibizpro.online action=allow add dst-host=*.wibizpro.online action=allow /ip hotspot walled-garden ip add action=accept dst-address=144.202.47.181

Pa otorize *captive.apple.com ni 17.0.0.0/8: macOS ak iOS ap kwè rezo a gen entènèt deja epi yo p ap janm ouvri asistan captif la. Règ pòtay ak sèvè ki anwo yo sifi. Ajoute sèlman domèn founisè peman w yo si sa nesesè.

Se sa ki pèmèt kliyan ki poko otantifye yo wè paj Wibizpro a epi peye anvan yo jwenn entènèt. San sa, paj peman an pa chaje.

4 Konekte pwen aksè WiFi ou yo

Tout mak fonksyone — pwen aksè yo se pon transparan. Sou chak :

  1. Mete l an mòd Pwen Aksè / bridge, epi fèmen DHCP li, NAT li ak pwòp pòtay li.
  2. Ba li yon IP jesyon estatik nan rezo routeur la.
  3. Mete pwòp DNS pwen aksè a sou IP LAN MikroTik la — pa yon rezolvè piblik.
  4. Sèvi ak menm SSID ak menm kalite sekirite sou tout pwen aksè.
Si pòtay la pa janm parèt, prèske toujou se pwen 3 a. Hotspot la fonksyone nan entèsepte DNS. Yon pwen aksè ki bay yon DNS piblik fè kliyan an kontoune routeur la, epi paj koneksyon an pa janm parèt — pi souvan sou iPhone ak Android 13+.

5 Sa k ap pase apre sa

Yon fwa konfigire, men sa kliyan ou yo ap viv:

  1. Kliyan an konekte ak SSID envite ou a.
  2. Navigatè a ouvè otomatikman sou paj seleksyon plan Wibizpro la ak pri ou yo.
  3. Li chwazi yon forfè epi li peze Pay & Connect.
  4. Yo peye an lajan kach oswa ak MonCash/NatCash — ou apwouve chak peman depi tablodbò ou.
  5. Wibizpro bay aksè atravè RADIUS pou dire achte a.
  6. Li wè paj konfimasyon an epi li ka navige sou entènèt.

Kliyan ki ekspire yo dekonekte otomatikman nan fen egzak pas yo a.

Sipò MikroTik la ap vini. Pòtay la, otantifikasyon RADIUS la, peman yo ak accounting la tout fonksyone. Dènye etap la — kliyan an ki konekte touswit apre li peye — ap fini pou RouterOS, kidonk yon nouvo sit MikroTik ka kite kliyan an sou paj konfimasyon an jiskaske li rekonekte. Mande nou anvan w mete yon nouvo routeur an sèvis.

? Plizyè SSID, plizyè pri

Ou ka touche lajan sou plizyè rezo yon fason diferan — tout depi yon sèl dashboard Wibizpro :

  1. Nan Wibizpro, kreye yon sit pou chak SSID ou vle fè peye. Chak jwenn pwòp token, sekrè ak pri li.
  2. Nan RouterOS, kreye yon hotspot ak yon antre RADIUS pou chak — chak ak sekrè sit li.
  3. Sou pwen aksè ou yo, difize SSID ou bezwen yo.

Egzanp:

SSIDURL pòtay laPri
GuestWiFi /portal/?token=dt_guest $1–$25 USD
Premium /portal/?token=dt_prem $5–$100 USD
Staff Pa gen pòtay Gratis

SSID yo ka pataje menm materyèl la — pa bezwen ekipman anplis. Revni chak swiv separeman nan dashboard Wibizpro ou.

? Ou sèvi ak yon EAP TP-Link pito ?
TP-Link Omada sèlman. Pa swiv seksyon sa a pou yon routeur MikroTik. Antre 8.8.8.8 ki ladan l se egzakteman sa ki anpeche pòtay captive a parèt sou RouterOS.

Pwen aksè TP-Link Omada otonòm yo toujou sipòte. Si w gen youn k ap mache deja, men konfigirasyon li — li pa chanje.

A. Ouvri onglet Portal la

  1. Konekte sou paj wèb bòn ou a (oswa kontwolè Omada ou a).
  2. Ale nan seksyon Wireless la.
  3. Chwazi onglet Portal la.

B. Ranpli paramèt Wibizpro yo

Nan onglet Wireless → Portal bòn ou a (egz. EAP110), ranpli egzakteman valè sa yo :

  • SSID : SSID envite ou a (egz. Wibizpro)
  • Authentication Type : External RADIUS Server
  • RADIUS Server IP : 144.202.47.181
  • RADIUS Port : 1812
  • RADIUS Password : sit ou a rad_xxx sekrè (tablodbò Wibizpro → paj sit la)
  • NAS ID : (vid)
  • RADIUS Accounting : Enable ✓
  • Accounting Server IP : 144.202.47.181
  • Accounting Server Port : 1813
  • Accounting Server Password : menm ak RADIUS Password
  • Interim Update : Enable ✓ — Interim Interval : 60 s (estatistik itilizasyon an dirèk nan dashboard Wibizpro ou)
  • Authentication Timeout : Custom → 0 D / 0 H / 5 M (bòn nan re-tcheke chak kliyan chak 5 minit — pas ki ekspire yo koupe vit)
  • Redirect : Enable ✓
  • Redirect URL : https://wibizpro.online/success/ (paj ki parèt apre otantifikasyon reyisi a)
  • Portal Customization : External Web Portal
  • External Web Portal URL : https://wibizpro.online/portal/?token=dt_your-site-token (paj forfè ki parèt anvan peman an)
Limit vitès pa plan (opsyonèl) : mete yon Vitès (Mbps) pou chak plan nan Wibizpro → Plans & Pricing — EAP la aplike li apati repons RADIUS la (bps brit). Si ou mete yon Rate Limit sou SSID la tou, EAP la aplike valè ki pi BA a nan de yo — retire li oswa monte li pi wo pase vitès Wibizpro yo. Plizyè EAP sou menm SSID la resevwa menm atribi yo — konfigire chak EAP menm jan.

C. Pèmèt Wibizpro nan politik otantifikasyon lib la

Nan onglet Wireless → Portal, ouvri politik otantifikasyon lib la epi ajoute :

  • 144.202.47.181 (pò 80) — obligatwa
  • 144.202.47.181 (pò 443) — obligatwa
  • 8.8.8.8 (DNS, pò 53) — obligatwa

Chak antre bezwen yon non — egz. Wibizpro-80, Wibizpro-443, DNS.

Antre chak adrès nan chan Destination an, ak pò li nan Destination Port — pa janm nan Source. Politik la se lis kote kliyan yo GEN DWA ale anvan yo peye, kidonk adrès la ale sou bò destinasyon an.

This is what lets unauthenticated clients see the Wibizpro page and pay before getting internet. Without this entry, the payment page won't load.

Pi bon toujou : kenbe pwen aksè a epi mete yon routeur MikroTik devan l kòm pòtay. EAP110 ou kontinye fonksyone — mete l an mòd bridge, fèmen pòtay li ak RADIUS li, epi swiv senk etap anwo yo pito.

? Ki jan li fonksyone

Wibizpro kenbe pòtay kaptif la pou ou. Nou okipe:

  • Paj forfè yo ak pri ou yo ak dire yo
  • Apwobasyon peman — lajan kach, MonCash ak NatCash ak ID tranzaksyon
  • Otorizasyon kliyan — depi peman an pase, nou bay aksè entènèt atravè RADIUS
  • Ekspirasyon sesyon — kliyan ki ekspire yo dekonekte otomatikman

? Sa ki nesesè
  • Yon routeur MikroTik ki gen RouterOS 7 — li vin pòtay la
  • Yon oswa plizyè pwen aksè WiFi, tout mak, an mòd bridge
  • Yon SSID envite pou monètize
  • Routeur ou dwe rive sou Wibizpro an HTTPS (pò 443 sòtan) ak RADIUS (UDP 1812/1813)
  • Yon kont Wibizpro — enskri ou la a

? Konfigire sit ou sou Wibizpro
  1. Kreye yon kont epi konekte nan tablodbò ou.
  2. Ale nan Sites → + Nouvo sit epi ba li yon non.
  3. Kopye URL pòtay la ak sekrè RADIUS ki montre sou paj sit la.
  4. Sèvi ak tou de nan konfigirasyon routeur ou (etap 1 ak 2 anwo).
  5. Mete plan ak pri ou yo depi tablodbò a — chwazi dire, pri ak lajan.

? Swiv ak jere

Tablodbò Wibizpro ou a ba ou yon vizibilite konplè:

  • Sesyon aktif — wè ki moun ki an liy kounye a
  • Revni — pa jou, semèn ak mwa, pou chak sit
  • Bloke/debloke aparèy — mete deyò kliyan pwoblèm yo manyèlman
  • Jesyon plan — chanje pri oswa ajoute/retire dire nenpòt lè
  • Istwa — chak koneksyon, peman ak blokaj anrejistre
Kòmanse →