RouterOS的Hotspot设置说明

参照routeros的手册，针对我的情况作了部分修改。已经在2.7.14和2.8.11上测试通过。 我的routeros是2块网卡，ether1连接adsl,做pppoe client，ether2连接局域网。 首先按照论坛上置顶的说明正确安装并配置routeros,实现客户机能够正常上网。 然后terminal routeros 改变www服务端口为8081： /ip service set www port=8081 改变hotspot服务端口为80,为用户登录页面做预备： /ip service set hotspot port=80 Setup hotspot profile to mark authenticated users with flow name "hs-auth": /ip hotspot profile set default mark-flow="hs-auth" login-method=enabled-address 增加一个用户： /ip hotspot user add "name"=user1 password=1 重定向所有未授权用户的tcp请求到hotspot服务 /ip firewall dst-nat add in-interface="ether2" flow="!hs-auth" protocol=tcp action=redirect to-dst-port=80 comment="redirect unauthorized clients to hotspot service" 答应dns请求、icmp ping ；拒绝其他未经认证的所有请求： /ip firewall add "name"=hotspot-temp comment="limit unauthorized hotspot clients" /ip firewall rule forward add in-interface=ether2 action=jump jump-target=hotspot-temp comment="limit access for unauthorized hotspot clients" /ip firewall rule input add in-interface=ether2 dst-port=80 protocol=tcp action=accept comment="accept requests for hotspot servlet" /ip firewall rule input add in-interface=ether2 dst-port=67 protocol=udp action=accept comment="accept requests for local DHCP server" /ip firewall rule input add in-interface=ether2 action=jump jump-target=hotspot-temp comment="limit access for unauthorized hotspot clients" /ip firewall rule hotspot-temp add flow="hs-auth" action=return comment="return if connection is authorized" /ip firewall rule hotspot-temp add protocol=icmp action=return comment="allow ping requests" /ip firewall rule hotspot-temp add protocol=udp dst-port=53 action=return comment="allow dns requests" /ip firewall rule hotspot-temp add action=reject comment="reject access for unauthorized clients" 创建hotspot通道给认证后的hotspot用户 Create hotspot chain for authorized hotspot clients: /ip firewall add "name"=hotspot comment="account authorized hotspot clients" Pass all through going traffic to hotspot chain: /ip firewall rule forward add action=jump jump-target=hotspot comment="account traffic for authorized hotspot clients" 客户机输入任何网址，都自动跳转到登陆页面，输入账号密码，继续浏览。 假如使用ftp、pop3等，也必须先通过网页登录，才可以使用，当然使用winbox的时候也必须先登录.