MikroTik RouterOS v2.9 Reference Manual page 519

First of all, a client must get an IP address. It may be set on the client statically, or leased from a
DHCP server. The DHCP server may provide ways of binding lent IP addresses to clients MAC
addresses, if required. The HotSpot system does not care how did a client get an address before
he/she gets to the HotSpot login page.
Moreover, HotSpot server may automatically and transparently change any IP address (yes,
meaning really any IP address) of a client to a valid unused address from the selected IP pool. This
feature gives a possibility to provide a network access (for example, Internet access) to mobile
clients that are not willing (or are disallowed, not qualified enough or otherwise unable) to change
their networking settings. The users will not notice the translation (i.e., there will not be any
changes in the users' config), but the router itself will see completely different (from what is
actually set on each client) source IP addresses on packets sent from the clients (even firewall
mangle table will 'see' the translated addresses). This technique is called one-to-one NAT, but is
also known as "Universal Client" as that is how it was called in the RouterOS version 2.8.
One-to-one NAT accepts any incoming address from a connected network interface and performs a
network address translation so that data may be routed through standard IP networks. Clients may
use any preconfigured addresses. If the one-to-one NAT feature is set to translate a client's address
to a public IP address, then the client may even run a server or any other service that requires a
public IP address. This NAT is changing source address of each packet just after it is received by
the router (it is like source NAT that is performed earlier, so that even firewall mangle table, which
normally 'sees' received packets unaltered, can only 'see' the translated address).
Note also that arp mode must be enabled on the interface you use one-to-one NAT on.
Before the authentication
When enabling HotSpot on an interface, the system automatically sets up everything needed to
show login page for all clients that are not logged in. This is done by adding dynamic destination
NAT rules, which you can observe on a working HotSpot system. These rules are needed to redirect
all HTTP and HTTPS requests from unauthorized users to the HotSpot servlet (i.e., the
authentication procedure, e.g., the login page). Other rules that are also inserted, we will describe
later in a special section of this manual.
In most common setup, opening any HTTP page will bring up the HotSpot servlet login page
(which can be customized extensively, as will be described later on). As normal user behavior is to
open web pages by their DNS names, a valid DNS configuration should be set up on the HotSpot
gateway itself (it is possible to reconfigure the gateway so that it will not require local DNS
configuration, but such a configuration is impractical and thus not recommended).
Walled Garden
You may wish not to require authorization for some services (for example to let clients access the
web server of your company without registration), or even to require authorization only to a number
of services (for example, for users to be allowed to access an internal file server or another
restricted area). This can be done by setting up Walled Garden system.
When a not logged-in user requests a service allowed in the Walled Garden configuration, the
HotSpot gateway does not intercept it, or in case of HTTP, simply redirects the request to the
original destination (or to a specified parent proxy). When a user is logged in, there is no effect of
this table on him/her.
Page 505 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.