MikroTik RouterOS v2.9 Reference Manual page 532

From /ip firewall nat print dynamic command, you can get something like this (comments follow
after each of the rules):
Putting all HotSpot-related tasks for packets from all HotSpot clients into a separate chain
Redirect all DNS requests to the HotSpot service. The 64872 port provides DNS service for all
HotSpot users. If you want HotSpot server to listen also to another port, add rules here the same
way, changing dst-port property
Redirect all HTTP login requests to the HTTP login servlet. The 64873 is HotSpot HTTP servlet
port.
Redirect all HTTPS login requests to the HTTPS login servlet. The 64875 is HotSpot HTTPS
servlet port.
All other packets except DNS and login requests from unauthorized clients should pass through the
hs-unauth chain
And packets from the authorized clients - through the hs-auth chain
First in the hs-unauth chain is put everything that affects TCP protocol in the /ip hotspot
walled-garden ip submenu (i.e., everything where either protocol is not set, or set to TCP). Here
we are excluding www.mikrotik.com from being redirected to the login page.
All other HTTP requests are redirected to the Walled Garden proxy server which listens the 64874
port. If there is an allow entry in the /ip hotspot walled-garden menu for an HTTP request, it is
being forwarded to the destination. Otherwise, the request will be automatically redirected to the
HotSpot login servlet (port 64873).
HotSpot by default assumes that only these ports may be used for HTTP proxy requests. These two
entries are used to "catch" client requests to unknown proxies. I.e., to make it possible for the
clients with unknown proxy settings to work with the HotSpot system. This feature is called
"Universal Proxy". If it is detected that a client is using some proxy server, the system will
automatically mark that packets with the http hotspot mark to work around the unknown proxy
problem, as we will see later on. Note that the port used (64874) is the same as for HTTP requests
in the rule #8 (so both HTTP and HTTP proxy requests are processed by the same code).
HTTPS proxy is listening on the 64875 port
Redirect for SMTP protocol may also be defined in the HotSpot configuration. In case it is, a
redirect rule will be put in the hs-smtp chain. This is done so that users with unknown SMTP
configuration would be able to send their mail through the service provider's (your) SMTP server
instead of going to [possibly unavailable outside their network of origin] the SMTP server users
have configured in their computers.
Providing HTTP proxy service for authorized users. Authenticated user requests may need to be
subject to the transparent proxying (the "Universal Proxy" technique and for the advertisement
feature). This http mark is put automatically on the HTTP proxy requests to the servers detected by
the HotSpot HTTP proxy (the one that is listening on the 64874 port) to be HTTP proxy requests to
unknown proxy servers. This is done so that users that have some proxy settings would use the
HotSpot gateway instead of the [possibly unavailable outside their network of origin] proxy server
users have configured in their computers. The mark is as well put on any HTTP requests done form
the users whoose profile is configured to transparently proxy their requests.
Providing SMTP proxy for authorized users (the same as in rule #12)
Page 518 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.