MikroTik Hotspot Billing in Kenya: How It Works

MikroTik Billing — The Full Picture

MikroTik RouterOS dominates the Kenyan ISP market. Its affordability, flexibility and feature set make it the default choice for everything from a single hotspot to a carrier-grade network. Any ISP billing system you choose has to integrate deeply with MikroTik, for both Hotspot and PPPoE.

How a Billing System Controls MikroTik

There are two common approaches.

The traditional route is the RouterOS API, which MikroTik exposes on port 8728 (or 8729 for TLS). A billing system connects inbound and uses it to create and remove PPPoE secrets, add and remove Hotspot users, assign bandwidth profiles, check active sessions, and apply IP bindings and address pools. This needs the router reachable from the internet, which is awkward behind CGNAT.

The alternative is an on-router agent that connects outward to the billing platform. Jasiyo works this way: a small script installed on the MikroTik dials home, so there is no public IP to arrange, no inbound port to open, and no RADIUS server to run.

PPPoE Billing via MikroTik

For PPPoE subscribers, the billing system stores credentials and syncs them to the router. When a subscriber's package expires their secret is disabled, so they cannot authenticate. When they pay, it is re-enabled immediately. The subscriber experiences this simply as being disconnected and reconnected.

Hotspot Billing via MikroTik, Step by Step

1. A customer connects to your WiFi network
2. MikroTik intercepts their traffic and redirects them to a captive portal
3. The customer selects a package and pays via M-Pesa STK Push
4. The M-Pesa callback reaches your billing system
5. The billing system creates or activates the Hotspot user on the router
6. The customer is granted access for the duration of their package
7. When the package expires, the user is removed and they land back on the login page

Bandwidth Control

MikroTik lets you set upload and download limits per user profile. Your billing system should map each package to the correct profile automatically — a customer on a 5 Mbps package should get exactly 5 Mbps, not whatever happens to be spare.

Voucher-Based Hotspot Billing

Where customers may not have a smartphone for STK Push — bus parks, rural trading centres — vouchers work well. The billing system generates codes tied to specific packages, the operator sells them over the counter, and the customer enters the code at the captive portal.

What to Look for in MikroTik Integration

• Supports both Hotspot and PPPoE from the same platform
• Real-time sync, not batch updates every few minutes
• Handles dropped connections gracefully, with retry logic
• Supports multiple routers from one account
• Works behind CGNAT, without requiring a public IP on every site

Setting It Up, Step by Step

Traditionally this was done with RADIUS, which means standing up and maintaining your own authentication server. Jasiyo uses a small agent installed on the router instead, so there is no RADIUS server in the picture at all.

Step 1 — Name your router

In the dashboard, go to Routers → Add Router and name it after the site or estate it serves, so you recognise it later.

Step 2 — Scan it

Jasiyo reads the device to find what is already there: RouterOS version, WAN interface, existing bridges, IP pools, and any PPPoE or Hotspot configuration. Nothing is changed at this stage — the scan only reads.

Step 3 — Choose a setup mode

A fresh setup builds the bridge, address pools and services from scratch. An existing setup leaves your current configuration alone and installs only the agent — this is the one to pick on a router that is already carrying live customers. Defaults are pre-filled to avoid clashing with ranges already on the device.

Step 4 — Paste the script

Jasiyo generates a script for your router. Paste it into the MikroTik terminal once. It applies the configuration and installs the agent, which connects outward to Jasiyo and keeps the router in sync. Because the connection is outbound, this works behind CGNAT and needs no public IP and no inbound firewall rule.

Step 5 — Create plans and connect M-Pesa

Create your PPPoE or Hotspot plans with the speeds and prices you actually sell, then connect your M-Pesa Paybill or Till. When a customer pays, the callback arrives and the router applies the change immediately.

What you end up with: unlimited routers on every plan, PPPoE, Hotspot and Static IP management, real-time sync between billing status and router state, automatic suspension and reactivation, per-customer usage reporting — and no RADIUS server, no public IP, and no inbound firewall rules.

Common Problems

• Customers pay but do not get online — usually a delayed Safaricom callback, or a captive portal the device never reached
• Customers overstaying their package — session management on the router needs to be configured correctly
• Multiple devices on one voucher — the billing system should enforce single-device use where you need it

Jasiyo handles these scenarios as part of its MikroTik integration. See the MikroTik setup guide →