Hubsoft integration with Mikrotik

About MikroTik

MikroTik manufactures network hardware and software used in nearly every country. Its routers run RouterOS and are managed through Winbox, a graphical management tool. The company's mission is to make internet technologies faster, more powerful, and more accessible.

What the integration does

After being registered as a connection device, Mikrotik uses Hubsoft's RADIUS:

• RADIUS authenticates subscribers' PPPoE connections and receives accounting updates every 10 minutes.
• Mikrotik radios authenticate wireless clients by MAC address, with the wireless interface (SSID, MAC, and WPA) registered in Hubsoft.
• Hubsoft disconnects subscribers through the RADIUS incoming port.
• The team can see connected clients, real-time bandwidth usage, and historical charts by day, week, and month.
• Suspended or canceled subscribers connect to a separate IP pool, on IPv4 and IPv6, which the provider blocks in the firewall.
• The connection statement records the IPv6 prefix assigned to each subscriber. RouterOS does not send this data to RADIUS; a script in the PPP profile notifies Hubsoft's API on every connection.
• Operators log in to Mikrotik with their Hubsoft user, through RADIUS, in the permission group defined in each user's registration.
• Mikrotik's deterministic CGNAT rules, including Netmap, are documented under Network > CGNat Mapping.

What you need

• An SSH user on Mikrotik for Hubsoft.
• The concentrator's POP registered under Network > Points of Presence.
• The same RADIUS secret on Mikrotik and Hubsoft.
• For IPv6 in the connection statement: the API URL and your instance token, provided by Hubsoft's support team.

How to activate

1. In Hubsoft, under Network > Connection Devices, add Mikrotik with its name, IP, manufacturer, model, and POP. Enable RADIUS, enter the secret and incoming port, choose the NAS type, and fill in the SSH username, password, and port.
2. In the Interfaces tab of the same registration, add the concentrator interface, usually VLAN or Ethernet.
3. In Winbox, under RADIUS, add the server with the ppp service, the RADIUS IP, the same secret, and the concentrator IP in Src. Address.
4. Still under RADIUS, in Incoming, select Accept and enter the same port registered in Hubsoft, usually 3799.
5. Under PPP > Secrets > PPP Authentication & Accounting, select Use Radius and set Interim Update to 00:10:00.
6. Under System > Users, remove users that are no longer needed, such as users from the previous system.

The step-by-step guide with screenshots is available in the Hubsoft wiki: Mikrotik configuration, Mikrotik radio, IPv6 in the connection statement and authentication issues.

Limitations

• The IPv6 prefix does not appear immediately in the statement: Hubsoft stores the data in a queue and synchronizes it every 1 minute.
• After adding the IPv6 script to the PPP profiles, active PPPoE sessions must reconnect. Hubsoft recommends doing this outside business hours.
• For wireless connections, the client authenticates only if wireless authentication is enabled in Mikrotik's RADIUS configuration.

Frequently asked questions

The subscriber cannot authenticate. What should I check first?

Test the ping to RADIUS. Increasing Bad Replies indicates a secret different from Hubsoft's; increasing Timeouts indicates a network issue or a timeout that is too low. In Hubsoft's authentication log, check that the service is enabled and that the MAC and password are correct. NAT between the concentrator and RADIUS also blocks authentication.

Does Mikrotik send the subscriber's IPv6 to Hubsoft?

Not on its own. RouterOS does not send the delegated prefix to RADIUS. The wiki script, in the on-up parameter of the PPP profiles, sends the prefix to Hubsoft's API on every connection.

Can technicians log in to Mikrotik with their Hubsoft user?

Yes. Under Configuration > General > Users, select "Has access via Radius" and add the Mikrotik-Group parameter with the permission group. On Mikrotik, enable login via RADIUS.

Reviewed on 10/10/2026.