Connect a router (NAS) · Mikrodius Docs

Every router that handles logins is a NAS in Mikrodius. Routers never register themselves: you add the NAS first, then run the command it gives you on the router. Mikrodius creates every key and secret the router needs, so there is nothing to type in by hand.

WireGuard, L2TP or SSTP

Each NAS reaches Mikrodius through its own encrypted tunnel, so it works behind NAT and without a public IP. You pick the tunnel type when you add the NAS. A RouterOS 6 NAS can switch between L2TP and SSTP at any time; WireGuard cannot be changed later.

Connection	Use it for
WireGuard	RouterOS 7. Faster and more reliable. Recommended.
L2TP	Routers still on RouterOS 6. Costs more as an extra NAS. Upgrade to v7 when you can.
SSTP	RouterOS 6 when L2TP keeps disconnecting or will not connect, for example behind CGNAT. Same price as L2TP.

Add the NAS

1
Open the workspace and go to NAS
Choose to add a NAS.
2
Name it
Use something you will recognise later, like the site or tower name.
3
Pick the vendor and connection type
For MikroTik, choose MikroTik RouterOS and WireGuard (v7) or L2TP (v6). Pick SSTP for a v6 router whose network blocks or drops L2TP.

Run the install command

After adding the NAS you get a one-line command. Open a terminal on the router and paste it in. It downloads a script that sets up the tunnel, adds Mikrodius as the RADIUS server for PPP and hotspot, turns on RADIUS for PPPoE and for the server profiles your hotspots use, and allows Mikrodius to send live changes (CoA) to the router.

The install link works once and expires after 24 hours. If it has expired or you need to run it again (for example after resetting the router), get a new install command from the NAS's row in the list.

The script turns on RADIUS only for hotspot servers that exist when it runs. If you add a hotspot server later, enable use-radius on its server profile yourself.

NAS status

pending install	Added, but the router has not connected yet. Run the install command.
online	The tunnel is up and the router is talking to Mikrodius.
offline	The router has stopped reaching Mikrodius: it lost power or internet, or its tunnel settings were changed. Logins through it fail until it is back.

Other devices

Ubiquiti, Cisco, Huawei and any other RADIUS client can be added too. There is no one-line command for them: open the NAS's Config to see the tunnel settings, RADIUS server address and shared secret, and enter them on the device. See Supported devices for which vendors get plan speeds automatically and what to pick when yours is not listed.

If a RouterOS 6 router on L2TP keeps disconnecting or never connects, use the SSTP button in its row to switch it to SSTP, then run the new install command on the router. It keeps its tunnel IP, login and fee. SSTP runs over TLS on TCP port 4443, which gets through most networks, including CGNAT.

Rotating credentials

If you think a router's keys were exposed, rotate the NAS's credentials. Mikrodius generates new tunnel keys and a new RADIUS secret, and the router drops off immediately until you run the new install command on it. Plan this for a quiet moment.

Moving or removing a router

To move a router from L2TP or SSTP to WireGuard (say, after upgrading to RouterOS 7), add a new NAS with WireGuard, run its command, and then remove the old NAS. Removing a NAS you pay for refunds the unused whole days, or all of it if the router never connected; see Billing and credits.