Wibizpro

Integrate Wibizpro with Your Network

Connect your access point to Wibizpro and start selling WiFi access in minutes.

1 Get Your Wibizpro Parameters
  1. Create a site in your Wibizpro dashboard.
  2. Open the site page — the two values you need are shown there:
  • Portal URL : https://wipay.online/portal/?token=dt_your-site-token
    That is a placeholder — the URL is not real until you have created a site. Yours will carry its own token.
    See what the portal looks like →
  • RADIUS secret : your site's rad_xxx
Every site has its own secret. That secret is what tells Wibizpro which site a client is standing in — and therefore which passes are valid there.

2 Configure Your MikroTik Router

In RouterOS, open New Terminal and paste this block as is:

# 1. RADIUS — this site's own secret /radius add address=144.202.47.181 secret=rad_xxx service=hotspot \ authentication-port=1812 accounting-port=1813 # 2. DNS — two settings that are NOT the same thing. # a) The router must answer its CLIENTS. Without this the portal # never appears: the hotspot works by intercepting DNS. /ip dns set allow-remote-requests=yes # b) The router's OWN upstream resolver. 8.8.8.8 is fine HERE — it is # the router asking, not the clients. A factory router already # learns one from the ISP; this line just makes it explicit. /ip dns set servers=8.8.8.8,1.1.1.1 # 3. Address pool for the clients /ip pool add name=wibizpro-pool ranges=192.168.88.10-192.168.88.254 # 4. Hotspot profile /ip hotspot profile add name=wibizpro hotspot-address=192.168.88.1 \ dns-name=wifi.local use-radius=yes radius-accounting=yes \ radius-interim-update=1m login-by=mac,http-pap # 5. Hotspot, on the bridge the access points are wired to /ip hotspot add name=wibizpro interface=bridge \ address-pool=wibizpro-pool profile=wibizpro disabled=no # 6. THE CAPTIVE LOGIN PAGE — this is where your Portal URL goes. # Without this step the client sees the ROUTER's own login page and # your portal never appears. Run it after step 5 (the hotspot # creates the file). # $(mac-esc) is filled in by the router for each client — leave it # exactly as written, backslash included. /file set [find name~"login.html"] contents="<html><body><script>window.location.href='https://wipay.online/portal/?token=dt_your-site-token&clientMac=\$(mac-esc)'</script></body></html>"
The names and addresses above are working defaults — change them if you want.
  • wibizpro and wibizpro-pool are just names. Any name works, as long as it is the same everywhere in the block.
  • 192.168.88.x is MikroTik's factory LAN. If your network uses another range, change all four addresses — the pool, the hotspot address, and both profile references.
  • bridge is the interface the hotspot runs on — the one your access points are wired to. If yours has another name, use it there.
  • The router's own upstream resolver can stay whatever your ISP gave it — 8.8.8.8 is fine there. What matters is that the clients ask the router, never a public resolver directly. Never hand 8.8.8.8 to the clients.
  • Step 6 is the one that puts your Portal URL on the router. It rewrites the hotspot's login.html so the client is sent to your page instead of RouterOS's own login. If the command refuses to run — some firmware versions object to the quotes — do it by hand instead: in Winbox, Files → the hotspot folder → open login.html and replace its whole contents with this (keep $(mac-esc) exactly as written — the router fills it in):
    <html><body><script>window.location.href='https://wipay.online/portal/?token=dt_your-site-token&clientMac=$(mac-esc)'</script></body></html>

Replace rad_xxx with your site's secret. The hotspot lives on the router — never on the access points.

Set the interim interval to 1m explicitly. RouterOS defaults to waiting for the server to dictate it, and Wibizpro does not send it. Without this line you lose live data usage, the online badge, and the one-live-device protection — with no error message anywhere.
Done. Unpaid clients are rejected and shown the Wibizpro portal; paid clients are accepted with their remaining time.

The captive login page, the WireGuard tunnel and the CoA operations are covered in the full runbook: docs/mikrotik-site-setup.md

3 Let Clients Reach the Portal

Unpaid clients are blocked until they authenticate — including the Wibizpro page itself. Allow it in the walled garden:

/ip hotspot walled-garden add dst-host=wibizpro.online action=allow add dst-host=*.wibizpro.online action=allow /ip hotspot walled-garden ip add action=accept dst-host=wibizpro.online add action=accept dst-address=144.202.47.181

Also allow your payment providers' domains, and Apple's captive-portal endpoints (17.0.0.0/8 and *captive.apple.com) — without those, iPhones never show the login page.

This is what lets unauthenticated clients see the Wibizpro page and pay before getting internet. Without it, the payment page won't load.

4 Connect Your WiFi Access Points

Any brand works — the access points are transparent bridges. On each one:

  1. Set it to Access Point / bridge mode, and turn OFF its DHCP, its NAT and its own captive portal.
  2. Give it a static management IP in the router's LAN.
  3. Set the access point's own DNS to the MikroTik's LAN IP — not a public resolver.
  4. Use the same SSID and the same security type on every access point.
If the portal never appears, it is almost always point 3. The hotspot works by intercepting DNS. An access point that hands out a public DNS makes the client bypass the router, and the login page never shows — most often on iPhone and Android 13+.

5 What Happens Next

Once configured, here is what your customers experience:

  1. User connects to your guest SSID.
  2. Browser automatically opens to the Wibizpro plan-selection page with your pricing.
  3. They pick a plan and tap Pay & Connect.
  4. They pay in cash or with MonCash/NatCash — you approve each payment from your dashboard.
  5. Wibizpro grants access through RADIUS for the purchased duration.
  6. They see a confirmation page and can browse the internet.

Expired clients are automatically disconnected at the exact end of their pass.

MikroTik support is in progress. The portal, the RADIUS authentication, the payments and the accounting all work. The last step — the client becoming connected right after paying — is still being finished for RouterOS, so a new MikroTik site may leave the client at the confirmation page until they reconnect. Ask us before going live on a new router.

? Several SSIDs, Several Pricings

You can monetize several networks differently — all from a single Wibizpro dashboard:

  1. In Wibizpro, create a site for each SSID you want to charge for. Each gets its own token, secret and pricing.
  2. In RouterOS, create a hotspot and a RADIUS entry for each — each with its site's secret.
  3. On your access points, broadcast the SSIDs you need.

Example:

SSIDPortal URLPricing
GuestWiFi /portal/?token=dt_guest $1–$25 USD
Premium /portal/?token=dt_prem $5–$100 USD
Staff No portal Free

The SSIDs can share the same hardware — no extra equipment needed. Revenue from each is tracked separately in your Wibizpro dashboard.

? Using a TP-Link Omada EAP Instead?
TP-Link Omada only. Do not follow this section for a MikroTik router. The 8.8.8.8 entry at the end of it is exactly what stops the captive portal from ever appearing on RouterOS.

Standalone TP-Link Omada access points are still supported. If you already have one running, this is its configuration — it does not change.

A. Open the Portal Tab

  1. Log into your EAP's web page (or your Omada Controller).
  2. Go to the Wireless section.
  3. Select the Portal tab.

B. Fill In the Wibizpro Parameters

On the Wireless → Portal tab of your EAP (e.g. EAP110), fill in exactly these values:

  • SSID : your guest SSID (e.g. Wibizpro)
  • Authentication Type : External RADIUS Server
  • RADIUS Server IP : 144.202.47.181
  • RADIUS Port : 1812
  • RADIUS Password : your site's rad_xxx secret (Wibizpro dashboard → site page)
  • NAS ID : (empty)
  • RADIUS Accounting : Enable ✓
  • Accounting Server IP : 144.202.47.181
  • Accounting Server Port : 1813
  • Accounting Server Password : same as RADIUS Password
  • Interim Update : Enable ✓ — Interim Interval : 60 s (live usage stats in your Wibizpro dashboard)
  • Authentication Timeout : Custom → 0 D / 0 H / 5 M (the EAP re-checks every client every 5 minutes — expired passes are cut quickly)
  • Redirect : Enable ✓
  • Redirect URL : https://wipay.online/success/ (the page shown after successful authentication)
  • Portal Customization : External Web Portal
  • External Web Portal URL : https://wipay.online/portal/?token=dt_your-site-token (the plan picker shown before payment)
Per-plan speed limits (optional): set a Speed (Mbps) per plan in Wibizpro → Plans & Pricing — the EAP enforces it from the RADIUS reply (raw bps). If you also set a Rate Limit on the SSID, the EAP applies the LOWEST of the two — remove it or raise it above the Wibizpro speeds. Several EAPs on the same SSID all receive the same attributes — configure every EAP identically.

C. Allow Wibizpro in the Free Authentication Policy

In the Wireless → Portal tab, open the Free Authentication Policy and add:

  • 144.202.47.181 (port 80) — required
  • 144.202.47.181 (port 443) — required
  • 8.8.8.8 (DNS, port 53) — required

Each entry needs a name — e.g. Wibizpro-80, Wibizpro-443, DNS.

Enter each address in the Destination field, and its port in Destination Port — never in Source. The policy is a list of places clients are ALLOWED to reach before paying, so the address belongs on the destination side.

This is what lets unauthenticated clients see the Wibizpro page and pay before getting internet. Without this entry, the payment page won't load.

Better still: keep the access point and put a MikroTik router in front of it as the gateway. Your EAP110 keeps working — set it to bridge mode, turn off its captive portal and its RADIUS, and follow the five steps above instead.

? How It Works

Wibizpro hosts the captive portal for you. We handle:

  • The plan-selection page with your pricing and durations
  • Payment approval — cash, MonCash and NatCash with transaction ID
  • Client authorization — once payment clears, we grant internet access through RADIUS
  • Session expiry — expired clients are automatically disconnected

? Prerequisites
  • A MikroTik router running RouterOS 7 — it becomes the gateway
  • One or more WiFi access points, any brand, in bridge mode
  • A guest SSID you want to monetize
  • Your router must reach Wibizpro over HTTPS (port 443 outbound) and RADIUS (UDP 1812/1813)
  • A Wibizpro account — sign up here

? Set Up Your Site on Wibizpro
  1. Create an account and log into your dashboard.
  2. Go to Sites → + New Site and give it a name.
  3. Copy the portal URL and the RADIUS secret shown on the site page.
  4. Use both in your router's configuration (steps 1 and 2 above).
  5. Set your plans and pricing from the dashboard — pick durations, prices, and currency.

? Monitor & Manage

Your Wibizpro dashboard gives you full visibility:

  • Active sessions — see who's online right now
  • Revenue tracking — daily, weekly, monthly breakdowns per site
  • Block/unblock devices — manually kick off problematic clients
  • Plan management — change pricing or add/remove durations anytime
  • Session history — every connection, payment, and block event is logged
Get Started →