From a router to a paid hotspot

01 / System map

Know which connection you are making

There are three separate links. A successful management tunnel does not, by itself, make a router a paid hotspot.

02 / Provider record

Register a hotspot distributor

1. Collect the business details.Use the business name, primary contact and Safaricom phone number. Email, location, service type and installation notes can be added in the form.
2. Create the owner.Sign up at /hotspot-reseller with a business email, Wi-Fi name and password. The new owner starts in Onboarding; the Chamnet admin activates it in /pingu before router commands can be issued.
3. Record each site separately.One owner may have several routers. Give each router a clear name, site and service type so telemetry and future billing can be assigned correctly.
4. Choose collection terms before selling passes.Decide whether the owner will use their own ArchPay account/channel or a documented Chamnet settlement arrangement. The current application cannot enforce this choice per owner yet.

Current access: each newly signed-up owner has a separate reseller session and sees only its own router records and telemetry. For an existing admin-created owner, use Invite login in the owner row and send the one-time link privately. Do not share the super-admin password with a distributor.

03 / Private enrollment

Connect a RouterOS v7 MikroTik

The owner should have local WinBox, WebFig or terminal access, working internet, a configuration export and binary backup, and the correct local management subnet. WireGuard uses an outbound connection from the router, so its site does not need a public IP.

1. Issue the enrollment.After approval, the owner opens Onboarding in /hotspot-reseller, enters the router and site names, chooses the service type, and confirms the LAN subnet used for local recovery.
2. Copy the complete command once.Chamnet reserves a unique WireGuard /32 and displays one RouterOS command block. Copy it immediately; it includes a temporary claim token and newly generated router account passwords.
3. Paste it in the router terminal.Use the local WinBox or WebFig Terminal on that exact MikroTik. Paste the complete block, including its opening and closing braces, and wait for the completion message. The router keeps its private WireGuard key; only the public key is sent to Chamnet.
4. Verify and activate.Back in Self install, select Verify and activate. The server checks a recent handshake, ping, both restricted RouterOS accounts and RouterOS v7 before enabling telemetry.

Expiry and recovery: the claim token lasts 30 minutes. After the router claims it, verification may finish within 24 hours. Use Reissue command on an expired enrollment for the same router; it keeps the reserved address and issues a new token. Keep the command private and confirm local recovery access before applying it.

What it changes: the command adds a management WireGuard interface, route and firewall allowance, creates restricted telemetry/operator accounts, and limits management services to the entered local subnet and VPS tunnel address. It does not set up Wi-Fi, HotSpot, RADIUS or payment routing.

04 / Day-to-day router control

How commands and remote management work

These read-only terminal checks help diagnose a new installation. Run them locally on the MikroTik; they do not alter configuration.

/system resource print
/interface wireguard peers print detail
/ping 10.254.77.1 count=4
/ip hotspot active print
/radius monitor [find where service=hotspot] once

Do not paste a second enrollment on the pilot router. It already has a private peer. Add a new enrollment only for another RouterOS v7 device or a planned replacement.

05 / Customer network

Make the enrolled router a paid HotSpot

This is a separate setup after management verification. Chamnet's pilot uses a guest bridge/subnet, DHCP, DNS, HotSpot, an external login redirect, walled-garden access to the portal, and RADIUS authentication. A new owner router needs its own reviewed settings and unique RADIUS shared secret before customers are charged.

1. Build the guest network.Choose the client subnet, gateway, DHCP pool, SSID and uplink. Keep the owner's management LAN separate from guest devices. Tenda access points can extend Wi-Fi behind the MikroTik over Ethernet; the MikroTik remains the HotSpot gateway.
2. Configure the captive portal.The router's HotSpot login page passes the device MAC, IP and login URL to Chamnet. The walled garden must allow the portal to load before payment.
3. Configure RADIUS for that router.The router needs a unique RADIUS client identity and secret, and the VPS must recognize its source address. HotSpot MAC authentication and reply attributes provide the paid session time and rate limit.
4. Test without collecting money first.Join from a fresh device, confirm captive redirect, confirm unpaid internet is blocked, grant a test authorization, then confirm that access ends when the pass expires.

Current limit: Self install does not automate these four steps for a new router. The working Chamnet payment path is tied to the existing pilot setup. Use a staged router-specific setup before selling an external owner's passes.

06 / Money to access

What happens after a customer pays

The customer enters a Safaricom number such as 798697987, 0798697987 or 254798697987; the server normalizes it to 254.... The server uses the configured ArchPay account and channel to start an STK prompt. Only a provider-verified completed result with the expected amount and phone can authorize access.

For the pilot, Chamnet writes the paid device's MAC and a temporary login to FreeRADIUS. The RADIUS reply includes Session-Timeout, Mikrotik-Rate-Limit and expiry. A background job removes expired authorizations; the router must also enforce session end. A second payment for the same MAC extends from the current pass end.

Support path: in /pingu, open M-Pesa transactions to compare payment state, M-Pesa receipt and access state. A completed payment with access pending needs a RADIUS/router check; a pending payment has not yet been confirmed. A failed, cancelled or timed-out prompt grants no access.

07 / Distributor settlement

How an owner's payment channel should be attached

There are two business models, and the implementation must record which one applies to each owner before a second business takes payments.

Not live yet: the current ArchPay key and active payment route are global server settings. Owners can submit their destination details; Chamnet admin can record a channel ID. Package, payment, subscriber and RADIUS authorization records are not fully owner-scoped, so the channel mapping cannot initiate reseller payments yet. The current Chamnet pilot remains the only payment-ready estate.

08 / Subscribers and plans

Manage clients, speed and time accurately

The pilot portal currently offers 1 hour for KES 10 at 10M/10M, 4 hours for KES 20 at 10M/10M, 12 hours for KES 30 at 15M/15M, and 24 hours for KES 50 at 20M/20M. The admin can add HotSpot plans and pause them. These plans are global until owner-scoped catalogs are implemented.

The client directory combines payment history with optional managed profiles. Adding a client profile records contact and lifecycle information; it does not automatically create a HotSpot, PPPoE or static-IP account on a router. PPPoE/static provisioning, vouchers, FUP and owner-scoped customer billing are planned.

Rates use RouterOS upload/download notation. To verify a 10M/10M pass, check the paid client's RADIUS reply and active router queue, then test on that client device. A speed test alone may reflect another interface or a bypassed session.

09 / Diagnosis

When the flow stops

10 / Router replacement

Replace the head router without losing the business

Keep the owner and customer history in the billing database. Back up the old router, enroll the replacement as a new router under the same owner, and verify its private link first. Recreate the guest subnet, HotSpot, portal redirect and unique RADIUS client on the replacement; then test an unpaid device, a test authorization, a real low-value payment and expiry before moving customer uplinks. Do not reuse the old router's WireGuard private key or RADIUS secret.

Changing the head router does not require a new Chamnet website. It does require router-specific network and RADIUS work, plus an owner/router mapping for future payments and reports.

11 / Handover

Before an external owner goes live

• Owner business details and settlement model are recorded.
• RouterOS v7 backup, local recovery path and stable internet are confirmed.
• WireGuard enrollment is active and router telemetry updates.
• HotSpot or PPPoE/static service is configured and tested for that site.
• Unique RADIUS client secret and owner/router authorization scope are deployed.
• Owner's plans, portal branding, staff permissions and payment channel are isolated.
• Fresh-device redirect, paid login, time limit, speed limit and expiry all pass.
• Support, reconciliation and outage recovery procedures are assigned.

Current pilot: Archie Tech Nexus is registered for onboarding, and the connected hAP pilot is assigned to its router inventory. This assignment does not change the pilot's existing Chamnet payment route, HotSpot or RADIUS settings. Next, build and test owner-scoped plans, orders, payment credentials, authorizations and reporting before connecting the provider's separate ArchPay channel or enabling owner-facing collection.

12 / Vendor references

Technical references

• MikroTik WireGuard — peer addresses, endpoint and keepalive.
• MikroTik REST API — supported management transport and authentication.
• MikroTik HotSpot and custom login pages.
• MikroTik RADIUS — HotSpot and PPP authentication.
• ArchPay — account, channels, STK push and webhook settings.