Non Payment Reminder for PPPoE/HOTSPOT Clients in Mikrotik

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><a href="http://aacable.files.wordpress.com/2012/11/showing-nonpayment-error-at-client.png"><img alt="" class="aligncenter size-full wp-image-2585" height="569" src="http://aacable.files.wordpress.com/2012/11/showing-nonpayment-error-at-client.png?w=791&h=569" title="showing-nonpayment-error-at-client" width="791" /></a><br /> another series for user manager base setup<br /><br /> <strong><a href="http://aacable.wordpress.com/2013/12/03/automating-non-payment-reminder-for-user-manager-expired-accounts/" rel="nofollow">http://aacable.wordpress.com/2013/12/03/automating-non-payment-reminder-for-user-manager-expired-accounts/</a></strong><br /> <br /> Following is a small howto (written on request of a friend) on how you can redirect non payment / expired pppoe users to a page where he can be informed that his/her account have been suspended due to non payment. <span style="text-decoration: underline;">In this guide I used PPPoE server only, but you can apply this theory to HOTSPOT or other services also</span>. Remember, methods can vary, but the logic remains same in most cases.<br /> For example when you want to block user due to non payment, just change the user profile to expired users , Then the User will still be able to connect using his ID (pppoe dialer), but when he will try to surf the internet, he will be redirected to you local web server page where he will be informed that his/her account have been suspended due to non payment {<em>As showed in the image above</em>} . This is sometimes helpful for some other purposes too, for example you can also configure / schedule Payment Reminder, that can show payment reminder to users at specific dates/time for few seconds / minutes and then user can resume surfing after few seconds/minutes. but that’s another story.<br /> To shorten this guide, <span style="text-decoration: underline;">I assume you have a working pppoe server in place</span> with following config.<br />[<em>Change the ip scheme as per your local requirement/network</em>]<br /> For example you may have pppoe server configured for following scheme,<br /><br /> <strong><strong>M</strong>ikrotik PPPoE Serve rIP = 10.0.0.1<br />Mikrotik User DHCP Pool = 10.0.0.0/8</strong><br /><strong> Mikrotik PPPoE Pool = 172.16.0.0/16</strong><br /><br /> Now You have to create expired ip pool so we can distinguish non payment users and expired users profile so if we want to block any user , we will simply change this user profile to expired profile.<br /> <h2>Adding IP pool for Expired / Non Payment Users</h2>/ip pool<br />add name=Expired-Pool ranges=172.16.1.1-172.16.1.255<br /> <h2>Adding Profile for Expired / Non Payment Users</h2>/ppp profile<br />add change-tcp-mss=default dns-server=10.0.0.1 local-address=10.0.0.1 name=pppoe-expired only-one=default rate-limit=128k/128k remote-address=\<br />Expired-Pool use-compression=default use-encryption=default use-ipv6=yes use-mpls=default use-vj-compression=default<br /> <h2>Enabling Mikrotik Web.Proxy for Expired / Non Payment Users</h2>Now enable <strong>Web</strong> <strong>proxy</strong>, so that <strong>expired</strong> <strong>pool</strong> users can be redirected to local proxy where they will be denied and redirected to non payment page on any local web server.<br /><br /> /ip proxy<br />set always-from-cache=no cache-administrator=webmaster cache-hit-dscp=4 cache-on-disk=no enabled=yes max-cache-size=none max-client-connections=600 \<br />max-fresh-time=3d max-server-connections=600 parent-proxy=0.0.0.0 parent-proxy-port=0 port=8080 serialize-connections=no src-address=0.0.0.0<br /> <h2>Redirecting Expired User Requests from web.proxy to any local web server page</h2>Now creating rule in web.proxy to block non payment / <strong>expired</strong> <strong>ip</strong> <strong>pool</strong> access and redirect to local web server page.<br /><br /> /ip proxy access<br />add action=deny disabled=no dst-port=”” redirect-to=10.0.0.2/nonpayment/nonpayment.htm src-address=172.16.1.0/24<br /><br /> 10.0.0.2 is a local web server where non payment page is uploaded.<br /> You must create any normal html page (which have the non payment message) and upload it to any web server of your choice, Either It can be local (Preferred) or remote. If its local you won’t have to create any further rules , otherwise if its on remote server like internet, you have to allow user to access that specific particular site folder and place them on top.<br /> <h2>Adding NAT Rule to redirect Expired / Non Payment Users to local web proxy</h2>Now add NAT rule so that only users with expired ip pool should be redirected to local web proxy where he will be redirected to any local web server page.<br /><br /> /ip firewall nat<br />add action=redirect chain=dstnat disabled=no dst-port=80 protocol=tcp src-address=172.16.1.0/24 to-ports=8080<br /> <h2>Restrict Access for Expired Users so they cannot use any other internet service</h2>Now add filter rule to restrict expired ip pool users so they cannot access other internet services.<br /><br /> /ip firewall filter<br />add action=reject chain=forward disabled=no dst-port=!80,8080 protocol=tcp reject-with=icmp-network-unreachable src-address=172.16.1.1-172.16.1.255<br /><br /> Now when you want to block any users for non payment, just change his profile to <strong>pppoe-expired </strong>profile.<br /> <em>As showed in the image below . . .</em><br /> <img alt="" height="357" src="http://aacable.files.wordpress.com/2012/11/change-profile-to-expired-accnts.png?w=607&h=357" title="change-profile-to-expired-accnts" width="607" /><br /> Now the user will still be able to connect to pppoe server, but he will get expired ip pool, and therefore will be treated accordingly to the rules we created for these users :~) As showed in the image below . . .<br /> <img alt="" class="aligncenter size-medium wp-image-2585" height="286" src="http://aacable.files.wordpress.com/2012/11/showing-nonpayment-error-at-client.png?w=300&h=215" title="showing-nonpayment-error-at-client" width="400" /><br /> Note: You must create any normal page and upload it to any web server of your choice, Either It can be local (Preferred) or remote. If its local you won’t have to create any further rules , otherwise if its on remote server like internet, you have to allow user to access that specific particular site folder and place them on top.<br /> <br /> <h2 style="text-align: center;"><span style="text-decoration: underline;"><span style="color: red; text-decoration: underline;">Tips for HOTSPOT</span></span></h2>Using above method you can also implement non payment reminder for <strong>HOTSPOT</strong> users also. I assume you already have working HOTSPOT already running in place.<br /><br /> <strong><strong>M</strong>ikrotik HOTSPOT Serve rIP = 101.11.11.241<br />Mikrotik HOTSPOT DHCP Pool = 101.11.11.0/8</strong><br /><strong> Mikrotik HOTSPOT Expired/NON_Payment Users Pool = 101.11.21.0/24<br /></strong><br /> First add expired ip pool for <strong>expired/non payment</strong> users.<br /><br /> /ip pool<br />add name=expired-pool ranges=101.11.21.1-101.11.21.255<br /> Now add profile for <strong>expired/non payment</strong> users.<br /> /ip hotspot user profile<br />add address-pool=expired-pool idle-timeout=none keepalive-timeout=2m name=expired-profile shared-users=1 status-autorefresh=1m transparent-proxy=no<br /><br /><br /> Now enable web proxy service so that we can redirect expired users to web proxy where they will be redirected to local web server showing non payment page.<br /><br /><br /> /ip proxy<br />set always-from-cache=no cache-administrator=webmaster cache-hit-dscp=4 cache-on-disk=no enabled=yes max-cache-size=none max-client-connections=600 \<br />max-fresh-time=3d max-server-connections=600 parent-proxy=0.0.0.0 parent-proxy-port=0 port=8080 serialize-connections=no src-address=0.0.0.0<br /><br /><br /> In proxy, add rule to block and redirect only <strong>expired/non payment</strong> ip pool.<br /><br /><br /> /ip proxy access<br />add action=deny disabled=no dst-port=”” redirect-to=101.11.11.240/nonpayment/nonpayment.htm src-address=101.11.21.0/24<br /><br /><br /> <strong>101.11.11.240</strong> is the local web server ip.<br /> Create <strong>NAT</strong> rule to redirect <strong>expired/non payment </strong>users to local web proxy. Move this rule at the end in the NAT List.<br /><br /><br /> /ip firewall nat<br />add action=passthrough chain=unused-hs-chain comment=”place hotspot rules here” disabled=yes<br />add action=masquerade chain=srcnat comment=”masquerade hotspot network-DEFAULT RULE, ADD ONLY ALLOWED USER IPS RANGE HERE e.g” disabled=no src-address=101.11.11.1-101.11.11.255<br /><span style="color: red;">add action=redirect chain=dstnat comment=”Redirect Expired Users to Proxy” disabled=no dst-address=!101.11.11.241 dst-port=80 protocol=tcp to-ports=8080</span><br /><br /><br /> Remember, in HOTSPOT default masquerading rule, you must add only allowed users ip range. so add second rule in the last which will actually redirect only expired ip pool to local web proxy. (the red one)<br /> Create Firewall Filter to Restrict Access for <strong>expired/non payment </strong>users only. Move this rule at the end in Filter list.<br /><br /><br /> /ip firewall filter<br />add action=reject chain=input disabled=no dst-port=!80,8080,53 protocol=tcp reject-with=icmp-network-unreachable src-address=101.11.21.0/24<br /><br /><br /> Finally create user and tag him with expired-profile.<br /><br /><br /> /ip hotspot user<br />add disabled=no name=admin password=admin profile=default<br />add disabled=no name=test password=test profile=expired-profile server=hotspot1<br /><br /><br /> Now from user end, try to browse any site, hotspot login page will appear, login with the test id, and try to browse, you will be redirected to your local web server page showing non payment reminder.<br /> Remember: Rules placement is very important in this method. if you misplace rules, you will not get desired results.<br /> Regard’s</div>

Non Payment Reminder for PPPoE/HOTSPOT Clients in Mikrotik

another series for user manager base setup http://aacable.wordpress.com/2013/12/03/automating-non-payment-reminder-for-user-manager-expire...

Read more »