MikroTik & NAS Integration

01Integration architecture

Daddy SAS talks to MikroTik routers over two channels — standard RADIUS for AAA decisions, and router-side operations (API/CoA) for live session actions.

• RADIUS (UDP 1812/1813) carries authentication, authorization and accounting.
• CoA/Disconnect-Message (UDP 3799) pushes policy changes and kills live sessions.
• Router-API operations are used where supported for management actions.
• Your subscribers, packages and billing live centrally in Daddy SAS — the router stays the enforcement point.

02Adding a NAS

• Register the router in the NAS/router section of the admin panel with its IP address and a shared secret.
• Enable the corresponding service: PPPoE server, Hotspot, or IPoE/DHCP.
• Point the router at Daddy SAS as its RADIUS server (see the example below).

03Illustrative RouterOS config

Standard RouterOS syntax — replace placeholders with your values. Illustrative, not copied from a live deployment.

# 1. Point the router at the Daddy SAS server
/radius add service=ppp,hotspot \
    address=<DADDYSAS_IP> secret=<STRONG_SECRET> \
    authentication-port=1812 accounting-port=1813 timeout=3s

# 2. Use RADIUS for PPP authentication + accounting
/ppp aaa set use-radius=yes accounting=yes interim-update=5m

# 3. Enable CoA / Disconnect-Message (UDP 3799)
/radius incoming set accept=yes port=3799

# 4. Hotspot profile → RADIUS accounting
/ip hotspot profile set [find] use-radius=yes \
    radius-accounting=yes interim-update=5m

04Compatibility

• MikroTik RouterOS & RouterBOARD — all versions supported (owner-confirmed).
• Other NAS platforms: Cisco, StarOS, ChilliSpot, pfSense, DD-WRT/OpenWRT.
• DOCSIS CMTS provisioning for cable networks.

05Multi-NAS operations

• Operate many routers from one dashboard — each NAS gets its own entry, secret and service assignment.
• A subscriber can authenticate on any NAS allowed by their account; sessions are tracked per NAS.
• Live session actions (disconnect, speed change) go out over RADIUS CoA/DM and router-API operations.
• Per-NAS monitoring isolates which router has a communication problem.

06Security recommendations

• Restrict the RADIUS service to the server address only and limit who can reach UDP 1812/1813.
• Use a long random shared secret per NAS — never reuse them.
• Keep router management (Winbox/API) off public addresses; a VPN or management VLAN is recommended.
• NAT/CGNAT-behind deployments are workable — ask support for the recommended topology.