Hotspot Radius Manager — install & user guide

Your routers and access points do not know your users. When someone connects, they ask a RADIUS server whether that person may log in. Hotspot Radius Manager is that server, together with a web portal where your team creates the accounts, sets the limits and sees what is happening.

Each user gets their own speed, device and data limit, instead of a share of one connection. Every login attempt and every session is stored with the user, IP address, MAC address and access point, so “who had this IP at 3pm on Tuesday?” has an answer. It runs on your own server — no cloud, nothing to install on the devices.

The dashboard — users online, logins and rejects today, RADIUS response time and router health. The data shown is an example, not a live network.

Changes take effect straight away. Disable a user who is online and they are disconnected; raise a group's speed and everyone in it who is online gets the new speed without logging in again.

Ports

Options go after bash -s --:

No internet on the server? Ask us for the bundle, copy it over, then run tar xzf hotspot-radius-manager-<version>.tar.gz, change into the folder and run sudo ./install.sh.

A new installation gets a 15-day trial with every feature, the first time it reaches the licence server. The banner at the top of the portal counts the days down. The Licence page shows the plan, the expiry date, the limits — user accounts, routers (NAS), admins and users online at once — and the server's Machine ID.

Give each NAS a site, building and floor so reports and alerts say where. Use Maintenance before planned work so a router going quiet raises no alarm. Secrets can be rotated in two steps without dropping a login.

Open Captive portal. You can keep several portals — one for students, one for guests — and the one marked Default is offered on the NAS page.

The captive portal designer with a live phone preview. The data shown is an example.

Open Groups & Bandwidth → New group. Start from a template — Students, Staff, Guests, VIP, Night boost — or from scratch.

Change a group and everyone in it who is online gets the new speed at once. One user needs something different? Open the user → Edit → Set this user's own speed & limits. Every change to a group is versioned with who, when and a note, and can be restored.

Opening a user shows everything on one page: status, devices, data used this month and in total, sessions, login history and every change made to the account. Disabling a user who is online disconnects them.

The Users page. The data shown is an example, not a live network.

Open Directory (LDAP / AD) and add your Active Directory or OpenLDAP server: address (prefer ldaps://, and paste your CA certificate if it is your own), a read-only service account and the base DN. Add a second server for failover.

Use Test connection and Try a login, then map directory groups to your plans — Students to Students-20M, Faculty to Faculty-50M. Passwords are checked against the directory at every login and are never stored here. The optional Directory sync creates the accounts in advance and disables people who have left.

Vouchers → New voucher batch. Choose how many codes (1 to 10,000), the group, and the limits: valid for a time from first login or from creation, a “use before” date, total data and time, and devices. A batch can be limited to certain sites or routers.

Download the batch as a PDF of 8 to 24 cards per page, each with a QR code that logs the visitor straight in, or export the codes. Each code shows its state — not issued, issued, in use, used, expired or revoked — with when it was redeemed, and the batch shows the value of the codes sold. Codes that should no longer work can be revoked.

Voucher batches and the print preview. The data shown is an example.

Turn each one on in Captive portal → Login methods. The SMS page supports a generic HTTP template, MSG91 (DLT) and 2Factor, with a fallback gateway and a log of every message and its cost.

Register the device under MAC devices with its MAC address and a group. The router logs it in by its MAC without showing a login page, and the account works only for that MAC. Devices appear in sessions, logs and reports like any other user, so you can still see what they did.

Users online now, logins and rejects with their reasons, logins per second, RADIUS response time, traffic, and the server's CPU, memory and disk — for the last 15 minutes up to 30 days. Below it, every router with when it last sent a login and an accounting record. A router that has gone quiet stands out here before users start calling.

Online Sessions lists every user online with IP, MAC, router, live speed, data used and how long they have been on. Select one or many and Disconnect — the router confirms it. The Issues tab finds stale sessions, users over their device limit, one MAC on many accounts and routers the server does not know.

Online sessions. The data shown is an example, not a live network.

Filter by username, IP, MAC in any format, router and time, and Export CSV for an investigation. How long records are kept is set under System Settings → Log retention — CERT-In expects at least 180 days. Older records are archived rather than lost.

Type a username or a MAC address. The page runs every check — account, password, expiry, devices, time and data limits, site — shows the recent attempts with the reason for each rejection, and tells you the fix. Test a login tries the password from the portal. The NAS & network tab shows routers blocked by the firewall, unknown clients and wrong secrets. The live feed shows each request as it arrives — ask the user to try now and watch.

Reports has 18 reports — users, usage, top users, logins per router, peak online, outages, vouchers, SMS, admin activity, sites and more — as PDF, Excel or CSV. Schedule any of them daily, weekly or monthly to a list of email addresses.

Analytics shows the trends: peak users online, active users, data and logins, a weekday-by-hour map of the busiest times, and a forecast of when you will reach the licence limit, your peak capacity or a full disk.

Analytics. The data shown is an example.

Built-in rules cover RADIUS or the database down, a router offline or no longer sending accounting, a spike in rejects, CPU, memory or disk, licence and certificate expiry, and failed backups. Alerts arrive by email, webhook (Slack, Microsoft Teams, Google Chat) and the bell in the portal.

Acknowledge an alert with a note so others know it is being handled. Unacknowledged alerts send reminders and escalate to a second list; a resolved message follows when the problem clears. Mute a rule, or put a router in maintenance, for planned work.

Users open https://your-server-ip/my and sign in with their Wi-Fi username and password. They see their validity, speed, limits and usage, their devices online (and can log one out), their session history, change or reset their password with a code by SMS or email, register devices and raise a request. Requests arrive under User requests. Which features users get, and a notice to show them, are set on the same page.

Build your own roles from 38 separate permissions under Roles & Permissions. Under Sites, split the network into campuses or buildings: users, routers, groups and voucher batches belong to a site, and an admin limited to a site sees only its users, sessions, logs, reports and dashboard. Per site you can also decide whether its users may log in everywhere or only at their own site's access points.

Every admin action is recorded in the Audit Log with who, when and from where. The log is hash-chained: Verify integrity detects any record that was changed or removed.

The database is backed up every night and the recent ones are kept. Under System Settings → Backup & restore you can back up now, download, upload and restore — restoring asks you to type RESTORE. Backups can be encrypted with a passphrase.

Under Disaster recovery, send an encrypted copy to another server over SFTP after every backup, and have backups restored into a scratch database on a schedule, so you know they work before you need them.

The installer sees an existing installation and upgrades it in place. The database is backed up first, and your users, settings and secrets are kept. The previous version stays on disk: if anything misbehaves, sudo hotspot-radius-manager rollback puts it back.

Messages on the login page

On the network and the server

The quickest things you can send us are the output of sudo hotspot-radius-manager status, a screenshot of the Troubleshoot page for the user or router in question, and the router model and RouterOS / firmware version.