To integrate MikroTik RouterOS devices with SignLogger you define the MikroTik as a RADIUS client (NAS), redirect guest traffic to a captive portal, and retain every access record as a Law-5651 compliant signed log. Because MikroTik is one of the most widely deployed router and hotspot platforms in Turkey, this integration follows a standard, repeatable flow. SignLogger is brand-independent, works with any RADIUS-capable MikroTik model, and keeps all data on your own infrastructure (VMware/Hyper-V) — nothing leaves your premises.
This content is for general information only and is not legal advice. For obligations and retention periods under Law No. 5651, rely on the current legislation and a qualified advisor.
How the Integration Works
The design rests on three components: the MikroTik device redirects the guest user to a captive portal (RouterOS Hotspot) landing page, the credentials the user enters are checked against SignLogger over the RADIUS protocol, and the authorized session plus all access records are collected and signed on the SignLogger side. Authentication, guest management, and Law-5651 log retention thus converge in one place.
- Authentication: Portal credentials are sent to SignLogger over UDP 1812.
- Accounting: Session start/stop and the IP-to-user mapping are logged over UDP 1813.
- Log signing: SignLogger signs the collected records every day with the timestamp and e-signature of an authorized certificate authority (TÜBİTAK Kamu SM).
Step 1: Define the RADIUS Client in SignLogger
First, register your MikroTik device as a RADIUS client in the SignLogger management panel. Set the IP address the device will use to reach SignLogger and the shared secret both sides will use. This secret protects the integrity of RADIUS messages; choose a long, hard-to-guess value and make sure it is written identically on both ends.
Step 2: Add the RADIUS Server in RouterOS
On the RouterOS side you can manage the device via WinBox, WebFig, or the terminal; because menu names vary by version, the terms here are generic. In the RADIUS settings section, add a new server entry and enter the following values:
| Parameter | Value |
|---|---|
| Address | IP address of the SignLogger server |
| Secret | Exactly the shared secret from Step 1 |
| Service | Hotspot / login |
| Authentication port | 1812 (UDP) |
| Accounting port | 1813 (UDP) |
| Authentication method | PAP |
Captive portal authentication works only with PAP; methods such as PEAP/EAP-TTLS are not used in the hotspot scenario. Make sure accounting is enabled so records reach SignLogger continuously — keeping the IP-to-user mapping up to date is critical for Law-5651 compliance.
Step 3: Guest Hotspot and Captive Portal Redirection
Enable RouterOS Hotspot on the interface guests connect to (a wireless or wired bridge/VLAN). In the hotspot server profile, mark authentication to be performed against RADIUS so that portal credentials are checked against SignLogger rather than a local user list. Until login completes, the user can reach only permitted addresses (the walled garden).
- Separate the guest network from the corporate network with a VLAN for a clean topology in terms of logging and security.
- Show your privacy notice and terms of use on the landing page.
- Add only the portal and authentication service addresses to the walled garden.
When planning this flow and defining guest policies, use the architecture on our hotspot and captive portal management solution page as a reference.
Law-5651 Compliant Signed Log Retention
Once the integration is complete, SignLogger collects the session and access records coming from MikroTik and signs them every day with a TÜBİTAK Kamu SM timestamp and e-signature. The Kamu SM integration works with credits (kontör); sufficient credits must be available for signing continuity, and where credits run out a fallback method backed by a server certificate can be defined. For exact legal figures such as the retention period and accepted identity method, consult the legislation.
Frequently Asked Questions
Does every MikroTik model work with SignLogger?
RouterOS devices with RADIUS client support and the Hotspot feature are compatible. Because SignLogger is brand-independent, you can add different MikroTik models using the same configuration logic.
Why must the shared secret match on both sides?
The shared secret validates RADIUS messages. If it is written differently on each side, authentication requests are rejected and guests cannot pass through the portal.
Is PAP secure for a captive portal?
Hotspot RADIUS authentication runs over PAP; since the traffic is carried within the portal's own session, this is the standard approach for that scenario. For 802.1x-based network access, EAP methods are used instead.
Where are the logs stored?
All data is kept locally on your own server (VMware/Hyper-V); SignLogger runs on-premises without sending data outside.
How often are the logs signed?
SignLogger signs the records every day with the timestamp and e-signature of the authorized certificate authority TÜBİTAK Kamu SM; this operation uses Kamu SM credits.
Do I need to replace my existing MikroTik infrastructure?
No. You complete the integration by adding a RADIUS server definition and Hotspot redirection to your existing MikroTik device; no hardware change is required.