Skip to main content
الشبكات والميكروتك

Protect MikroTik HotSpot Port 80 and Reduce Unauthorized HTTP Traffic

A MikroTik RouterOS firewall configuration for controlling port 80 HTTP requests from unauthenticated HotSpot clients, while allowing the login page, local network and required connectivity requests.
Updated: 13 min read 16 views 0 comments
Protect MikroTik HotSpot Port 80 and Reduce Unauthorized HTTP Traffic
حماية البورت 80 ومنع طلبات HTTP غير المصرح بها في شبكة MikroTik HotSpot

Protect Port 80 on MikroTik HotSpot Networks

Some MikroTik HotSpot networks receive repeated HTTP requests from devices that have not yet authenticated. This configuration marks selected port 80 packets from unauthenticated HotSpot clients and drops them through the firewall while preserving access to the login page and required local destinations.

This configuration does not completely close port 80 for every client. It targets specific HTTP traffic generated by unauthenticated HotSpot users.

Before Installation

Create a RouterOS backup and export:

MikroTik / Terminal
/system backup save name=before-port80-protection

/export file=before-port80-protection

You must identify and replace the following values:

  • The IP address of the HotSpot login page.
  • The local network address range.

Example Values

Code
HotSpot login page: 172.20.25.1
Local network: 172.16.0.0/12

Do not use these values unless they match your actual network configuration.

Protection Script

MikroTik / Terminal
/ip firewall mangle

add action=accept chain=prerouting content=samsun dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-SAMSUNG"

add action=accept chain=prerouting content=apple dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-APPLE"

add action=accept chain=prerouting content=204 dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-204"

add action=accept chain=prerouting content=htm dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-HTML"

add action=accept chain=prerouting content=rom dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-ROM"

add action=accept chain=prerouting content=txt dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-TXT"

add action=accept chain=prerouting content=gener dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-GENERATE"

add action=accept chain=prerouting dst-address=172.20.25.1 dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-LOGIN-PAGE"

add action=accept chain=prerouting dst-address=172.16.0.0/12 dst-port=80 hotspot=from-client,!auth protocol=tcp comment="PORT80-ALLOW-LOCAL-RANGE"

add action=mark-packet chain=prerouting connection-state=invalid,established,related,untracked dst-port=80 hotspot=from-client,!auth new-packet-mark=80port passthrough=no protocol=tcp comment="PORT80-MARK-UNAUTH"

/ip firewall filter

add action=drop chain=input packet-mark=80port place-before=0 comment="salmandahmash"

Verification

MikroTik / Terminal
/ip firewall mangle print stats where comment~"PORT80-"

/ip firewall filter print stats where comment="salmandahmash"

Confirm that the HotSpot login page still opens, test authentication with a temporary user and verify that normal browsing works after login.

Remove the Rules

MikroTik / Terminal
/ip firewall mangle remove [find where comment~"PORT80-"]

/ip firewall filter remove [find where comment="salmandahmash"]

Important Warning

Incorrect login page or network addresses may prevent the captive portal from opening. Test the rules locally and keep MAC Winbox access available before applying the configuration remotely.

Source: إعداد وتحرير: منصة هايبر إكس

Tags:

#MikroTik #Hotspot #Firewall #RouterOS #مايكروتك #البورت 80 #Port 80 #Mangle #استنزاف الرصيد #حماية الشبكات #صفحة الهوتسبوت #Packet Mark #شبكات الإنترنت

Comments

0 published comments. New comments are reviewed for spam protection.

No comments published yet.