How to Integrate M-Pesa with MikroTik Hotspot Step-by-Step
Why raw RouterOS script loops crash production routers, and how modern Cloud RADIUS with Safaricom Daraja 2.0 delivers sub-second automated logins.
Why DIY MikroTik M-Pesa Scripts Fail in Production
Hundreds of Kenyan network admins begin by downloading free RouterOS scripts or setting up basic PHP SMS forwarding. Here is what happens when real customers start paying:
100% CPU Freezes During Peak Hours
Lost Money When M-Pesa Callbacks Drop
Security Vulnerability (Fake SMS & Open APIs)
Step-by-Step Production Setup Guide
The battle-tested architectural blueprint for connecting MikroTik to Safaricom Daraja.
Step 1: Configure MikroTik Hotspot Server Profile
In WinBox, navigate to IP -> Hotspot -> Server Profiles. Enable RADIUS authentication (use-radius=yes) and configure MAC-based zero-touch login (login-by=mac,http-chap,cookie).
Step 2: Enable RFC 3576 / RFC 5176 Incoming CoA
Open Terminal in RouterOS and run '/radius/incoming set accept=yes port=3799'. This allows the RADIUS server to dispatch real-time Packet of Disconnects when packages expire without rebooting interfaces.
Step 3: Establish Encrypted WireGuard Management Mesh
Create a WireGuard interface connecting your MikroTik to RhoBill's cloud gateway. This assigns a private static IP (10.64.0.0/16) that bypasses Safaricom/Airtel CGNAT firewalls safely.
Step 4: Upload RFC 8908 Zero-SMS Captive Portal
Import the mobile-optimized captive portal HTML. When guests connect, their smartphones automatically trigger the login prompt with one-tap Lipa na M-Pesa STK Push.
# 1. Enable RFC 3576 Packet of Disconnect (CoA)
/radius/incoming set accept=yes port=3799
# 2. Add Local FreeRADIUS AAA Server
/radius add service=hotspot,ppp address=10.64.0.1 secret=YOUR_SECRET
# 3. Configure Hotspot Profile for MAC Auto-Login
/ip/hotspot/profile set [find default=yes] login-by=mac,http-chap,cookie use-radius=yes
Frequently Asked Technical Questions
Why do free GitHub MikroTik M-Pesa scripts frequently fail in production?
Most free scripts shared online rely on '/tool fetch' scheduled scripts running on the router or an unauthenticated PHP script on a web server. These scripts lack transaction deduplication, cannot handle Safaricom Daraja in-flight query delays (such as 500.001.1001 or 1001), and bog down the router's single-core CPU when scanning active user tables.
Do I need a static public IP from Safaricom to connect M-Pesa to MikroTik?
No. With RhoBill, your MikroTik router initiates an outbound WireGuard tunnel to our gateway. Because the tunnel is outbound, it punches through any carrier-grade NAT (CGNAT) without requiring you to purchase an expensive static public IPv4 address from your upstream telco.
How does RhoBill automate the M-Pesa STK Push on the customer's phone?
When a guest enters their phone number on the captive portal, RhoBill invokes Safaricom's Daraja 2.0 Lipa Na M-Pesa Online API (/mpesa/stkpush/v1/processrequest). Safaricom prompts for their PIN. Once entered, Safaricom sends an encrypted callback to RhoBill, which immediately adds the user's MAC address to RADIUS and authorizes internet access in under 1.5 seconds.
Automate your MikroTik hotspot with RhoBill
Skip the headache of writing and debugging raw RouterOS fetch scripts. Paste one bootstrap command and go live in 5 minutes.