Enterprise MikroTik Billing System Engineered for Kenya
Automate PPPoE concentrators, zero-SMS hotspot captive portals, and FreeRADIUS Fast-Path CoA disconnects across your entire MikroTik fleet. Zero manual scripts. Zero CGNAT headaches.
Fast-Path RADIUS CoA Disconnects
Eliminate revenue leakage. The exact second a customer package expires or bandwidth quota is hit, RhoBill dispatches an RFC 3576 Packet of Disconnect. Zero delay, zero CPU spikes.
CGNAT Traversal via WireGuard
Manage distributed MikroTik routers behind carrier NAT (Safaricom, Airtel, JTL) without paying for public static IPs. Outbound WireGuard tunnels guarantee 100% remote uptime.
One-Command Terminal Provisioning
Forget manual IP pool entries, complex mangle rules, and fragile walled-garden IP lists. Paste one clean fetch command into WinBox, and RhoBill configures your router in under 5 minutes.
How RhoBill Orchestrates MikroTik Routers in Kenya
Most billing systems rely on brittle script generators or slow HTTP polling. RhoBill integrates directly with MikroTik RouterOS v7 using industry-standard network protocols:
1. PPPoE Concentrator & Dynamic Queue Trees
RhoBill provisions PPPoE server profiles on your fiber interfaces with dynamic simple queues. Customer download and upload speeds are shaped automatically according to their active package profile (e.g. 10M/10M, 20M/20M) with zero packet drops.
2. Offline-Resilient Local FreeRADIUS AAA
Our local FreeRADIUS agent stores active session tokens in memory. If your international fiber link drops or upstream DNS stutters, existing subscribers stay online without disruption.
3. Zero-SMS Hotspot RFC 8908 Discovery
When guests connect to your Wi-Fi, their phone automatically triggers modern Captive Network Assistant (CNA) browsers. Subscribers pay via M-Pesa STK Push and authenticate instantly by MAC address—no SMS delay, no OTP typing.
# 1. Fetch & apply provisioning script
/tool fetch url="https://rhobill.com/api/b/YOUR_TOKEN" mode=https dst-path=rhobill.rsc
# 2. Automated WireGuard interface created
/interface/wireguard add name=rhobill-wg0 listen-port=51820
# 3. RADIUS AAA and Fast-Path CoA enabled
/radius add service=hotspot,ppp address=10.64.0.1 secret=***
/radius/incoming set accept=yes port=3799
[System Status: WireGuard Connected · CoA Active · Ready]
Under 5 Minutes from Unboxing to First M-Pesa Payment
Follow this simple 4-step workflow to onboard any MikroTik RouterOS device.
Generate Encrypted Provisioning Keys
Register your RhoBill tenant account. The cloud control plane automatically provisions your dedicated WireGuard mesh peer keys, local API credentials, and RADIUS AAA tokens.
Paste Bootstrap Command in WinBox
Open WinBox, navigate to Terminal, and paste the one-line secure fetch script (/api/b/[token]). RouterOS executes the script inside a safe-mode transaction.
Automated WireGuard & RADIUS Handshake
Your MikroTik establishes an encrypted WireGuard tunnel (rhobill-wg0), configures local FreeRADIUS AAA accounting, and opens telemetry feeds over private IPv4 space.
Instant Subscriber Provisioning
Your PPPoE pools and zero-SMS captive portal are live. When subscribers pay via M-Pesa, RhoBill authenticates them instantly via Fast-Path RADIUS.
MikroTik Engineering FAQs
In-depth technical answers for Kenyan network engineers and ISP founders.
Why is FreeRADIUS CoA superior to traditional MikroTik API polling scripts?
Legacy billing software runs recurring scripts (/system script or API polling loops) every 60 seconds to scan active sessions and kick expired users. On a router with 500+ subscribers, this spikes CPU load to 100% and allows subscribers up to 59 seconds of free unpaid browsing. RhoBill uses RFC 3576 / RFC 5176 Change of Authorization (CoA) packets. The exact millisecond a subscriber's time or byte quota expires, our local FreeRADIUS agent dispatches a Disconnect-Request (Packet of Disconnect), severing the session instantly with 0% CPU strain.
How does RhoBill manage MikroTik routers behind CGNAT or mobile SIMs?
Most Kenyan ISPs receive private carrier-grade NAT IP addresses (e.g., 100.64.0.0/10) from upstream telcos like Safaricom, Airtel, or Jamii Telecommunications, making incoming WinBox connections impossible. RhoBill solves this by having your MikroTik establish an outbound WireGuard mesh tunnel to our cloud gateway. This gives your router an encrypted, static management interface (10.64.x.x) reachable anywhere without requiring costly public static IPv4 addresses.
Which MikroTik RouterOS versions and architectures are supported?
RhoBill natively supports RouterOS v7.12 and newer across all architectures, including ARM64 (CCR2116, CCR2004, RB5009), Tile (CCR1009, CCR1016, CCR1036), ARM (RB4011, hAP ax), MIPSBE (hEX S, hAP ac), and x86/64 Cloud Hosted Router (CHR) virtual instances.
What happens to active subscribers if the internet link to RhoBill drops?
Unlike purely cloud-hosted billing systems that drop subscribers during cloud outages, RhoBill deploys an offline-resilient local FreeRADIUS authentication cache at your network core. Active PPPoE sessions and hotspot guest connections continue routing traffic uninterrupted even during cloud WAN link outages.
Does RhoBill support both PPPoE Fiber and Wi-Fi Hotspot on the same MikroTik router?
Yes. You can run PPPoE Server concentrators on your fiber VLANs (e.g., vlan10-pppoe) and Hotspot Captive Portals on your wireless interfaces simultaneously. Bandwidth queues, voucher batches, and M-Pesa payments are managed from a single unified tenant dashboard.
Upgrade your MikroTik network management today
Stop fighting fragile API scripts and delayed customer disconnections. RhoBill brings commercial-grade RADIUS automation to your network.