Routers, RADIUS and sessions

How a PPPoE login works#

Your MikroTik routers don't decide who gets internet. They ask CoreSync. The protocol they use to ask is called RADIUS, and a router that asks is called a NAS (network access server), or a RADIUS client.

Here's what happens when a home customer's router (or ONU) connects:

1. The customer's router dials PPPoE to your MikroTik with the customer's username and password.
2. Your MikroTik sends the login to CoreSync over its management tunnel, signed with the RADIUS secret you both share.
3. CoreSync checks the account: does the username exist, is it active, not expired, not paused, is the password right, and is the device allowed.
4. If all is well, CoreSync answers Accept, with the plan's speed and the customer's IP address (from a pool, or their fixed IP).
5. The session starts. The router keeps reporting usage, and the customer appears in Active Sessions.

When an account expires or is suspended, CoreSync doesn't simply refuse the login. It lets the router connect at a tiny speed, so it stops retrying, and puts the customer in your expired pool. If the router has the expired pool and its firewall, the customer is sent to a page to pay. When they pay, CoreSync drops the session so the router dials again straight away and gets full speed.

Add a router as a RADIUS client#

Every router that logs customers in must be known to CoreSync as a NAS, with a shared RADIUS secret. You don't do this separately: it happens when you add the router.

1. In Devices → All Devices, add the router with the role Hotspot / PPPoE Router. Under Services this device handles, pick PPPoE, Hotspot or both. See Devices, OLTs and ONUs.
2. Type a RADIUS Secret. It's a shared password between the router and CoreSync; both sides must match.
3. Connect the router over the management tunnel. RADIUS travels through the tunnel, so the router must be online in CoreSync.
4. Open the router's page and go to the NAS Setup tab to check and finish the setup.

The NAS Setup tab#

The NAS Setup tab appears on routers added as a NAS. It has four parts.

The health check looks at:

• NAS Record IP: the address CoreSync expects the router's logins to come from. A mismatch means every login fails.
• SSH Connectivity: whether CoreSync can log into the router.
• RADIUS Config: whether the router points at CoreSync with the right secret.
• PPPoE Server and Hotspot Server: whether they exist and are switched on.
• IP Pools: the pools on the router.
• Active Hotspot Sessions and Active PPPoE Sessions: how many people are on now.

1. When a line fails, press Fix next to it.
2. Press Get Script first. CoreSync shows the RouterOS commands it would run, without changing anything.
3. If the script looks right, press Apply via SSH. Then press Run Health Check again.

The NAS Devices list#

There is also a plain list of every RADIUS client, the NAS Devices page. It isn't in the menu; open it by typing /admin/nas after your CoreSync address. It shows each NAS with its status, users online and CPU, and has Add NAS Device and Refresh Status.

Add routers in All Devices instead whenever you can, so they also get a device page with the NAS Setup tab, monitoring and the management tunnel.

The management tunnel#

Each router connects to CoreSync over a private, encrypted tunnel (WireGuard, or OpenVPN on older RouterOS). CoreSync manages the router through it, and the router's RADIUS logins travel through it.

• If the tunnel is down, the router shows offline in CoreSync, and new logins on that router fail.
• Customers already online usually stay online until they reconnect.
• You set the tunnel up when you add the router. See Devices, OLTs and ONUs.

To see the tunnels, open Maintenance → VPN, explained below.

IP pools#

An IP pool is a range of addresses CoreSync and your routers hand out. Open Devices → IP Pools. The page has two tabs: IP Pools and Public IPs.

amani.coresyncisp.com/admin/ip-pools

A pool in the shared range from 100.64.0.0 to 100.127.255.255 is a CGNAT pool: many customers share a few public IPs. CoreSync marks it CGNAT and asks which public IPs it goes out through.

1. Press New Pool and choose the Pool Purpose.
2. Choose the Router / NAS Device (only online routers are listed) and type a Pool Name. You can't change the name later: it's what the router calls the pool.
3. Type the Subnet (CIDR), or type a number in Target Subscribers (optional) and let CoreSync pick a CGNAT subnet big enough. The range and gateway fill in from the subnet.
4. Check Range Start, Range End, Gateway and Interface. For static pools, choose the Block Allocation: /30 (a router-side IP and a customer IP for each customer) or /32 (a single address each).
5. For a CGNAT pool, pick the CGNAT public IP target(s). With several, customers are spread across them, and each customer always goes out through the same one.
6. Optional: press Check on router to see if the pool already exists there, and tick Push pool + NAT rule to router on save.
7. Press Create Pool.

A CGNAT pool also shows, under its status, whether the router has it:

• Synced: the router has the pool as CoreSync has it.
• Mismatch: the router's copy is different.
• Not pushed: it only exists in CoreSync so far.

The menu at the end of each row has:

• Check on router and Push to router (CGNAT pools): compare with the router, or send the pool and its NAT rule to it.
• Edit: change the range, gateway, interface, public IPs and DNS.
• Apply to Subscribers: put matching subscribers on this pool in RADIUS. Filter by account and connection status, then press Apply to Matching Subscribers. They get addresses from it the next time they connect.
• Delete.

The Public IPs tab is your list of public addresses per router. Press Add Public IP to add one, or a whole range with a Start IP, End IP and Label Prefix. CGNAT pools pick their public IPs from this list.

Expired, rogue and hotspot pools on a router#

Each router also needs a few standard pools: one for expired customers (with a firewall that only lets them reach DNS and your payment page), one for unknown or blocked logins, and one for hotspot guests. CoreSync can create them for you.

1. Open the router's page and go to its IP Pools tab.
2. In Auto-provision NAS Pools, tick Rogue pool, Expired pool + firewall and/or Hotspot pool.
3. Press Create & Push. CoreSync picks ranges that don't clash with your other pools, pushes them to the router, and lists what it made.

Without the expired pool and its firewall, expired customers stay connected at a crawl but aren't sent to the payment page.

Active Sessions: who's online#

Active Sessions (under Services in the menu) lists everyone online right now: PPPoE customers and hotspot guests. It refreshes every 30 seconds.

amani.coresyncisp.com/admin/sessions

• Each row shows the Type, Username / MAC, Subscriber, NAS Device, IP Address, when they connected, how long, and data Down and Up.
• Search by username, MAC or IP, and filter by Type (Hotspot or PPPoE) or by NAS Device.

1. To kick a session, open the row menu and choose Disconnect.
2. Check the name and router, then press Disconnect. CoreSync tells the router to drop that session.

A PPPoE customer's router dials straight back in. Use this after you change someone's plan, speed or IP, so the change takes effect.

RADIUS logs: accepted and rejected logins#

Maintenance → RADIUS Logs shows every login attempt and session start and stop from your routers. It's the first place to look when a customer says they can't connect.

1. Type the customer's username in Filter by username....
2. Narrow it with Zone, NAS / Router, Event Type and Period (1 hour up to 7 days).

   amani.coresyncisp.com/admin/maintenance?tab=radius-logs

   

3. Read the Event and the Detail / Reason column. Hover over it for more.

For a rejected login, CoreSync works out why:

For session stops, the reason says how it ended, for example Idle timeout, Physical disconnect (cable or signal) or Disconnected by administrator. Times are shown in East Africa Time. The list refreshes every 30 seconds.

Each customer also has their own RADIUS Logs tab on their page. See Subscribers.

The RADIUS settings tab#

Settings → RADIUS holds the login rules for all your customers.

amani.coresyncisp.com/admin/settings?tab=radius

Static IP customers#

Static IP customers don't log in with a username and password. Their router has a fixed address, and CoreSync manages them on your MikroTik directly:

• Their speed is a queue on the router, set from their plan.
• When they expire or are suspended, CoreSync blocks their IP on the router.
• When they pay, CoreSync unblocks the IP and restores their plan speed.

Because of this, CoreSync must be able to reach the router over its management tunnel. If it can't, a payment is recorded but the customer stays blocked until the router is reachable again.

1. Make a Static pool for the router first (see IP pools).
2. When you add the subscriber, choose the service type Static IP. Under Static IP Details, pick the IP Pool. CoreSync suggests the next free address in Client IP.
3. Save. Give the technician the Client Config box: IP, gateway and DNS for the customer's router.

To switch an existing customer between PPPoE and static, use Convert to Static IP or Convert to PPPoE on their Overview tab. To change the address, use Edit static IP. See Subscribers.

Static customers don't log in, so their page has no RADIUS Logs tab and they don't show in Active Sessions.

Maintenance tools#

Maintenance (under System in the menu) gathers the operational tools. Pick a tool on the left.

Check a router's tunnel (VPN)#

Maintenance → VPN has a WireGuard tab and an OpenVPN tab. The WireGuard tab counts Total Peers, Connected and Problems, then lists each router (peer) with its Last Handshake, data sent and received, and Status.

1. Find the router in the list. A handshake older than a few minutes means the tunnel is down.
2. If it shows DRIFT or Config Drift, press Repair on that row. It restores that peer's settings only.
3. If it's Stale, check the router itself first: power, its internet connection, and its own WireGuard settings.

The OpenVPN tab lists the client certificates CoreSync issued (Issued Certs), which are connected, and their virtual address.

Recycle Bin#

When a subscriber is deleted, they go to Maintenance → Recycle Bin first. Search the deleted records, then use Restore to bring one back, or Delete Permanently to remove it for good.

Only subscribers are kept here for now. The Payments and Tickets tabs say (soon).

Common mistakes#

• A different RADIUS secret on the router. Every login fails. Fix it from the NAS health check, or save the secret with Push RADIUS config to router via SSH.
• Pressing Apply via SSH without reading the script. Press Get Script first.
• Leaving a migrated router's RADIUS timeout very short. Logins fail with "radius timeout". Keep 3s.
• Deleting a pool customers still use. Move them to another pool first.
• Expecting a plan change to apply at once. PPPoE customers pick up a new speed or IP when they reconnect. Disconnect them, or use Force Redial (CoA).
• Clearing a MAC lock for every reject. Only clear it when the customer really changed their router. Otherwise, someone else may be using their login.
• Full Reload to fix one tunnel. It drops every tunnel. Repair the one peer.

If it doesn't work#

More help: Troubleshooting.