MikroTik walled garden: allow sites before login

Last updated: 2 October 2026

A walled garden is the list of places a hotspot user may reach without logging in: your own website, a payment page, or a help line. MikroTik has two lists for it, one by website name and one by address.

Allow a website by name

/ip hotspot walled-garden add dst-host=example.com action=allow
/ip hotspot walled-garden add dst-host=*.example.com action=allow

This list works on web traffic. The * matches any subdomain.

Allow a server by address or port

/ip hotspot walled-garden ip add dst-address=203.0.113.10 action=accept
/ip hotspot walled-garden ip add dst-host=pay.example.com action=accept

Use the IP list for anything that is not a plain web page, or when the name list is not enough for an HTTPS site.

A worked example

You want customers to read your price list and reach a payment page before they log in. Your site is wifi.example.com and it loads fonts and scripts from a second domain:

/ip hotspot walled-garden add dst-host=wifi.example.com action=allow comment="price list"
/ip hotspot walled-garden ip add dst-host=wifi.example.com action=accept comment="price list https"
/ip hotspot walled-garden ip add dst-host=cdn.example.net action=accept comment="files the page loads"
/ip hotspot walled-garden ip add dst-host=pay.example.org action=accept comment="payment page"

Then put a link to the price list on your login page. To find the extra domains a page needs, open it on a computer with the browser's developer tools on the Network tab and note the host names that appear.

What usually goes wrong

The page loads without its pictures or styles. Modern sites load files from other domains. Open the site, note the other host names it uses and add them too.
HTTPS sites. Add them to the IP list with dst-host; the router resolves the name to addresses.
Too much allowed. Every allowed site is free internet. Keep the list short.

Check and remove

/ip hotspot walled-garden print
/ip hotspot walled-garden ip print
/ip hotspot walled-garden remove [find dst-host=example.com]

Where RadiusNest fits

If you use RadiusNest's customer account page, the setup command adds the walled-garden entries it needs, so hotspot customers can open their account page from the login screen.

Start the free trial See pricing

Questions and answers

What is the difference between walled-garden and walled-garden ip?

The first matches web requests by host name and path. The second works at address level and suits HTTPS sites, other ports and non-web services.

Can I allow WhatsApp or another app before login?

Only roughly. Apps use many changing servers, so a walled garden for an app is never complete.

Does a walled garden bypass speed limits?

Traffic to walled-garden sites is not tied to a logged-in user, so user limits do not apply to it.

Related guides

Start the free trial See pricing