​

Start with the smallest failing path

Record the ISP, router, service type, subscriber/device, start time/timezone, and exact symptom. Determine whether the incident affects one device, one subscriber, one NAS, one service type, or the whole network before changing configuration.

​

Router is offline

1. Check last reachability and WireGuard state.
2. Verify power, ISP uplink, DNS, time, and local RouterOS access.
3. Run diagnostics if the management path responds.
4. Use targeted WireGuard reconnect/port rotation where evidence points to transport.
5. Avoid reboot/reprovision until configuration and impact are understood.

​

Provisioning does not detect the NAS

Inspect terminal output, outbound HTTPS/DNS, RouterOS permissions/version, duplicate identity, and wizard status. If a NAS record exists, continue from it instead of creating another.

​

Subscriber credentials rejected

Check subscriber type, exact username/password, active/paused/blocked state, expiry, compatible package, router service, and RADIUS reachability. Disconnect a stale session only after identifying it.

​

Subscriber paid but remains offline

Verify final payment status and subscriber association, then package/expiry/account state, device limit, active sessions, NAS health, and access credentials/binding. Do not create a duplicate payment or user while investigating.

​

No packages on captive portal

Check Hotspot type, active/on-offer/public visibility, price/duration, NAS restriction, and the NAS identifier reaching the portal. Then redownload/sync portal state if the router has stale assets.

​

Payment prompt cannot open provider

Confirm router DNS/internet and walled-garden destinations for the selected gateway. Sync the walled garden and test from the captive device. Do not broadly allow the internet as a workaround.

​

Voucher rejected

Confirm code spelling, ISP, unused/expiry state, package, router context, and terms. Search the voucher record to see whether it redeemed elsewhere.

​

Binding device has no access

Verify router, normalized MAC, reserved IP/subnet, conflict, package, expiry, and bypass rules. Compare the current device MAC—phones can use randomized MAC addresses per network.

​

Escalate with evidence

Provide sanitized diagnostic text, relevant IDs, router/service state, one affected subscriber example, timestamps, scope, and actions already tried. Never provide router passwords, API secrets, payment credentials, OTPs, recovery codes, or full provisioning commands.