Customers on the isolation list lose internet and every HTTP page goes to the billing notice; the payment portal still opens.

A customer is isolated by putting their IP in an address list (automatically through a PPPoE/Hotspot profile, or by hand for static IPs). Their DNS goes to the router, HTTP port 80 goes to the web proxy which redirects to the notice page, the portal and payment gateway are allowed, and everything else is blocked. The EXPIRED list and profile match the Change Profile action of MyWifi Next.

• HTTPS pages (most sites today) cannot be redirected without a certificate error, so they are refused. Customers usually see the notice through the phone's "Sign in to network" prompt or when opening an http:// site.
• A PPPoE customer is isolated when logging in with the isolation profile: after changing the secret's profile, drop the session (/ppp active remove) so it logs in again. To lift it: set the plan profile back and drop it again.
• If the portal is behind Cloudflare/a CDN, its IP is shared with other sites. Still safe (only the portal is redirected), but other sites on the same CDN open too.
• allow-remote-requests=yes lets anyone outside query the router's DNS unless port 53 from the WAN is closed. Close it with the Router Hardening generator.
• Connections opened before the isolation can keep going for a while; dropping the PPPoE/Hotspot session clears them.

How to use: Copy the script, open Winbox → New Terminal, paste. Or Download .rsc, upload it in Files, then run /import file-name=isolir-pelanggan.rsc.

RouterOS v6 / v7 · added 11 November 2026