ISP management for MikroTik,
done right.
SecuryTik Active Mikrotik Manager
SAMM (SecuryTik Active Mikrotik Manager) is a full-stack platform for PPPoE & Hotspot networks — FreeRADIUS + PostgreSQL backbone, polished admin and customer portals, double-entry accounting, and a Telegram self-service bot.
Runs everywhere — bare Linux, Docker, MikroTik containers, or the cloud.
- One installer FreeRADIUS, PostgreSQL & portals
- Six built-in languages English, Arabic RTL, Turkish & more
- Four limit types Expiration, quota, daily & uptime
- Free to start Up to 3 routers, all features, forever
Database-native accounting. No round-trips on the AAA path.
Byte accumulation, limit evaluation, and CoA enqueue happen inside
PostgreSQL functions called by unlang + rlm_sql on every
Interim-Update. No Python round-trip on the AAA hot path.
Six capability areas. One installer.
Every layer below ships in the same install script — no DIY integrations, no bolt-on plugins.
AAA core
FreeRADIUS 3 + PostgreSQL with PAP/CHAP, dynamic NAS clients (no restart), and hybrid CoA — CoA-Update with automatic fallback to Disconnect-Request.
Plans & limits
Speed (Mbps) + Framed-Pool. Four independent limits — expiration, quota, daily, uptime — each configurable to throttle, switch plan, or disconnect on exhaust.
Accounting
Built-in double-entry engine, invoices, expenses, resellers, assets, depreciation. Automatic overdue-invoice detection. Bill the way an ISP actually bills.
Admin portal
Customers, plans, live MikroTik inventory, firewall backups, WiFi/cAPsMAN, Hotspot voucher cards, role-based per-page permissions, ticket queue.
Customer self-service
Customer portal for usage / plan / invoices / tickets. Telegram bot — customers verify once, then everything from chat: plan, quota, change password, download invoice PDFs.
Multilingual & themeable
English, Arabic (RTL), Turkish, French, Spanish, German out of the box. Live in-portal translation editor — no restart needed. 11 visual themes per user.
Your whole network visible from one screen.
Every layer of your ISP operation — live sessions, CoA routing, router health, staff access, and the full audit trail — in a single panel. No SSH, no Winbox, no spreadsheets.
247 subscribers online. See them all.
A live RADIUS session table — user, plan, effective speed, bytes down/up, and time online — auto-refreshed every 30 s. Filter by router, search by username or IP, or filter to throttled-only to spot quota exhaustion fast.
- User, framed IP, router, plan, effective speed, down/up bytes
- Throttled badge — spot exhausted plans at a glance
- CoA-Disconnect per row — kick a session without touching the router
- Auto-refresh every 30 s — no manual reload
Plan changes reach the router. No reconnect.
When a subscriber's limit changes — quota exhausted, plan upgraded, manual disconnect — SAMM enqueues a CoA-Update or Disconnect-Request and delivers it to the router live. Subscribers experience the change instantly, mid-session.
- CoA-Update — speed or plan attribute change without disconnect
- Automatic fallback to Disconnect-Request if CoA-Update is NACK'd
- Retry up to 3× with configurable CoA port per NAS
- Full outbox visible — pending, sent, NACK, done, failed
Every router. Health-checked every 30 s.
SAMM polls each registered MikroTik via the RouterOS API and surfaces version, CPU, memory, uptime, ping latency, and active user count per device — so your NOC sees a router going down before the support calls start.
- RouterOS version, board identity, uptime, active users
- CPU % and memory % — catch overloaded core routers early
- Ping latency — reachable / unreachable indicator
- Firewall backup + scheduled revert, WiFi & cAPsMAN management
Staff access, scoped to the page.
Create admin roles with per-page View / Edit / None permissions. A billing clerk sees invoices but never touches router config. A NOC operator sees sessions but never exports financial reports.
- View / Edit / None per section — granular per page
- Scope option: see all customers or only own-created
- Unlimited admin accounts — one per staff member
- Last login tracked per admin — spot dormant accounts
Every admin action. Timestamped.
Every change made by any admin — plan edit, password reset, manual disconnect, setting change — is recorded with actor, target, full JSON payload, and applied timestamp. Searchable, filterable, exportable.
- Actor, action, target, created, applied — all recorded
- Full JSON payload modal — see exactly what changed
- Filter by actor, action type, or applied state
- Retention managed by built-in history cleaner
Customers self-serve from chat.
You get fewer support calls.
A full web portal for usage, invoices, and tickets — and a Telegram bot that goes further. Customers verify once, then run everything from a chat message, in their own language.
- Live plan, quota, and expiry — always current
- Download invoice PDFs without logging in to the portal
- Change password and open support tickets from chat
- Responds in English, Arabic, Turkish, French, Spanish, German
Quota 42 GB / 100 GB · 12 days left
↓ invoice-may-2025.pdf
Full ISP books. No separate tool needed.
Double-entry accounting built into SAMM — not bolted on. Invoices, expenses, resellers, assets, and cash accounts all live in the same database as your subscribers.
- Cash & bank accounts, capital accounts, P&L
- Invoices with auto-overdue detection and server-side PDF export
- Resellers — buy card groups on invoice, track what they owe
- Fixed assets with straight-line depreciation schedules
- Expense categories: Bandwidth, Salaries, Rent, Equipment…
Live per-interface traffic. No Winbox needed.
SAMM polls every MikroTik interface via the RouterOS API and shows TX/RX rates, link state, and error counters refreshed every 30 seconds — across every router on your network.
- TX/RX Mbps auto-refreshed every 30 s per interface
- Link state: up / down / disabled with live indicator
- Error and drop counters per physical port
- Filter by router, interface type, or running state
- History graphed per interface — spot saturation trends
See exactly what your network is carrying.
Layer-7 traffic classification breaks your bandwidth down by app — streaming, social media, messaging, gaming — so you know where your upstream goes before you buy more.
- Top social & streaming platforms ranked by bandwidth
- Active session counts and peak-hour heatmap per service
- Daily and monthly totals — today, 7 d, 30 d views
- Drill down to per-subscriber app usage
- Export as PDF or CSV for capacity planning
Automate your network. Set it once, let it run.
Build time-based rules that fire directly on your MikroTik interfaces — off-peak bandwidth boosts, scheduled maintenance windows, or policy enforcement during business hours. No scripting required.
- Day-of-week + time-range rules with midnight-crossing support
- Actions: enable / disable interface, set speed limit, queue apply
- Rules pushed directly to MikroTik via API — no config file editing
- Per-router scope — target one device or apply fleet-wide
- Run log — every trigger timestamped in the audit trail
Push RADIUS to any MikroTik in four clicks.
The in-panel wizard connects to your router via API, pushes the RADIUS client config, creates the PPPoE service and IP pools, and runs the auth test — no terminal, no Winbox.
- Register router with IP, API port, and credentials
- One-click RADIUS push — auth/acct/CoA config applied via API
- PPPoE server + IP pool created automatically in RouterOS
- Discover neighbor routers and add your whole fleet at once
- Auth test runs from the admin panel — no radtest command needed
Built by people who deploy ISPs for a living
SAMM is the operational platform SecuryTik uses on its own ISP deployments — from MikroTik core routing to FTTH/GPON fiber rollouts and NOC operations. You get the same tool, with the team behind it for support.
Frequently asked questions
What people ask before deploying SAMM.
What is SAMM?
SAMM (SecuryTik Active Mikrotik Manager) is a full-stack ISP management platform for MikroTik networks. It bundles FreeRADIUS + PostgreSQL, an admin portal, a customer portal, double-entry accounting, and a Telegram self-service bot into a single installer.
Who is SAMM for?
ISPs and network operators running MikroTik routers — anyone authenticating PPPoE or Hotspot subscribers, managing plans and limits, and billing customers. SAMM is used worldwide and ships with a multilingual UI (English, Arabic with RTL, Turkish, French, Spanish, German) and 11 visual themes, so teams in any region can operate it in their own language.
Does SAMM work with my MikroTik router?
Yes. SAMM uses standard RADIUS, so any MikroTik device running RouterOS that supports a RADIUS client works — from a small hAP through to a CCR. No special board or RouterOS feature flag is required. SAMM additionally uses the MikroTik API for inventory, firewall backups, and Hotspot voucher cards.
What does SAMM need to run?
A Linux server with root access — Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, or Debian 12. One install script sets up FreeRADIUS, PostgreSQL, the FastAPI portals, the notification and Telegram workers, and (optionally) a Cloudflare Zero Trust tunnel.
Is SAMM free?
Yes — fully featured, free for up to 3 routers, forever. The Pro tier removes the device cap and adds priority support; contact [email protected] to upgrade.