Every capability, in detail
SecuryTik Active Mikrotik Manager
AAA core, plans & limits, accounting, admin portal, customer portal, Telegram self-service, multilingual UI — all in one installer.
FreeRADIUS at the core
PAP/CHAP-based authentication with PostgreSQL on the hot path — limit evaluation and CoA queueing happen inside the database on every Interim-Update.
Authentication & accounting
- FreeRADIUS 3 + PostgreSQL backbone
- PAP, CHAP and MS-CHAPv2 authentication
- PPPoE and Hotspot support
- IPoE / DHCP access — authenticate each DHCP lease by Option 82 circuit-id (the physical access port) or device MAC; the DHCP radius-password is simply the router's RADIUS secret, nothing extra to configure
- Dynamic NAS registration — no restart on add/remove
IPv6 & addressing
- IPv6 dual-stack — every subscriber can get IPv6 alongside IPv4: a WAN address plus a routed prefix (a /56 by default) delegated to their LAN by DHCPv6-PD. Opt-in from the router wizard (choose the prefix length and IPv6 blocks); works with PPPoE, Hotspot and IPoE, and supports a static prefix per subscriber
- Per-user static IPv4 or IPv6 override
Identity & device control
- Case-insensitive usernames by default — kkk37, KKK37 and Kkk37 are the same account, while passwords stay case-sensitive. Turn it off in Settings for strict matching
- MAC sticky — optionally lock a PPPoE subscriber to the first device they log in from and reject any other MAC. Off by default; admins can reset a subscriber's stored MAC at any time
Hybrid CoA
- Single coa_outbox queue, one drainer
- CoA-Update first; auto-fallback to Disconnect-Request on NACK
- Originated from samm-radius, not FreeRADIUS
- Retry counts & default port configurable in samm.settings
Session reliability
- Stale-session reaper — a lost Accounting-Stop can never leave a user "online" forever
- Simultaneous-session limit per plan — one device per subscriber by default, or any number you set. Sessions that stopped reporting are ignored, so a dropped connection never locks anyone out
- Friendly captive landing page for expired subscribers — ready-made redirect rules, no broken connection
- Per-subscriber NAS pinning enforced fail-closed at authentication
Scale & high availability
- Load-tested at 70,000 RADIUS users on a single server
- High-availability option — PostgreSQL streaming replication with a hot standby, a standby AAA node, and a documented promote/failover runbook (no single point of failure)
Four limit types, infinite combinations
Speed (Mbps) + Framed-Pool plus up to four independent limits — each with its own exhaustion behaviour.
And a Speed Boost that raises or lowers whole plans by a percentage — a holiday weekend at double speed, or an emergency throttle — measured from the plan rate, replacing any speed window until it lapses, and never lifting a subscriber who has exhausted a limit.
Expiration
- Days since activation or assignment
- On exhaust: throttle / next plan / disconnect
Quota
- Total bytes — configurable: both, download only, or upload only
- On exhaust: throttle / next plan / disconnect
Daily
- Bytes since the last daily reset
- Reset time configurable per-environment
- On exhaust: throttle / next plan / disconnect
Uptime
- Cumulative session seconds
- Independent of bytes consumed
- On exhaust: throttle / next plan / disconnect
Speed windows
- Scheduled speed boosts by day-of-week + clock range
- Midnight-crossing fully supported
- Throttled / exhausted users excluded — speed never lifts while a limit is in force
Two usage counters
- user_limit_state — resettable per-limit counters
- user_usage_totals / user_usage_daily — non-resettable billing counters, never zeroed
- Admin resets only touch limit state — billing stays accurate
Double-entry accounting, built in
Bill the way an ISP actually bills — no spreadsheet bridges, no separate tool.
Every charge is a choice you see before you commit: a full invoice on whole plan periods, a segmented one that pro-rates the exact time, or none at all — with the line items, tax and total computed live as you change them.
Invoices & expenses
- Renewal-driven invoicing tied to plan changes
- PDF rendering (server-side) for portal & Telegram bot
- Tax groups — apply several tax rates (VAT/GST and more) per plan or invoice, each posted to its own ledger account
- Dunning schedule — configurable bill day, due day and automatic block day, with optional late fees, so overdue accounts chase and cut themselves off automatically
- Prepaid wallet billing — subscribers keep a balance that auto-pays invoices on renewal; they top it up themselves by card or crypto
- Expense tracking and categorization
Resellers, assets, depreciation
- Reseller accounts with commission tracking
- Asset inventory with depreciation schedules
- Cash, bank & capital accounts, customer statements, P&L reports
- Export the books to QuickBooks, Xero or any spreadsheet — CSV and API for the general journal, chart of accounts, invoices, trial balance, P&L and balance sheet (always reconciled with the reports)
- Real chart of accounts, real double-entry — every transaction balances
Agents & resellers — wholesale billing
- Sell through agents on a prepaid wholesale model — an agent is a scoped admin login with its own prepaid balance, a per-agent commission split (e.g. 60% you / 40% the agent) and a credit limit
- On every renewal SAMM charges the agent's balance the wholesale price (net of commission) and posts it to your books as real revenue; the customer gets a real retail invoice payable to the agent that stays off your ledger — it is the agent's own receivable
- Agent-side dunning (its own switch, on by default, editable grace period) auto-suspends a non-paying customer with a CoA disconnect; record the customer's payment to the agent and they reactivate automatically
- Each agent sees only their own customers, wallet balance, statement and sales — your company books stay hidden; commission is a trade discount, never booked as an expense
- Works untouched if you don't use agents — it is a pure add-on to the existing billing
Online payments
- Subscribers pay invoices themselves from the portal — no manual reconciliation
- Prepaid wallet top-up — subscribers load a balance from the portal (card or crypto) that automatically settles future invoices
- Stripe & PayPal for bank cards, plus Binance / USDT crypto (works where cards can't)
- Each gateway uses your own account — funds go straight to you, nothing through us
- Auto-reconnect on payment; every payment posts a balanced ledger entry with its method
Mistakes cost money. So they are reversible — and reversals are reviewed.
A five-minute undo window on every action that moves money or state, and a superadmin gate on the ones that hand money back.
Undo & redo
- Five minutes to take back a renewal, a payment, a plan change or a deletion — from the topbar, or by jumping to any point in the action history
- Refuses rather than rewrites: an undo stops if the record was deleted, re-created, or edited by someone else in the meantime
- A reversal, not a delete — the original action and its undo both stay in the audit log
Agent approval gate
- An agent pays for a subscriber out of their own prepaid balance, so reversing is a way of getting money back — and a way to cheat
- Actions that COST the agent money stay immediate; actions that hand money back are parked for a superadmin
- Approving replays the request through the same code the agent would have run — never a second implementation that could drift
- Agents see their own queue and can withdraw a request; the right to decide can be delegated without handing over the superadmin account
Safe by default
- Bulk delete shows nothing until you have chosen a filter — no list to accidentally confirm
- Every router field states its shape before you submit, and refuses a name the device already has
- Charging nothing is a permission, not a checkbox — new roles cannot skip invoicing until you allow it
Run the whole network from one screen
Customers, plans, devices, vouchers, tickets, audit trail — all role-aware so each admin sees only what they need.
Customers & plans
- Create, edit, suspend, reactivate customers
- Plan management with multi-limit configuration
- Plan switch (queued via audit log; live CoA refresh)
- Per-customer credit, balance, and payment history
- Global search — find a subscriber by username, MAC, IP, phone or email, plus cards, routers, plans, invoices, settings and every page. Start typing anywhere, and every result respects the operator's own permissions
- Recent & pinned pages per operator, so the screens each person lives in are always one click away
- Create a numbered batch of subscribers in one pass — pick how many, where the numbering starts and how wide it pads; the preview shows the real first and last name, skipping any already taken
- Duplicate a plan or a whole card group: every setting copied exactly, cards regenerated with fresh codes
- Live duplicate checks — a username, plan, card group, admin login, agent or router address says Exists or Available as you type
MikroTik inventory
- Live ping monitoring of every router
- RouterOS version & identity sync
- Interface statistics & history, plus per-interface quota & schedule policies
- Full firewall editor with Auto-Security hardening — backup & scheduled revert as a safety net
- WiFi / cAPsMAN management
- DNS app & website filter driven by a curated, continuously updated catalog
- Pick exactly which apps each router watches, and in which direction — the router carries rules only for what you selected, not the whole catalog
- Monitor-only mode for non-NAS MikroTiks
Zero-touch provisioning
- NAS Router Wizard — generates and streams the full RADIUS + PPPoE / Hotspot / IPoE config, with an optional IPv6 dual-stack step (choose the delegated prefix length and blocks)
- Auto-Complete pre-fills the wizard from the live router state
- Import an existing RouterOS .rsc export to pre-seed the wizard from a router's current configuration
- Neighbor discovery (MNDP) finds MikroTiks on the wire; one-click bootstrap adopts a factory-fresh device
- RouterOS update management — check, download, install & reboot per router from the panel
Application-aware QoS
- Drag the apps and sites your subscribers use into eight download-priority slots
- Optional per-app speed caps and a total download ceiling
- Auto-distribute by category — messaging, conferencing, social, streaming, downloads and more
- Compiled into a MikroTik queue tree with packet-mark rules and pushed in one click
- Built on the same Websites & App filter that powers monitoring
Hotspot voucher cards
- Generate batches of pre-paid voucher cards
- Printable PDF sheets with your ISP logo
- Per-batch plan, expiry, pricing — and per-batch NAS pinning
- Visual hotspot login-page designer — pick a design, brand it, push it to the router, revert any time
- Card sales post straight into the accounting ledger
Self Service — guests sign themselves in
- A visitor taps Register on your hotspot page, types their name and mobile number, and SAMM sends them a passcode by SMS, WhatsApp or email — no staff, no printed vouchers
- You keep a named, exportable record of everyone who used the guest network, with the device MAC as the router reported it
- Validity counts from the moment the passcode is sent, so an unused code does not sit alive for a week
- One live passcode per number, a waiting period after it expires, and a daily cap — so radio range is not a blank cheque on your SMS credit
- Licensed separately from your plan, by passcodes a day, with its own renewal date — works on any plan including Free
Where Self Service is used
Built for restaurants, cafés and coffee shops, hotels and guest houses, expos and trade fairs, conferences and conference centres, shopping malls and retail stores, clinics, dental surgeries and hospital waiting rooms, gyms and fitness studios, co-working spaces and shared offices, barbershops and beauty salons, airports and airline lounges, bus and railway stations, stadiums and sports clubs, university and school campuses, libraries, car showrooms, petrol stations, wedding and event venues, holiday resorts, camping and caravan sites, ferries and tour buses, and municipal public Wi-Fi
Support tickets
- Customer support ticket queue with status tracking
- Assignment, comments, attachments, history
- Telegram bot integration — customers can open tickets from chat
Role-based permissions
- Custom roles with per-page View / Edit / None permissions
- By-NAS scoping — branch admins see only their routers' subscribers
- Per-subscriber admin assignment — hand an individual customer to an admin regardless of which router they sit behind
- Scoped admins get a dashboard, invoice list and customer balances covering only their own customers; the company books stay hidden
- Per-subscriber NAS pinning, enforced fail-closed at RADIUS auth
- Signed-cookie sessions with strict SameSite
Live sessions & reports
- Live session view — current online users by NAS
- Connection status on every subscriber — Online Since, Offline Since, or Never Connected, with Offline and Never Connected filters and an "Offline now" dashboard card
- Sortable MAC, IP, address and serial columns with a column chooser that remembers your layout
- Access Log — every session the routers reported via RADIUS accounting (PPPoE / Hotspot / IPoE), filterable by period, router or user, with a CSV export that honors the active filter
- Usage reports per customer, plan, or NAS
- Time-series traffic charts
Traffic trends and top consumers. Without a query.
Subscriber and session trend charts, daily traffic per NAS, and top-N bandwidth rankings — all pre-computed, no manual SQL.
Subscriber & session trends
- Configurable period: Today / 7d / 14d / 30d / 90d
- Active, online, and expired user curves over time
- Time-series snapshot stored hourly for history
Traffic & top consumers
- Daily up/down bytes chart per NAS
- Top-10 download / upload today and this month
- Per-plan and per-NAS usage breakdowns
Self-service that actually offloads work
Subscribers see their plan, usage, invoices, and tickets — without contacting support.
Account & usage
- Current plan, expiration, daily & total quota
- Real-time usage gauges
- Profile edit & password change (cleartext required for PAP)
Invoices & support
- View & download invoice PDFs
- Open support tickets, reply, attach files
- Ticket history with full audit trail
Self-service from chat
Customers /start the bot, verify once with their SAMM credentials, then do almost everything portal-side from inside Telegram.
Interactive self-service
- One-time verification with SAMM username + password
- Password message auto-deleted on receive
- Check plan, quota, usage, expiration
- Edit profile, change password
- View & download invoice PDFs in chat
- Manage support tickets — inline-keyboard menus
Architecture
- Sole getUpdates poller — no race conditions
- Conversation state in tg_bot_session (locked per chat)
- Reuses portal queries; never forks data access
- File sends happen after transaction commit, off the dispatcher lock
One queue, multiple channels
All outbound customer messaging flows through a single throttled notif_outbox, with per-customer channel priority.
Event types
- Renewal reminder, expiry notice
- Quota warning, plan-renewed receipt
- Payment receipt
- Manual admin broadcasts
Channels & routing
- Email, Telegram, SMS and WhatsApp channels — SMS via a generic HTTP gateway or Twilio; WhatsApp via the official Meta Cloud API (created in Meta for Developers) or an unofficial QR-linked bridge
- Per-customer channel priority with fallback
- Channel config with Fernet-encrypted secrets
- Throttled delivery — no surprise SMTP bills
A real REST API — included, not an add-on
Everything the admin portal does, your own systems can do too: a documented, token-authenticated API with signed webhooks, on every tier.
Tokens & scopes
- Bearer tokens minted in the panel — secret shown once, only a hash stored
- Per-resource read/write scopes, per-token rate limits
- Expiry presets (30–360 days or never) and one-click revocation
- Interactive Swagger UI on your own install — authorize with a token and run any endpoint live
- Fully typed request and response schemas; generate a client from the OpenAPI spec
Full surface
- Subscribers: create, renew, suspend, change plan, reset limits, usage
- Plans, invoices with PDF, live sessions and remote disconnect
- Hotspot cards: generate groups, add cards, extend, print voucher PDFs
- Mutations ride the same audited command queue as the admin portal
Webhooks
- Push events to your systems: customer created/renewed/expired, limit exhausted, invoice created/paid
- Every delivery signed (HMAC) so receivers can verify authenticity
- Automatic retries with backoff; failing endpoints auto-disable
- One-click test event from the panel
Multilingual & themeable
Babel-based i18n with a live in-portal editor, plus sixteen shipping themes — every user picks their own.
Languages
- English, Arabic (RTL), Russian, Persian (RTL), Turkish, French, Spanish, German
- Per-user language preference saved to account
- Add new languages at runtime via the admin UI
- Live /admin/translations editor — no restart
- Export / import .xlsx workbooks for translators
Themes
- 16 shipping themes — light and dark variants
- One data-theme axis, 26 CSS custom properties per palette
- CSS logical properties — RTL works automatically
- Preference saved per user account
Run SAMM anywhere — bare OS, Docker, MikroTik, or the cloud
One product, five install paths. Pick the surface that fits your network — they all run the same SAMM, talk to the same license server, and ship from the same release.
Bare OS — one command, one server
- Ubuntu 22.04 / 24.04 / 26.04 or Debian 12 / 13, single idempotent shell script
- Auto-generated DB password & signing keys on first run
- Re-runs apply upgrades safely — no state lost, no reconfiguration
- Built-in WireGuard server & optional Cloudflare Zero Trust tunnel
Server ISO — boot the installer, answer one screen
- A bootable appliance image: write it to a USB stick, boot the server, and SAMM installs itself unattended
- One-screen network wizard — static IP or DHCP — then it fetches and installs the latest SAMM release automatically
- Branded console, welcome banner and a samm-tools launcher for day-to-day server tasks
- Download from dl.securytik.com — no operating system to install first
Docker — Ubuntu, Windows, anywhere
- Multi-arch image (linux/amd64 + linux/arm64) — one tag, every CPU
- One-line installer on Ubuntu/Debian, or Docker Desktop on Windows / macOS
- Compose bundle pinned to a sha256 image digest per release — immutable upgrades
- Cron auto-update built in — daily pull, zero downtime when there's nothing new
MikroTik containers — directly on the router
- Paste the same docker-compose.yml into RouterOS Container → Apps → New → YAML — done
- One multi-arch file for every platform: RouterOS 7.23+ pulls the right CPU build from the image tags automatically (arm64 on router hardware, amd64 on x86/CHR) — no per-arch file, nothing to choose
- No external Linux box, no separate hosting — SAMM runs where your network does
- Experimental deployment path — bare-OS or Docker remain the recommended production routes
Cloud — Hetzner, DigitalOcean, AWS, anywhere with a public IP
- Same one-command installer; works on any Ubuntu/Debian VM in any cloud provider
- Cloudflare Tunnel publishes the admin/customer portal without opening firewall ports
- Built-in WireGuard reaches MikroTik routers behind NAT — no public IP needed on the router
- Daily backups encrypt to a single passphrase-protected archive — restore anywhere
Five systemd services
- samm-api — admin + customer portals (FastAPI)
- samm-radius — CoA dispatcher, expiration sweeps
- samm-worker — MikroTik API sync + ping
- samm-notification — channel delivery worker
- samm-telegram — interactive bot
Reach every router — even from the cloud
Host SAMM anywhere. A built-in WireGuard server and a managed Cloudflare Tunnel close the gap between a cloud server and MikroTik routers sitting behind NAT — no public IP, no port forwarding.
WireGuard server
- SAMM creates a WireGuard server in one click — keypair, interface, and listen port generated for you
- Cloud-hosted SAMM reaches MikroTik routers behind CGNAT over an encrypted tunnel
- Each router gets a ready-to-paste peer config — tunnel up without a public IP or port forwarding
- RouterOS API, RADIUS, and CoA traffic all ride the same private link
- Peer list with last-handshake status in the admin panel
Cloudflare Tunnel
- Paste your Cloudflare tunnel token — SAMM installs and runs cloudflared as a managed service
- Bring your own domain; the admin and customer portals go live over HTTPS
- The tunnel dials out — no inbound firewall rules, no exposed public IP
- Start, stop, and check tunnel health from the System tab
- Pairs with WireGuard — control SAMM from anywhere while SAMM reaches the routers
Bulk operations and data control.
History cleaning, bulk plan changes, import/export, and database backups — all from the admin panel, no command line.
Bulk operations
- Bulk plan change — reassign N subscribers in one action
- Bulk delete — remove inactive subscribers with confirmation
- History cleaner — prune old session/audit rows by age
Data portability
- Export / import subscribers and plans via structured file
- Migrate from SAS4 / Radius Manager, Super Speed Radius or Pro Radius — read the old system's MySQL backup (gzipped or plain), or for Pro Radius its exported subscriber list, map plans and users to their SAMM equivalents, and preview the result before anything is written
- Database backup and restore from the admin panel
Pairs with the full SecuryTik stack
SAMM is the operational platform SecuryTik uses on its own ISP rollouts. Use it standalone, or have us deliver the whole environment around it.
Network & ISP services
- Full ISP buildout — wireless + FTTH/GPON fiber
- MikroTik installation, configuration, ISP core routing
- Captive Portal + RADIUS authentication design
- NOC setup and ongoing 24/7 operation
- SecuryTik network services →
Server infrastructure
- Bare-metal or virtualized SAMM deployments
- HA & DR design with VMware / Proxmox
- Backup & retention policies
- SecuryTik server services →
Security hardening
- SAMM running behind defended infrastructure
- SIEM (Wazuh / ELK) integration for AAA event ingestion
- Periodic security audits & pen-testing
- SecuryTik cybersecurity →
Managed operations
- 24/7 NOC monitoring of your SAMM deployment
- Managed patching, backups, capacity planning
- SLA reporting
- SecuryTik managed IT →