Connecting a router

Before you start

You need:

A MikroTik router running RouterOS 7.10 or later. Check under System → Resources in WinBox, and upgrade for free under System → Packages → Check for updates. Oculus secures logins between your router and its servers with TLS (RadSec), which needs RouterOS 7.
A working hotspot on the router. If you don't have one yet, run IP → Hotspot → Hotspot Setup in WinBox (or /ip hotspot setup in the terminal) and follow the wizard. Oculus takes over an existing hotspot; it doesn't create one.
Internet on the router, with these outbound connections allowed:

To	Port	Used for
Oculus	TCP 443 (HTTPS)	Fetching configuration and your login page
Oculus RADIUS	TCP 2083 (RADIUS over TLS)	Checking logins and recording usage
Time servers	UDP 123	Keeping the clock right, so vouchers expire on time

Nothing needs to connect in to your router. A public IP address, port forwarding and a VPN are not required.

Generate the script

Go to Sites and click Add router next to the site — or Devices → Add router.
Give the router a name you'll recognise, such as lodge-hex-01.
Pick the router's RouterOS version.
Enter the hotspot server to connect. Find its name under IP → Hotspot → Servers; the setup wizard calls it hotspot1. Only this hotspot is switched to Oculus — any other hotspot on the router keeps working as before.
Choose how Oculus manages the router (see below), then Generate script.

The script contains your router's passwords and is shown once. Copy it before you close the window. If you lose it, generate a new one — the old one stops working.

Put the script on the router

You get two ways to deliver it. Both do exactly the same thing.

Paste into the terminal. Open WinBox → New Terminal and paste the whole script. The script is a single block, so RouterOS waits for all of it before it starts.

Fetch with /import. Run the one-line command instead. The router downloads the script itself, runs it, and deletes the file afterwards. This is easier over a slow connection or from a phone. The command works once, within 15 minutes.

Either way, the router checks itself first. If the RouterOS version is too old or the hotspot name is wrong, it stops with a message and changes nothing.

When it finishes you'll see:

version check passed: 7.19.5 (stable)
hotspot server found: hotspot1
radsec certificate installed
radius (radsec) + walled garden configured
ntp configured
management: polling every 60s (outbound only)

Oculus onboarding complete.

The router shows as Online on the Devices page within a minute.

What the script changes

Area	Change
Certificates	Installs this router's own security certificate, so its logins reach Oculus encrypted
RADIUS	Adds Oculus as the login server for your hotspot, over TLS
Your hotspot server	Switches its profile to check logins with Oculus
Walled garden	Lets customers reach your login page and your payment gateway's checkout before they're online
Clock	Turns on NTP time sync
Scheduler	Adds a task that checks in with Oculus
Login pages	Adds a `oculus-hotspot` folder with small pages that forward customers to your Oculus login page, and points your hotspot at it

It does not touch your bridges, IP pools, DHCP, firewall rules, or any other hotspot. Your router's own hotspot folder — its original login page and anything you customised — is left exactly as it was. Everything Oculus adds is labelled oculus, and running the script again replaces the earlier version rather than adding a second copy.

How Oculus manages the router

Polling (the default)

The router checks in with Oculus on a schedule — every 60 seconds by default — to pick up changes and report its status. Because the router always makes the connection, it works behind any network, including mobile data and Starlink.

The only cost is a short delay: a change you make, or a voucher you revoke, reaches the router at its next check-in. You can set the interval from 30 seconds to 15 minutes; longer is gentler on a metered or satellite link.

Real-time management

Oculus can instead keep a secure WireGuard connection to the router. Changes apply immediately, and revoking a voucher disconnects the customer at once. It's most useful for sites with a fixed public IP. This option appears only when it's enabled for your account.

After connecting

The Devices page shows each router's status:

Status	Meaning
Pending	Script generated, router not heard from yet
Online	Checking in normally
Offline	Hasn't checked in for 15 minutes — see Troubleshooting
Unsupported	RouterOS is older than 7.10 — upgrade the router

Changes made on the router. If someone edits an Oculus setting directly in WinBox, the Devices page flags it. Oculus never reverses it on its own. Choose Acknowledge to keep the change, or Re-adopt to put Oculus's settings back.

Removing Oculus from a router

Use the router clean-up script: Devices → Router clean-up. It's also offered when you remove a router, and on Account once your organisation is scheduled for deletion.

Run the one line it shows in the router's terminal (WinBox → New Terminal). The router downloads the script, runs it and deletes the file. For a router without internet, paste the whole script instead.

The script:

stops the router checking in with Oculus, first, so nothing is put back halfway through;
switches your hotspot back to its own login page and local users;
removes Oculus's RADIUS servers, security certificates, walled-garden entries, user profiles, login-page files and time servers;
ends logins that came through Oculus;
removes the WireGuard tunnel and API user, on routers that had real-time management.

It doesn't touch your bridges, IP pools, DHCP, firewall rules or local hotspot users, and it's safe to run more than once. The same script works on every router. If you used RADIUS from another provider before Oculus, switch it back on under IP → Hotspot → Server Profiles afterwards.

On this page