SMALLGIANT ORBIT User Guide
How to run your hotspot and PPPoE business from the billing panel.
1. Getting started
- Open your panel address and sign in with your admin username and password.
- Change the default admin password first: Settings → Administrator Users.
- Set your company name, logo, currency (KES) and contact details under Settings → General Settings.
Menu map
| Menu | What it is for |
|---|---|
| Dashboard | Users online, data usage, income, expiring users |
| Customers | PPPoE Customers, Hotspot Customers, Add Customer, Active Clients, Client Usage |
| Packages | Hotspot and PPPoE packages and vouchers |
| Revenue / Payments | Income, Payment Transactions, M-Pesa Transactions, Payment Gateway |
| Reports | Daily reports, Period reports, Expenditure |
| Devices | Hotspot and PPPoE clients online, All Clients |
| SMS / Notifications | Single and bulk SMS, User Notification, SMS and WhatsApp gateways |
| Settings | General Settings, Administrator Users, Routers, IP Pool, Hotspot Login Sync, Hotspot Settings, MikroTik Config and Monitor, Add Router (Wizard), Staff WiFi, Payment Page Settings, Logs |
2. Add a router
Go to Settings → Add Router (Wizard). The wizard has four steps: Add, Connect, Base setup, Services.
Step 1: Add. Give the router a name and choose how the panel reaches it:
- Public IP: the router has its own public address. Enter it with the API port (8728).
- Tunnel (WireGuard): the router is behind NAT or a mobile/CGNAT line. The wizard gives you a short script to paste into Winbox New Terminal. Once pasted, the router appears with a
10.99.0.xaddress and the panel reaches it through the tunnel.
Step 2: Connect. The wizard tests the API login and reads the router's ports. If "Reading ports" never finishes, the panel cannot reach the router: check the tunnel (/interface wireguard peers print, then ping 10.99.0.1 from the router), the API service (/ip service print, port 8728 enabled) and that the router has internet.
Step 3: Base setup (new or factory-reset routers). Pick the WAN port and the LAN ports, then press Preview to see every command before anything is applied. Apply then:
- backs up the router and arms a 10-minute automatic rollback;
- sets LAN, DHCP and DNS, then WAN, then NAT and firewall last;
- checks the router still answers on a fresh connection;
- cancels the rollback only when the check passes.
If you lose access during the 10 minutes the router puts itself back as it was. Press Keep once you are happy.
Step 4: Services. Choose Hotspot, PPPoE, or both (see the next section).
3. Hotspot and PPPoE
Same bridge. Hotspot and PPPoE share one bridge and one LAN. This is the simplest setup and works well on small sites.
VLANs. Use the VLAN option in Add Router (Wizard) when you want hotspot and PPPoE on separate VLANs. Give each role (Hotspot, PPPoE) its ports, then apply. The panel creates the VLAN interfaces, address pools, DHCP, hotspot server and PPPoE server.
Login page is installed for you. After hotspot setup the router downloads the branded login page automatically. You no longer need to open Winbox to copy files. If the router shows the plain MikroTik login page instead, open Settings → Hotspot Login Sync and run Fix for that router, or for all routers at once.
Why DNS matters. The hotspot DHCP network must hand out the router as DNS server, and the login page host name must not end in .local (Android phones fail to resolve it). The wizard sets both correctly.
4. Packages, customers and payments
- Packages: Packages → Hotspot / PPPoE → Add. Set name, price, validity, bandwidth plan and the router(s) it applies to. Hotspot packages appear on the login page automatically.
- Vouchers: Packages → Voucher. Print or share the codes; customers redeem them on the login page.
- M-Pesa: Payments → Payment Gateway. Enter your own shortcode details so payments go straight to you. Test with a small package before going live.
- Customers: Customers → Hotspot Customers / PPPoE Customers. Search by phone or username, extend or recharge a plan, and see payment history.
- Buy for TV / Account: the login page lets a customer reconnect with an account or buy for another device.
- Reports: Reports → Daily reports / Period reports to see income by day, router and package.
5. Staff WiFi (admins online without paying)
Staff WiFi gives your team free, controlled internet with no package. It works on all your routers, uses its own staff hotspot profile with 1 shared user (one device per login), and records exactly who logged in and when.
- Open Staff WiFi under Settings.
- Add a staff member: name, username, password. Save. The account is pushed to every enabled router.
- Staff open the hotspot login page and use the Staff Login row.
- Disable an account to cut access at once (and kick the active session); Enable it to restore. Delete removes it from all routers.
- The Online tab shows who is connected now; History shows past logins.
6. Troubleshooting
| Problem | Likely cause | Fix |
|---|---|---|
Phone shows ERR_NAME_NOT_RESOLVED on the login page |
Hotspot DHCP network has no DNS, or login host ends in .local |
Run Hotspot Login Sync; check /ip dhcp-server network print shows the router as dns-server |
| Plain MikroTik login page appears | Branded login.html missing on the router |
Hotspot Login Sync → Fix |
| Blank page after "Buy a package" | Panel page not reachable from the hotspot (walled garden) | Run Login Sync; confirm walled-garden hosts for your panel domain |
| Wizard stuck on "Reading ports" | Panel cannot reach the router API | Check the tunnel, API service (8728) and router internet |
| Router shows offline | Power, uplink, or tunnel down | Ping 10.99.0.1 from the router; check WireGuard peer |
| Customer paid but not connected | M-Pesa callback not received | Check Payments → M-Pesa Transactions; recharge manually and note the M-Pesa code |
| Staff cannot log in | Account disabled or already in use (1 shared user) | Enable the account; kick the old session |
| Lost access after Base setup | Wrong WAN/LAN port chosen | Wait for the 10-minute rollback, then re-run with the right ports |
7. Backups and security
- Take a router backup before any big change:
/system backup save name=before-change, then download it with Winbox. - Back up the panel database and files nightly, and keep a copy off the server.
- Use strong, unique admin passwords. Give staff the Staff WiFi login, not the admin login.
- Keep the API service limited to the panel's address (
/ip service set api address=<panel IP or 10.99.0.1>). - If M-Pesa keys are ever shared or exposed, rotate them in the Safaricom portal and update the panel.
- Keep PHP, the OS and MikroTik RouterOS updated.
Need help? WhatsApp +254 745 285 549 or email network@smallgiantorbit.co.ke.