RadControl v4 — User guide

The installer prints the web address and a generated password for the first root operator on its final screen. Open http://<your-server>/ and sign in.

radcontrol — sign in

Change the generated password right away: avatar menu → Change password.
Enable two-factor auth under Account → Two-factor auth (TOTP, works with any authenticator app).
Optional hardening: System → Password policy sets length/rotation rules for every operator.

The header has a global search — find any subscriber by name, username, email or dealer from anywhere in the app.

2 · Add your router (NAS)

A NAS is any router that sends RADIUS to RadControl — typically a MikroTik running PPPoE or Hotspot. Go to Manage → NAS devices → New NAS and enter its IP, a shortname, and a shared secret. Save. That's it — no restart: RadControl recognizes new routers automatically, so the router is served on its first packet.

On the MikroTik side:

RouterOS terminal

> /radius add service=ppp address=<radcontrol-ip> secret=<shared-secret> timeout=800ms
> /radius incoming set accept=yes port=3799   # CoA — lets RadControl change speeds mid-session
> /ppp aaa set use-radius=yes accounting=yes interim-update=5m

The NAS list shows a seen by RADIUS badge once the first request arrives.
Set the CoA port (default 3799) so cap crossings and night windows apply mid-session, not just at the next login.
Open UDP 1812/1813 from the router to the server, and UDP 3799 in the other direction.

3 · Create a plan (account type)

Plans live in Manage → Account types. A plan is the template dealers resell: price, period, speeds, and policy. The speed section compiles everything into the Mikrotik-Rate-Limit your routers receive.

radcontrol — plan editor

Account type editor: speeds, tiers, burst and time windows

Basic speed — the baseline, as up/down (e.g. 5M/25M).
Usage tiers — thresholds in MB that step the speed down as the period's quota is consumed; the last tier is the penalty speed.
Burst — RouterOS burst triple (speed, threshold, time) for snappy page loads.
Time windows — drag directly on the day/night track:
- Night Booster — a different base speed inside the window.
- No Speed Reduction — suppresses penalty speeds only.
- Free Quota Time Span — traffic in the window doesn't count against quota.
Caps — daily / monthly volume caps, session limits, and the counter reset hour.

Changing a plan changes it for every subscriber on it, at their next authentication — and immediately for anyone online, via CoA.

4 · Add & renew subscribers

Manage → Users → New user: pick the offer (plan + price for the selling dealer), set username and password, optionally lock the MAC, save. The subscriber can connect immediately; billing starts per the plan's pay on activation setting.

Renew — on the user page, Renew charges the dealer's credit and extends the period.
Top-up — adds volume to the current period without moving the expiry date.
Override bandwidth — a per-user rate limit that wins over the plan (support tool; remove it when done).
Scheduled change — queue a different plan to apply at the period end.
Bulk import — CSV import under Users for migrations.

The user page's Network Activity tab is your first support stop: live status, the 30-day usage chart, cap meters and the session log answer “why am I slow?” before the subscriber finishes asking.

radcontrol — online users

Online users report with per-session NAS, IP and traffic

5 · Scratch-card batches

Scratch cards turn plans into something a shop can sell. Manage → Scratch cards → New batch: choose the offer, the quantity and the unit price, and RadControl generates the codes. Export the batch as CSV for the printer.

radcontrol — scratch cards

Scratch-card batches with activation progress

A card activates itself on the subscriber's first login — no operator needed.
The batch page tracks sold vs activated; the Cards report finds any single code.
Batch cost is charged to the creating dealer's credit at generation time.

6 · Dealers & credit

Manage → Dealers shows the whole resale tree: balances, user counts, online counts, and each dealer's offer catalogue with markup. Top-level dealers buy credit from you; branches get credit from their parent.

New dealer — creates a top-level dealer or a branch under one (subject to the parent's may create sub-dealers flag).
Offers — enable plans for the dealer and set the commission added on top of the parent's price. The resolved price is what the dealer's operators pay per renewal.
Credit — deposit, withdraw, or transfer parent→child from the dealer page. Every movement lands in the ledger with a running balance.
Move users — reassign subscribers between dealers in bulk when territories change.

Dealers sign in with their own account and see only their subtree — their users, their branches, their ledger. Viewers are read-only accounts for staff.

The analyzer needs NetFlow from your routers. Everything else — collection, scoring, nightly model refits — is automatic.

Enable it per NAS

Open the NAS page → NetFlow section → enable, and note the collector address and the sampling rate (default 1:100).
Point the MikroTik at the collector:

RouterOS terminal

> /ip traffic-flow set enabled=yes active-flow-timeout=1m
> /ip traffic-flow target add dst-address=<collector-ip> port=2055 version=9
# sampling 1:100 — keep it identical to the NAS page setting
> /ip traffic-flow set packet-sampling=yes sampling-interval=100 sampling-space=0

Export flows before NAT so subscriber IPs are visible to the collector.
The NAS list shows a NetFlow badge with a flows-per-minute sparkline once data arrives; a mismatch badge appears if the router's sampling disagrees with the configured rate.

Read the report

radcontrol — sharing analyzer

Doubt scores are not verdicts. They compare an account's traffic texture against its plan population. A large family can score high legitimately.
New installs show baseline building for about two weeks; scores start as honest heuristics and switch to the ML ensemble once enough history exists.
Click any account for the evidence page: score history, weekly activity heatmap, device-count signals, traffic mix. Review it before talking to the customer.
A sensible workflow: filter to ≥70%, check evidence, then upsell a family plan — flagged accounts are your best leads, not your enemies.

8 · Backups & recovery

Do this on day one. System → Backup & recovery: pick SFTP or an S3-compatible bucket, paste credentials, and generate the recovery passphrase. Write the passphrase down somewhere that isn't this server. Snapshots are encrypted on your box before upload — without the passphrase, backups are noise.

radcontrol — backup & recovery

Backup and recovery settings with run history

Business data ships every 15 minutes; the dashboard card says protected with the last snapshot age.
Disaster? Install RadControl on a fresh box (same one-liner), open Backup & recovery, choose Restore from backup…, enter storage + passphrase, type RESTORE. Subscribers, balances and settings return; routers reconnect on their own.

9 · Licensing

System → License shows the installed license: customer, expiry, subscriber limits, and validity. Licenses are signed files verified locally — no internet connection is ever required.

Paste the license blob you received and save; the page shows the decoded limits immediately.
Approaching a limit shows a warning well in advance. Passing it never cuts off existing subscribers — RadControl only pauses new activations until you upgrade.
Expired licenses get a 30-day grace period with a banner before enforcement starts.

10 · HTTPS & your domain

By default RadControl serves the web UI over plain HTTP on port 80 — fine for a box you only reach over a private/VPN network. To open it to staff over the internet, give it a domain name and RadControl will front the stack with Caddy, which gets and auto-renews a free Let's Encrypt certificate for you — no cron job, no manual renewals.

Before you start: point the domain's DNS A (and AAAA, if you use IPv6) record at this server's public IP, and make sure TCP 80 and 443 are open to the internet. Let's Encrypt proves you own the name over port 80, so it must be reachable.

Turn it on at install time — just add the domain to the one-liner:

server shell

# Free, auto-renewing Let's Encrypt certificate:
$ curl -fsSL https://radcontrol.org/install.sh | sudo \
      RC_DOMAIN=portal.myisp.net RC_TLS_EMAIL=ops@myisp.net bash

# ...or bring your own certificate instead:
$ curl -fsSL https://radcontrol.org/install.sh | sudo \
      RC_DOMAIN=portal.myisp.net \
      RC_TLS_CERT=/etc/ssl/portal.pem RC_TLS_KEY=/etc/ssl/portal.key bash

When it finishes, the web UI is at https://portal.myisp.net/. The very first visit can take a few seconds while the certificate is issued.

Change the domain, swap a certificate, or turn HTTPS off later — use the tls.sh helper on the server (no reinstall, no downtime for RADIUS):