How to run Mikhmon online on AwanCerah and connect it to MikroTik

Mikhmon (MikroTik Hotspot Monitor) is a web app for creating vouchers and managing MikroTik hotspot users from your browser. Hosted online, Mikhmon can be opened from anywhere, without being on the same network as the router.

On AwanCerah, Mikhmon v3 can be installed in three ways. We tested all three, and the default mikhmon/1234 login is replaced during installation.

Choose how to install

All three can be billed by the hour, so you can try first and delete at any time. The container price includes a 1 GB volume for Mikhmon data.

Option 1: Web Hosting

1. Create Web Hosting in the console. The smallest plan is enough for Mikhmon.
2. Open the hosting account, go to the Apps tab, and choose Mikhmon in the Install an app card.
3. Pick a Domain. Until your domain's DNS points to the hosting, use the temporary address such as name.hs1.awanbaru.my.id, which already has HTTPS.
4. Keep Folder set to mikhmon, or leave it empty to install at the domain root (the folder must be empty).
5. Check the Admin username and Admin password. A random password is filled in, and Create makes a new one.
6. Click Install Mikhmon and save the password shown. It is not shown again.

Mikhmon is ready right away, for example at https://name.hs1.awanbaru.my.id/mikhmon/admin.php?id=login.

Option 2: Container

1. Open Create container in the console, pick a location, and choose the Mikhmon template.
2. Under Name & address, enter a name such as hotspot-office. It becomes the web address and cannot be changed.
3. Keep Volume checked so Mikhmon data (routers, vouchers, and settings) is kept.
4. Finish creating the container. About a minute later Mikhmon is ready at https://hotspot-office.pwt1.awanbaru.my.id/admin.php?id=login.

The username and password are shown in the Access card on the container page.

Option 3: VPS

1. Open Create server in the console. At the operating system step, switch to the Apps tab and choose Mikhmon.
2. Pick a plan. Mikhmon needs at least 1 vCPU and 1 GB RAM, so the cheapest plan is enough.
3. Fill in Domain (optional) for HTTPS, then point the domain's A record to the server IP. Without a domain, Mikhmon is served over plain HTTP on the server IP.
4. Create the server. About 3 minutes later, the Mikhmon card on the server page shows the Address, Username, and Password.

For real use, add a domain so the Mikhmon login is encrypted with HTTPS.

Prepare the MikroTik router

Mikhmon connects to the router through the RouterOS API on port 8728. Create a dedicated user for Mikhmon instead of using your main admin user. Open Terminal in Winbox and run:

/ip service enable api
/user add name=mikhmon group=full password=ReplaceWithALongPassword

The next step depends on whether your router has a public IP.

Router with a public IP

In Mikhmon, enter the router's public IP as IP MikroTik. Allow the Mikhmon user to sign in only from the Mikhmon server. If the router firewall drops connections from outside the LAN, also add an accept rule for the API from that server:

/user set mikhmon address=MIKHMON-SERVER-IP/32
/ip firewall filter add chain=input protocol=tcp dst-port=8728 src-address=MIKHMON-SERVER-IP action=accept place-before=0 comment="Mikhmon"

The Mikhmon server IP is your VPS IP, or the hosting server IP shown in the Mikhmon install card on the Apps tab. A container's outgoing address can change, so use the Tunnel method below for containers.

Router without a public IP

A router behind NAT, for example at home or on a regular ISP connection, can be reached through AwanCerah Tunnel. Tunnels are free at 10 Mbps. A free tunnel that stays disconnected for 7 days in a row is deleted automatically.

1. In the console, open Tunnel and click Create tunnel. Choose WireGuard for RouterOS v7, or L2TP/IPsec, SSTP, or OpenVPN for RouterOS v6.
2. Open the tunnel, copy the script under How to connect, and paste it into the Winbox Terminal. The router connects and gets a Tunnel IP such as 10.250.1.1.
3. Open the Port forwarding tab, click Add port forward, choose TCP, enter 8728 as the Target port on device, and click Add.
4. The console shows the Public address, for example edge.awancerah.cloud:24817. The public port is random and can be replaced with Change port.

In Mikhmon, enter that public address including the port as IP MikroTik: edge.awancerah.cloud:24817.

All connections through port forwarding reach the router from 10.250.0.2. Limit the Mikhmon user to that address, and allow the API from it if your router firewall drops connections from outside the LAN:

/user set mikhmon address=10.250.0.2/32
/ip firewall filter add chain=input protocol=tcp dst-port=8728 src-address=10.250.0.2 action=accept place-before=0 comment="Mikhmon via AwanCerah Tunnel"

Add the router in Mikhmon

1. Sign in to Mikhmon with the username and password from the console.
2. Click Add Router.
3. Under Session Settings, fill in Session Name (anything, for example office), IP MikroTik, and the Username and Password of the Mikhmon user on the router.
4. Fill in Hotspot Name, DNS Name (the same as DNS Name in IP > Hotspot > Server Profiles), and set Currency to Rp.
5. Click Save, then Connect. Use Ping to check whether the router can be reached.

When it works, the Mikhmon dashboard shows your router data and you can start creating vouchers.

If Mikhmon cannot connect

• Make sure the api service is enabled in IP > Services on port 8728.
• For routers behind Tunnel, check the tunnel status in the console. The router must be connected, and Mikhmon must use the public port from the Port forwarding tab, not 8728.
• Check the router's input firewall rules. The accept rule for port 8728 must sit above any drop rule.
• Check the Mikhmon user's username and password, including upper and lower case.