Setting Up Expired Users
By default, an expired user is rejected and can't connect at all. Many ISPs prefer to let expired users connect with a very low speed and a separate IP pool, so they can reach a renewal page or the user portal. This guide shows how.
1. Create the expired profile
In Profiles → profiles list click New and set:
| Field | Value |
|---|---|
| Profile Name | Expired |
| Type | Fair Usage Policy (FUP) |
| Limit Expiration | OFF (important) |
| Download / Upload Rate | At least 512 kbps (lower speeds can't load web pages) |
| Pool Name | expired |
| Ignore Static IP | ON (optional, so expired users don't use their static IP) |
| Unit Price | 0 |
The expired profile must have Limit Expiration OFF. If it is ON, expired users are still rejected.
2. Link your packages to it
Edit each package you sell and set:
- Limit Expiration: ON
- Expired Next Profile: Expired
- Expiration Grace Period (optional): extra time after expiration before the user is moved.
3. Prepare the router
On the MikroTik:
- Create the IP pool
expired(for example 10.100.100.0/24). - Add a srcnat masquerade rule for that pool. Without it, users get an IP but can't reach anything.
- Add firewall filter rules that allow the expired pool to reach DNS and your SAS Radius portal / payment page, and drop all other traffic.
Avoid DNS or HTTP redirect (dstnat) rules for the whole network. They redirect all users, and many CPE routers disconnect when their checks are redirected.
4. What happens
- The user's expiration date passes.
- SAS Radius disconnects the online user.
- The user's router reconnects and gets the Expired profile's speed and pool. The user shows the purple FUP status in Online Users.
- When the user is activated (renewed), they reconnect on their normal package. Their package in the panel never changed.
If expired users are not disconnected, see Disconnect and CoA in the NAS chapter.