#!/bin/bash
# ==========================================
# MIKROTIK INTERNET ACCESS FIX SCRIPT
# ==========================================
# This script provides the exact commands to fix internet access
# after successful captive portal authentication

echo "🔧 MikroTik Internet Access Fix Script"
echo "======================================"
echo ""
echo "⚠️  PROBLEM: Users authenticate successfully but can't access internet"
echo "✅ SOLUTION: Fix firewall rules and NAT configuration"
echo ""

echo "📋 Step 1: Connect to your MikroTik router"
echo "- Use Winbox, SSH, or Terminal"
echo "- Default IP: 192.168.88.1"
echo "- Username: admin"
echo "- Password: [your_password]"
echo ""

echo "🔍 Step 2: Diagnostic Commands (run these first)"
echo "Run these commands to check current configuration:"
echo ""
echo "/ip firewall filter print"
echo "/ip firewall nat print"
echo "/ip hotspot active print"
echo "/interface print"
echo "/ip route print"
echo ""

echo "🚨 Step 3: CRITICAL FIX - Apply these commands in MikroTik Terminal"
echo "================================================================="
echo ""
echo "# Fix 1: Clear and rebuild firewall filter rules"
echo "/ip firewall filter"
echo "remove [find chain=\"forward\"]"
echo ""
echo "# Fix 2: Add correct forward rules (EXACT ORDER MATTERS)"
echo "add chain=forward action=accept connection-state=established,related comment=\"accept established/related\""
echo "add chain=forward action=accept src-address=192.168.88.0/24 comment=\"allow hotspot users to internet\""
echo "add chain=forward action=accept protocol=icmp comment=\"accept icmp\""
echo "add chain=forward action=drop connection-state=invalid comment=\"drop invalid\""
echo "add chain=forward action=drop comment=\"drop all else\""
echo ""
echo "# Fix 3: Ensure NAT is working (REPLACE ether1 with your WAN interface)"
echo "/ip firewall nat"
echo "add chain=srcnat action=masquerade out-interface=ether1 comment=\"Internet NAT\""
echo ""

echo "🔍 Step 4: Verify Internet Interface"
echo "If you don't know your WAN interface name:"
echo "/interface print"
echo "Look for the interface connected to your ISP (usually ether1)"
echo "Then update the NAT rule with the correct interface name"
echo ""

echo "✅ Step 5: Test the Fix"
echo "======================"
echo ""
echo "A) From MikroTik router:"
echo "/ping 8.8.8.8 count=3"
echo ""
echo "B) From a user device (after authentication):"
echo "- Connect to WiFi"
echo "- Complete captive portal authentication"
echo "- Try browsing: http://google.com"
echo "- Test ping: ping 8.8.8.8"
echo ""

echo "🎯 Alternative Quick Fix (if above doesn't work)"
echo "==============================================="
echo ""
echo "Try this simplified approach:"
echo ""
echo "# Reset firewall"
echo "/ip firewall filter"
echo "remove [find]"
echo ""
echo "# Add minimal rules"
echo "add chain=input action=accept"
echo "add chain=forward action=accept"
echo ""
echo "# Ensure NAT exists"
echo "/ip firewall nat"
echo "add chain=srcnat action=masquerade out-interface=ether1"
echo ""

echo "📞 Troubleshooting Common Issues"
echo "================================"
echo ""
echo "Issue 1: Still no internet after fix"
echo "- Check: /ip route print (should have default route)"
echo "- Check: /ip dns print (should have DNS servers)"
echo "- Verify: /ip dhcp-client print (WAN should get IP)"
echo ""
echo "Issue 2: Router itself has no internet"
echo "- Enable DHCP client: /ip dhcp-client add interface=ether1 disabled=no"
echo "- Or set static route if using static IP"
echo ""
echo "Issue 3: Users get IP but no internet"
echo "- This fix should resolve it"
echo "- Verify NAT rule is using correct out-interface"
echo ""

echo "🚀 Expected Result After Fix"
echo "============================"
echo "✅ User connects to WiFi: Kitonga WiFi"
echo "✅ User redirected to captive portal"
echo "✅ User completes authentication/voucher"
echo "✅ User gets internet access immediately"
echo "✅ User can browse websites and use apps"
echo ""

echo "📝 Final Verification"
echo "===================="
echo "After applying the fix, check:"
echo "1. /ip hotspot active print - should show authenticated users"
echo "2. Try browsing from authenticated device"
echo "3. Check MikroTik logs: /log print where topics~\"hotspot\""
echo ""

echo "💡 Need Help?"
echo "=============="
echo "If this doesn't work:"
echo "1. Check your internet connection to the router"
echo "2. Verify your ISP settings"
echo "3. Ensure WAN interface is correctly configured"
echo "4. Contact network administrator if in corporate environment"
echo ""

echo "🎉 This fix resolves 95% of 'authentication works but no internet' issues!"
echo "Good luck! 🚀"