How to Automate PPPoE Billing for Your MikroTik Network in Kenya

If you're running a small or mid-sized ISP in Kenya, chances are your billing workflow looks something like this: a subscriber's package expires, you get a WhatsApp message, you manually disable their account on Winbox, they pay via M-Pesa, you get another message, you re-enable them. Repeat this fifty times a month and you've spent hours doing work that should take zero human effort.

PPPoE billing automation is not a luxury for large ISPs. It's the difference between running a business and being held hostage by it.

This guide covers how automation actually works on a MikroTik network, what the integration points are, and what to look for when choosing a billing system that won't make your life harder.

---

Why MikroTik and PPPoE Are the Default Stack for Kenyan WISPs

MikroTik RouterOS is the dominant choice for Kenyan wireless ISPs for good reason — the hardware is affordable, the feature set is deep, and RouterOS gives you granular control over PPPoE profiles, queues, and IP pools that enterprise-grade alternatives charge a premium for.

PPPoE (Point-to-Point Protocol over Ethernet) is the authentication layer most WISPs use to manage subscriber sessions. Each subscriber connects with a username and password, gets assigned an IP from a pool, and has a queue applied that enforces their bandwidth limit. When a subscriber's billing cycle ends, you disable their secret or remove them from the active pool. When they pay, you re-enable them.

The problem is that every one of those actions — disable, enable, change profile, assign IP — is a manual Winbox operation if you don't have automation in place.

---

What "Automated PPPoE Billing" Actually Means

Automation in this context means your billing system talks directly to your MikroTik router via the RouterOS API. When a billing event happens, the router responds — no human in the loop.

The key events that should trigger automatic router actions:

Subscription expiry — When a subscriber's active period ends, the billing system should immediately disable their PPPoE secret on the router. The subscriber gets disconnected. No manual action needed.

Payment received — When an M-Pesa payment comes in and is matched to a subscriber, the billing system re-enables their secret and extends their expiry date. The subscriber reconnects within seconds.

Package upgrade or downgrade — If a subscriber changes their plan, the billing system updates their PPPoE profile on the router to reflect the new bandwidth limits. The change takes effect on their next session.

New subscriber provisioning — When you onboard a new customer, the billing system creates their PPPoE secret on the router automatically. No need to open Winbox.

All of this happens through the MikroTik RouterOS API — a programmatic interface that lets external systems read and write router configuration in real time.

---

You Don't Need a Paybill to Start Automating

This is a common misconception that stops small ISPs from adopting billing systems too early: "I'll set up proper billing once I have a Paybill number."

The suspension and provisioning automation is completely independent of your payment collection method. Even if you're still collecting payments manually — bank transfer, cash, or M-Pesa to your personal number — a billing system can still eliminate the bulk of your manual router work.

Here's how it works without a Paybill:

• Subscriber expiry triggers automatic suspension on the router — no manual Winbox intervention
• You confirm payment through whatever channel you're using
• You manually click "activate" in your billing dashboard
• The system handles the router re-enable and expiry extension

That single change — automated suspensions — already removes half the manual work. You're no longer doing two Winbox operations per subscriber per month, just one. And as your business matures and you onboard a Safaricom Paybill, you add STK Push on top of an already-working system rather than building from scratch.

Start with automation where you are. Add payment integration when you're ready.

---

The M-Pesa Integration Problem

Once you do have a Paybill or Till number, the question becomes: how does your billing system know which subscriber paid, and how does it trigger the router to re-enable them?

There are two common approaches, and they are not equal:

SMS confirmation parsing — Some older billing systems watch for the M-Pesa confirmation SMS that Safaricom sends to your registered line and parse it for the amount and account reference. This is fragile. SMS delivery is unreliable, parsing breaks when message formats change, and there's no feedback loop — the subscriber has no idea if their payment was received.

Daraja STK Push — The modern approach. Your billing system initiates a payment request directly from the subscriber's phone number via Safaricom's Daraja API. The subscriber gets a prompt on their phone to enter their M-Pesa PIN, confirms the payment, and Safaricom sends a real-time callback to your server confirming the transaction. No SMS parsing. No manual matching. The callback triggers the router action immediately.

STK Push is the right way to do M-Pesa integration for ISP billing. If a billing system is still relying on SMS in 2025, that's a red flag.

---

What a Properly Automated Flow Looks Like

Here's the complete lifecycle of a subscriber on a well-automated MikroTik billing system:

1. Onboarding — You create the subscriber in your billing dashboard. The system calls the RouterOS API and creates their PPPoE secret with the correct profile and password. They connect immediately.

2. Active period — The subscriber is online. The billing system monitors their session, tracks bandwidth usage, and knows exactly when their package expires.

3. Expiry — At the moment of expiry (or at midnight, depending on your configuration), the billing system disables the PPPoE secret via the API. The subscriber's session drops.

4. Renewal — The subscriber wants to renew. They open your portal or receive a payment prompt. They pay via M-Pesa STK Push. Safaricom confirms the payment to your server. The billing system immediately re-enables the PPPoE secret and extends the expiry. The subscriber reconnects — often within 30 seconds of payment.

5. No human involvement at any stage.

---

What to Look For in a MikroTik Billing System

Not all billing systems marketed for MikroTik actually do this well. Here's what matters:

Native RouterOS API integration — The system should connect directly to your router, not require you to run scripts or use RADIUS as a middleman for basic operations. RADIUS has its place, but for small WISPs it adds complexity without proportional benefit.

Daraja STK Push support — As covered above. SMS-based reconciliation is not acceptable for a production billing system in 2025.

Multi-router support — Most WISPs start with a single MikroTik but grow into multiple devices as coverage expands — a core router at the main site, another at a remote distribution point, perhaps a separate device for a hotspot deployment. Your billing system needs to manage subscribers across all of them from a single dashboard, with each subscriber correctly mapped to their router. If the system only supports one router per account, you'll outgrow it faster than you think.

Bulk messaging — Expiry reminders sent automatically via SMS or WhatsApp 3 days, 1 day, and on the day of expiry dramatically reduce inbound "my internet is off" messages. Instead of subscribers discovering their connection is dead and calling you, they get a reminder, pay in advance, and stay connected. Good billing systems let you configure these message templates and send them automatically on a schedule — no manual sending required.

Flat-rate pricing — Many billing systems charge per subscriber or per router. This model punishes you for growing. Look for flat-rate monthly pricing so your billing cost doesn't scale with your subscriber count.

Local support — Timezone matters. A billing system with support based outside Africa means you're raising tickets at 2am Nairobi time and waiting until the next business day. For a production ISP system, that's not acceptable.

---

The Cost of Not Automating

The manual billing tax is real and it compounds. Consider a small ISP with 150 subscribers on monthly packages:

• Average of 2 manual router interactions per subscriber per month (disable + re-enable)
• 300 Winbox operations monthly
• At even 3 minutes per operation: 15 hours of manual work every month

That's nearly two full working days spent on tasks a billing system should handle automatically. As your subscriber base grows, this doesn't get easier — it gets worse.

Automation isn't about replacing the human element of running an ISP. It's about redirecting your time to things that actually grow the business: acquiring new customers, improving network reliability, expanding coverage.

---

Getting Started

If you're currently managing a MikroTik PPPoE network manually, the migration to an automated billing system is simpler than it sounds. The core requirements are:

• Your MikroTik router must be reachable by the billing system (either on the same network or via a management tunnel)
• You need a Safaricom Daraja account with STK Push enabled (Paybill recommended over Till for account reference matching)
• Your subscribers need to be imported into the billing system with their current PPPoE credentials

Most modern billing platforms offer a CSV import for bulk subscriber migration, so you're not re-entering data manually.

---

Oversight is a billing and subscriber management platform built specifically for Kenyan WISPs and hotspot operators. It integrates directly with MikroTik RouterOS and Safaricom Daraja — PPPoE provisioning, STK Push payments, and subscriber management from a single dashboard. If you're running a MikroTik network and want to eliminate manual billing, start a free trial at oversight.co.ke.