Profiles, bandwidth and quotas

The limits a signed-in guest gets, and how they are enforced.

What a profile controls

A profile (Accounts → Profiles) is a named bundle of limits enforced through RADIUS: upload and download speed caps, a data quota, an idle timeout, a session time limit, a grace period, how many simultaneous sessions the same account may hold, how often accounting interim-updates fire, and — if the profile is sold rather than assigned for free — a price. Every profile also has a type: countdown, expiration, or free (an older pay-per-use type is remapped to expiration when a legacy profile is edited).

A profile can also carry custom RADIUS attributes for anything Kiwire's own fields don't cover — a MikroTik burst rate, an Aruba user role, a VLAN.

Bandwidth

Upload speed and download speed set the ceiling, in kbps, for each direction (0–100,000). Minimum upload speed and minimum download speed optionally set a guaranteed floor, and must not exceed the matching ceiling — the form rejects a minimum higher than the maximum.

Time, data and credit quotas

Quota limit caps total data for the period (up to 1 GB shown in the admin's units, 0 = unlimited). Session time caps how long a single session may run (minutes, up to roughly five years for an effectively unlimited plan). Idle timeout disconnects a session that's gone quiet (seconds, up to 24 hours). Reset schedule — hourly, daily, weekly, monthly, yearly, a custom time of day, or "on top-up" — controls when the quota and time counters roll over, with the grace period, reset grace, custom time and custom weekly settings shaping exactly when that happens.

When a guest's session hits the quota or time limit, Kiwire's login check resolves it in a fixed order: first, if the profile resets on top-up and the grace period doesn't block it, the counters reset and the guest carries on; otherwise, if the profile names an advance profile, the session is switched to it and a RADIUS change-of-authorization is sent; if neither applies, the login is rejected with a quota- or time-limit-reached message. Bonus quota added by a top-up code is layered on top of the profile's own allowance before any of this is checked.

Simultaneous logins

Simultaneous use (default 1, up to 1000) caps how many active sessions the same account can hold at once, and is enforced through RADIUS. Once an account is at its limit, a new login is either rejected outright, or — if the tenant's login policy has auto-disconnect turned on — one existing session is kicked to make room, chosen by the policy's disconnect target: all connected sessions, the first or last connected, a random one, or the lowest- or highest-usage session.

Expiry

A profile itself doesn't hold an account's expiry date — that lives on the account (voucher or user). What a profile does control is the renewal cadence around expiry: the reset schedule and grace period decide when quota/time counters roll over versus lock a guest out, and the active switch decides whether the profile can still be picked at all for a new voucher, user or login method — turning it off doesn't retroactively affect guests already on it, it just stops new assignments. A profile can also name an advance profile to fall through to automatically once its own quota or time is exhausted (a profile can't be its own advance profile).

Custom RADIUS attributes

Kiwire's own fields cover speed, data, time and simultaneous logins, and send them in a form every controller understands. When you need something vendor-specific — a burst rate, a firewall address list, a user role, a VLAN — add it as a custom attribute on the profile. Every guest signed in on that profile gets it.

Where to type it

1. Open Accounts → Profiles and edit the profile (or create a new one).
2. Near the end of the form, just below Remark, find the Custom Attribute box.
3. Type the attributes in the format below and click Save.

The next guest who signs in gets the new attributes. Guests who are already online keep what they got at sign-in until they reconnect, or until Kiwire changes their session (for example when they move to an advance profile).

How to type it

The box takes the attribute name and its value in this exact shape:

{"Attribute-Name": "value"}

• Start with { and end with }.
• The attribute name in double quotes, then a colon, then the value in double quotes.
• For several attributes, separate them with a comma — and put no comma after the last one.
• Use plain straight quotes ". Curly quotes “ ” (what Word, WhatsApp or email often turn quotes into) are not accepted, so type the text in the box rather than pasting it from those apps.
• Spaces and line breaks between entries don't matter; put each attribute on its own line if that's easier to read.

One attribute — this is exactly what goes in the box:

Custom Attribute{"Mikrotik-Rate-Limit": "2M/10M"}

Three attributes, one per line:

Custom Attribute{
  "Tunnel-Type": "VLAN",
  "Tunnel-Medium-Type": "IEEE-802",
  "Tunnel-Private-Group-Id": "120"
}

If the text isn't in the right shape, Save shows an error under the form and nothing is changed — fix the text and save again.

Examples

Copy the one you need into the Custom Attribute box and change the value.

MikroTik — speed with burst. The Max Upload Speed and Max Download Speed fields give a flat limit. For a burst, use MikroTik's own rate string instead and set those two fields to 0, so only one limit reaches the router:

{"Mikrotik-Rate-Limit": "2M/10M 4M/20M 1M/5M 10/10"}

That reads upload/download: 2 Mbps up and 10 Mbps down normally, bursting to 4/20 Mbps while the average stays under 1/5 Mbps, measured over 10 seconds. Plain "2M/10M" gives the same flat limit without the burst.

MikroTik — tag guests for a firewall rule. Adds the guest's IP to an address list on the router, which your firewall or queue rules can then match:

{"Mikrotik-Address-List": "vip-guests"}

MikroTik — both at once:

{"Mikrotik-Rate-Limit": "2M/10M", "Mikrotik-Address-List": "vip-guests"}

Huawei — average rates. Huawei takes rates in bits per second, so 2 Mbps up and 10 Mbps down is:

{"Huawei-Input-Average-Rate": "2048000", "Huawei-Output-Average-Rate": "10240000"}

Aruba — give the plan its own role. The role must already exist on the Aruba controller; it decides the guest's firewall policy and bandwidth contract there:

{"Aruba-User-Role": "guest-premium"}

Any vendor that supports dynamic VLANs — put the plan on VLAN 120. Three standard attributes that always go together:

{"Tunnel-Type": "VLAN", "Tunnel-Medium-Type": "IEEE-802", "Tunnel-Private-Group-Id": "120"}

Standard — apply a named filter that is already defined on the controller:

{"Filter-Id": "guest-web-only"}

Standard — label the session for your own reports. The controller sends Class back in every accounting record for the session, so a plan name here shows up in the router's or a billing system's logs:

{"Class": "plan-gold"}

Check your controller's page under Hardware → Vendors for which attributes it honours — a controller silently ignores attributes it doesn't know.

Common mistakes

Typed	Problem	Correct
Mikrotik-Rate-Limit=2M/10M	Not in the {"name": "value"} shape	{"Mikrotik-Rate-Limit": "2M/10M"}
{Mikrotik-Rate-Limit: 2M/10M}	Name and value need double quotes	{"Mikrotik-Rate-Limit": "2M/10M"}
{"Class": "plan-gold",}	Comma after the last attribute	{"Class": "plan-gold"}
{"Filter-Id": "a"}{"Class": "b"}	Two sets of braces	{"Filter-Id": "a", "Class": "b"}
{“Class”: “plan-gold”}	Curly quotes	{"Class": "plan-gold"}
{"Mikrotik Rate Limit": "2M/10M"}	Spaces in the name — use the exact name with dashes	{"Mikrotik-Rate-Limit": "2M/10M"}

Where the attribute goes

By default an attribute is sent to the controller in the sign-in reply, which is what you want almost every time. You can put a prefix in front of the name to say otherwise:

Prefix	Meaning	Example
(none) or reply:	Sent to the controller	{"reply:Filter-Id": "guest-web-only"}
control:	Used by Kiwire's RADIUS server itself, never sent to the controller	{"control:Simultaneous-Use": "2"}
request:	Treated as if the controller had sent it	rarely needed

Rules

• Custom wins. If a custom attribute has the same name as one Kiwire generates from the form, the custom value is sent. For example {"reply:Session-Timeout": "1800"} overrides the Session Time field. Prefer the form field unless you have a reason; it keeps the profile readable for the next person.
• One value per attribute. Each name can appear once. An attribute that a vendor expects several times (such as several Cisco-AVPair lines) can only carry one value here.
• At most 40 attributes per profile. Names use letters, digits and dashes; values are text or numbers.
• A speed of 0 is dropped. To most controllers a bandwidth value of 0 means "block all traffic", not "no limit", so Kiwire never sends one — whether it comes from the form or from a custom attribute.
• Sign-in attributes are refused. Names that decide whether a login succeeds — password, auth-type, nt-password, realm and similar — are rejected when you save. A profile is a plan, and anyone allowed to edit profiles must not be able to let every password through.

Bulk update

Accounts → Bulk Update applies a profile, zone or status change to every user or voucher matching a filter at once, instead of editing accounts one by one. It's the tool for retiring a profile tenant-wide (move everyone off it before deleting it) or moving a batch of vouchers onto a different plan. It only edits accounts that already exist, so it needs at least one active profile or zone to reassign them to.

Profiles get attached to a guest three ways: directly on a user or voucher record, as the plan picked at the moment of login (many login methods and payment plans link straight to a profile), or forced by the zone — a zone's forced-profile setting names a profile that every login into that zone is pinned to, overriding whatever the login method or account would otherwise have granted.