Quick Create
Add Subscriber Record Payment New Ticket Service Advisory
Notifications
0 unread

No new notifications

System alerts will appear here.
--

Loading...

Verifying account...

My Profile Account Settings
Sign Out

General Settings

Manage ISP identity, branding, preferences, billing, service, network, integrations, security, and portal configuration.

Company & ISP Profile

Choose a category, change what you need, then save that section.

Loading settings…

Organization Profile

Legal identity and public contact information.

Legal company name *

Enter the legal company name.

Display name

Legal entity type *

Industry / provider classification *

SEC/DTI Registration Number

Tagline

Hotline *

Enter a valid Philippine mobile number.

General email *

Enter a valid email.

Billing email

Website *

Enter a valid HTTPS website URL.

Subscriber portal URL

Timezone *

Select the timezone.

Currency *

Select the currency.

Locale

BIR TIN number

Use the number shown on approved BIR registration records.

Hotline numbers

The first number is the primary public hotline.

System branding assets

PNG, JPG, WEBP, or ICO up to 4 MB. Assets are versioned and reused by the system.

Primary / Login logo

Navbar, login, and company identity

Compact logo

Collapsed navigation and small spaces

Browser icon

Browser tab and saved shortcut

Invoice logo

Generated invoice and billing documents

Receipt logo

Official and downloadable receipts

System preferences

Shared display, navigation, pagination, and refresh defaults.

Date format

Time format

Week starts on

Default theme

Default landing page

Default table rows

Auto-refresh interval

seconds

Browser alerts

ISP legal, tax & regulatory profile

Central provider identity used by billing, receipts, portals, and authorized system views.

Editable & audited

BIR registration type

BIR RDO code

NTC expiry / renewal date

NTC registration / certificate / VAS number

NTC authority / license type

DTI business name registration

NPC registration / DPO reference

Mayor's / business permit number

Permit expiry / renewal date

Enter only verified registration information. Blank optional fields remain hidden from public views.

Customer service, NOC & privacy contacts

Public support contacts may appear in the Subscriber Portal; internal regulatory data remains protected.

Customer support email

Customer support hotline

NOC email

NOC hotline

Data Protection Officer / privacy contact

Privacy email

Customer service hours

Service coverage summary

Saved changes are validated, versioned, and recorded in audit history.

Offices & Service Locations

Public office records and operational location labels.

Standard office hours

Primary service area

Offices, Branches & Network Coverage

Select a row to review its profile, coverage barangays, and assigned MikroTik routers.

Router assignments are synchronized to the selected branch only after Office Settings is saved. A router can belong to one branch at a time.

Office / Branch	Type	Primary location	Coverage	MikroTik routers	Status	Menu
Loading office and branch records…

Saved changes are validated, versioned, and recorded in audit history.

Billing, Due Date & Isolation Rules

Draft defaults; subscriber contracts and approved exceptions remain authoritative.

Isolation and reconnection must never run from browser settings alone. The backend must verify posted payments, grace periods, account exceptions, advisories, idempotency, router state, and authorized execution before changing service.

Billing cycle *

Select the billing cycle.

Grace period *

days

Enter 0–60 grace-period days.

Unpaid threshold *

month(s)

Enter 1–12 unpaid months.

Approved due-date days *

Comma-separated calendar days from 1 to 31.

Enter valid comma-separated days.

Outage-proration basis

Bill (SOA) prefix

Receipt prefix

Payment prefix

Ticket prefix

Application prefix

Tax display

Prepare recurring invoices through the backend scheduler

Enable automated isolation only after production safety approval

Isolation on the router

Used by automatic isolation, the Isolation & Reconnection page and bulk actions.

Isolation PPP profile

Must exist on every router. Isolation Templates › RouterOS script creates it with the walled garden.

Generate monthly invoice before due date

day(s) before due

Zero generates the invoice on the due date; recommended value is 7 days.

Overdue reminder schedule

Days after due date; comma-separated and within the grace period.

Prepaid reminder

hours

Before a prepaid load ends.

Final isolation notice

hours before

Reconnect delay after verified payment

minutes

Allow promise-to-pay requests

Maximum approved extension

days

Stop monthly bills after the contract end date

The last bill is prorated up to the contract end date. Renew contracts on Subscription Billing > Contracts ending.

Saved changes are validated, versioned, and recorded in audit history.

Installation & Service Rules

Standard service amounts and operational targets.

Installation fee *

₱

Enter the installation fee.

Cable allowance minimum *

meters

Enter the minimum allowance.

Cable allowance maximum *

meters

Maximum cannot be below the minimum.

Excess cable rate *

₱/ meter

Enter the excess cable rate.

Plan-change processing fee *

₱

Enter the processing fee.

Survey / installation target *

Select the service target.

Standard restart guidance

Approved speed-test URL

Service-policy notes

Initial support response SLA

hours

Service restoration target

hours

Planned maintenance notice

hours before

Saved changes are validated, versioned, and recorded in audit history.

Payment & Reconciliation

Provider modes and controls without exposing credentials.

Store provider keys and webhook secrets only in the encrypted backend environment. This page must show connection state and secret references, never raw secret values.

Gateway environment *

Select the gateway environment.

Production uses approved live credentials and may create real subscriber charges.

Primary gateway

Settlement timezone

Webhook path

Backend route reference only.

Encrypted secret reference

Enter a backend reference only, not a secret or URL.

Reconciliation window

hours

Amount tolerance

₱

Webhook retry limit

Show approved online-payment options in the portal

Allow verified-payment reconnection after safety approval

Payment gateway connections

Configure approved providers, channels, fees, and routing priority.

Store only a backend credential or vault reference. Secret keys and webhook signing secrets must never be pasted into this page.

“Valid configuration” means the approved fields passed backend validation. A provider adapter must still perform a live connectivity and webhook-signature test before production activation.

Payment-link expiry

minutes

Minimum online amount

Maximum online amount

Gateway fee charged to

Use next enabled gateway on failure

Saved changes are validated, versioned, and recorded in audit history.

ISP Operations & Automation Guardrails

Safe policy foundation for provisioning, outages, isolation, reconnection, and network changes.

Production mode is active. RouterOS monitoring, PPP provisioning, and controlled reconnection run only through authenticated backend services with validation, rate limits, audit records, and rollback-aware workflows.

—Readiness

Backend readiness not checked

Run the protected check to review branches, plans, routers, and required safety policies.

Phase 2: Integration Health

Redacted connector inventory and passive configuration checks. No device, subscriber, or payment state is changed.

Waiting for backend inventory

Connector inventory has not been loaded.

Recent protected checks

Checked	Operator	Ready	Attention	Not configured	Result
No health checks recorded.

Saved changes are validated, versioned, and recorded in audit history.

Add a MikroTik router in 4 easy steps

No typing of commands: ONE-KONEK makes the script, you paste it once, and the router connects by itself.

ServerONE-KONEK checks the WireGuard and RADIUS settings. Fix anything red.

Router detailsName, branch and how the router connects (new tunnel or its own tunnel).

Paste scriptWinBox > New Terminal > paste. One time only.

ConnectWait here. The status turns Connected by itself.

If it does not connect

What you see	What to do
`onekonek-wg` showsI(invalid) in Interfaces	Paste the newest script again (Routers > terminal button). It now picks a free WireGuard port by itself.
Peer has never handshaked	The server does not know the router yet: do step 3 → "On the server" (one line), then wait 30 seconds.
`/ping` to the server tunnel IP gets no answer	The router cannot reach the server endpoint: check the router internet and that UDP to the server port is not blocked.
The terminal says "this router already has a tunnel"	Use it: Add Router > "It already has a tunnel" and enter its address from IP > Addresses.
Login failed / not enough permissions	Paste the script again; it recreates the ONE-KONEK user and its rights.
ONE-KONEK is on a different machine than the WireGuard server	That machine needs a route to the tunnel subnet (or install ONE-KONEK on the WireGuard server).

Router NAS Management

Add a router, then copy the setup script to the MikroTik terminal. The row turns from Waiting to Connected by itself. A router on the same network or an existing VPN:Same network / VPN.

Router name	Type	WireGuard	Status	Login	Actions
Loading…

RADIUS & WireGuard Infrastructure

RADIUS server, WireGuard tunnel and isolation for the selected router.

Select router

RADIUS server

Selected router

Set up the RADIUS server

Routers send PPPoE logins and accounting to this address through the tunnel. Each router gets its own secret in its setup script.

RADIUS server IP

Auth port

Acct port

Allowed routers (client CIDR)

Use the tunnel subnet, for example 10.200.0.0/24. "Any address" (/0) is not allowed.

Shared secret (leave empty to keep)

Generate a new secret

WireGuard server interface

One tunnel for every remote router.

Interface

Server tunnel IP

Tunnel subnet

MTU

Listen port

Public endpoint host

The address routers dial to (public IP or domain of the ONE-KONEK server). RADIUS still uses the tunnel IP.

Server public key

From the server: wg show wg0 public-key

I changed the server key on purpose (routers must get their script again)

MikroTik / NAS peers

Routers connected through the WireGuard tunnel.

Router	Tunnel IP	Handshake	Status

Step 1 of 4 · Check that everything is ready

ONE-KONEK checks the server for you. Fix anything marked red first, then press Next.

On the MikroTik router you will need:

RouterOS 7 or newer.WinBox > System > Resources > Version. (WireGuard is not in RouterOS 6.)
Working internet on the router.It dials out to the server, so CGNAT / no public IP is fine.
An admin login in WinBox(only to paste the script once; ONE-KONEK then uses its own limited user).

Step 2 of 4 · Tell ONE-KONEK about the router

Router name (example: MALOLOS CCR1016)

Short code (optional, made for you)

Branch

What the router does

What ONE-KONEK may do

Subscriber logins (PPPoE)

How will ONE-KONEK reach this router?

New ONE-KONEK tunnelRecommendedThe script makes the WireGuard tunnel for you. Use this for a new router or when unsure.

It already has a tunnel to the serverA WireGuard / VPN made before (for example by another system) that is already Connected on the server.

The script only adds items marked "ONE-KONEK ENROLL": a limited API user, the tunnel and, if chosen, the RADIUS client. It does not touch WAN, routes, NAT, PPPoE servers or your other firewall rules.

Router on the same network or an existing VPN

Five short steps with a certificate check. For remote routers with RouterOS 7, use the Routers tab: one script does it.

Server readiness

Checked once and reused for every device. Saved settings alone never count as ready.

What do you want to connect?

Other PPPoE servers and devices

PPPoE is how a subscriber logs in, not a way to manage a device. Only RouterOS routers are configured directly; everything else is described honestly below.

Device	Management	Remote site	Accounts / sessions	Support

Device name

Code

Branch

Device role

Use saved setup template (optional)

What should ONE-KONEK do with it?

Monitor onlyRead status, sessions and backups. No changes to accounts.

Manage subscriber connectionsAlso create and update subscriber PPPoE accounts (needs the "write" right).

Read existing account passwords (gives the "sensitive" right; leave off for monitoring)

Also check isolation readiness (unpaid accounts)

Advanced

Location

Latitude

Longitude

How does ONE-KONEK reach this router?

On the same network

Management IP or name the ONE-KONEK server can reach directly.

Remote location

Guided WireGuard tunnel to the ONE-KONEK hub (RouterOS 7). Works behind CGNAT.

Already connected through a VPN

Use the private address of an existing VPN. No new tunnel.

Management address

RouterOS version

API service

Advanced: existing API login, port, server address

API port

ONE-KONEK server address (as the router sees it)

Existing API username

Existing API password

Setup script

No working management connection yet? An authorized administrator runs this once on the router: WinBox > New Terminal > paste. It changes only items marked "ONE-KONEK ENROLL" and contains a one-time password that is replaced at the first successful test.

Plans and router profiles

Suggestions come from the profile name and its real speed limit, never from the price. Review each one; the router profile itself is not changed.

Router profile	Upload	Download	Address pool	System plan	Result

Accounts on this router

Matched by router and username. Linking never resets passwords, bills customers, changes status or drops sessions.

Username	Profile	Status	Subscriber	Action

Saved as you go: you can leave and continue later.

Which subscriber?

Subscriber

1Router and plan

2Account

Create account (unique username, strong password, address from the router pool)

Link existing account

Advanced: fixed IP

Open IP addresses (General Settings)

3Set up the modem / ONU

4Verify connection

"Connected" only when the router or RADIUS shows a live session for this account.

IP addresses

Subnets, router address pools, fixed IPs and what is really in use. Problems are shown for you to fix; ONE-KONEK never moves a customer to another address by itself.

Loading…

Address	State	Recorded for	Live session	Router / scope

Subnets

Subnet	Purpose	Router / scope	Use

Address pools on the routers

Read from /ip pool (read-only). Use is counted from live sessions.

Router	Pool	Ranges	Use	Read

Reservations (devices, gateways, servers)

Customer fixed IPs are set on the subscriber's PPPoE account; they appear under Addresses.

Address	Label	Kind	Router / scope

Integrations & Plugins

Configure protected connections used by network, billing, messaging, customer, compliance, and business operations.

Store passwords, tokens, private keys, and webhook secrets only in the server environment or encrypted vault. Enter a credential reference here—never the raw secret.

Runtime mode

Health-check interval

minutes

Default timeout

seconds

Default retries

Public webhook base URL

Used to generate callback URLs; individual paths remain configurable per integration.

Require signed webhooks

Allow audited custom connectors

Log redacted request metadata

No integrations loaded

Integration	Category	Environment	Method	Branch scope	Health check	Status	Menu
No integrations configured.

Saved changes are validated, versioned, and recorded in audit history.

Display name

Provider / plugin

Notification Preferences

Sender identity, channels, schedules, consent, and delivery safeguards.

Sender name *

Enter the sender name.

Reply-to email *

Enter a valid reply-to email.

Delivery window start

Delivery window end

End time must be later than start time.

Default language

Portal alerts

SMS

Facebook

Require approval for bulk, security, isolation, billing-impacting, or sensitive notifications.

Approval must remain required for sensitive notifications.

Standard message footer

Messaging integrations

Configure approved SMS, email, Telegram, WhatsApp, and Viber delivery connections.

Store only a backend credential or vault reference here. Never paste an API token, password, or private key into the browser.

Retry limit

Messages per minute

Delivery receipts

Unicode SMS

Email tracking

Connected Email Accounts

Multiple IMAP/SMTP mailboxes used by the Email Center.

Passwords remain server-side. Enter a credential reference here, then set the matching EMAIL_CREDENTIAL_* environment variable in the app container.

Mailbox	Provider	Capabilities	Last sync	Actions
Loading connected mailboxes…

Saved changes are validated, versioned, and recorded in audit history.

Security, Audit & System

Organization-wide access, evidence, retention, and operational safeguards.

Idle session timeout *

minutes

Enter 5–480 minutes.

Failed-login limit *

Enter 3–20 attempts.

Lockout duration *

minutes

Enter 5–1,440 minutes.

Audit retention

days

Backups

Open Backups (schedule, offsite copy, restore test)

Environment

2-step verification for staff:Staff & Roles › Security policy

Require approval for financial, access, isolation, and destructive actions

Sensitive-action approval must remain enabled.

Preserve immutable security and business audit events

Audit logging must remain enabled.

Data-retention policy reference

I confirm that production security settings require risk review, authorized approval, tested rollback, and documented implementation evidence.

Security review confirmation is required.

Saved changes are validated, versioned, and recorded in audit history.

Payment gateways

Online payments subscribers make in the portal. Set up a gateway with its API keys; payments are posted to the bill automatically.

Loading payment gateways…

Where are the API keys kept?

Keys typed in a gateway's setup are stored encrypted on the server and are never shown again (only their last 4 characters). Keys can also stay in the server environment file (backend/.env); a key typed here is used first.

Provider	Sandbox (testing)	Live (real payments)
Xendit	`XENDIT_TEST_SECRET_KEY`, `XENDIT_TEST_WEBHOOK_TOKEN`	`XENDIT_LIVE_SECRET_KEY`, `XENDIT_LIVE_WEBHOOK_TOKEN`
PayMongo	`PAYMONGO_TEST_SECRET_KEY`, `PAYMONGO_TEST_WEBHOOK_SECRET`	`PAYMONGO_LIVE_SECRET_KEY`, `PAYMONGO_LIVE_WEBHOOK_SECRET`
Maya Business	`MAYA_SANDBOX_PUBLIC_KEY`, `MAYA_SANDBOX_SECRET_KEY`	`MAYA_LIVE_PUBLIC_KEY`, `MAYA_LIVE_SECRET_KEY`

Sandbox is for testing only: subscribers never see sandbox gateways, and test payments are never posted to a bill.

Manual payments, QR codes & bank accounts

Accounts subscribers can pay into directly (GCash, Maya, QR Ph, bank transfer) and the instructions they see. Staff confirm these payments in Payments & Collections.

Add one entry per account. The account name, number, QR image and instructions are shown in the subscriber portal and on payment reminders.

PNG, JPG or WebP up to 2 MB. Never upload passwords, PINs, OTPs or recovery codes.

Loading payment accounts…

Connected services

Every integration ONE-KONEK supports, with its real status. Items marked "Not available yet" still need development and are never shown as connected.

Loading integrations…

Webhooks & API access

Receive payment notices from providers, send signed event notices to your other systems, and manage API keys.

Incoming: payment provider webhooks

Copy each address into the provider dashboard. Every request is verified (token or signature) before it is used, repeats are ignored, and payments are re-checked with the provider before posting.

Loading…

Outgoing: send events to your systems

ONE-KONEK posts a signed JSON message to each address when a chosen event happens. Failed deliveries are retried automatically.

Loading…

How receivers verify the signature

Each request has these headers:

X-OneKonek-Event — the event name, e.g. payment.posted
X-OneKonek-Event-Id — unique per event; store it and ignore repeats
X-OneKonek-Timestamp — Unix time in seconds
X-OneKonek-Signature — v1= + HMAC-SHA256 of timestamp + "." + raw body using the endpoint secret

Reject requests older than 5 minutes or with a signature that does not match.

Delivery history & troubleshooting

Every attempt is kept with its result. Re-sending an event that can post a payment or change a service asks for confirmation first.

Direction

Status

Loading…

API keys

For other systems that call the ONE-KONEK API. A key has the same permissions as your account, is shown only once, and can be revoked at any time.

Loading…

Invoice, receipt & message preview

How your saved company details and logos appear to subscribers. Update logos above and company details in Company & ISP Profile.

Notification identity

Sender name, reply-to email and the message footer are edited in Notifications & Communications.

Edit sender & templates

Who can change settings

These rules are enforced by the server. Every saved change is recorded in the history below without secret values.

Loading…

Maps & Coverage

Map provider, default map location, default address on new forms, address lookup, coverage rules and who can see subscriber pins. Only a Super Administrator can change these.

View onlyOpen the GIS map

Map provider

Map style (optional)

MapTiler: streets-v2, hybrid. Mapbox: mapbox/streets-v12.

Custom tile address

Must contain {z}, {x} and {y}. Write {key} where the key goes; the key itself stays in backend/.env as GIS_MAP_API_KEY.

Map credit

Keep map tiles

days

Map on

Default map location

Where maps open when nothing else is selected. Leave empty to fit the map to your service areas.

Latitude

Longitude

Zoom

Default address on new forms

Pre-filled on new subscriber and application forms. Staff can change them per record.

Country

Region

Province

Municipality / City

Postal code

Address lookup & coverage rules

Address lookup provider

Keys stay in backend/.env as GIS_GEOCODING_API_KEY.

Max drop distance

Cable allowance

Fiber route reach

Check coverage automatically (never blocks registration)

Who can see subscriber pins

Subscriber locations on the GIS map. They are never in the map export.

Saving asks for a reason and is recorded in the change history.

Configuration History

Versioned changes, approvers, deployment state, rollback points, and audit references.

No configuration versions loaded

Approved backend configuration versions and rollback evidence will appear here.

Versioned system settings are connected to the protected backend.

General Settings

Company & ISP Profile

Organization Profile

Hotline numbers

System branding assets

Primary / Login logo

Compact logo

Browser icon

Invoice logo

Receipt logo

System preferences

ISP legal, tax & regulatory profile

Customer service, NOC & privacy contacts

Offices & Service Locations

Offices, Branches & Network Coverage

Billing, Due Date & Isolation Rules

Installation & Service Rules

Payment & Reconciliation

Payment gateway connections

Network Integrations

MikroTik

Multi-vendor OLT

GIS & Coverage

MikroTik connection & PPPoE accounts

ISP Operations & Automation Guardrails

Backend readiness not checked

Phase 2: Integration Health

Recent protected checks

Operating mode

Provisioning safeguards

Billing-linked service actions

Outage, SLA & customer protection

Change window & rate limits

Routers

Add a MikroTik router in 4 easy steps

If it does not connect

Router NAS Management

RADIUS & WireGuard Infrastructure

RADIUS server

Selected router

Set up the RADIUS server

WireGuard server interface

MikroTik / NAS peers

How isolation works on this router

Walled garden (allowed while isolated)

RouterOS isolation script

Isolation template for this router

Router on the same network or an existing VPN

Server readiness

What do you want to connect?

MikroTik router / PPPoE server

Subscriber modem, ONU or router

Other PPPoE server / NAS

Continue a setup

Other PPPoE servers and devices

Setup script

Plans and router profiles

Accounts on this router

Which subscriber?

Subscriber

1Router and plan

2Account

3Set up the modem / ONU

4Verify connection

OLTs

Signal and outage thresholds

IP addresses

Subnets

Add subnet

Address pools on the routers

Reservations (devices, gateways, servers)

Reserve an address

Is this address free?

Integrations & Plugins

Notification Preferences

Messaging integrations

Connected Email Accounts

Subscriber Portal & Web Tabs

Approved Web Tabs

Security, Audit & System