Skip to content
WinetPay
FR EN
Create my space
Hotspot Camouflage

Hotspot Camouflage

Hotspot Camouflage hardens your MikroTik WAN gateway in depth: RouterOS identity erased from external scans, administration services closed outside your LAN, hotspot clients' DNS encrypted via DoH, TCP options normalised, IPv6 disabled to prevent leaks, and — as a v7 option — one or more outbound WireGuard tunnels through Cloudflare WARP that encapsulate all traffic. The script applies hot, without reboot, without disconnecting clients. A symmetric removal script ships with it: it erases exactly and only what the install put in place, and restores the original MAC. Compatible with RouterOS v6 and v7 (Furtif level v7 only).

What this product does

  • RouterOS identity hidden — neutral hostname, MNDP discovery off, telnet/ftp/api/www disabled
  • WinBox and SSH restricted to your LAN only — no door left for external scans
  • Encrypted client DNS through Cloudflare DoH, with public DoH endpoints blocked for bypass prevention
  • MSS clamping at 1,400 bytes, IPv6 off — no OS fingerprint leaked via Happy Eyeballs
  • WAN MAC cloning with original MAC backup for clean removal
  • WAN traffic smoothing through PCQ — bufferbloat reduced, latency stable under load
  • Optional outbound WireGuard tunnel (Furtif level, v7) — up to 4 Cloudflare WARP peers with PCC load-balancing
  • Built-in kill-switch — if all tunnels drop, no traffic leaves
  • Symmetric removal script — replayable, erases only what the install put in place

What happens after you buy

  1. 1 Choose your formula (monthly or yearly), your level, and your number of tunnels
  2. 2 Pay by Mobile Money; the amount is computed from your choices
  3. 3 Download your personalised .rsc file — each subscription has its own keys
  4. 4 Import the file in the MikroTik terminal: /import file-name=the-file.rsc
  5. 5 Hardening applies hot, in a few seconds, without reboot
  6. 6 Find your active subscription in « Camouflage » (BO menu): tunnel state, regenerate keys, cancel
  7. 7 To remove: import the included removal script, which cleans up everything

Why it helps

  • Hot apply, no router reboot, no client disconnection
  • Works even if your router isn't (yet) registered on WinetPay
  • Flexible subscription: monthly for as many months as you choose, or yearly with 2 months free
  • Cancellable anytime — coverage stays active until the paid term
  • Anonymous WireGuard keys generated on demand — no account to create, no credit card
  • One .rsc file to apply, one .rsc file to remove everything

Technical specifications

Model
Recurring subscription — monthly (N months) or yearly
WARP mode
Anonymous keys generated via wgcf, no sign-up
Base level
v6 + v7, local hardening without outbound tunnel
Furtif level
v7 only — Base + 1 to 4 outbound WireGuard tunnels
Compatibility
RouterOS 6.47+ and 7.x — the script detects the version
Time to apply
A few seconds, hot, no reboot
My-server mode
You bring your own WireGuard endpoint
Delivered format
Two .rsc files: install and symmetric removal