Skip to content

Configure Captive Portal

This guide sets up a captive portal on a guest or public network segment. Users on that network are redirected to a login page before receiving internet access.

For full reference information, see Captive Portal.

Prerequisites

  • A dedicated interface for the captive portal network (LAN or an optional interface). The portal cannot share an interface with a bridged segment.
  • DHCP server must be enabled on that interface before the portal will work.
  • Plan a DHCP max lease time that exceeds the portal idle timeout.

Step 1: Configure the interface

If you are using a dedicated guest interface (recommended):

  1. Assign and configure the interface as described in Configure Optional Interfaces
  2. Give it a descriptive name (e.g., GUEST)
  3. Assign it an IP subnet (e.g., 10.10.0.1/24)

Step 2: Enable DHCP on the interface

Go to Services > DHCP Server and select the guest interface tab.

Field Value
Enable Checked
Range start 10.10.0.100
Range end 10.10.0.200
Default lease time 3600 (1 hour)
Max lease time 7200 (2 hours)

Set the max lease time to be comfortably above the captive portal idle timeout you will configure in the next step.

Step 3: Configure the captive portal

Go to Services > Captive Portal.

Basic settings

Field Value Notes
Enable Checked —
Interface GUEST The interface where the portal is active
Idle timeout 30 Minutes of inactivity before disconnecting
Hard timeout 480 Absolute session limit (8 hours); blank = unlimited
Logout popup Your preference Allows users to manually disconnect
Redirection URL — Blank = redirect to originally requested URL after login

Authentication

Choose one:

Local users (simple setup): - Select Local User Manager - Add users under Services > Captive Portal > Users

RADIUS (for centralised auth): - Select RADIUS - Enter the RADIUS server IP, port (1812), and shared secret - Enable accounting (port 1813) if your RADIUS server supports it

No authentication (terms-of-service only): - Select None - Users click through without credentials

Upload a TLS certificate and private key to serve the login page over HTTPS. Set the server hostname to match the certificate's CN/SAN.

Without HTTPS, credentials are submitted in plaintext.

Step 4: Add local users (if using local auth)

Go to Services > Captive Portal > Users.

Add accounts for each user or shared account. These are separate from system web GUI users.

Step 5: Firewall rules

The captive portal handles traffic interception automatically, but you must still create rules to control what authenticated clients can access.

Go to Firewall > Rules > GUEST.

Allow authenticated clients to reach the internet:

Action:   Pass
Interface: GUEST
Source:   GUEST subnet
Dest:     any

Block access to the firewall's admin interface (recommended):

Action:   Block
Interface: GUEST
Source:   GUEST subnet
Dest:     GUEST IP address (firewall)
Dest port: 443 (web GUI port)

Place block rules before the pass rule.

Block access to LAN and other internal segments:

Action:   Block
Interface: GUEST
Source:   GUEST subnet
Dest:     LAN subnet

Step 6: DNS forwarder

Enable the DNS forwarder (Services > DNS Forwarder) so unauthenticated clients can resolve hostnames for the portal redirect. Without DNS, some clients may not reach the portal page.

Step 7: Validate

  1. Connect a test device to the guest network
  2. Confirm it receives a DHCP address in the correct range
  3. Open a browser and navigate to any HTTP site — you should be redirected to the portal login page
  4. Log in and confirm internet access is granted
  5. Confirm access to LAN and the admin interface is blocked
  6. Check Status > Captive Portal to see the active session

Vouchers

For time-limited access codes (hotel, café):

  1. Enable vouchers in the captive portal configuration
  2. Go to Services > Captive Portal > Vouchers
  3. Create a voucher roll with the desired duration and number of codes
  4. Print or distribute the generated codes

Users enter a voucher code in the Voucher field on the login page instead of a username/password.

Important notes

  • All clients are disconnected when you save captive portal configuration. Schedule changes for off-peak periods.
  • Bridge mode on the interface is incompatible with captive portal.
  • If per-user bandwidth limits are needed, the traffic shaper must be enabled globally.