How to Set Up a Captive Portal: Step-by-Step for Any Hardware
Key Takeaways: Captive portal setup follows the same core pattern across all hardware vendors: isolate guest traffic on a VLAN, point the SSID to an external splash page URL, configure a walled garden for authentication, and test on multiple devices. The specific clicks differ by vendor, but the architecture is identical. A hardware-agnostic cloud platform eliminates most of the vendor-specific friction. Setup time averages 15 minutes per location once you know the pattern.
Most resellers overcomplicate captive portal setup. They treat each hardware vendor like a completely different project, building custom playbooks for Meraki, another for UniFi, another for Aruba. The reality: every captive portal deployment follows the same four-step architecture. The vendor-specific part is just which dashboard you click through.
This guide covers the universal setup process, then breaks down vendor-specific instructions for the hardware you'll encounter most often in the field.
The universal captive portal architecture
Every captive portal works the same way at the network level, regardless of vendor:
- •Guest device connects to an SSID broadcasting on the access point
- •DNS interception redirects HTTP requests to the captive portal splash page
- •Guest authenticates via email, social login, SMS, or WhatsApp OTP
- •Authentication callback tells the access point to allow the device through
- •Guest traffic flows normally after authentication
The differences between vendors are in step 2 (how they intercept DNS) and step 4 (how they receive the authentication callback). Everything else is identical.
What you need before starting
- •Access to the venue's WiFi controller or cloud management dashboard
- •A cloud-based captive portal platform (self-hosted portals create maintenance nightmares at scale)
- •The external splash page URL from your portal platform
- •A walled garden list — the domains that must be accessible before authentication (your portal platform's domains, social login providers, payment gateways if using paid WiFi)
Step 1: Create an isolated guest SSID
Never put guest traffic on the same network as the venue's business operations. This is security 101, but you'd be surprised how many venues run a single flat network.
Create a dedicated VLAN for guest traffic. Tag it with a VLAN ID (commonly 100-199 for guest networks). Configure the SSID to broadcast on this VLAN only.
SSID naming matters for discoverability. Use the venue name: "CafeRoma_WiFi" beats "Guest" every time. MyWiFi supports emoji in SSID names, which sounds gimmicky but actually increases connection rates in younger demographics — a coffee shop using "☕ BeanBar WiFi" saw 23% higher initial connections than "BeanBar Guest" in an A/B test across 12 locations (Source: MyWiFi internal data, 2025).
Bandwidth limiting: Cap guest traffic at 5-10 Mbps down, 2-5 Mbps up. This prevents guests from consuming the venue's entire pipe. Most controllers support per-client rate limiting at the SSID level.
Step 2: Configure external captive portal redirect
This is where vendor differences appear. The goal is identical: when a guest connects to the SSID, redirect them to your external splash page URL instead of letting them browse freely.
Cisco Meraki
Meraki's cloud controller makes this straightforward:
- •Navigate to Wireless > SSIDs and select your guest SSID
- •Under Splash page, select Click-through or Sign-on splash page
- •Choose My RADIUS server or External splash page depending on your integration method
- •Enter the splash page URL provided by your portal platform
- •Configure the walled garden under Wireless > Firewall & traffic shaping > Walled garden
- •Add your portal platform's domains and any social login callback URLs
Meraki's CMX API also supports presence analytics — footfall data without requiring authentication. This is a separate integration from the captive portal and requires Location Analytics to be enabled.
According to Cisco's 2025 Annual Internet Report, Meraki holds approximately 34% of the cloud-managed WiFi market share in North America (Source: Cisco Annual Internet Report, 2025).
Ubiquiti UniFi
UniFi requires the controller to be running (either the UniFi Cloud Key, Dream Machine, or self-hosted controller):
- •In the UniFi controller, go to Settings > WiFi
- •Create or edit the guest SSID
- •Enable Guest Portal under the SSID settings
- •Select External Portal Server as the authentication type
- •Enter the portal URL, redirect URL, and any required parameters
- •Under Advanced, configure the pre-authorization access list (walled garden equivalent)
UniFi's captive portal implementation requires the controller to be reachable from the access points. If the controller goes offline, the portal stops working. Cloud Key or Dream Machine deployments handle this automatically; self-hosted controllers need uptime monitoring.
Aruba Networks
Aruba Central provides cloud-managed portal configuration:
- •In Aruba Central, navigate to Security > Captive Portal
- •Create a new captive portal profile
- •Set the portal type to External
- •Enter the splash page redirect URL and the authentication callback URL
- •Configure the whitelist (walled garden) for pre-auth access
- •Apply the captive portal profile to the guest SSID under Wireless > SSIDs
Aruba's ClearPass integration adds 802.1X-level authentication if the venue needs it, but for most guest WiFi deployments, the standard web-based portal is sufficient.
Ruckus Wireless
- •In the Ruckus controller, go to Services > Hotspot Services
- •Create a new hotspot profile
- •Set the login page to External and enter your portal URL
- •Configure the walled garden entries
- •Apply the hotspot profile to the guest WLAN
Datto (formerly Open Mesh)
- •In Datto Network Manager, navigate to SSID Settings
- •Enable the splash page and select External URL
- •Enter the portal redirect URL
- •Add walled garden domains under network access settings
Other vendors
The pattern repeats for every vendor: MikroTik (Hotspot server configuration), EnGenius (Captive Portal settings in cloud controller), Cambium (Guest Access in cnMaestro), TP-Link Omada (Portal settings), and others. The steps are always: create SSID, enable external captive portal, enter URL, configure walled garden.
A hardware-agnostic platform like MyWiFi handles 20+ vendor integrations from a single dashboard. The Device Integration Wizard auto-detects the hardware type and generates vendor-specific configuration instructions, reducing setup time to under 2 minutes per access point.
Step 3: Configure the walled garden
The walled garden (also called pre-authentication access list or whitelist) defines which domains a guest can reach before authenticating. Without it, the splash page won't load because the guest's device can't reach the portal server.
Minimum walled garden entries:
- •Your portal platform's domain(s)
- •CDN domains serving portal assets (images, CSS, JavaScript)
- •Social login OAuth domains (if offering social login):
- •
facebook.com,fbcdn.net,facebook.net(Facebook) - •
accounts.google.com,googleapis.com(Google) - •
api.whatsapp.com(WhatsApp OTP) - •
appleid.apple.com(Apple Sign-In)
- •
- •Payment gateway domains (if using paid WiFi):
stripe.com,js.stripe.com
Common mistake: Adding too many domains to the walled garden. Every domain you whitelist is accessible without authentication. Keep it minimal. A guest who can reach YouTube before logging in has no reason to log in.
According to a 2025 study by Wireless Broadband Alliance, 67% of captive portal failures are caused by incomplete walled garden configurations (Source: WBA Industry Report, 2025).
Step 4: Build and deploy the splash page
With the network configuration done, the splash page is where guest interaction happens. This is what guests actually see and interact with.
Splash page essentials
- •Client branding: Logo, colors, imagery that matches the venue. Generic portals kill conversion rates.
- •Clear value proposition: "Connect to free WiFi" or "Join our WiFi for exclusive offers"
- •Login method: One or two options maximum. Email + social login, or WhatsApp OTP + email. Three or more options create decision paralysis.
- •Legal compliance: GDPR consent checkbox (unchecked by default), terms of service link, privacy policy link. Non-negotiable in the EU, and increasingly required globally.
- •Mobile-first design: 85%+ of captive portal sessions are on mobile devices (Source: MyWiFi platform data, 2025). Design at 375px width first.
For detailed splash page conversion optimization, see our guide on creating WiFi splash pages that convert.
Testing the deployment
Test on at least three device types before handing off to the client:
- •iPhone (Safari) — iOS has its own captive portal detection (CNA) that opens a mini-browser. Your splash page needs to work within this constrained viewport.
- •Android (Chrome) — Android's captive portal detection varies by manufacturer. Samsung, Google Pixel, and Xiaomi all handle it differently.
- •Laptop (Chrome/Firefox) — Desktop browsers typically redirect to the portal in a full browser tab.
Test checklist:
- •Portal loads within 3 seconds on the venue's connection
- •Login method works end-to-end (guest data appears in your platform)
- •Redirect after authentication goes to the correct URL
- •Returning guests get the "Welcome Back" experience (if configured)
- •Terms and privacy policy links work
- •Portal renders correctly on both portrait and landscape orientations
Step 5: Configure post-authentication settings
Authentication is just the beginning. What happens after the guest connects determines the ongoing value.
Session management
- •Session timeout: 60-120 minutes for cafes/restaurants, 24 hours for hotels, 8 hours for coworking spaces
- •Daily connection limit: Optional — some venues limit to 2-3 sessions per day per device
- •Bandwidth cap: Enforce per-client limits to protect the venue's connection quality
- •Device limit: 1-2 devices per authenticated guest prevents credential sharing
Smart redirect
After authentication, send the guest somewhere valuable:
- •The venue's website or current promotion page
- •A Google Maps review request (great for building client review profiles)
- •An app download page (App Store or Google Play deep links)
- •A WhatsApp conversation with the venue
- •An affiliate offer page (additional revenue stream for you)
Marketing automation triggers
Set up automated campaigns that fire based on guest behavior:
- •Connect trigger: Welcome email sent immediately after first connection
- •Disconnect trigger: Follow-up message sent after guest leaves
- •Inactive trigger: Re-engagement campaign after X days of no visits
- •Birthday trigger: Automated birthday offer (requires birthday field on portal)
For a complete walkthrough of automation setup, see our guide on automating WiFi follow-up emails.
Scaling across multiple locations
The single-location setup is straightforward. The challenge comes when you're deploying across 10, 50, or 200 locations for a client — or managing portals for dozens of different clients.
Templates save hours
Build portal templates by vertical. A restaurant template with the right fields, branding placeholders, and automation sequences can be cloned and customized in minutes rather than built from scratch each time. See solutions for your vertical for vertical-specific portal configurations and recommended field sets.
Centralized management
A platform with multi-location management lets you:
- •Push portal updates to all locations simultaneously
- •View analytics across all locations in one dashboard
- •Manage client-level permissions so venue operators can view their own data without accessing other clients
- •Schedule automated reports per location or grouped by client
Hardware standardization (when possible)
If you have influence over hardware selection, standardize on one or two vendors. Managing Meraki at 30 locations is easier than managing Meraki at 10, UniFi at 10, and Ruckus at 10. Hardware-agnostic platforms handle the integration differences, but you still need to troubleshoot hardware-specific issues occasionally.
The average deployment time drops from 45 minutes to 12 minutes after a reseller has completed 5 installations on the same hardware platform (Source: MyWiFi partner survey, 2025). To white-label these portals for your clients under your own brand, explore the partner program.
Troubleshooting common issues
Portal doesn't load
- •Check the walled garden — is the portal platform's domain included?
- •Verify DNS is working on the guest VLAN
- •Confirm the SSID is set to external captive portal mode (not internal)
- •Check that the controller can reach the internet (cloud-managed controllers need outbound connectivity)
Authentication succeeds but no internet
- •The authentication callback didn't reach the controller — check firewall rules
- •The MAC address authorization didn't propagate — some controllers have a delay
- •DNS resolution on the guest VLAN points to an unreachable server
iOS captive portal detection issues
iOS uses a specific URL (captive.apple.com/hotspot-detect.html) to detect captive portals. If this URL is blocked or returns an unexpected response, iOS won't trigger the portal popup. Ensure this domain is accessible on the guest VLAN.
Guests aren't seeing the portal on reconnect
Returning guests within the session timeout are usually auto-authenticated. If the session has expired but guests still bypass the portal, check the MAC address cache settings on the controller. Some vendors cache authenticated MACs for longer than the configured session timeout.
FAQ
How long does a typical captive portal setup take?
First-time setup on unfamiliar hardware takes 30-60 minutes. With a hardware-agnostic platform and the Device Integration Wizard, subsequent setups average 10-15 minutes. At scale (5+ locations on the same hardware), setup drops to under 10 minutes per location.
Do I need to be on-site to set up a captive portal?
Not necessarily. If you have remote access to the WiFi controller (cloud-managed systems like Meraki, UniFi Cloud, or Aruba Central), the entire setup can be done remotely. You'll need someone on-site to test the portal on a real device, but that can be the venue staff.
What if my client's hardware isn't supported?
Most modern cloud-managed WiFi hardware supports external captive portals. If the hardware is legacy or consumer-grade, a MyWiFi hotspot device can be added to the network as a dedicated guest WiFi access point without replacing the existing infrastructure. Choose a plan to get started — every tier includes the Device Integration Wizard for hardware-specific setup instructions.
How do I handle venues with multiple SSIDs?
Create one SSID for guest WiFi with the captive portal. Leave the venue's existing SSIDs for staff and operations untouched. The guest SSID should be on its own VLAN with appropriate bandwidth limits.
What's the difference between a captive portal and a splash page?
A captive portal is the entire system: network interception, redirect, authentication, and authorization. The splash page is the visual front-end that guests see and interact with. The splash page is one component of the captive portal system.
Can I use the same splash page across all my clients?
Technically yes, but you shouldn't. Each client's portal should carry their branding. Templates make this efficient — build once, clone, and customize per client. A white-labeled portal looks professional; a generic one looks like you're cutting corners.