UniFi has two guest features that people mix up. Network Isolation keeps guests away from your own devices. The Hotspot Portal puts a sign-in page between a guest’s phone and the internet. You can use either one alone. A venue usually wants both, and this guide sets them up in that order, with the reasons a portal fails to appear at the end.
- Isolation
- Settings, Networks: Network Isolation. Settings, WiFi: Client Device Isolation.
- Sign-in page
- Settings, WiFi: Hotspot Portal, then Captive Portal.
- Page design
- Insights, Hotspot, Landing Page.
- You need
- A UniFi console or Cloud Key, or a self-hosted Network application.
Menu paths here follow UniFi Network 9. Older versions put the same settings in slightly different places, and Ubiquiti moves things between releases, so if a label doesn’t match, look one level up.
1. Make the guest network
- Create a network. In UniFi Network, open Settings, then Networks, and create a new network (a separate VLAN) for guests.
- Turn on Network Isolation. This stops the guest network reaching your other networks and VLANs.
- Create the WiFi. Under Settings, WiFi, create a new SSID and assign it to the guest network you just made.
- Turn on Client Device Isolation. Guests on the same access point can then no longer reach each other’s phones.
Ubiquiti also suggests Device Isolation (ACL) to carry the same separation onto the switches, and Proxy ARP to cut broadcast noise on busy networks. For a café with one access point, the four steps above are the part that matters.
UniFi lets you put a portal on a password-protected SSID or an open one, though some portal providers ask for open. Open is more common in venues anyway, because the portal does the gatekeeping and nobody has to read a password off the wall.
2. Switch on the Hotspot Portal
Open Settings, then WiFi, select the guest SSID, and enable Hotspot Portal, then Captive Portal. That alone sends every new device on that SSID to a sign-in page before it gets the internet.
From Network 9.0, with the zone-based firewall, you can do this for a whole network rather than one SSID. Under Settings, Security, Firewall, put the guest network into the Hotspot zone. That is also how you catch wired guests: make a network such as GuestLAN, set its zone to Hotspot, and any device plugged into a port on that network gets the same portal.
3. Build the landing page
Go to Insights, then Hotspot, then Landing Page. Here you set the branding and choose how guests get through. UniFi offers:
| Method | How it works | Suits |
|---|---|---|
| Password | One shared code on the landing page | A small office, a waiting room |
| Vouchers | Printed codes, each with its own expiry and data or speed limit | Hotels and events |
| Payment | Guests pay through Stripe | Paid hotspots |
| Guests sign in with a Facebook account | Places happy to depend on Facebook | |
| RADIUS | Checks guests against a RADIUS server | Organisations that already run one |
| External portal server | Hands the whole sign-in to another service | Email capture, custom branding, marketing |
The built-in page is perfectly good at letting people online. It is weak at everything after that. There’s no proper email capture with consent, and very little you can do with the list of who connected. That is the gap the external portal option exists to fill.
4. Using an external portal server
With an external portal, UniFi still holds the guest at the hotspot, but it sends the browser to someone else’s server. The redirect carries what that server needs to identify the guest:
http://your-portal/guest/s/default/?ap=94:2a:6f:d0:30:57&id=1c:71:25:63:e4:24&t=1742398732&url=http://...&ssid=guest
Here ap is the access point’s MAC address, id is the guest device’s MAC, url is the page they were trying to reach and ssid the network they joined. Once the guest has done whatever the portal asks, the portal tells your controller to let that MAC address online, with a time limit and optional data and speed caps. From Network 9.1 Ubiquiti publishes an official API for this, with keys generated under Control Plane, Integrations; portals built before that sign in to the controller with an account you create for them.
Two settings make or break it. The portal’s address has to be in the pre-authorization allowances on the landing page settings, or guests’ phones can’t load the portal before they’re authorised. And the portal needs to reach your controller, which may mean opening the controller’s port to it.
Building a portal server yourself is a real project. Most venues use a hosted one. We run a UniFi captive portal for venues, CaptureWiFi, which works exactly this way: each access point can show its own page, and guests can sign in with an email address or pay for access.
Captive portal not showing up?
The phone joins the guest Wi-Fi and no sign-in page appears. These are the causes, roughly in the order we’d check them.
The portal isn’t on for that SSID
Check Settings, WiFi for the guest SSID and confirm Hotspot Portal is enabled. If you used the Hotspot zone instead, confirm the network really is in it. A new SSID copied from an old one doesn’t always bring its settings along.
The phone is already authorised
Once a device has signed in, UniFi remembers its MAC address until the authorisation expires. A phone you tested with yesterday will go straight online and look like a broken portal. Test with a device that has never joined, or remove the authorisation for your test phone from the hotspot’s guest list.
The browser went to an HTTPS site
The access point can only intercept plain HTTP. Phones find the portal by fetching a test page in the background (Apple’s is captive.apple.com, Android’s is connectivitycheck.gstatic.com) and then pop up the sign-in sheet. If that popup is missed and the guest types a bank’s address into the browser, the HTTPS request can’t be redirected and nothing happens. Tell guests to open any plain-http page. http://neverssl.com exists for exactly this.
The portal’s address isn’t pre-authorised
With an external portal, this is the commonest fault. The redirect fires, the browser tries to load the portal, and the hotspot blocks it because the guest isn’t authorised yet. The page spins and times out. Add the portal’s address to the pre-authorization allowances, plus any domains the portal loads from, such as a payment provider.
A certificate warning
An HTTPS portal with a self-signed certificate shows a security warning, and most guests won’t tap through it. Nor should they. Use a hostname with a real certificate if you enable the secure portal option.
A VPN on the phone
An always-on VPN or a custom DNS profile on the guest’s phone can stop the device noticing it is behind a portal. Turning the VPN off until they’re signed in fixes it.
The controller is off
If your UniFi Network application runs on a PC or a server rather than a console or Cloud Key, that machine serves the built-in portal. When it’s switched off, new guests can’t sign in.
For the UniFi gear itself, our Ubiquiti default logins page has the factory credentials. For guest networks on ordinary home routers, see the guest Wi-Fi setup guide, and for what a guest can and can’t reach, guest Wi-Fi vs main Wi-Fi.
