Manual Captive Portal

Captive Portal (Guest WiFi)

Location: Firewall → Captive Portal

Adds a splash/login page in front of your Guest WiFi network — the kind you see at a café or hotel, where a device has to click through (or enter a password) before it gets real internet access. This is a pure nftables implementation with zero new package dependencies; it doesn't change how guest isolation itself works (guest devices already can't see your other devices), it just adds an authentication gate in front of that existing guest network.

Prerequisite: captive portal only applies to interfaces already flagged as a guest network. Set up your Guest WiFi first on Basic Setup (Connection → Basic → WiFi guest network toggle) — the portal detects which AP(s) are guest networks automatically from that setting; there's nothing to link up manually between the two pages.

How it works, in short

1. A guest device joins your Guest WiFi SSID as normal (WiFi encryption, if any, is unaffected — the portal is a separate layer on top).
2. Until that device's IP+MAC pair is in the router's authorized list, its web traffic is redirected to a splash page served by a second, separate web server instance on the router (not the admin UI).
3. The guest clicks through (or enters a password, depending on your Authentication Mode), and the router adds that device to an nftables set with a timeout matching your configured session length — no separate cron job or timer needed, the firewall itself expires the entry.
4. Once authorized, the guest is redirected onward (to the URL you configured, or Google's generate_204 captive-portal-detection endpoint by default) and browses normally until the session timeout is reached, at which point they'll see the splash page again.

Settings

Field	Meaning
Enable captive portal for guest WiFi	Master on/off switch.
Gateway Name	The name shown as the page title/heading on the splash page guests see — e.g. your business or network name.
Authentication Mode	Click-through (no password) — guests just click Connect, no credentials needed (still gives you the session-length control and a place to show terms of use). Username / Password — guests must enter a password (username is collected but not checked — see below) before they're let through.
New Password	Only shown in Password mode. Leave blank to keep the current password. "The password is hashed before it is stored, never saved in plain text."
Session Length (minutes)	How long an authorized device stays authorized before it has to click through / log in again.
Portal Port	The port the splash-page web server listens on.
Redirect URL After Login (optional)	Where an authorized guest is sent after successful login. Leave blank to use the default connectivity-check URL.

The Status panel on the page shows two live counts pulled straight from the firewall's own nftables sets, not a separate database: Connected Guest Devices and Authenticated Sessions.

On the "Username" field in password mode

The splash page collects a username alongside the password, but it's cosmetic — only the password is actually verified against the stored hash. Don't rely on it to distinguish which guest is which; if you need actual per-guest tracking, that's a bigger feature than this page provides.

Practical example: a simple guest splash page with a shared password

1. Make sure your Guest WiFi is already enabled and working (Basic Setup page).
2. On this page, check Enable captive portal for guest WiFi.
3. Set Gateway Name to something guests will recognize (e.g. "Acme Cafe WiFi").
4. Set Authentication Mode to Username / Password, and set a New Password you can hand out verbally or on a sign.
5. Set Session Length to something like 480 (8 hours) so guests don't have to re-authenticate constantly through the day.
6. Leave Redirect URL blank unless you want guests dropped on a specific page (e.g. your business's website) after logging in.
7. Save. Test from a phone: join the guest SSID, confirm the splash page appears before general browsing works, and disappears once the correct password is entered.

See also

• Basic Setup — enabling the Guest WiFi network this feature gates