5.7 Hotspot
The captive portal: the page a guest sees before they are allowed onto the network. Use it for guest Wi-Fi, a hotel network, a waiting room — anywhere people you do not administer need internet access on terms you set.
Administration — /hotspot-admin
Portal zones. A zone is one captive network: the interfaces it covers, how a guest proves they may use it, what the portal page says, and the limits that apply once they are in.
The choices that shape a zone:
| Interfaces | Which networks this zone captures. Normally a dedicated guest VLAN — never your own LAN. |
| Authentication | How a guest gets in: no credentials at all (click-through), a voucher, local users, or an external directory or RADIUS server. Several methods can be offered together. |
| Portal page | The text, logo and terms the guest sees. Make it name the venue, so a guest knows they are in the right place. |
| Session limits | How long a session lasts, idle timeout, and bandwidth limits per guest. |
| Allowed addresses | Destinations reachable before logging in — a payment provider, the venue's own website. Keep this list short; everything on it is open to anyone who can associate. |
The portal controls access, not privacy. Guests on the same zone can still see each other unless the network beneath isolates them. If that matters, isolate clients on the access point and give the zone its own VLAN.
Sessions — /hotspot#sessions
Who is on the portal right now: the address, the MAC, which zone, how they authenticated, when they connected and how much they have transferred. An administrator can disconnect a session from here, which drops that device back to the portal page.
Vouchers — /hotspot#vouchers
Generates batches of codes with a validity period, hands them out as a printable list, and tracks which have been used. The standard arrangement for a hotel or a café: a code per guest, valid for a day, no accounts to manage.
A voucher's clock starts when it is first used, not when it is printed — a batch can be made in advance.
Log File — /log/core/portalauth
Every authentication attempt, successful or not, with the address and the method. This is the record you keep when local rules require you to know who was on the network and when; see also System → Compliance.