Unifi Captive Portal Page not loading

[NorthernNoel]

I set this up ages ago elsewhere and it worked fine, I'm trying to setup a guest network with Unifi captive portal in place. Going through the process again but having issues. I've built a segregated network on the switches, added it to the Smoothwall so have the following working:
1. transparent proxy so doesn't ask for auth.

2. DHCP on the Smoothwall.
3. DNS set to the Smoothwall.

4. DNS allowed to the Smoothwall.

5. firewall rule to allow traffic to the Unifi controller address.

6. firewall rule to allow traffic out to the web.

That works great, however as soon as I enable captive portal it doesn't do anything. The device will just connect to the internet without prompting for the captive portal page. If I go to http://CONTROLLERIP:8880/guest/s/default/ on a domain PC I can see the captive portal page. However, if I do it on a guest device then I just get a blank page with the header (Hotspot Portal). The firewall logs show the traffic being passed through so I think it's something on the Unifi that is obvious that I've missed.

[NorthernNoel]

A bit more investigation leads me to believe that Unifi doesn't like your guest network to be on a separate VLAN to the controller. Ubiquiti say that this is working as design! As a test I stuck the guest network on the same VLAN and bang it worked straight away. Now trying to decide if moving the controller IP to the guest VLAN and locking it down by local firewall is good enough.

[Davit2005]

1 hour ago, NorthernNoel said:

A bit more investigation leads me to believe that Unifi doesn't like your guest network to be on a separate VLAN to the controller. Ubiquiti say that this is working as design! As a test I stuck the guest network on the same VLAN and bang it worked straight away. Now trying to decide if moving the controller IP to the guest VLAN and locking it down by local firewall is good enough.

😲 that is crazy. Make sure controller fully locked down if that is the case but I'd certainly ask on forums. Seems a design flaw and opens up controller to abuse if not able/aware to secure.

[Boredguy]

Strange since I have my Unifi OS controller on a different vLan than my BYOD devices and they get the captive portal happily.

 

I assume you remembered to put the IP address of the server in the pre-approved list on the Unifi Hotspot page?

[nicholab]

Does Smoothwall offer a captive portal page?  It might be easier to get this to work.

[tom_newton]

Yes it does. Known as "ssl login" 

[synaesthesia]

As @Boredguy - we have ours on a separate VLAN and portal works fine there too, it's not a Unifi limitation by any means. 

[NorthernNoel]

On 13/04/2026 at 17:33, Boredguy said:

Strange since I have my Unifi OS controller on a different vLan than my BYOD devices and they get the captive portal happily.

 

I assume you remembered to put the IP address of the server in the pre-approved list on the Unifi Hotspot page?

Yeah I've tried that the best I've found is this workaround: Captive portal/landing page not working when using different VLAN -Workaround- | Ubiquiti Community however, I still don't like it.

[NorthernNoel]

11 hours ago, tom_newton said:

Yes it does. Known as "ssl login" 

Thanks Tom, this might be the answer. I've been going down a rabbit hole looking at different captive portal options. Didn't realise Smoothwall has one!

Edit: actually of course I know what the SSL login page is now I've looked. I think it's probably a bit limited for what I want as I'm looking at implementing a voucher scheme. Don't think SSL login has that?

[synaesthesia]

I don't understand what the actual issue is - only the portal needs to be on the same VLAN and as long as you can get your clients access to that which isn't at all difficult; are you doing my favourite trick of overcomplicating/overthinking it?

[NorthernNoel]

The portal sits on the controller. The controller is in a different subnet, opened the firewall to allow access to the portal site however it doesn't work. The firewall shows green for allowing traffic through (I even set a test rule to allow all traffic in case I was missing something). However, as the guest network is on a different subnet the controller just rejects it. I say rejects it, it actually does nothing and just gives them internet access without the portal page loading. If I manually try to access the portal page it's just a blank page. If I stick the guest network on the same subnet it works straight away.

However I do feel as though I've missed something obvious! I had this working in 10 minutes previously and can't see what I've done different 😂

[synaesthesia]

Ah - is the controller on the same subnet as the access points though?

 

A quick look at my setup and it's thus:

 

Controller (and portal) along with APs are on their own VLAN

Guest SSID is on it's own VLAN

DHCP for this handled by Smoothwall (worth checking gateway addresses are correct)

Firewall rule in place on Smoothwall to allow unrestricted access to the UniFi portal on port 8880 - another thing worth checking, I forgot it has a different port!

 

[Boredguy]

So if you go to your Hotspot configuration page, do you have your server IP address listed in the Authorization Access -> Pre-Authorization Allowances section?

I have a dedicated DHCP server for my BYoD devices on vLan 80 with a 172.x.x.x range.

My Unifi controller is sat on vLan 1 with a 10.x.x.x range.

In the Pre-Authorization allowance I've got my 10.1.2.3/32 address of the server entered there and page loads fine.

I've also got the externally accessible IP address listed since I'm running Unifi Server OS and got a few of our primary schools setup as dedicated sites within the same server

[NorthernNoel]

I got all excited thinking that was it but no dice I'm afraid 😞

Controller (portal) and APs all on their own VLAN (I had a thought that might not be the case)
Guest SSID is on it's own VLAN
DHCP handled by the Smoothwall with correct gateway
Firewall rule in place (I got brutal and opened it all up between the two for testing) and traffic showing green in the firewall logs

I'm lost as to why it's not working and Unifi support are about as useful as a chocolate fireguard. Are you on Unifi OS with Network 10.2.105?

[NorthernNoel]

3 minutes ago, Boredguy said:

So if you go to your Hotspot configuration page, do you have your server IP address listed in the Authorization Access -> Pre-Authorization Allowances section?

I have a dedicated DHCP server for my BYoD devices on vLan 80 with a 172.x.x.x range.

My Unifi controller is sat on vLan 1 with a 10.x.x.x range.

In the Pre-Authorization allowance I've got my 10.1.2.3/32 address of the server entered there and page loads fine.

I've also got the externally accessible IP address listed since I'm running Unifi Server OS and got a few of our primary schools setup as dedicated sites within the same server

Tried it with and without and no difference

[synaesthesia]

16 minutes ago, NorthernNoel said:

I got all excited thinking that was it but no dice I'm afraid 😞

Controller (portal) and APs all on their own VLAN (I had a thought that might not be the case)
Guest SSID is on it's own VLAN
DHCP handled by the Smoothwall with correct gateway
Firewall rule in place (I got brutal and opened it all up between the two for testing) and traffic showing green in the firewall logs

I'm lost as to why it's not working and Unifi support are about as useful as a chocolate fireguard. Are you on Unifi OS with Network 10.2.105?

Yup exactly that version.

I don't think any of these settings would be related but just in case our unifi guest network settings are as follows:

 

And the hotspot settings - pre auth allowances in place for the controller IP, core switch IP, smoothwall IP and the guest network IP range as well as gstatic.com which I recall being important but shouldn't be related to your issue.

Post auth restrictions are the usual array of internet networks and a couple of our internal ranges not related to guest wifi.

 

With a little luck it'll be one little setting!

 

 

 

[NorthernNoel]

Thanks, I've gone down an absolute rabbit hole today but have a captive portal working. As I wasn't getting anywhere I figured, Unifi captive portal isn't working for me so I'll find an alternative!

 

After looking around for a bit I decided on OPNSense, it's overkill for what I need but has a captive portal built in. Setup a basic firewall with it and positioned it between the guest network and the Smoothwall. Then went about learning how to get all of the functions I need working. DHCP is now done by OPNSense with an option added to force captive portal. OPNSense firewall is locked down so guest clients can't get to anywhere apart from the internet. All traffic from OPNSense is filtered using a transparent proxy on the student rule in Smoothwall.

 

I've had a good go at trying to get around it and am reasonably satisfied that it's working within it's limitations. Now just tidying up the captive portal page to give it a corporate school branding and then going to look at applying a real world cert to the captive portal page.

[Boredguy]

We use Opnsense, but it's just for doing the DHCP, DNS and Firewall rules

[synaesthesia]

Have been using OPNSense at home in place of the awful Virgin router, mostly to better control what my kids are up to and set times/allowances/bandwidth limitation to them  It's awesome!

[NorthernNoel]

1 hour ago, synaesthesia said:

Have been using OPNSense at home in place of the awful Virgin router, mostly to better control what my kids are up to and set times/allowances/bandwidth limitation to them  It's awesome!

Same for me! I'm amazed how solid it is for a free product. Never been confident enough to jump over at work but actually it's making more and more sense.