Every captive portal has a side door: the short list of things reachable before login. Used well, it is how a guest pays for the room or reads your terms hosted on your own site. Used carelessly, it quietly becomes the whole internet, one exception at a time.
Portals call this the walled garden; on Untangle it lives on the Passed Hosts tab and it is really two different lists wearing one name. Pass Listed Server Addresses are destinations a captured guest may reach before logging in. Pass Listed Client Addresses are devices that never see the portal at all. Confusing the two is the classic mistake — one opens a window for every guest, the other unlocks the door for one device. This guide keeps them separate and brutally short.
A captured guest's traffic is held, but some destinations must work before any login exists:
Add entries one at a time, test as a guest, and write a note beside each saying why it exists. An entry nobody can explain is an entry to delete.
This list exempts the device, permanently, portal or no portal. Legitimate residents are few: the reception PC that must work before anyone logs in, your own phone for testing the network as an insider, a fixed device like a lobby display that cannot type passwords.
Every other request for this list is a convenience you will regret. A staff member's personal phone does not belong here — staff should use the staff network. A guest who "stays all month" gets an account, not an exemption: accounts end, exemptions are forever and invisible.
The failure story writes itself: an admin wants guests to reach the payment page, and adds it under client addresses — achieving nothing, because the payment server is not a client of this network. Or they add a guest's phone as a "server" and wonder why nothing changed. When a pass does not work, the first question is always: did I put it on the list that matches what it is? Servers are destinations out there; clients are devices in here.
A walled garden is a promise about what is reachable without identity. Keep the promise small enough to keep.
Both lists, set up and tested live in the full captive portal video.
▶️ Watch Full VideoThe payment page is a server, so it goes under Pass Listed Server Addresses. If the page pulls files from other addresses (a payment processor's own domain, for example), those addresses need listing too — test the complete payment flow as a guest, not just the first page.
Portals work most reliably with addresses, and Untangle's Passed Hosts lists are address-based. Services whose addresses change or multiply (big CDNs especially) are genuinely awkward here — that friction is information: the more addresses a pre-login feature needs, the more you should ask whether it belongs behind the login instead.
There is no magic number, but there is a working test: can you explain every entry, out loud, in one pass? The day a list needs scrolling and shrugging, it has stopped being a garden wall and become an unreviewed firewall policy. Audit it back down.