Captive Portal Setup on Untangle Firewall Complete Guide
Guests join your WiFi and the internet simply works — no name, no terms accepted, no record. A captive portal fixes that: every guest first lands on your login page, accepts your usage terms or signs in, and only then touches the internet. Here is the full setup on the Untangle firewall.
✍️ Technical Anshu📶 Guest WiFi on Untangle⏱️ 10 minute read
🎥 The complete Untangle captive portal setup, live on screen — watch the video alongside this guide
A captive portal is a gate, not a decoration. On Untangle (now sold as Arista Edge Threat Management), the Captive Portal app holds a guest's traffic at the firewall until that guest completes your page — a button that says they accept your terms, or a real login checked against Local Directory, RADIUS or Active Directory accounts. Only then does the firewall let their traffic through. This guide builds it in the right order: isolated guest network first, portal second, test last. One honest warning before we start: a portal identifies guests and records their acceptance — it does not encrypt anything. Your WiFi password still does that job.
Status: ON
Capture Rules: [ Guest interface traffic → CAPTURE ]
Captive Page: Basic Login
Authentication: Local Directory
Passed Hosts: 2 server addresses, 1 client address
Active Sessions: 3 guests signed in
[ Test the portal from a phone before real guests arrive ]
What a working Captive Portal app looks like on Untangle — capture rules on the guest side only, one clear login method, and a short passed-hosts list. Panel drawn for illustration.
1
What the Portal Really Does, in One Minute
When a guest device joins, Untangle's Capture Rules decide whether that machine is "captured". A captured machine can reach almost nothing — the firewall answers its first web request with your portal page instead. The guest completes the page, the firewall marks the machine as passed, and normal internet access begins until the session ends.
It is an identity layer — you learn which account (or at least which device, and when) used your connection.
It is a terms layer — the guest actively accepts your usage policy before getting access, which matters for hotels, cafes and offices.
It is not a security boundary by itself — isolation between the guest network and your office LAN is a separate job, covered in step 2 and in the isolation guide in this series.
2
Plan First — Guest Network, Then Portal
Never switch the portal on against your main office LAN as a first experiment: every staff laptop and printer becomes a "guest" and work stops. The safe shape is:
A separate guest SSID on its own interface or VLAN, with its own subnet — the firewall sits between guests and everything else.
Firewall rules that let the guest subnet reach the internet but not office PCs, servers or NAS boxes.
The Captive Portal app capturing traffic only on that guest side.
One decision made in advance: terms-only page, or real accounts? Step 4 covers the choice.
If your guest network does not exist yet, build it first — the separate guide on guest WiFi isolation in this series walks through it.
3
Install the App and Write the Capture Rules
On the Untangle console the portal is one of the apps in the rack:
Open Apps and install Captive Portal (on current systems the same platform is branded Arista Edge Threat Management — the app and layout are the same).
Open the app's Settings and find Capture Rules.
Enable the example rule pattern that captures traffic arriving on your guest interface — the rule matches source interface, so office traffic is never captured.
Leave the portal OFF until the page and authentication in step 4 are ready, then turn the app on.
Capture rules can also match addresses and other conditions, which is how you would capture, say, only the conference-room network. For a first setup, one rule — guest interface in, capture on — is the honest scope.
4
Choose How Guests Get In
On the Captive Page tab pick the page style — start with Basic Login. Then set the method on the User Authentication tab:
Acknowledgement only — the guest reads your message and presses OK. No identity, but the terms were shown and accepted; right for a small cafe.
Local Directory — accounts you create inside Untangle itself. Reception makes a guest an account; the guest signs in with it. Right for offices and hotels that want a name attached.
RADIUS or Active Directory — the firewall asks your existing server. This needs the Directory Connector app as well, and it is how larger offices give staff-grade identity on guest or BYOD networks.
Write the page text like a notice, not a contract essay: who runs this network, what is logged, how long a session lasts, and one line of plain terms. Guests actually read short pages.
5
Add Passed Hosts, Then Test Like a Guest
Two short lists on the Passed Hosts tab finish the build:
Pass Listed Server Addresses — servers a guest may reach before logging in, such as your own booking or payment page. Keep this list as short as you can.
Pass Listed Client Addresses — devices that skip the portal entirely, like your own phone or a reception PC.
Now test honestly: on a phone, forget the guest network, rejoin, and wait for the portal to pop up by itself. Sign in, browse two or three sites, then check Active Sessions in the app — your phone should be listed.
Also test the failure path: a wrong password should fail cleanly, and a guest device should not be able to open an office printer or file share.
If the page does not pop up on the phone, do not start changing random settings — that exact problem has its own guide in this series, and it is almost never the portal itself.
⚠️ The one mistake that hurts: turning the portal on against the wrong interface. If the capture rule catches your office LAN, every staff machine is held at a login page and the phones start ringing. Capture the guest interface only, and test from a phone before you announce the network to anyone.
🎥 Watch the Full Setup in the Video
Every click from this guide — installing the app, the capture rule, the page and the test — shown live on the Untangle console.
Captive Portal is one of the long-standing apps in the NG Firewall app set, and Untangle's platform keeps a group of core apps available without a paid package. Untangle is now sold as Arista Edge Threat Management and packaging changes over time, so check the Apps screen on your own box — if Captive Portal installs and runs, you have what this guide needs. Features like Active Directory authentication additionally need the Directory Connector app.
Does a captive portal make my guest WiFi secure?
Not by itself. A captive portal identifies guests and records that they accepted your terms — it does not encrypt their traffic and it does not isolate them from your office network. Encryption is the WiFi password's job (WPA2 or WPA3), and isolation is the job of a separate guest network with firewall rules, which this guide treats as step one.
Can guests get in without creating accounts?
Yes. The simplest mode is an acknowledgement page: the guest reads your message and presses OK to continue, with no username at all. You give up knowing exactly who it was — the firewall still logs the device and the time — but for a small cafe or a waiting room that trade is often the right one.
This guide is based on the Technical Anshu captive portal video • Stuck on a step? Ask in the video comments — you will get a reply 🙏