Guest WiFi Isolation Comes Before the Captive Portal
The portal is the front desk. Isolation is the locked door behind it. If your guests share one flat network with your office PCs, a login page changes nothing about what a guest device can reach — and that reach is the real risk.
🎥 See the guest-side setup on the firewall in the full captive portal video
Ask what a captive portal protects and most people say “the WiFi”. It does not. It protects the doorway — who gets in, under what terms. What a guest can touch after the door is decided somewhere else entirely: by whether the guest network is a separate, fenced-off network at all. On the Untangle setup from the main guide, the portal and the isolation are two different jobs, and isolation comes first. This page is the honest checklist for that fence.
Firewall view — two networks, two very different rights (illustrative)
Office LAN 192.168.1.0/24 → office servers, printer, NAS allowed
Guest WiFi 192.168.50.0/24 → internet only
Guest WiFi 192.168.50.0/24 → office LAN blocked
Guest client → guest client blocked
Rule that matters: the portal signs guests in.
The fence decides where signed-in guests may go.
The shape to aim for: guests get the internet and nothing else. Addresses are examples — your subnets will differ.
1
One Flat Network Is the Real Problem
Many small offices run one router, one SSID, one subnet — and the file server, the billing PC and every visitor's phone all sit inside it. In that shape, any guest phone can attempt to open the NAS login page, the printer's web panel or a shared folder. Adding a captive portal to that network only adds a login page in front of the same open room.
Portals get blamed for breaches they were never designed to prevent. The design flaw is older and simpler: guests and office machines were the same network.
2
Build the Fence — Interface, Subnet, Rules
Three pieces, in order:
A separate path in. Either a second physical interface on the firewall wired to the guest access point, or a VLAN carried to a managed switch and a guest SSID. Untangle handles both; the VLAN route is what most growing offices end up with.
Its own subnet and DHCP range for guests, clearly different from the office range, so firewall rules and logs read cleanly.
Rules with a default of no. Guest subnet to the internet: allowed. Guest subnet to the office subnet: blocked. Guest to the firewall's own admin pages: blocked. Guest to guest: blocked where your access point supports client isolation.
3
Where the Portal Sits in This Shape
With the fence built, the Captive Portal's capture rule points at the guest interface only. Before login, the fence already limits the guest to the portal page and your pass-listed servers; after login, the fence still limits them to the internet. The portal adds identity and terms on top of a boundary that already exists — which is the only order that makes sense.
This is also why the portal should never be your excuse to skip the fence "for now". A login page on a flat network is a sign-in sheet on an unlocked door.
4
Prove It From a Guest Chair
Do not trust the diagram — sit where a guest sits:
Join the guest SSID on a phone, complete the portal, and browse the internet. That must work.
From the same phone, try the office printer's IP and the file server's IP in a browser. Both must fail.
Try the firewall's admin address from the guest side. It must fail too.
Check the guest can still reach the portal page itself after a session ends — re-login is part of normal life.
If step 2 or 3 succeeds, the portal is irrelevant until the rules are fixed — the fence has a hole, and the honest fix is in the firewall rules, not in the portal settings.
⚠️ One honest exception: a home user with no office machines may not need any of this. The fence matters the moment the same network carries billing PCs, a NAS, printers with scan-to-folder, or anything a stranger's phone should never even see.
🎥 See the Firewall Side in the Video
Interfaces, rules and the portal working together — the full setup is demonstrated on the console.
Can I run a captive portal on my main LAN just for terms acceptance?
You can, and some offices do exactly that for staff acknowledgement pages. Just be clear about what you bought: a record that terms were shown, not isolation. If guests also use that LAN, the exposure is unchanged — move guests to their own network first, then decide whether the main LAN needs a page of its own.
Is a VLAN as good as a separate physical network?
For this job, yes — provided the switch and access point are configured correctly and the firewall is the only path between the VLANs. The mistakes to avoid are trunk ports left wide open and a guest SSID accidentally bridged to the office VLAN. Test from a guest device, exactly as step 4 describes.
My router offers a guest network button. Is that enough?
Often it is a real start: consumer guest modes usually isolate clients and block LAN access. What they do not give you is the portal, per-guest accounts, session control and logs. If the built-in guest mode's isolation tests pass, you can still place the firewall's guest interface behind it — but most offices outgrow the button quickly.
This guide is based on the Technical Anshu captive portal video • Stuck on a step? Ask in the video comments — you will get a reply 🙏