Skip to content
See the demoStart free
Networking

What is Captive Portal?

Definition

A captive portal is the web page a network forces a device to load before it grants internet access. The network intercepts the first request from a newly joined device and redirects it to that page, where the guest logs in, accepts terms, or enters details. Access opens only once the portal approves the session.

How a captive portal actually intercepts traffic

When a device joins the network it is placed in an unauthenticated state. The gateway holds the device in a restricted policy where DNS resolves but almost all outbound traffic is blocked or rewritten. The moment the device makes its first HTTP request, the gateway answers with a redirect to the portal URL instead of the requested page. Modern operating systems no longer wait for the user to open a browser: iOS, Android, macOS and Windows all fire a connectivity check to a known endpoint immediately after association, notice that the response is not what they expected, and pop the portal in a dedicated mini-browser. That is why a login screen appears "by itself" on a phone. Once the portal authorises the session, the gateway moves the device MAC address into an authorised policy and traffic flows normally until the session expires.

Where the portal runs matters

There are two broad architectures. In an internal portal, the login page is served by the access point or the controller itself, which keeps everything on the local network but makes design, integrations and reporting difficult. In an external captive portal, the gateway redirects to a page hosted on the public internet, which then calls back to the controller to authorise the session. External portals are what make marketing features possible, because the page can be a full web application with a CRM behind it rather than a static form baked into networking firmware.

Common failure modes

Portals break in predictable ways. If HTTPS interception is attempted, browsers show certificate warnings, so well-built portals redirect only plain HTTP and rely on the OS connectivity check for everything else. If the portal domain is not in the walled garden, the redirect itself gets blocked and the guest sees a spinner forever. If session timeouts are too aggressive, guests are asked to log in repeatedly and abandon. And if the portal is not responsive, the OS mini-browser, which is often a small window with no address bar, renders it unusably.

Run a guest WiFi login on your own network

VoqadoWiFi runs branded guest portals on TP-Link Omada and Ubiquiti UniFi networks. The Starter plan is free forever: one location, 500 logins a month, consent logging included.

Common questions about captive portal

Is a captive portal the same thing as a splash page?

They overlap but are not identical. The captive portal is the whole mechanism: interception, the login page, and the authorisation handshake with the network. The splash page is the specific screen the guest sees. Every splash page is served by a captive portal, but the portal also includes the plumbing the guest never notices.

Why does the login screen sometimes not appear?

Usually because the device cached a previous session, because the OS connectivity check endpoint is unreachable, or because a DNS-over-HTTPS setting bypasses the network resolver. Opening a plain HTTP address in a browser normally forces the redirect to fire.

Do captive portals slow the network down?

The portal only affects the authentication step. Once a session is authorised, traffic is forwarded by the access point or gateway exactly as it would be on an open network, so throughput is unaffected.

Related terms

Captive Portal rarely comes up on its own. These are the entries operators usually read next.