TP-Link Omada, hardware controller

OC200 and OC300 captive portal setup

The portal setting on an OC200 is the same one the cloud and software controllers use. What is different is where the box lives: on your LAN, behind your router, where an internet service cannot reach it unless you give it a way in.

Print my Omada settings All Omada controllers

How do I set up an external captive portal on an OC200?

Open the OC200, go to Settings, Authentication, Portal, edit the portal on your guest SSID and choose External Portal Server. Paste your VoqadoWiFi portal URL, add www.voqadowifi.com and voqadowifi.com to Pre-Authentication Access, then publish the controller on HTTPS port 443 with a trusted certificate so the authorization call can reach it.

At a glance

Where you reach it: The controller address on your LAN, in a browser
Portal setting: Settings, Authentication, Portal, External Portal Server
Portal URL: https://www.voqadowifi.com/portal/your-venue-slug
Walled garden: www.voqadowifi.com and voqadowifi.com
Where the authorization goes: The controller address you enter in the dashboard, on port 443
Needs an inbound path: Yes: a tunnel or reverse proxy with a trusted certificate

Checked against the VoqadoWiFi integration code on 7 October 2026. Controller menu labels move between firmware releases; the setting names above are the ones the setup wizard prints.

Step by step

Open the portal settings on the OC200
Browse to the controller on your LAN, pick the site that carries the guest SSID, and go to Settings, Authentication, Portal. Edit the portal bound to the guest SSID, or create one and bind it.
Set the authentication type to External Portal Server
Switch from No Authentication, Simple Password or Voucher to External Portal Server. From now on Omada redirects unauthenticated devices instead of serving its own page.
Paste the portal URL exactly as the dashboard prints it
Enter https://www.voqadowifi.com/portal/your-venue-slug with no trailing slash and no question mark of your own. Omada appends clientMac, apMac, ssidName, radioId and a one time token to the URL, and a second query string breaks that hand off.
Allow the portal domain before authentication
Add www.voqadowifi.com and voqadowifi.com to Pre-Authentication Access on the same portal. The full list, with the reason for each line, is on the walled garden page.
Give the controller a public HTTPS address on port 443
After the guest submits the form, VoqadoWiFi posts the one time token back to the controller address you saved in the dashboard. That call travels from the internet to your OC200, connects on port 443 and checks the certificate. An outbound tunnel or a reverse proxy with a real certificate in front of the OC200 gives it both.
Enter the controller address and IDs in the dashboard
In the location settings enter the public HTTPS address as the Omada Controller URL, plus the Site ID, and the Controller ID if your redirect URL carries omadacId. Leave the port off: the authorization call uses 443 whatever the address says.
Test from a phone that has never joined
Forget the network on a test phone, turn mobile data off, join the guest SSID and complete the form. Then open Portal Health in the dashboard: a successful attempt means the controller accepted the token.

What breaks on this controller

The controller URL is a LAN address

Typing https://192.168.0.2 into the dashboard works for you and fails for everyone else, because the authorization call comes from the internet. Portal Health records it as a network or timeout failure and the guest sees the portal’s Almost there screen instead of getting online.

A port number that is not 443

The token call connects on port 443. A controller that only answers on another port refuses the connection even though the address in the dashboard looks right. Publish it on 443, or put a proxy on 443 in front of it.

The factory self signed certificate

The token call checks the certificate. A self signed certificate fails that check and the attempt falls through to the credential methods; with none configured, Portal Health shows auth with “Token-based auth failed and no operator/API credentials configured”.

The guest took too long on the form

Omada’s token is short lived. If it has expired the controller answers -1001 and the token is rejected. A short form fixes most of this; rejoining the network issues a fresh token.

Why a box on your LAN needs an inbound path at all

Omada’s external portal hand off has two legs. The first is the redirect: the access point sends the guest’s phone to your portal URL with the device details and a one time token attached. That leg never touches your router’s inbound rules, because the phone is already inside.

The second leg is the authorization. Once the guest has signed in, VoqadoWiFi’s servers return the token to the controller, and the controller opens the firewall for that device. That leg starts on the internet and ends at the OC200. If nothing on your network answers it, the guest gives you an email address and then stays offline.

An outbound tunnel solves this without opening a port: a small connector inside the venue holds a connection open to the tunnel provider, and requests to a hostname you own travel down it to the OC200. It also survives carrier grade NAT, where port forwarding is impossible.

Questions

Is the OC300 set up the same way?

Yes. The OC300 has the same Settings, Authentication, Portal path and the same External Portal Server option. The difference is capacity, not the portal.

Do I need Omada cloud access turned on?

Not for the portal. The redirect comes from your access points and the authorization goes to the controller address you save in the dashboard. Cloud access is a separate remote management feature.

What happens to guests if the internet drops?

New guests cannot sign in, whatever the controller, because the portal and the authorization both depend on the internet. The OC200 keeps your staff network and settings running; it cannot keep an internet hosted login page reachable.

Where do I see whether authorization worked?

Portal Health in the dashboard lists every attempt with its result, the error kind (network, timeout, ssl, auth, controller or unknown) and the Omada error code when there is one.

Deeper reading

Longer articles from the blog that cover this controller. Where an article and this page disagree, this page is the one checked against the current integration.

Omada cloud vs local controller. Cost and failure modes of the OC200 against the other two options.
Guest VLAN segmentation. Keep authorized guests away from your point of sale.
How the captive portal mini browser behaves

Keep reading

Omada setup hubThe steps every Omada controller shares.Omada authorization error codes Omada Software Controller setup Walled garden domains

Sources: lib/omada/api.ts and the setup wizard, read on the date above. TP-Link and Omada are trademarks of TP-Link Technologies. VoqadoWiFi is not affiliated with or endorsed by either vendor.

Run your Omada portal free

One location and 25 guest logins a month on the Starter plan, no card. The dashboard prints the finished portal URL for this controller.