Walled garden domains for a VoqadoWiFi portal
Before a guest is authorized, the controller blocks everything except a short allow list. Get that list wrong in one direction and the portal never loads; get it wrong in the other and the portal never appears. Here is the exact list, and the reasoning behind every line.
www.voqadowifi.com and voqadowifi.com. On Omada they go in Pre-Authentication Access on the portal; on UniFi in Pre-Authorization Access in the hotspot settings. Do not add the phone connectivity check domains or broad wildcards.TP-Link Omada
Settings, Authentication, Portal, then the portal bound to your guest SSID. Open Pre-Authentication Access, enable it, and add each line as a URL entry.
www.voqadowifi.com voqadowifi.com
The External Portal Server URL itself is separate: it is https://www.voqadowifi.com/portal/your-venue-slug. Full Omada setup.
Ubiquiti UniFi
In the Network application open the hotspot settings for the guest network (Landing Page on current releases, Guest Control on older ones) and add each line to Pre-Authorization Access. Leave HTTPS Redirection off while you are there.
www.voqadowifi.com voqadowifi.com
The External Portal Server field takes the host www.voqadowifi.com; UniFi adds /guest/s/<site>/ itself. Full UniFi setup.
Why each entry is there
| Entry | What it carries before login | What breaks without it |
|---|---|---|
| www.voqadowifi.com | The portal page, its scripts and styles, the venue logo and background (proxied through the same host), the UniFi entry path /guest/s/<site>/, and the form submission itself. | Everything. The phone is sent to a page it is not allowed to load and shows a spinner, a blank window or a timeout. |
| voqadowifi.com | Requests to the bare domain, which answer with a permanent redirect to www. A phone has to be allowed to receive that redirect before it can follow it. | Any link or setting that uses the bare domain stalls before it reaches the portal. |
The short list is deliberate. Venue logos and background images are stored with a hosting provider, but the portal fetches them through its own address, so that provider never has to be reachable before login. The portal also signs guests in with an email form rather than a social login, so no identity provider needs an exception.
Optional: the brand fonts
The portal requests its fonts from fonts.googleapis.com and fonts.gstatic.com without blocking the page. Before login those hosts are usually blocked, so the portal draws in the phone’s system font and works exactly the same. If the brand font matters to you on the first screen, add both. They are not in the setup wizard’s list because the portal does not need them.
fonts.googleapis.com fonts.gstatic.com
What to leave out, and why
The phone connectivity checks
Phones decide whether to open the login window by fetching a known address right after joining: Apple devices use captive.apple.com, Android devices a generate_204 address, Windows its own test host. If that request succeeds, the phone concludes it is online and never shows your portal. These must stay blocked until the guest is authorized.
Broad wildcards
Every entry is free internet for anyone who has not signed in. A wildcard for a large provider opens a large slice of the internet and can also satisfy a connectivity check by accident. Allow exact hostnames only.
Analytics and ad tags
Nothing on the portal needs them before login. Anything you measure belongs after authorization.
Test it from a phone in two minutes
- Forget the guest network on a phone and turn mobile data off.
- Join the guest SSID. The login window should open by itself within a few seconds.
- If it opens but stays blank or unstyled, the walled garden is incomplete. Check both entries are saved on the portal bound to this SSID.
- If it never opens, try any plain
http://address in the browser. If that redirects to the portal, the phone simply did not trigger its check; if it loads the real site, the device is already authorized or something on the list is too broad.
Questions
Which domains do I need in the walled garden for VoqadoWiFi?
Do I need to add Google or Apple domains for social login?
Should I add the phone connectivity check domains?
My portal loads without the brand font. Is something missing?
Does the walled garden still apply after the guest logs in?
Keep reading
List checked against the setup wizard and the portal code on 7 October 2026. If the portal ever starts loading something from another host, this page and the wizard change together.
Get your portal URL to go with the list
Create the free account and the dashboard prints the portal address for your controller. One location and 25 guest logins a month, no card.