In brief
Guests join the Wi-Fi but the login page never appears. VLAN mapping, DNS-over-HTTPS, the AP's own portal, walled garden gaps, HTTPS first page, wrong DHCP and clock issues, with a check order.
Same symptom, different causes
A guest joins the Wi-Fi on their phone, sees a "no internet" warning, and the login page never shows up. Or the page appears on some phones and not on others. This is the most common support request in captive portal deployments, and it almost always calls for a look at the network set-up before the box.
Below are seven causes, how to recognise each one and how to fix it. At the end is the check order we recommend; follow it in sequence and most problems are solved in the first three steps.
1. The SSID lands on the wrong VLAN
If the guest SSID on the access point is not tagged to the guest VLAN, the phone either ends up on the staff network or gets no IP at all. The portal listens on the box's guest interface; a phone that is not on that network will never see the page.
How to tell: Look at the IP address the phone received. If it is not in the guest range (for example 192.168.1.x instead of the 10.x range the box hands out), this is the problem.
Fix: Bind the guest SSID to the correct VLAN ID on the AP. On the switch, confirm that the AP's port carries that VLAN tagged and that the same VLAN reaches the box's guest interface.
2. DHCP comes from another device, not the box
If there are two DHCP servers on the guest network (the modem and the box), the phone takes an IP from whichever answers first. A phone that gets its IP from the modem uses the modem as its gateway; it never sees the box, no portal appears, and no record is kept either.
How to tell: If the phone's gateway address is not the box's guest IP, another DHCP server is active.
Fix: Only the box should serve DHCP on the guest VLAN. Make sure the modem's DHCP does not reach that VLAN. For the access record to be consistent, DHCP, NAT and the portal need to be on one device anyway; this is a record problem as much as a connectivity problem.
3. The AP's own portal is still on
Many access points and cloud-managed AP systems host their own captive portal. If that feature stayed on when you installed the box, two portals collide: the phone sees the AP's page first, and the box's page never appears or flips back and forth.
How to tell: The login page that appears is not your branded page but the AP vendor's default page.
Fix: On the AP, disable captive portal, splash page and any "guest policy" type feature for the guest SSID. Client isolation can stay on; it is unrelated to the portal and recommended.
4. Gaps in the walled garden
The walled garden is the list of addresses reachable before login. The addresses the phone needs to display the portal, and those needed for the SMS code, must be on that list. If the list is incomplete, the phone cannot complete its "is there internet" check and does not open the login page, or the page opens with missing parts.
How to tell: The page appears but a logo, font or button does not work; or some phone brands never open it.
Fix: Add every external resource the portal page uses (fonts, images, the post-login redirect address) to the walled garden. Confirm that the addresses operating systems use for connectivity checks are not caught by the portal redirect. If possible, design the portal page without external resources; that is the most robust route.
5. The first page is HTTPS or HSTS
A captive portal catches the phone's first unencrypted (HTTP) request and redirects it to the login page. If the guest opens a browser and goes straight to an HTTPS site, the box cannot redirect that request; if it tried, the browser would show a certificate error. On sites using HSTS the browser never even attempts HTTP.
How to tell: The phone says "connected, no internet", the guest opens a site in the browser and sees a certificate error or a blank page.
Fix: This is not a box fault; it is modern browser behaviour. The cure is to make the operating system's automatic portal detection work (steps 1 to 4). A one-line hint for guests also helps: "tap the network in Wi-Fi settings" or "type this short address in your browser". That address must be in the walled garden and must work over HTTP.
6. DNS-over-HTTPS or a private DNS
If the phone sends its DNS queries encrypted (DoH) or to a manually configured private DNS server, it never receives the DNS answer the box uses for redirection. The connectivity check fails and the portal does not appear.
How to tell: On the same network the portal appears on some phones but not on those with "private DNS" or "secure DNS" switched on.
Fix: Before login, allow only the box's DNS on the guest network; block pre-login access to external DNS addresses and known DoH endpoints with a firewall rule. Most operating systems fall back to system DNS when DoH fails, and portal detection then works. After login, guests using whatever DNS they like is not a problem.
7. Clock and certificate
If the box's clock has drifted, two things break. If the portal uses HTTPS, the certificate is treated as "not yet valid" or "expired". On the timestamp side, records are stamped with the wrong time. If the name on the portal certificate does not match the portal address, the browser warns as well.
How to tell: The panel shows an NTP drift warning, or the browser's certificate error points to a date problem.
Fix: The box monitors NTP synchronisation and warns in the panel when drift grows. Confirm that pre-login access to the NTP server is open. Check that the certificate name matches the portal address and that it has not expired.
Recommended check order
| Step | Check | Symptom if the problem is here |
|---|---|---|
| 1 | Are the phone's IP and gateway in the box's guest range? | If not: VLAN mapping (1) or wrong DHCP (2) |
| 2 | Is the page that appears your portal? | If it is the AP's page: AP portal on (3) |
| 3 | Any NTP or certificate warning in the panel? | If so: clock/certificate (7) |
| 4 | Does the page open but incomplete? | Walled garden (4) |
| 5 | Only some phones affected? | Private DNS/DoH (6) |
| 6 | Is the guest opening an HTTPS site directly? | HSTS/HTTPS first page (5) |
The first three steps concern the network set-up and close most cases. The only step that belongs to the box is clock and certificate, and the panel tells you about that one anyway.
Prevent it before installation
- Plan the guest VLAN from the switch to the AP in one pass.
- Turn off every portal and splash feature on the AP.
- Design the portal page without external resources; if you use any, add them to the walled garden.
- Connect the alarm channel (e-mail/Telegram/webhook) in the panel on installation day so NTP and offline warnings reach you.
Deployment details are on the box and virtual appliance pages. For installation support, contact us.