U6, U7, UniFi NetworkManaged APDirect
Hotspot-Box with Ubiquiti UniFi
UniFi U6 and U7 access points work with Hotspot-Box out of the box. In the UniFi Network controller you point the guest SSID at the box's LAN side (directly or as the guest VLAN); the login screen, SMS verification and Law 5651 records all stay on the box. Menu names vary between controller versions, so this page describes each setting by what it does.
The one setting that changes on the AP
Attach the guest SSID to the network that reaches the box's LAN (or to the guest VLAN) and switch off UniFi's own guest portal for that SSID.
Step by step
- 1
In UniFi Network define a network for guests and give it the VLAN ID that reaches the box's LAN side; the switch ports in between must carry that VLAN tagged.
- 2
Create a new Wi-Fi network (SSID) and attach it to that network; it can be open or password-protected, the box does the identity check.
- 3
Keep UniFi's hotspot/guest portal option off on that SSID, otherwise guests see two login screens.
- 4
Turn on client isolation (guest policies) so guest devices cannot see each other.
- 5
Disable UniFi's DHCP server for this network, or define it as a VLAN-only network; the box hands out the addresses.
- 6
Join the guest SSID with your phone and confirm the box's login screen appears and the SMS code gets you online.
Common traps
If UniFi's own guest portal stays on, guests see the UniFi screen first and then the box's, and the records become inconsistent. Turn it off.
If you define the network as one that NATs through the gateway, guest traffic leaves without passing the box. The guest network must exit via the box's LAN.
A missing VLAN tag on the switch port means the AP broadcasts, but guests never get an address.
Fast roaming and band steering do not affect the box; enable isolation only on the guest SSID, not on the staff SSID.
U6/U7 models differ in PoE class; underpowered PoE makes the AP reboot and drops guest sessions.
Frequently asked
I use a UniFi Dream Machine or Cloud Gateway. Where does the box go?
Behind the gateway, on the side where the guest VLAN comes out. The gateway only routes; the guest login screen, speed plan and Law 5651 records live on the box.
Do I need UniFi's RADIUS support?
No. Most installations run in bridge mode. You only enable RADIUS in special cases where you want the AP to report sessions to the box as a NAS.
Should the guest SSID have a password?
Your choice. An open SSID is the easiest; if you set a password you print it on table cards. Either way the box verifies identity with the SMS code.
Menu names and locations change with firmware versions; this page describes each setting by its function. Screenshots are available from your installer or from us.