NWA, WAX, NebulaManaged APDirect
Hotspot-Box with Zyxel
Zyxel NWA and WAX series access points work with Hotspot-Box directly. Through Nebula cloud management or the device's local interface you attach the guest SSID to the box's LAN side (or to the guest VLAN); the login screen, SMS verification and Law 5651 records stay on the box. Nebula and the local interface use different menu names, and they change with firmware, so we describe each setting by its function.
The one setting that changes on the AP
Attach the guest SSID to the VLAN that exits to the box's LAN and turn off Zyxel's own captive portal for that SSID.
Step by step
- 1
In Nebula (or the local interface) create the guest SSID and enter the VLAN ID that reaches the box's LAN.
- 2
The switch port the AP hangs off must carry that VLAN tagged; with a Zyxel switch, Nebula configures it from the same place.
- 3
Leave Zyxel's captive portal / guest login feature off on the SSID.
- 4
Turn on the isolation option that blocks client-to-client traffic (layer-2 isolation / intra-BSS blocking).
- 5
If a Zyxel gateway or Nebula serves DHCP on the guest VLAN, switch it off; the box hands out the addresses.
- 6
Test: join the guest SSID, the box's screen should open, and the SMS code should get you online.
Common traps
If Zyxel's own portal stays on you get two login screens and the box's record is incomplete.
Layer-2 isolation comes with an allowed-MAC list; if you do not add the box's LAN MAC, guests never reach the box.
The 'guest' label in Nebula does not carry a VLAN by itself; enter the VLAN ID explicitly.
With a Zyxel security gateway (USG/ATP), the guest VLAN must exit through the box, not the gateway.
WAX models differ in PoE class; 802.3af power is not enough for some models and throttles the radios.
Frequently asked
Does guest Wi-Fi stop if the Nebula licence expires?
The Nebula licence only affects Zyxel's management features. The SSID keeps broadcasting; guest login and records happen on the box, so nothing is interrupted.
Do I need Zyxel's RADIUS support?
No; bridge mode is enough for most businesses. If you wish, the AP can be registered with the box's RADIUS server as a NAS.
Is there a difference between the local interface and Nebula for the box?
No. The settings you look for are the same in both: guest SSID on the right VLAN, portal off, isolation on, DHCP on the box.
Menu names and locations change with firmware versions; this page describes each setting by its function. Screenshots are available from your installer or from us.