UniFi External Captive Portals - getting started

Last updated: 29 October 2026 · Tested on UniFi Network 10.x

This guide shows you how to point a UniFi controller at Fydelia as its UniFi external captive portal server. It covers the guest network and SSID, the Hotspot Portal (External Portal Server) settings, the pre-authorisation (walled garden) list, the controller admin user Fydelia needs, and how to test and fix the setup. It works with UniFi Dream Machines (UDM / UDM Pro), Cloud Keys, self-hosted controllers and hosted UniFi controllers.

Quick links: How it works · Before you start · Portal settings · Walled garden · Test · Troubleshooting · FAQ

Video coming soon: UniFi external portal server setup walkthrough

1. What a UniFi external portal server does

Every hotspot setting lives in the UniFi controller (the Network application), so your access points must be adopted by a controller that is always on. When a guest joins your open guest SSID, the access point keeps them in a walled garden and redirects their browser to the external portal server, which is Fydelia. Fydelia shows your branded splash page, collects the details you ask for, and then contacts your controller directly through its API to authorise the guest's device for full internet access.

UniFi does not let you set a full custom redirect URL. Instead it sends the guest to Fydelia on a path containing your UniFi site ID (/guest/s/<site_id>/) and adds these query parameters:

Parameter	What it contains
ap	MAC address of the access point the guest is connected to
id	MAC address of the guest's device (used to authorise it on the controller)
url	The page the guest originally tried to open
ssid	The name of the WiFi network the guest joined

Fydelia uses the site ID to choose which splash page to show, so the site ID you enter in Fydelia must match your controller.

2. Before you start

You will need:

• A UniFi controller on a current software version (Network 8, 9 or 10 recommended).
• A Fydelia account and a splash page that uses the Entrance Form – UniFi form.
• A local admin user on the controller for Fydelia (see step 7).

Controller types

All UniFi controller types are supported:

• On-site software: the Network application running on a PC or server in your office or venue.
• On-site hardware: UniFi Dream Machine (UDM, UDM Pro), Dream Wall and the Cloud Key series.
• Hosted / cloud: the Fydelia UniFi controller, UniFi Hosting, or third-party hosting such as Hostify.

Reachability and ports

Fydelia must be able to reach your controller directly. Ubiquiti does not allow systems like Fydelia to connect through ui.com, because multi-factor authentication (mandatory since July 2024) cannot work for a system-to-system connection. Your controller must therefore be reachable on your external IP address, or on a DDNS name that points to it.

Controller	Port Fydelia connects to	What you need to do
UniFi Dream Machine / UDM Pro (UniFi OS)	443	Add a firewall rule allowing external traffic on 443 into the gateway. See Accessing UDM Pro directly from the WAN.
Cloud Key and self-hosted software controllers	8443	Port-forward 8443 from your external IP to the controller.
Hosted controllers (e.g. *.unifi-hosting.ui.com)	As provided by the host	Usually nothing; the controller is already reachable on the web.

Once it works, you can restrict inbound access to Fydelia's servers only. The IPs to allow are listed in Walled garden and firewall IP settings.

Not sure which version you have? See The UniFi controller interface versions.

3. Create the guest network (VLAN)

We recommend keeping guests on their own network, separate from your business devices.

1. In the controller, go to Settings → Networks and click New Virtual Network (called Create New Network on some versions).
2. Give it a name such as Guest WiFi and set a VLAN ID that isn't already in use.
3. Save it. You'll select this network when you create the SSID in the next step.

4. Create an open SSID with the Hotspot Portal

Guests must be able to join without a password, so the SSID is open and the captive portal does the sign-in.

Network 10

1. Go to Settings → WiFi and click Create New.
2. Enter the SSID name and select the guest network from step 3.
3. Under Advanced, choose Manual, set Security to Open, and tick Hotspot Portal.
4. Click Apply Changes.

Network 8 and 9

1. Go to Settings → WiFi and edit (or create) your WiFi network.
2. Under Advanced, choose Manual.
3. Tick Hotspot Portal. This shows a hotspot portal link. If you want to configure the portal first, click the link and choose Leave, then come back and enable it on the SSID afterwards.
4. Save.

Note: some versions won't let you create a network that is open by default. If so, create it with a password first, then change Security to Open.

5. External Portal Server settings

Open the Hotspot Portal (Network 8+: the hotspot portal link on the SSID, or Hotspot Manager → Landing Page; Network 7.x: Profiles → Guest Hotspot). There are three tabs. On the Authentication tab (padlock icon), choose External Portal Server and click edit. On the Settings tab, enter the following:

Setting	Value
Authentication	External Portal Server
External portal server IP	116.202.86.187. UniFi requires an IP, but it isn't used because the domain below takes over. (Older guides show 144.76.195.139, which is also a Fydelia server.)
Domain	ondemand.fydelia.com
Secure Portal	See screenshot (to be confirmed)
HTTPS redirect	Enabled. This is needed so iPhones redirect (see troubleshooting).

Save your settings. Changes are then provisioned to your access points.

6. Pre-authorisation (walled garden)

Pre-authorisation lets guests load the splash page before they sign in. In the Hotspot Portal settings, add these as pre-authorised domains or IPs. If you use domain-based pre-authorisation, ondemand.fydelia.com is the essential entry.

Type	Entry
Domain	ondemand.fydelia.com
Domain	ondemand.fydeliawifi.com
Domain	splash.fydelia.com
Domain	hyper001.fydelia.com
Domain	cdn.fydelia.com
IP	144.76.195.139
IP	78.47.218.217
IP	91.107.197.54
IP	116.202.86.187

If you add social login or payment options to your splash page, those providers' domains must also be pre-authorised.

7. Controller admin user and Fydelia splash settings

Create a local admin for Fydelia

Fydelia authorises guests through your controller's API, so it needs a local admin account (not a ui.com account).

• UniFi OS (UDM, Cloud Key Gen2+, Network 8+): go to Admins, click + (Add Admin) and restrict it to local access, with Remote Access turned off.
• Self-hosted 7.5+: go to Settings → System → Administration, add an admin with Remote Access unticked, then tick Set Admin Password.
• The role must be at least a basic admin (Site Administrator). Read-only users can't authorise devices.
• Log in once with the new account and change the password if prompted, before you use it in Fydelia.

Full steps: Creating a UniFiOS admin user for external captive portal.

Configure your Fydelia splash page

1. In Fydelia, go to List pages → Edit page, then hover over Entrance Form – UniFi and click Edit.
2. UniFi site ID: the ID in your controller URL, not the site name. If your site ID is default, use your network's external IP (or your DDNS name) instead.
3. SSID (optional, for your reference).
4. UniFi server: the full address of your controller, including protocol and port, e.g. https://mycloudcontroller.mydomain.com:8443.
5. UniFi username and password: the local admin from above.
6. Session duration in minutes (1440 = 24 hours). Returning guests are reconnected automatically.
7. Tick Primary page if several pages share the same site ID, then Save changes and Publish.

More detail: Configuring your UniFi splash page.

8. Test it

1. On a phone, forget the guest network if you've joined it before, then connect to the SSID.
2. The Fydelia splash page should appear automatically. If it doesn't, open any http:// website in the browser.
3. Sign in. You should get full internet access, and the guest should appear as authorised in the controller's client list.
4. In Fydelia, check that the connection appears in your venue's guest data.

9. Troubleshooting

iPhones don't redirect ("No internet connection")

Enable HTTPS Redirect in the Hotspot Portal settings, save so the change is provisioned to the access points, then forget the network on the iPhone and reconnect. Forgetting the network clears cached SSL state; if you skip it, the problem can look unsolved. See UniFi issue with iPhones. For QR codes, see iPhone QR scanning won't redirect.

Splash page doesn't show, or shows the wrong page

• Check that ondemand.fydelia.com is in the pre-authorisation list and set as the portal domain.
• Check that the site ID in Fydelia matches the controller URL (or uses your external IP if the site is default), and that the page is published.
• Check that Hotspot Portal is ticked on the SSID and that the changes have been provisioned.

Guest sees the splash page but never gets online (controller not reachable)

• Check that the controller is reachable from the internet on the right port (443 for UDM, 8443 for Cloud Key and self-hosted), and that the firewall or port-forward rule is in place.
• Make sure you're not using a ui.com address. Fydelia must connect to the controller directly.
• Check that the admin user is local, isn't read-only, and that its password matches the one in Fydelia.
• If you use IP locking, allow Fydelia's server IPs listed in the firewall settings.

Other common issues: UniFi no internet connection and problems connecting with laptops.

10. Older UniFi versions (7.x and 6)

• Version 7.x: hotspot settings are under Profiles. See the UniFi 7.x setup guide and UniFi Hotspot Manager (7.4+).
• Version 6 and earlier: hotspot settings are under Guest Control. Fydelia still works, but we recommend upgrading. See the version 6 and earlier guide.
• UniFi OS consoles: see the UniFiOS splash page setup and UDM Pro setup.

11. FAQ

What is a UniFi external portal server?

It's a captive portal hosted outside your UniFi controller. UniFi redirects guests to it, and once they sign in it tells the controller to let them online. With Fydelia, the external portal server shows your branded splash page and authorises guests through your controller's API.

Which IP and domain do I enter?

Enter 116.202.86.187 as the external portal server IP (UniFi requires one but doesn't use it) and ondemand.fydelia.com as the domain. Add ondemand.fydelia.com to pre-authorisation too.

Does it work with UniFi Cloud / UDM Pro?

Yes. It works with UDM / UDM Pro, Cloud Keys, self-hosted and hosted controllers. Fydelia can't use ui.com, so a UDM needs a firewall rule allowing direct access on port 443 and a local admin user.

Do I need port forwarding?

For on-site controllers, yes: Fydelia must reach the controller directly (443 for UDM, 8443 for Cloud Key and self-hosted). Hosted controllers are usually reachable already and don't need it.

Why don't iPhones redirect?

Usually because HTTPS Redirect is off. Turn it on, provision the change, then forget and rejoin the network on the iPhone.

Which UniFi versions are supported?

Network 8, 9 and 10 are covered by this guide. Version 7.x and version 6 and earlier are also supported, with their own guides linked above.