This article will show you how to configure captive portal via WiFi, with click-to-continue, using an external captive portal URL, or using captive portal to authenticate users via Nebula Cloud Authentication. This will show you how to configure when users should re-authenticate, using strict policy to block users from accessing internet, how to avoid the IT administrator needing to authenticate users manually etc. Also, how to customize your captive portal via HTML & CSS.
When setting up WiFi, you might want to create a sophisticated guest WiFi with a captive portal - this tutorial will show you how to set up an SSID with the Captive portal function on the Nebula Control Center.
In our scenario, we want to create a Guest SSID (WiFi) for our guests, but we want them to go through our Captive Portal before they are able to enter the internet from their device.
Table of Content
1) Configure Captive Portal with click-to-continue
1.1 Configure WiFi SSID settings
1.2 Configure SSID Advanced settings
1.3 Configure Captive Portal Customization
2) Configure External Captive Portal URL
2.1 Enable External Captive Portal URL
2.2 Configure Captive Portal Advance Settings
3) Configure Captive Portal via Nebula Cloud Authentication
3.2 Configure "Captive Portal Advance Setting"
3.3 Configure Nebula Cloud Authentication
4) Configure Advanced Captive Portal Settings
4.1 Configure Re-Authentication Settings
4.2 Configure Captive Portal Behavior
4.3 Configure & Customize a Captive Portal Theme
Configure Captive Portal Video
If you now check the available WiFi's on your PC or mobile device you will be prompted for authentication from captive portal when you connect to your WiFi.
Preparation Steps
- Log in to your Nebula Control Center
- Select your organization
- Make sure that your AP(s) is/are online
1) Configure Captive Portal with click-to-continue
1.1 Configure WiFi SSID settings
a) Navigate to Site-wide -> Configure -> WiFi SSID settings.
b) Then configure your guest SSID by enabling "Advanced mode", so you can see all settings.
c) Tick the box "Enabled" to enable the second SSID and make it a layer 2 isolated SSID, by ticking "Guest Network" as below:
d) Hit Save.
1.2 Configure SSID Advanced settings
a) Navigate to Site-wide -> Configure -> Access points -> SSID Advanced settings
b) Tick "Click-to-continue" to enable guests to first enter a web portal, before they're able to move on to surf the internet
c) Hit Save.
1.3 Configure Captive Portal Customization
a) Navigate to Site-wide -> Configure -> Access points -> Captive Portal Customization
b) If you want to upload your logo, you can do that by clicking "Choose file" (this will be shown for all users logging into the Guest WiFi via Captive Portal)
c) Make sure the logo is uploaded correctly, create your "Message" that the guests will get before they enter the WiFi and customize your "Success page" that will be shown after they have successfully logged with the Captive Portal.
d) Hit Save
1.4 Verify your Results
In the logs, it says that the user has used ClickToContinue to log in via captive portal
2) Configure External Captive Portal URL
2.1 Enable External Captive Portal URL
If you're having your own Captive Portal, you can use it by navigating to
Site-wide -> Configure -> Access points -> Captive Portal Customization
Scroll down to External Captive Portal URL and insert the URL in this format:
https://example.com
2.2 Configure Captive Portal Advance Settings
Because we're using "zyxel.com" as our captive portal, we need to re-configure our captive portal settings from "Block all access until sign-on" to "Allow HTTPS traffic without sign-on" because this website is
1) not a sign-on website
2) It's located on the internet
Navigate to
Site-wide -> Configure -> Access points -> Captive Portal Customization
Then select "Allow HTTPS traffic without sign-on" and hit save.
3) Configure Captive Portal via Nebula Cloud Authentication
3.1 Configure Sign-in Method
Navigate to
Site-wide -> Configure -> Access points -> SSID advanced Settings
Then select the correct "SSID" and then change the "Sign-in method" to Nebula Cloud Authentication.
3.2 Configure "Captive Portal Advance Setting"
a) Walled Garden - the "garden" is what websites that the user is allowed to reach without login via Captive Portal (e.g. 192.168.1.34, 192.168.1.0/24, https://zyxel.com). If you have an external Captive Portal, you may enter the website, or IP address of the captive portal
b) Self-registration - Allow the users to create their own WiFi accounts and then choose if the IT administrator needs to accept their request or if their request is accepted automatically. You can also deny users from creating their own cloud accounts.
c) Simultaneous login limit - Select if you want to limit the amount of users that can login to the Guest WiFi via Captive Portal
d) Scrict Policy - Select if users are blocked from internet before Captive Portal authentication, or if they can surf the internet via HTTPS.
e) Reauth time - Select a specific re-authentication time for users that have already logged in. Default is set to "Follow site-wide Settings" which is default set to "Every day". This means that the users needs to re-authenticate to the Captive Portal site the next day they're entering the Guest WiFi.
f) NCAS disconnect behavior - If the Nebula cloud servers are unavailable and the users are not able to authenticate via Captive Portal, choose if you want to allow the users to surf the web anyway, or if they're blocked from the internet until the nebula cloud servers are reachable again.
3.3 Configure Nebula Cloud Authentication
This is optional, if you want to create cloud users yourself, or if you want them to manually create users for themselves. If you want the users to create users themselves, you can skip this step.
a) Navigate to Site-wide -> Configure -> Cloud Authentication
b) Click "Add" to add a new Cloud user
c) Create the cloud user
3.4 Verify your Results
a) Login to the WiFi and then create your account
b) Check the email inbox to confirm your email
Click on the "Please confirm your account here":
Then the user will confirm the email and get this message:
c) Update the user
Because we have selected the strict "Self-registration (see 3.2), we need to manually authorize the users in Nebula Cloud Center before the guests can enter.
Note!
If we don't want to authorize everyone, change this to "Allow users to create accounts with auto authorized" by navigating to
Site-wide -> Configure Access points -> SSID advanced Settings
Then select the Guest SSID and scroll down to "Captive portal Advance Setting"
d) Login with the user credentials
4) Configure Advanced Captive Portal Settings
4.1 Configure Re-Authentication Settings
a) Navigate to Site-wide -> Configure -> Site Settings
b) Navigate to "Captive Portal Reauthentication" section and select if you want the users to authenticate every half hour, every day, every 30 days etc.
4.2 Configure Captive Portal Behavior
After the user has successfully logged in via Captive Portal, you can choose for the user to stay on the "success page", or you can re-direct the user to another URL - your website, or maybe your webshop for promotion purposes.
4.3 Configure & Customize a Captive Portal Theme
4.3.1 What are there to customize?
You can customize the whole Captive Portal journey for the users, where you can edit the buttons, fonts, colors and other appearances in the Captive Portal journey.
Here below are the available page customization that you can do.
4.3.1.1 User login page
4.3.1.2 Success Page
4.3.1.3 Click-to-continue page
4.3.1.4 Voucher page
4.3.1.5 Social Login (Facebook-login) page
4.3.1.6 CSS page (for Color.css, Icon.css and layout.css)
4.3.2 Create your own customized Captive Portal
a) Navigate to
Site-wide -> Configure -> Access points -> Captive Portal Customization
b) Then copy the Modern Button Theme and another copy of that button will appear.
c) Click on "edit"
d) Click on any object to customize its color (and/or font)
4.3.2.1 Result
4.3.3 Edit HTML code
You can also edit the HTML code of the captive portal by clicking the "HTML" button on the page.
This will change the appearance to the HTML code that you can now edit
KB-00031