Does UniFi client isolation stop guests from reaching my business network?

Client Device Isolation works at the access point and blocks guest-to-guest traffic within a single AP only — guests on different APs can still see each other through it, and it says nothing about the LAN. The layers Ubiquiti documents are distinct: Network Isolation or the Hotspot firewall zone blocks guests initiating connections to your internal networks (the zone's default matrix allows only return traffic), while Device Isolation (an ACL at switch level, requiring a gateway- or L3-switch-routed network) closes the cross-AP guest-to-guest path. Verify with tests, not toggles: from a guest device, your printer, NAS, other guests, and even the gateway's admin page must each fail to respond — the Hotspot zone's default for traffic to the gateway is policy-dependent, so the admin UI must be tested, not assumed blocked.

What sign-in methods does the UniFi captive portal support?

Ubiquiti's current hotspot documentation lists, selectable in combination: Facebook, Password, Payment (currently supported by Stripe), Vouchers (with customizable expiration, bandwidth limits and data quotas), RADIUS (advanced), and an External Portal Server (advanced). Selecting no method gives the click-through flow with terms acceptance where enabled. Note the era drift: older documentation describes PayPal and other processors; the current text supports Stripe only. Voucher operations are handled in Hotspot Manager, including single- and multi-use vouchers, printing batches, revoking a voucher (immediate deactivation), extending a guest by 24 hours per action, and Operator Accounts — restricted, Hotspot-Manager-only logins designed for front-desk staff.

Why doesn't the captive portal appear for some guests?

The portal appears when an unauthorised guest's web traffic is redirected — Ubiquiti's own state model tags the device as a guest with authorized: false until the portal records authorisation for that device. Real-world friction points: a portal served without a valid certificate produces browser certificate errors (Ubiquiti's documentation warns the operating system's captive-network assistant may then not appear at all); HTTPS-first apps don't trigger the classic HTTP redirect, which is why phones rely on their built-in captive-portal checks (Ubiquiti's own API example shows Apple's captive-check address being redirected); and client-side VPN or private-DNS apps can bypass the detection path — a community-documented cause rather than an official one. The dress rehearsal with your own phone, on data-off Wi-Fi join, catches most of it before a customer does.

UniFi · Guest Wi-Fi · Captive portal

Guest Wi-Fi with a captive portal — built in layers, verified by tests

First published 20 October 2026 · From Ubiquiti's Hotspots & Captive Portals, Guest WiFi Best Practices, Isolation, and Zone-Based Firewall documentation, read in full. Items resting on Ubiquiti's legacy Controller Guide or versioned third-party walkthroughs are marked where used.

Do not fix the wrong thing first. “Guest Wi-Fi” is three separate layers owners constantly conflate: (1) a guest network, (2) a portal (the splash page — hospitality, not security), and (3) isolation (the actual security). A beautiful portal on an un-isolated network is a welcome mat on an open door. Build all three; verify the third with tests, not toggles.

The architecture, in Ubiquiti's model

When a guest joins, UniFi tags the device GUEST, authorized: false. Any web attempt redirects to the portal; completing it records authorization for that device (with an expiry) and the gate opens — to exactly the destinations your post-authorization rules allow. Before authorization, the guest lives in a walled garden: the portal itself plus any pre-authorization addresses you deliberately list. Two enablement scopes exist and are routinely confused: the portal per-SSID (Settings → WiFi → Hotspot Portal) and the Hotspot firewall zone per-network (Zone-Based Firewalls, Network 9.0+) — which also portals wired clients on that network.

The portal menu — as currently documented

Method	Documented notes
Vouchers	Customisable expiration, bandwidth limits, data quotas; generated/printed/revoked in Hotspot Manager — the small-business default.
Password	One shared password at the portal — simple; rotation is your hygiene problem.
Payment	Stripe is the currently supported processor. (Legacy docs describe PayPal and others — retired; don't design around them.)
Facebook	Listed first in the current article. Its longevity depends on Meta's side — dress-rehearse it end-to-end before depending on it.
RADIUS / External Portal Server	Advanced paths (your own auth/portal infrastructure).
None selected	The click-through flow, with terms-of-use acceptance where you enable it (a documented portal element: guests can be required to accept your terms).

The setup ladder

Guest network first: a separate network/VLAN for guests (your gateway routes it; the isolation steps assume this).
Guest WLAN on that network, named obviously (“CafeName Guest”).
Isolation layer (next section) — before any guest touches it.
Rate limits: apply a bandwidth profile to the guest WLAN so one guest's cloud backup can't eat the till's card reader bandwidth (QoS/traffic-shaping is a documented UniFi facility; per-guest voucher quotas stack on top).
Enable the portal (per-SSID or Hotspot zone — pick one scope deliberately), choose method(s), set the terms text if you use acceptance.
Brand it: logo/background within the documented customisation; keep the page light — it loads pre-authorization, through the walled garden, on a stranger's phone.
Vouchers (if chosen): generate the first batch in Hotspot Manager.
Dress rehearsal with your own phone (next sections), then open the doors.

Isolation — three features, three scopes, one famous gap

Feature	Scope	What it actually blocks
Network Isolation (or Hotspot zone defaults)	Network-wide	Guests initiating to internal networks: the zone matrix gives Hotspot→Internal Allow Return Traffic only, Hotspot→Hotspot and Hotspot→DMZ Block All — but Hotspot→Gateway is policy-dependent. Your gateway's admin page is a test, not an assumption.
Client Device Isolation	Per-AP	Guest-to-guest within one access point. The gap: guests on different APs remain visible to each other through it.
Device Isolation (ACL)	Switch level	Closes the cross-AP guest-to-guest path — requires the network be routed by a UniFi gateway or L3 switch.
Proxy ARP	Per-WLAN	Congestion hygiene Ubiquiti recommends for busy guest networks — not a security boundary; don't list it as one.

Verify like an auditor — the 8 tests (from a guest device, unauthorised then authorised)

Reach the portal (pre-auth) — and nothing else on the internet.
Reach a pre-authorization-listed address only if you listed one deliberately.
After authorising: browse the open internet.
Ping/browse the LAN printer → must fail.
The NAS / POS / office PC → must fail.
Another guest's device (same AP, then a different AP) → must fail both times (test 7 is where the famous gap shows itself).
The gateway's admin UI → must fail (the policy-dependent one).
A wired device on the guest network → portal + same isolation, if you used the zone scope.

Voucher operations (Hotspot Manager)

Single-use vouchers die after first authorisation; multi-use serve a group/event. Each carries its duration and optional byte quota and bandwidth limits. Day-to-day verbs are documented: Print / Print Batch / Print All Unused, Revoke (“immediately deactivate”), and guest Extend (+24 hours per action). Staffing pattern: Operator Accounts — admin-created, restricted to Hotspot Manager only, documented as designed for hotel-style front desks. That is exactly a café counter: staff can mint and revoke vouchers and cannot touch your network settings. (These functions are documented in Ubiquiti's Controller Guide; exact menu paths shift between Network versions — the capabilities are the stable part.)

Portal realities — the honest section

HTTPS doesn't redirect like HTTP. Modern phones detect captive portals with their own check requests (Ubiquiti's API documentation's example literally shows Apple's captive-check address being redirected) — when detection works, the splash appears as a system sheet; when it doesn't, the guest sees a browser error, not your page.
Certificate discipline: a “Secure Portal” served without a valid certificate shows guests a certificate error, and Ubiquiti's own text warns the OS captive assistant may then not appear. An unbranded-but-working portal beats a branded-but-alarming one.
Community-documented (labelled): guests running VPN or Private-DNS apps often defeat portal detection. Ubiquiti's documents don't cover it; your counter staff's script (“turn off VPN/private DNS, rejoin”) comes from practice, not the manual.
The legal boundary: the terms-acceptance element is a documented feature. What the law requires of your guest logging or retention is not something Ubiquiti's documentation states, and this guide won't invent it — that's a question for your own counsel, not a settings page.

FAQ

Portal or just a password on the SSID?

Different jobs: the SSID password controls joining; the portal controls authorization after joining (terms, vouchers, expiry, per-device records). Many cafés need only a guest network + isolation + the password on the receipt; the portal earns its complexity when you want vouchers, branding, or acceptance records.

Guests say “Wi-Fi connected, no internet, no page.”

The dress-rehearsal failures, live: portal detection defeated (VPN/private DNS), a certificate-alarming secure portal, or the guest joined before you finished enabling. Re-run the 8 tests; the failing test names the layer.

Can staff get longer access than guests?

Keep staff off the guest network entirely — a separate staff WLAN on the internal network (see our Wi-Fi guides). Mixing staff into the guest system for convenience quietly re-opens the door the isolation tests just closed.

Sources

Ubiquiti Help Center — UniFi Hotspots and Captive Portals (method inventory, scopes, state model via the External Hotspot API article), Best Practices: Guest WiFi, Implementing Network and Client Isolation, Zone-Based Firewalls (Hotspot matrix), QoS and Traffic Shaping · Ubiquiti Controller User Guide (legacy; voucher/Hotspot Manager operations, secure-portal certificate warning — tiered as legacy).

Verification note: the method inventory, isolation scopes and zone matrix were confirmed from Ubiquiti's current articles on 20 October 2026. Default session expiry (reported as 8 hours) rests on consistent third-party UI walkthroughs rather than a current help article and is treated as a setting to confirm on your console, not a fact.

Did this guide work for you?

Your reaction tells us whether this guide solved the problem it promised to solve.