DOCUMENTATION

Documentation

Setup, platform settings and troubleshooting for Captivo Portal and Captivo Access -- step by step.

Captivo Portal

Guest Wi-Fi and corporate network access: connecting your firewall or controller to Captivo, RADIUS, SMS and troubleshooting.

Setup

pfSense integration

Setting up pfSense Captive Portal with Captivo end to end: RADIUS server, zone settings, MAC authentication and accounting.

OPNsense integration

Connecting OPNsense Captive Portal to Captivo: RADIUS, template and session-timeout settings.

MikroTik integration

Setting up MikroTik Hotspot with Captivo: PAP/CHAP, walled garden and interim-update settings.

FortiGate integration

Connecting FortiGate Captive Portal to Captivo: RADIUS server, user group and pre-authorisation.

Cisco Meraki integration

Setting up a Captivo splash page on Cisco Meraki: splash settings, RADIUS and the walled garden.

Ruijie integration

Connecting a Ruijie controller to Captivo: portal server, RADIUS and pre-authorisation.

UniFi integration

Setting up the Captivo guest portal on UniFi with the Connector: external portal, RADIUS profile and allowlist.

Quick Start

Follow the steps below to get Captivo up and running in 10 minutes:

  1. 1Get your RADIUS server details from Settings → RADIUS
  2. 2Download the portal HTML file
  3. 3Create a Captive Portal zone on pfSense/OPNsense
  4. 4Configure the RADIUS server and upload the HTML

Platform settings

RADIUS settings

Captivo's RADIUS server: client definition, shared secret and why accounting is required.

SMS integration

Configuring an SMS provider for guest verification, the sender header and balance alerts.

Webhooks

Carrying session and guest events into your own systems: event types, signature verification and retries.

Troubleshooting

The portal does not open

The device joins the Wi-Fi but no sign-in page appears: HTTPS interception, walled garden, DNS and a stale portal file.

Sign-in is rejected

The password or voucher is right but sign-in fails: shared secret, NAS address, PAP/CHAP, tenant prefix, temporary rejects and expired credentials.

Sessions do not appear

The guest is online but Active Sessions and reports are empty or incomplete: accounting, interim updates, port 1813, the MAC list and the clock.

SMS messages do not arrive

The guest entered a number but the password SMS never arrives: provider settings, balance, number format, rate limits, the daily budget and the anomaly alert.

Emails do not arrive

A guest password, an admin notification or a scheduled report never lands: tenant SMTP, the connection test, spam and SPF/DKIM, unsubscribed recipients.

Captivo Access

Time-boxed, recorded access for outside vendors to internal apps and remote desktops: starting on Cloud or your own server, the Connector, resources, policies and troubleshooting.

Getting started

Getting started on Cloud

Opening your console with a Captivo account, the first admin with a passkey, the Connector and the first resource: on the service we run there is no install, only four steps.

Installing on your own server

Server, Docker, three DNS records, .env and bringing the stack up with one command; automatic TLS, the first admin and updating. Including where recordings are stored.

Setup

Installing the Connector

The outbound-only agent that runs inside your network: adding it from the console, running the command, the ALLOWED_TARGETS boundary, the data volume and backing up the recording key.

Defining resources

Web app, remote desktop (RDP/SSH/VNC) and isolated browser: the public hostname, the internal address, the credential vault, recording and clipboard settings, health checks.

Inviting a vendor and granting access

Invitation, passkey enrollment, time-boxed grants, the approval flow and weekly schedules; the portal the vendor sees, and the five roles.

Quick Start (Cloud)

To connect your first vendor to an internal app in 15 minutes:

  1. 1Open your console with your Captivo account: <your-org>.cloud.captivo.io
  2. 2Add a connector under Infrastructure → Connectors and run the command on a machine inside your network
  3. 3Define the internal app or server as a resource under Infrastructure → Resources
  4. 4Invite the vendor under People → Invites and grant a time-boxed access under Access

Platform settings

Policy settings

Session limits, maximum grant duration, the source-IP allowlist, recording mode and retention, clipboard and file-transfer defaults, the notification webhook: all live, no redeploy.

Session recording and live view

Recordings live on the Connector's own disk, encrypted; replay and command search, live view and take-control, the deletion flow, retention and the tamper-evident audit log.

Identity: passkeys, SSO and directory

Passwordless sign-in and recovery, OIDC single sign-on for staff, Active Directory / LDAP group mapping and SMTP for invitations.

Troubleshooting

The connector shows offline

The command ran but the console never shows Online, or it dropped later: tunnel address, outbound 443, pairing code, a lost data volume, a stopped container and an outdated version.

The app does not open (404, 403, 502)

The vendor opens the address but no app appears: unmatched resource, grant and time window, IP allowlist, an unreachable internal address, the egress boundary, certificate and cookie domain.

Cannot sign in with a passkey

The passkey fails during enrollment or sign-in: RP ID mismatch, a key on another device, an expired invitation, an unsupported browser, a disabled account and session limits.

The remote desktop session does not connect

An RDP, SSH, VNC or isolated-browser session will not start, or clipboard and file transfer fail inside it: unreachable target, credential, session engine, paste shortcut, file transfer and recording consent.

A recording cannot be played or deleted

A recording is missing, will not open, search says incomplete or deletion stays pending: an offline Connector, recording off, retention, a lost volume or key, and a deletion awaiting the Connector's confirmation.