DOCUMENTATION

The portal does not open

The device joins the Wi-Fi, but the sign-in page never appears.

Symptom

The guest connects to the network. Either the phone shows no "sign in to network" notice at all, or tapping it opens a blank or broken page. On some devices the browser shows a "connection is not secure" warning instead of the portal.

Check these first

  1. Open a browser on the guest device and type a plain HTTP address, for example http://neverssl.com. If the portal appears, interception works and the problem is the notification, not the portal.
  2. Check the walled garden on the device: app.captivo.io, captivo.io and radius.captivo.io must be allowed before sign-in (on-prem: your own server address instead).
  3. Confirm the guest VLAN can resolve names: on the guest device, look up any domain. If lookups fail, DNS is blocked before the portal.

Possible causes

HTTPS addresses cannot be intercepted

How to tell: A plain HTTP address opens the portal; typing an HTTPS site (google.com, instagram.com) gives "connection is not secure" or hangs.

Fix: This is expected: no access device can redirect HTTPS traffic without breaking its certificate. Phones and laptops open the portal on their own by probing HTTP check addresses (captive.apple.com, connectivitycheck.gstatic.com, msftconnecttest.com). Do NOT add those check addresses to the walled garden: a device that reaches them thinks it is online and never shows the sign-in notice.

Walled garden is incomplete

How to tell: The portal page opens but looks unstyled or empty, or pressing the submit button fails with a network error.

Fix: Allow the Captivo addresses listed above for both directions before authentication. Vendor steps: pfSense, OPNsense, MikroTik.

DNS does not resolve

How to tell: The portal opens when you type the server's IP address but not its name, or the device reports "DNS server not responding".

Fix: Let unauthenticated clients reach DNS: either the access device answers DNS itself for the guest VLAN, or UDP/TCP 53 to your resolver is allowed before sign-in. Interception relies on the device resolving names first.

The portal file is stale

How to tell: A design or sign-in method change made in the panel does not show up, or the page says the server cannot be reached.

Fix: Download the portal HTML again from Settings → Portal and upload it to the device. On-prem: if the server address changed, a fresh download is mandatory, because the address is baked into the file.

MikroTik: the login page name

How to tell: The router's default hotspot page appears instead of the Captivo design.

Fix: The downloaded file must be stored as login.html inside the hotspot directory the profile uses. See the MikroTik guide.

Certificate warning (on-prem)

How to tell: The browser shows "certificate is not valid" when the portal page loads its assets from your server.

Fix: Install a certificate the guest devices trust: Let's Encrypt on a public name, or your corporate CA on an internal name. A self-signed certificate warns on every guest device and some block the page outright.

Sign-in notices on phones can lag by a few seconds after joining. Wait ten seconds before judging.

If it is still not solved

  • Access device model and firmware version
  • Operating system of the guest device that fails
  • What happened when you typed a plain HTTP address
  • A screenshot of the walled garden / allowed hosts list
  • When the portal file was last downloaded from the panel

Was this article helpful?