Skip to main content

Walled Garden

The walled garden (or pre-authentication access list) specifies which websites users can reach before logging in. You must add IronWifi's IP and any authentication provider domains (Google, Facebook, Stripe, etc.) for the captive portal to work correctly.

Quick Start​

  1. Add IronWifi IP: 107.178.250.42/32 (required)
  2. Add domains for your authentication providers (Google, Facebook, etc.)
  3. Configure entries in your controller's captive portal settings
  4. Test by connecting and verifying splash page loads
  5. Test each authentication method works

How It Works​

  1. User connects to WiFi
  2. User is in a "walled garden" - can only access specified resources
  3. Any other request redirects to the splash page
  4. After authentication, full internet access is granted

Required Entries​

IronWifi Splash Page​

Always include the IronWifi hosting IP:

107.178.250.42/32

This hosts your captive portal splash page.

Your Splash Page Hostname​

If using a custom domain:

splash.yourdomain.com

Authentication Provider Requirements​

Add these domains based on your enabled authentication providers:

Google Login​

accounts.google.com
*.googleapis.com
*.gstatic.com
*.google.com

Facebook Login​

facebook.com
*.facebook.com
*.fbcdn.net
connect.facebook.net

LinkedIn Login​

linkedin.com
*.linkedin.com
*.licdn.com

Twitter/X Login​

twitter.com
*.twitter.com
*.twimg.com
x.com
*.x.com

Apple Login​

appleid.apple.com
*.apple.com
*.icloud.com

Microsoft/Azure AD​

login.microsoftonline.com
*.microsoft.com
*.azure.com
*.msftauth.net

SMS Providers​

Twilio:

*.twilio.com

Other providers: Check your SMS provider's documentation.

Payment Gateways​

Stripe:

*.stripe.com
js.stripe.com

Braintree:

*.braintreegateway.com
*.braintree-api.com
*.paypal.com

Configuring Walled Garden​

Ubiquiti UniFi​

In UniFi Controller:

  1. Navigate to Settings > Guest Control
  2. Under Pre-Authorization Access, add entries
  3. Enter IP addresses or hostnames

Cisco Meraki​

In Meraki Dashboard:

  1. Navigate to Wireless > Configure > Access Control
  2. Enable Walled Garden
  3. Add ranges under Walled Garden Ranges

Aruba​

In Aruba Controller:

  1. Navigate to Configuration > Security > Captive Portal
  2. Add entries to Whitelist

MikroTik​

In RouterOS:

/ip hotspot walled-garden
add dst-host=*.google.com
add dst-host=107.178.250.42

pfSense​

In pfSense:

  1. Navigate to Services > Captive Portal
  2. Click Allowed IP Addresses
  3. Add entries with direction (Both/From/To)

FortiGate​

In FortiGate GUI:

  1. Navigate to WiFi & Switch Controller > SSID
  2. Edit your captive portal SSID
  3. Under Captive Portal, find Exempt Sources/Destinations
  4. Add IP addresses and FQDNs

CLI method:

config wireless-controller vap
    edit "guest-wifi"
        config portal-exempt-addr
            edit 1
                set address "107.178.250.42/32"
            next
        end
    next
end

Ruckus SmartZone​

In SmartZone:

  1. Navigate to Services & Profiles > Hotspot Services
  2. Edit or create your hotspot profile
  3. Under Walled Garden, add entries:
    • Click Create New
    • Enter IP address or domain
    • Set traffic direction

Ruckus Cloud​

In Ruckus Cloud:

  1. Navigate to WiFi Networks > select network
  2. Go to Guest Access settings
  3. Under Walled Garden, add entries
  4. Click Save

Juniper Mist​

In Mist Dashboard:

  1. Navigate to Organization > Wireless > WLANs
  2. Edit your guest WLAN
  3. Scroll to Captive Portal section
  4. Add entries under Allowed Subnets and Allowed Hostnames

In Omada Controller:

  1. Navigate to Wireless Networks > edit network
  2. Go to Portal tab
  3. Under Free Authentication Policy, add:
    • IP ranges
    • MAC addresses
    • Hostnames

Cisco WLC (Wireless LAN Controller)​

In WLC:

  1. Navigate to Security > Access Control Lists > Pre-Auth ACL
  2. Create or edit ACL
  3. Add permit rules for required IPs/subnets
  4. Apply ACL to WLAN

CLI method:

config acl create PreAuth-ACL
config acl rule add PreAuth-ACL 1 permit host 107.178.250.42
config wlan pre-auth acl PreAuth-ACL enable <wlan-id>

OPNsense​

In OPNsense:

  1. Navigate to Services > Captive Portal
  2. Select your zone
  3. Go to Allowed Addresses tab
  4. Add entries:
    • Direction: Both/In/Out
    • IP address or hostname

Grandstream​

In Grandstream controller:

  1. Navigate to SSID settings
  2. Find Portal section
  3. Under Whitelist, add:
    • IP addresses
    • Domain names

IP Address vs Hostname​

IP Addresses​

Pros:

  • Always works
  • No DNS resolution required
  • More reliable

Cons:

  • May change
  • May miss CDN endpoints

Format:

107.178.250.42/32
10.0.0.0/24
192.168.1.100

Hostnames​

Pros:

  • Automatically follows DNS changes
  • Covers multiple IPs
  • Easier to manage

Cons:

  • Requires DNS to work before auth
  • May not work on all controllers

Format:

*.google.com
accounts.google.com
example.com

Testing Walled Garden​

  1. Connect a device to the WiFi
  2. Try accessing each walled garden entry
  3. Verify splash page loads
  4. Test each authentication provider
  5. Confirm other sites redirect to splash page

Troubleshooting​

Authentication Provider Not Working​

  1. Verify all required domains are in walled garden
  2. Check for HTTPS/SSL certificate issues
  3. Test on different devices
  4. Review browser console for blocked resources

Splash Page Not Loading​

  1. Confirm 107.178.250.42/32 is in walled garden
  2. Check controller captive portal settings
  3. Verify redirect URL is correct
  4. Test direct access to splash URL

Users Bypass Captive Portal​

  1. Review walled garden - may be too permissive
  2. Check for MAC whitelist entries
  3. Verify session timeout settings
  4. Check for cached authentication

Best Practices​

  1. Minimal entries - Only add what's necessary
  2. Use wildcards wisely - *.google.com is broad
  3. Test thoroughly - After any changes
  4. Document changes - Track what you've added and why
  5. Regular review - Remove unnecessary entries
  6. Monitor - Check for authentication failures

Complete Example​

For a portal with Google login and Stripe payment:

# IronWifi
107.178.250.42/32

# Google
accounts.google.com
*.googleapis.com
*.gstatic.com
fonts.googleapis.com

# Stripe
*.stripe.com
js.stripe.com

# Your custom domain (if used)
splash.yourcompany.com