Hotspot & Vouchers

Set up a WiFi hotspot with a captive portal and voucher-based authentication for your customers.

~20 min · Intermediate

Overview

The hotspot system lets you sell WiFi access through vouchers or M-Pesa payments. Customers connect to your WiFi, see a captive portal login page, and either enter a voucher code or pay via M-Pesa to get online.

How it works

Connect WiFi
Customer joins
open network
Captive Portal
Browser redirects
to login page
Pay / Voucher
M-Pesa STK push
or voucher code
Online!
Customer gets
internet access

Prerequisites

  • Router connected — complete the Router Setup Guide first
  • WiFi interface — your router must have a wireless interface (built-in or AP connected to a bridge)
  • M-Pesa credentials (optional) — if you want to accept mobile payments. Configure in Settings → Payment Gateways

1. Setup Hotspot in dashboard

The one-click setup provisions the hotspot server, captive portal files, and RADIUS authentication on your router.

Go to Network → Routers and click on your router
Click the "Setup Hotspot" button in the header
Fill in the configuration:
  • Hotspot Interface — the wireless interface (e.g. wlan1 or bridge-hotspot)
  • Address Pool — IP pool for hotspot clients (e.g. hotspot-pool)
  • Hotspot Package — select a package for default access
Click Setup Hotspot — the system will automatically:
  • • Create the hotspot server on your router
  • • Upload the captive portal login page
  • • Configure RADIUS authentication
  • • Set up the walled garden (allowed sites before login)
The setup is fully automated. No manual router configuration needed!

2. Configure WiFi interface

Ensure your wireless interface is set up correctly for hotspot use.

Important: The WiFi interface must be open (no WPA2 password). Encryption prevents the captive portal from redirecting users to the login page.

Terminal

# Set WiFi to open (no encryption)
/interface wireless security-profiles set [find name=default] mode=none

# Set SSID
/interface wireless set wlan1 ssid="YourHotspotName" mode=ap-bridge

3. Create packages

Create WiFi packages that customers can purchase. Each package defines the speed, duration, and price.

Go to Services → Packages
Click New Package
Set the package details:
  • Name — e.g. "1 Hour - 20 KES"
  • Type — select "Hotspot"
  • Price — e.g. 20
  • Validity — e.g. 1 day, 1 hour
  • Download/Upload Speed — bandwidth limits
Create as many packages as you need (e.g. 1hr, 24hr, 7 days, 30 days)

4. M-Pesa integration

Enable M-Pesa payments so customers can buy WiFi access directly from the captive portal.

Go to Settings → Payment Gateways
Add or configure your M-Pesa gateway with your Daraja API credentials
The captive portal will automatically show M-Pesa payment options to customers
Customers can also use their M-Pesa receipt number as a login code. After paying, the system automatically generates access credentials.

5. Test the hotspot

Connect a phone or laptop to the WiFi network
Open a browser — you should be redirected to the captive portal
Purchase a voucher or use M-Pesa to pay
Enter the voucher code or receipt number to log in
Verify you have internet access

Customization

The captive portal is fully customizable from the dashboard.

  • Branding — upload your logo and set colors in the hotspot settings
  • Walled garden — allow specific sites before login (e.g. payment providers)
  • Voucher batches — generate and print voucher cards in bulk from Hotspot → Vouchers

Troubleshooting

Captive portal not showing
  • • WiFi must be open (no WPA2) — encryption blocks portal redirection
  • • Check the hotspot server is enabled on the router
  • • Use "Verify Hotspot Files" on the router page to check portal files
  • • Verify DNS is working on the router
M-Pesa payment not creating access
  • • Check your M-Pesa gateway is properly configured
  • • Verify the callback URL is accessible from the internet
  • • Check the payment log in Billing → Payments
Voucher code not working
  • • Check the voucher status in Hotspot → Vouchers (it may be expired or already used)
  • • Ensure the RADIUS server is reachable from the router: /radius monitor 0