Captive portal on Keenetic: a guest network with SMS authorization

Keenetic is common in small coffee shops and guest houses: affordable, stable, with a clear interface. A captive portal works on it, but the segment logic differs from MikroTik and that is what trips people up.

What you need before you start

• Admin access to the router's web interface
• A current KeeneticOS version. Segments and guest policies have changed noticeably across recent releases. If the firmware is old, update it first, or half the menu items will be named differently from any guide
• The portal address and key from the authorization server
• The addresses for the allow list: the portal and the SMS gateway
• A phone with mobile data switched off for testing

It is also worth deciding up front where the boundary between the working and the guest network runs. On Keenetic that decision is made once and determines everything else: the segment sets the SSID, the subnet and the access rules.

The key idea: everything is built around a segment

In KeeneticOS the network is split into segments, each with its own addressing, access rules and SSIDs. Guest access is not a checkbox on an access point: it is a separate segment with the guest SSID bound to it. Client isolation and restrictions between segments are set at the segment level.

Step 1. The guest segment

Create a separate segment for guests and bind the guest SSID to it. In its settings enable:

• client isolation — guests do not see each other;
• no access to other segments — the guest network cannot reach the till, cameras or work machines;
• its own address pool and DHCP.

That is the barrier the whole exercise is for: see guest network isolation.

Step 2. The portal

Built-in portal. KeeneticOS has an authorization component for the guest network: it intercepts the first request and shows a login page. Fine for a greeting and a shared password, but on its own it does not confirm identity and does not keep a log fit for an inspection.

External authorization server. The working option for a venue: Keenetic delegates authorization over RADIUS, the portal confirms the phone number by SMS or a digital ID and keeps the log. The segment settings take the RADIUS address, the shared secret, and accounting must be enabled — without it sessions never reach the log.

Step 3. What to allow before authorization

Until the guest signs in, nothing goes out. The portal and its API addresses must be allow-listed, otherwise the login page never loads and it all looks like "the internet is down". Add the SMS gateway domains too.

How to confirm it works

1. Connect to the guest SSID with mobile data switched off
2. Open any site over http — the login page should appear
3. Sign in and check the internet works
4. Confirm the session is visible in the connection log
5. From the guest phone, try to open the router's address or a work computer — there should be no access

If that last step succeeds and a device on the working network opens, segment isolation is off. That is not a cosmetic flaw: a guest network in that state gives a stranger the same access as the working one.

If the portal will not open

• Test over http, not https. A secure connection cannot be intercepted without a certificate warning, so "no redirect" usually means the phone went to an https address by itself
• DNS. If the guest gets an external resolver while interception runs on the router, the substitution fails. In the guest segment DNS must point at the Keenetic itself
• The component is not installed. KeeneticOS is modular; the needed component may simply be absent from the current build
• Device cache. The phone remembers the network as "no internet". After changes, forget the network and reconnect

What goes into the log

Keenetic itself does not keep connection history in the form it will be asked for. The portal keeps the log: each session stores the phone number, the sign-in and sign-out time and the device MAC address. Export is from the dashboard.

That settles two questions at once — how many logs fit on the router, and what happens on a factory reset or a change of model. The history stays put. Which fields are worth keeping, and for how long, is covered in Wi-Fi log retention.

When Keenetic is not enough

One access point in a small room is comfortable. With several points and seamless roaming between a room, a terrace and a second floor, look at controller systems — compared in the hardware guide. The duty to identify the guest does not depend on the model: what the law requires.