Hardware for Wi-Fi authorization: what a router must support

The first question after "is this even mandatory?" is "will I have to replace the routers". Usually not. Here is what the hardware actually needs and how the four common lines differ.

What the hardware needs

The law names no brands. The requirement is one: a guest gets access only after identity is confirmed, and the session must be recorded. The wording and grounds are on the page about the law and inspections. From hardware that needs three things.

• Captive portal. The router must intercept the first request from an unauthorized client and show a login page
• Working with an external authorization server, usually over RADIUS: identity and the session log do not live on the router
• Network separation. A guest segment apart from the working one, otherwise the portal exists while the till shares a network with guest phones — see guest network isolation

Everything else is convenience. If those three are covered, the hardware stays.

Four lines and where each fits

MikroTik

Built-in hotspot, flexible, runs on almost any model. Requires knowing RouterOS. Best when you want control over every rule. Step-by-step config: SMS authorization on MikroTik.

Keenetic

Clear interface, affordable, handles a small room well. The logic is built around segments rather than per-access-point checkboxes, which is the first stumbling block. See captive portal on Keenetic.

TP-Link Omada

A controller system: access points are configured centrally. Sensible past two access points, with seamless roaming between rooms. See the portal in Omada.

Ubiquiti UniFi

Also controller-based and similar to Omada in logic: guest network, guest portal, external authorization server and pre-login allow list. Common in hotels and business centres. See the portal in UniFi.

By situation

Situation	Usual choice
One access point, small room	Keenetic
Full control over rules	MikroTik
Several rooms, roaming	Omada or UniFi
Mall, dozens of points, analytics	Omada or UniFi with a controller

When replacement is unavoidable

• An ISP router with no captive portal. The most common case: the box the installer brought routes traffic and nothing else
• No network separation. Without a separate guest segment there is no safe solution
• Several points that are not linked. Three independent routers sharing an SSID is not roaming: the guest re-authorizes on every move

Beyond the hardware

Hardware is half the job. The other half is the session log: what it must contain and how long to keep it is in Wi-Fi log retention. And the method of confirming identity: at volume the cost gap between SMS and Aitu Passport becomes a real line item. Scenarios for cafes, hotels and malls differ in detail, but the hardware requirement is identical.