ISPStack
Hotspot · captive portal

Voucher in.
Internet out.

Sell wifi by the hour or by the gig. Branded splash, plan tiles, voucher batches printed at the till — and the same CoA layer you use for PPPoE releases the customer the second the code clears.

1 hr
KSh 20
2 Mbps
1 day
KSh 100
5 Mbps
1 wk
KSh 500
10 Mbps
9:41
Sign in to Cafe-Bridge-WiFi
Cafe Bridge
Welcome to WiFi
Choose a plan or enter a voucher
1 hr
2 Mbps
KSh 20
1 day
5 Mbps
KSh 100
selected
1 wk
10 Mbps
KSh 500
or enter voucher
Powered by your ISPstack Billing System
Captive portal · first hit after SSID join
Capabilities

Built so it just works for the walk-in customer.

From the moment they tap "Connect" on the SSID to the moment they hit YouTube, the path is opinionated — and that's the point.

Captive-portal login

Hotspot clients land on a branded portal at /portal/walled_garden — a route MikroTik DNATs to via the parking subnet by default.

Voucher batches

Print 50, 500, 5,000 codes at a time in any plan tier. Sell at the till, in shops, via your reseller network — redemption ticks the inventory down.

Plan-based rate limit

Per-plan speed_down / speed_up applied to the session via RADIUS attributes. Time-limited and data-capped plans tear down cleanly on expiry.

CoA-release on auth

Successful portal login triggers a CoA-Disconnect that lets the NAS rebind the client to the live profile — no logout-then-login, no second auth round.

Ad injection (optional)

Splash page can pull ads from the marketing-service via mTLS. If marketing is down the portal still renders cleanly — the customer never sees a fallback error.

Public-endpoint hardened

Login and status endpoints are open to the world; rate-limited per IP, signed-cookie session, and the MAC-binding RFC the rest of the wifi industry pretends to follow.

Voucher batches

Print a sheet. Sell at the till.

Generate any number of codes in any plan tier. Each batch is tied to a tenant + plan; redemption decrements the unsold count and posts the revenue against the right account.

Batch BCH-2026-0518
Plan: 1 hour · 2 Mbps · KSh 20 each
Printed by stores@
25 May 2026 · 09:18
1 hour · 2M
WIFI-7H2K-N4LD
KSh 20 · valid 30d
1 hour · 2M
WIFI-A8RM-K2P1
KSh 20 · valid 30d
1 hour · 2M
WIFI-3CDX-Y8V0
KSh 20 · valid 30d
1 hour · 2M
WIFI-Q1BN-WP44
KSh 20 · valid 30d
1 hour · 2M
WIFI-2F8E-X1HM
KSh 20 · valid 30d
1 hour · 2M
WIFI-LQ55-9R7T
KSh 20 · valid 30d
✓ redeemed
1 hour · 2M
WIFI-EYV9-3MD1
KSh 20 · valid 30d
1 hour · 2M
WIFI-7B0K-44JM
KSh 20 · valid 30d
1 hour · 2M
WIFI-RT81-K0NS
KSh 20 · valid 30d
1 hour · 2M
WIFI-PD06-Z2NL
KSh 20 · valid 30d
1 hour · 2M
WIFI-VU58-MA4X
KSh 20 · valid 30d
1 hour · 2M
WIFI-W7N4-QQ20
KSh 20 · valid 30d
12 of 500 shown 421 unsold · 79 redeemed
Batch revenue
KSh 1,580
79 of 500 redeemed
Active sessions
  • 00:12 WIFI-LQ55-… 48m left
  • 00:08 WIFI-VU58-… 52m left
  • 00:03 WIFI-7B0K-… 57m left
Walled garden

The packet path, drawn the way it actually runs.

From the moment an unauthenticated MAC joins the SSID, every hop is choreographed: parking subnet, DNAT to the portal, voucher redeemed, CoA released, free for HTTP/S to the wider internet.

step 1
Client joins SSID, gets parking-subnet lease.
step 2
First HTTP DNAT'd to /portal/walled_garden.
step 3
Voucher / plan validated; MAC binds, session row created.
step 4
CoA-Disconnect issued; NAS rebinds, client is live.
Want to talk?

Print your first voucher batch today.

Captive portal goes live the moment you point your NAS at us; vouchers print to any thermal printer at the till — redemption ticks the inventory down automatically.