Guest WiFi for ISPs and business broadband providers

A broadband provider that connects pubs, cafes and hotels already supplies the router and sends the monthly invoice, so guest WiFi can go on as one more line. This guide is for ISPs, WISPs, altnets and business broadband resellers doing that.

Guest WiFi as a line on the connection contract

Guest WiFi fits a business broadband contract as a monthly add-on per venue, billed by you with the connection. On CaptiFi's reseller and white-label models you buy at wholesale in your account currency, set your own retail price and invoice the venue yourself. Sold at CaptiFi's public price, your margin is more than a third of that price, and you can charge more. A partner-managed client who opens Billing in the dashboard sees a notice that billing is handled by their service provider, with no CaptiFi plans, prices or card form, and cannot order a CaptiFi device with a card or buy SMS credits there.

Pick the plan by what the venue will use. Essentials, $69 a month at the public price, covers the branded splash page, GDPR contact capture, CSV export, paid WiFi and WiFi vouchers for up to 1,000 new guests a month. Growth adds integrations, API access and rewards. Review requests and email marketing are on Growth. For a plain add-on, partners can also sell a capture-only plan (branded splash page, contact capture and CSV export for up to 1,000 new guests a month, without review requests or email marketing), billed at the Essentials wholesale rate. Paid WiFi pays into the venue's own Stripe account, and CaptiFi takes no commission.

Using the router and access points already installed

CaptiFi works as an external captive portal on the access points a venue already has, and where nothing suitable is installed, the CaptiFi device plugs in behind your router. There are setup guides for UniFi, TP-Link Omada, Cisco Meraki, Aruba Instant On, Ruckus, Fortinet and Cisco Catalyst. MikroTik hotspots and DrayTek routers have no card in the setup wizard: email support@captifi.io and CaptiFi support sends the portal details. The hardware page lists model families and the deployment guide has the checklists.

The CaptiFi device behind your router

The CaptiFi device is a dual-band WiFi 5 (802.11ac) access point powered over Ethernet from the PoE injector in the box. Plug it into a spare router port, join the CaptiFi Setup network from a phone and enter the venue's 8-digit activation PIN, and guest WiFi is live in about five minutes with no controller, static IP or firewall change. It needs outbound access only (HTTPS on TCP 443 and WireGuard on UDP 51820 to CaptiFi, plus DNS and NTP), and because it dials out, CaptiFi's network guide says double NAT is normally fine. It is for indoor use. When a venue signs up directly it comes with every plan from Essentials up for a refundable deposit; for your clients you order it from the client's page, it is billed through your partner agreement, and each order shows its status from pending to delivered with the courier's tracking number (see the device page).

Controllers behind carrier-grade NAT

Controller installs need more care on a CGNAT line. CaptiFi's deployment checklist asks for the controller to be reachable externally, by static IP or DNS hostname with inbound HTTPS allowed. A controller at a site behind your CGN, on an address from the 100.64.0.0/10 block that RFC 6598 reserves as shared address space for carrier-grade NAT devices, cannot be reached that way unless the site gets a public address. For UniFi, CaptiFi's Remote Tunnel gets round it: the console connects out to CaptiFi, so no port forwarding or bridge mode is needed, and the tunnel runs on UniFi OS gateway consoles and most Cloud Keys. For a self-hosted controller of another brand, check its setup guide before you promise the install, or use the CaptiFi device.

Separating guest traffic from the venue's own network

Guests need their own SSID and VLAN with client isolation, away from tills, cameras and office machines. On a controller that means a guest SSID on a guest VLAN, with CaptiFi as the external portal on that SSID; the Omada steps, for example, use an open guest SSID on a separate VLAN with Omada's own Guest Network option off. The CaptiFi device broadcasts its own guest network alongside the venue's private one, and if your router can, put its port on a VLAN of its own with internet access (CaptiFi's network guide warns that a port isolated with no uplink leaves the device offline).

After sign-in, guest traffic runs straight over the venue's connection, so capacity planning stays with you; paid WiFi speed tiers are enforced on UniFi. On managed networks, watch for MAC filtering (add the device's MAC from its label to the allow list) and an existing captive portal upstream (connect the device to a port that bypasses it).

What the provider, CaptiFi and the venue each do

On the reseller and white-label models the work splits as below. On a referral, CaptiFi bills and supports the venue itself.

CaptiFi's data processing agreement names the account-holding Customer as controller and CaptiFi as processor; on white label you sign it before adding clients, so set out the venue's role and yours in your own contract with the venue.

White label for providers who sell under their own name

White label suits a provider whose customers buy from it by name, and CaptiFi's partner pages list ISPs among the partners it is meant for. It is the reseller model at the same wholesale rates, plus a minimum monthly commitment agreed when you upgrade that acts as a floor on the wholesale bill; it can start on an agreed later date and is prorated in its first month.

A venue owner who signs in sees your logo, colour and tab icon, finds your support email on the support page, and gets your brand on the main account emails and, on Growth and Pro with Brand PDF reports on, the monthly PDF report. You set all of it once on the Branding page, and changes reach every client account within a few minutes.

The limits, as the white-label page and CaptiFi's documentation set them out:

• clients sign in to the dashboard at my.captifi.io, and that dashboard sign-in page is CaptiFi's
• there is no custom domain for the dashboard
• a support phone number is not shown to clients
• ticket confirmations and review requests do not carry your brand, and platform emails send from CaptiFi's addresses

Each client venue can verify its own sending domain for guest campaigns, so set that up at onboarding.

Support tickets and the fleet health digest

Support tickets from your clients come to you. A request a partner-managed client raises from Guides and support on my.captifi.io is emailed to your support address and listed on your Tickets page with its priority (Low, Normal, High or Urgent) and its status (Open, Answered or Closed), and you reply from your own helpdesk. When a ticket needs CaptiFi, escalate to partners@captifi.io; step 10 of the deployment checklist lists what to include.

A morning health digest flags client venues that need attention, and copies of offline and back-online alerts for CaptiFi devices at client venues go to your support inbox. The Partner API adds further venues per client, priced on your statement as extra sites. Engineers and account managers can have their own staff logins, with payout details kept to the account owner.

Choosing a partner model

Referral suits a provider that wants no extra billing or support (CaptiFi bills and supports the venue, and you earn 20% of every payment for the client's lifetime), reselling suits one that already invoices monthly, and white label one that sells under its own name. You can start as a reseller and move to white label later; the hub guide to guest WiFi for MSPs compares the models and the MSP programme page has the rate card.

Once you know which business lines you would start with, apply to the CaptiFi partner programme and choose Internet Service Provider as your business type.

Sources: IETF, RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space (April 2012), read 22 October 2026; CaptiFi's partner programme pages and customer documentation, October 2026. UniFi, Omada, Meraki, Aruba, Ruckus, Fortinet, MikroTik, DrayTek, Cisco and Stripe are trade marks of their owners; CaptiFi is not affiliated with or endorsed by them.