Cloud RADIUS and Guest WiFi for Ubiquiti UniFi
Add 802.1X authentication and a branded guest hotspot portal to your UniFi SSIDs without running a RADIUS server. IronWiFi hosts the RADIUS and the external portal in the cloud and works with UDM, UDM-Pro, UDM-SE, UDR, Cloud Key Gen2, and self-hosted controllers on UniFi Network 8, 9, and 10.
What You Can Do with UniFi and IronWiFi
One cloud service behind every SSID in your UniFi site
802.1X and WPA2-Enterprise SSIDs
Add IronWiFi as a RADIUS profile under Settings → Networks and set your SSID security to WPA2/WPA3 Enterprise. IronWiFi handles the 802.1X exchange with EAP-TLS, PEAP, and EAP-TTLS, so staff join with their existing credentials or a certificate instead of a shared passphrase.
Guest Hotspot Portal
Switch an open SSID to the Hotspot application and point the External Portal Server at IronWiFi to get a branded splash page. Email, SMS, social, voucher, and self-registration flows are built in, and every session is logged for reporting.
Your Existing Identity Provider
UniFi forwards the RADIUS request to IronWiFi, and IronWiFi checks it against Microsoft Entra ID, Google Workspace, Okta, OneLogin, JumpCloud, or any LDAP and Active Directory you connect. No separate WiFi password list to maintain.
Dynamic VLANs and RadSec
Set a VLAN ID on each IronWiFi user group and UniFi tags clients into that VLAN at association time, so guests, staff, and contractors can share one SSID. UniFi Network 8.4 and later also supports RadSec, which tunnels RADIUS over TLS for branch sites and untrusted links.
Four Steps in the UniFi Controller
Everything is configuration — there is nothing to install on your network
Create your portal in IronWiFi
In the IronWiFi console create a captive portal with the vendor set to Ubiquiti Networks. Set the Controller URL to your controller's public address, using port 443 for a UDM, UDM-Pro, UDM-SE, or UDR and port 8443 for a Cloud Key Gen2 or self-hosted controller, enter your UniFi admin credentials, then save and copy the splash page URL. The controller has to be reachable from the internet for this to work.
Create the guest network and SSID
In UniFi go to Settings → Networks and create a Guest network on an unused VLAN with Network Isolation enabled. Then under Settings → WiFi create an SSID with no password, attach it to that network, and set the Application to Hotspot with Hotspot Type set to Captive Portal.
Point the hotspot at IronWiFi
On the Hotspot Portal page, enable External Portal Server and set the external portal to the IronWiFi address, leave Secure Portal on, and enter your IronWiFi splash hostname. Then add the same IronWiFi address under Pre-Authorization Allowances so unauthenticated clients can load the portal, along with the domains for any social login providers you turned on.
Test it
Connect a device, browse to any HTTP page, and confirm the IronWiFi splash page loads. Back in the IronWiFi console the captive portal's Controller Status should read Connected, and the authentication should appear under Reports → Authentications.
Have Questions? Get Answers
- Start a free trial and connect a UniFi SSID today
- Follow the step-by-step UniFi setup guide in the help center
- Ask us anything by email — we answer setup questions directly
Prefer a deep dive? Read the UniFi cloud RADIUS setup guide, browse all compatible hardware, or subscribe through AWS Marketplace and pay on your AWS bill.