Ubiquiti UniFi and guest WiFi: captive portal setup with Purple

Welcome to the Purple Technical Briefing. I'm your host, and in the next ten minutes, we'll be providing a senior-level guide to integrating Purple's WiFi intelligence platform with Ubiquiti UniFi networks. This is for the IT managers, network architects, and operations directors who need actionable guidance to deploy a world-class guest WiFi solution. We'll cover the core architecture, a step-by-step implementation plan, and the common pitfalls to avoid. So, let's set the context. You have a UniFi network — it's powerful, it's scalable, but its native guest portal capabilities are basic. Your organisation needs more than just a password; it needs intelligence. You want to understand visitor behaviour, capture data for marketing in a GDPR-compliant way, and provide a seamless, branded user experience. This is the problem that the Purple integration solves. It transforms your UniFi infrastructure from a simple internet provider into a rich source of business intelligence. The core of this integration lies in UniFi's External Portal Server feature. When a guest connects, the UniFi controller doesn't handle the login itself. Instead, it redirects the user to the Purple cloud platform, which takes over the entire authentication journey. After the user logs in via a social account, a form, or a voucher, Purple makes a secure API call back to your UniFi controller to say: 'This user is authenticated, grant them access.' It's a simple, robust, and highly effective architecture. Now for the technical deep-dive. Let's walk through the five key steps for a successful deployment. I'll keep this concise. Step one: Controller Accessibility. Your UniFi controller must be reachable by Purple's cloud platform. This means you need a static public IP or hostname, and you must configure a port forward rule on your firewall. It's TCP port 8443 for software controllers and port 443 for hardware like the UDM Pro or Cloud Key Gen2. Step two: The Guest SSID. Inside your UniFi Network Application, you'll create a new wireless network. The crucial setting here is that the security protocol must be Open. This is non-negotiable. It's this open state that allows the captive portal redirect to happen. Don't worry — the security is handled by the portal and network segmentation, not by a pre-shared key. Step three: The Hotspot Portal. This is where you tell UniFi to use Purple. You'll enable the Hotspot Portal and set the authentication type to External Portal Server. You will then input the specific IP address and access domain provided by Purple. A key mistake to avoid here is enabling HTTPS redirection. Purple manages the security, so this should be disabled. Step four: The Walled Garden. This is the most critical and often misunderstood part of the configuration. The Walled Garden is your pre-authentication whitelist. You must add all of Purple's domains, plus the domains for any social login providers you want to offer, such as facebook.com. If this list is incomplete, the portal simply will not load for your guests. It's the first place to check when troubleshooting. Step five: The Purple Portal. Finally, you log in to your Purple account. In your venue settings, you'll enter the public address of your UniFi controller and, very importantly, the credentials for a dedicated local administrator account — not your Ubiquiti cloud account. This is what allows Purple to make that vital API call to authorise the guest. Follow those five steps, and you have a robust, enterprise-grade guest WiFi solution. Let's talk about implementation recommendations and pitfalls. Best practice number one: network segmentation. Your guest SSID must be on its own VLAN, completely isolated from your corporate network. This is non-negotiable for security and PCI DSS compliance. Second, use bandwidth throttling. UniFi allows you to set per-user rate limits. Use them to ensure a fair experience for everyone. Third, as I mentioned, use a dedicated local admin account for the API. It limits your security exposure. The most common pitfall we see is a failed redirect — the portal doesn't load. Nine times out of ten, this is an incomplete Walled Garden. The second most common issue is a successful login, but no internet access. This points directly to a communication failure between Purple and your controller. Check your port forwarding rules and the admin credentials in the Purple portal. Time for a rapid-fire Q&A. I'm often asked: Can I do this with a UDM Pro? Yes, absolutely. The process is identical, just remember to use port 443. What if my controller IP changes? You need a static IP or a dynamic DNS hostname. If the address changes, the integration will break. How secure is an Open SSID? The security is enforced by client isolation on the access point and the VLAN firewall rules. The guest network is isolated. For even greater security, we can deploy WPA3-Enterprise with RADIUS, which is what our PurpleConnex solution does. To summarise, integrating Purple with UniFi elevates your guest WiFi from a simple utility to a strategic asset. It provides deep business intelligence, powerful marketing capabilities, and a professional user experience. The key to success is a methodical approach to the configuration: ensure public controller access, use an open SSID, configure the external portal and Walled Garden correctly, and use a dedicated local admin for the API. By following this guide, you can ensure a smooth, successful, and highly valuable deployment. For detailed, step-by-step written instructions and diagrams, please refer to the full technical reference guide on our website. Thank you for listening to the Purple Technical Briefing.