Walled garden generator
Generate pre-authentication allowed domain rules, ACL whitelists, and controller CLI scripts for 9 enterprise wireless hardware platforms.
Configure and validate captive portal walled gardens
1. Select service integrations
2. Add custom venue domains
Include custom API endpoints, venue CDN hosts, or web assets required by your splash page.
3. Choose hardware controller & export format
Select your target enterprise wireless controller to format the exact CLI or dashboard whitelist rules.
# ==================================================================
# Cisco Meraki Dashboard - Walled Garden Allowed Domain List
# Location: Wireless > Configure > Access control > Splash page
# ==================================================================
*.aadcdn.msauth.net
*.aadcdn.msftauth.net
*.account.live.com
*.accounts.google.co.uk
*.accounts.google.com
*.accounts.youtube.com
*.api.purple.ai
*.apis.google.com
*.app.purple.ai
*.appleid.apple.com
*.appleid.cdn-apple.com
*.assets.purple.ai
*.auth.gfx.ms
*.auth.purple.ai
*.captive.purple.ai
*.cdnjs.cloudflare.com
*.challenges.cloudflare.com
*.fonts.googleapis.com
*.fonts.gstatic.com
*.googleusercontent.com
*.gsa.apple.com
*.gstatic.com
*.idmsa.apple.com
*.login.live.com
*.login.microsoftonline.com
*.logincdn.msauth.net
*.onboarding.purple.ai
*.portal.purple.ai
*.purple.ai
*.ssl.gstatic.com
*.static.cloudflareinsights.com
*.www.purple.aiImportant notes on Apple CNA bypass and captive portal detection
Whitelisting Apple probe hostnames (captive.apple.com) suppresses the automatic Captive Network Assistant browser overlay on Apple devices. While this allows seamless authentication for return visitors in corporate environments, it prevents the splash page from opening automatically on guest devices. For standard visitor networks, leave the Apple CNA probe unselected to ensure immediate login prompt display.
How pre-authentication walled gardens operate
In enterprise guest WiFi deployments, a walled garden (pre-authentication access control list) defines the specific network destinations an unauthenticated device is allowed to reach before completing splash page onboarding. When a guest connects to an open or secure guest SSID, the wireless LAN controller (WLC) or cloud-managed access point places the client into a restricted pre-authentication state.
All standard web traffic is intercepted and redirected to the captive portal login URL. However, for modern splash pages featuring social login (OAuth 2.0), credit card billing (Stripe, PayPal), custom typography (Google Fonts), or external CDN assets, the client browser must exchange data with third-party servers prior to receiving full internet authorization. If any of these endpoints are omitted from the controller walled garden whitelist, the login process fails silently, resulting in blank modal windows or broken checkout buttons.
Enterprise wireless controller walled garden comparison matrix
| Hardware platform | Mechanism | Wildcard format | Configuration interface | Dynamic DNS snooping |
|---|---|---|---|---|
| Cisco Meraki MR | AP-level DNS snooping | *.domain.com | Dashboard Web UI / REST API | Automatic per client MAC |
| Cisco Catalyst 9800 | IOS-XE Parameter-Map | redirect-passthrough domain | CLI / WebUI WebAuth Profile | Supported via FQDN snooping |
| Aruba AOS 8 / 10 | Netdestination aliases | name *.domain.com | CLI / Aruba Central UI | Built-in DPI engine |
| Ubiquiti UniFi | Gateway authorization table | *.domain.com | UniFi Network Hotspot Settings | Integrated into dnsmasq / UDM |
| Fortinet FortiGate | FQDN Address Objects | set fqdn *.domain.com | FortiOS CLI / Captive Exempt List | FortiGuard DNS resolution table |
| Juniper Mist | Cloud-pushed AP hostnames | *.domain.com | Mist AI Portal / Mist API | Edge AP hardware acceleration |
| Ruckus SmartZone | WISPr Walled Garden Table | *.domain.com | SmartZone WebUI / ZoneDirector | AP-level DNS proxy filter |
Apple CNA and Android captive portal probe mechanics
When mobile devices associate with an unencrypted or guest SSID, the operating system launches an automated background connectivity check to determine whether the device has unrestricted internet access or is trapped behind a captive portal:
- Apple iOS and macOS: Issues an HTTP GET request to
http://captive.apple.com/hotspot-detect.html. If the server returns anything other than the exact HTML text containing<HTML><HEAD><TITLE>Success</TITLE></HEAD><BODY>Success</BODY></HTML>, the OS immediately pops up the modal Captive Network Assistant (CNA) browser. - Google Android: Sends an HTTP 204 request to
http://connectivitycheck.gstatic.com/generate_204. If the access point intercepts the connection and returns an HTTP 302 redirect or an HTML splash page, Android displays a 'Sign in to WiFi network' notification in the system tray. - Microsoft Windows: Contacts the Network Connectivity Status Indicator (NCSI) at
http://www.msftconnecttest.com/connecttest.txt, expecting a 200 OK with the stringMicrosoft Connect Test.
Best Practice Recommendation: Do not whitelist Apple or Android probe domains unless you are intentionally implementing a frictionless headless onboarding flow (such as Passpoint / Hotspot 2.0). Whitelisting these probes fools the operating system into thinking it has live internet, which suppresses the splash screen and forces guests to manually open a web browser to discover the portal.
Securing walled gardens against DNS tunneling and abuse
While walled gardens are essential for visitor authentication, improperly configured whitelists can expose guest networks to security vulnerabilities:
Always restrict unauthenticated DNS traffic to trusted corporate DNS resolvers or internal controller proxy forwarders. Allowing open recursive DNS across the pre-auth network allows malicious actors to tunnel arbitrary TCP/UDP traffic over DNS queries (Iodine / DNScat).
Avoid broad top-level wildcard whitelists like *.amazonaws.com or *.cloudfront.net where possible. Specify exact asset bucket hostnames (e.g., myvenue-assets.s3.amazonaws.com) to prevent unauthorized browsing of unauthenticated cloud storage.
Configure pre-authentication session ACLs to permit only outbound TCP port 443 (HTTPS) for third-party OAuth and payment processors, closing unencrypted port 80 to prevent man-in-the-middle session hijacking on the guest VLAN.
Frequently asked questions about walled gardens and captive portals
What is a walled garden in guest WiFi and captive portal networks?
A walled garden (also referred to as an allowed domain whitelist or pre-authentication access control list) is a restricted browsing environment enforced by wireless access points or wireless LAN controllers. Before an unauthenticated visitor logs in through a captive portal splash page, all general internet traffic is blocked. The walled garden explicitly whitelists specific fully qualified domain names (FQDNs) and IP ranges - such as the captive portal hosting servers, OAuth identity providers, payment processors, and web fonts - allowing the splash page and authentication scripts to function without granting full network access.
How does DNS snooping work on enterprise access points for walled gardens?
Modern enterprise access points (such as Cisco Meraki, Aruba, and Juniper Mist) utilize dynamic DNS snooping rather than static IP access control lists. When an unauthenticated client sends a DNS query for a domain in the walled garden whitelist (e.g., accounts.google.com), the access point intercepts the DNS response from the upstream resolver. The AP inspects the returned A or AAAA records and temporarily installs dynamic Layer 3 firewall permit rules for those specific IP addresses for the client's MAC address, expiring them when the DNS TTL elapses.
Why does whitelisting Apple CNA break the automatic splash page popup?
Apple devices detect captive networks by sending an HTTP probe to captive.apple.com upon connecting to an SSID. If the device receives the expected 'Success' response, it assumes full internet access is available and will not open the Captive Network Assistant (CNA) browser overlay. Whitelisting captive.apple.com allows this probe to pass through unintercepted, which tricks iOS and macOS into believing the device has full connectivity, suppressing the automatic modal login prompt.
What domains must be whitelisted for social login via Google, Apple, and Microsoft?
For Google authentication, whitelist accounts.google.com, ssl.gstatic.com, apis.google.com, and gstatic.com. For Microsoft Entra ID / 365, whitelist login.microsoftonline.com, login.live.com, aadcdn.msftauth.net, and aadcdn.msauth.net. For Sign in with Apple, whitelist appleid.apple.com and appleid.cdn-apple.com. Because OAuth providers frequently use content delivery networks and subdomains, wildcard matching (*.domain.com) is recommended on controllers that support it.
What causes captive portal redirect loops and blank white screens?
Redirect loops and blank screens typically occur due to three issues: 1) Missing CDN or JavaScript assets in the walled garden (e.g., fonts.gstatic.com or js.stripe.com blocked before loading), 2) Strict HTTPS redirection where the controller attempts to intercept an HTTPS request without a valid SSL certificate on the gateway, or 3) Missing OAuth callback domains where the identity provider attempts to redirect back to the portal host but is blocked by pre-auth firewall rules.
How does Purple simplify walled garden management across multi-vendor networks?
Purple operates high-availability Anycast cloud infrastructure with consolidated single-origin domain architectures. By centralizing captive portal hosting, authentication engines, and CRM integrations behind unified FQDN endpoints (such as onboarding.purple.ai), Purple minimizes the number of external domain rules required on wireless controllers, reducing configuration errors and eliminating pre-auth dropouts.
Related network diagnostic and WiFi tools
Deploying enterprise guest WiFi across multi-vendor networks?
Eliminate complex walled garden maintenance, SSL warnings, and portal timeouts. Purple integrates natively with Cisco Meraki, Catalyst 9800, Aruba, UniFi, Fortinet, Mist, and Ruckus to deliver high-availability captive portals, Passpoint onboarding, and behavioral guest analytics.
Book a 20-min demoNetforge Network Multi-Tool
Run offline network health checks, path analysis, and latency diagnostic scans directly from your desktop.
Download Multi-Tool