A guest network is the separated WiFi network that visitors connect to. A captive portal is the web experience that can appear before the network grants normal access.
Why the distinction matters
You can have a guest network without a marketing captive portal. You can also add a third-party portal to a supported guest network to collect consented data, show terms, authenticate users or trigger marketing workflows.
Security first
The guest network should be segmented from sensitive business systems regardless of which portal software is used. Portal software is not a substitute for sound network design.
Primary sources checked: Ubiquiti captive portal docs. Pricing and features can change; confirm time-sensitive details before buying.
Use the guest network for segmentation
The guest network answers the routing and security question: which devices are guests, and what are they allowed to reach? It should be designed so visitors cannot freely reach sensitive internal networks or one another where isolation is required.
Use the captive portal for the access experience
The captive portal answers a different question: what must a guest do before normal access is authorized? That can be accepting terms, entering a password, redeeming a voucher, verifying a contact method or completing a third-party login workflow.
You may need one, both or neither
| Scenario | Guest network | Captive portal |
|---|---|---|
| Office visitors with shared password | Yes | Optional |
| Cafe collecting consented emails | Yes | Usually yes |
| Hotel with room-based login | Yes | Usually yes |
| Small private waiting room | Yes | May be unnecessary |
Security should not depend on the portal
A guest network should still have the correct segmentation and firewall policy even if the portal is turned off. The portal controls the access experience; it does not replace network isolation. This distinction also makes troubleshooting easier: first confirm the device can associate and receive the intended network policy, then troubleshoot the web authorization layer.
How to choose the simplest design
If visitors only need internet and there is no individual identity requirement, a guest network with a password may be sufficient. Add a captive portal when you need per-guest access, terms, vouchers, payments, identity, consented data capture or a branded login. Every added step should solve a real operating requirement.
For the full explanation, see what is a captive portal?