XaWiFi Captive Portal
Secure, metered guest Wi-Fi for maritime and remote networks.
Turn any satellite link into a branded, billable, policy-controlled hotspot.
Guest Wi-Fi Built for the Farthest Reaches
Designed from the keel up for ships, rigs, and remote camps where bandwidth is precious and every gigabyte counts.
Branded Experience
Custom splash pages, themes, logos, and multilingual copy. Guests see your brand, not a generic router page.
Flexible Access
Issue voucher codes, PIN codes, or charge directly to a guest folio. Sell time, data, or unlimited plans per device.
Policy & Billing
Enforce time and data quotas, per-plan bandwidth limits, and automatic expiry. Integrates with PMS for cabin billing.
One Portal, Any Link
XaWiFi sits between your guests and the upstream connection. It does not replace your VSAT, Starlink, L-band, or 5G backhaul — it turns that backhaul into a managed, guest-ready service.
From cruise ships and expedition yachts to offshore platforms and remote research stations, the same stack controls who gets online, for how long, and at what speed.
Discuss Your SetupTechnical Specifications
Built on proven, open standards and engineered for the constraints of satellite networks.
⚙️ Core Stack
- Apache + PHP 8.5 application server
- MySQL application database
- FreeRADIUS 3 for authentication and accounting
- MikroTik RouterOS HotSpot gateway
- RouterOS API + RADIUS PoD/CoA for live control
🔐 Authentication Modes
- Voucher codes with batch generation and printing
- PIN codes tied to guest or cabin records
- PMS folio posting for charge-to-room
- Long-lived device tokens for returning guests
- MAC + token fallback when MAC changes
📏 Policy Enforcement
- Time-based plans (minutes/hours/days)
- Data-based plans with byte-precise quotas
- Combined time + data plans — first limit wins
- Per-plan upload/download speed limits
- Queue priority and MikroTik group mapping
🍎 Mobile Captive Network Assistant
- Apple CNA suppression strategy for self-signed links
- Standard CNA strategy with trusted HTTPS
- Android/iOS captive portal detection endpoints
- Lightweight CNA login page (cna.php)
- Post-auth success signal for sheet auto-close
🔄 Session Lifecycle
- MAC-based session restore on reconnect
- Idle reconnect via device token cookie / localStorage
- Automatic RADIUS accounting reconciliation
- Quota enforcer runs every 5 minutes
- Session expiry enforcer runs every 2 minutes
🖥️ Management & APIs
- Role-based admin dashboard (admin / operator)
- Guest, voucher, session, and plan management
- PMS ledger, reports, and printable summaries
- JSON API for portal and third-party integrations
- System logs, test suite, and health watchdog
🛡️ Security & Resilience
- HTTPS enforcement on portal domain
- CSRF tokens on admin and API endpoints
- Device-token hashing with bcrypt
- Ghost-session cleanup when router and DB drift
- IP anti-hijack: no IP-only session restore with valid MAC
📡 Satellite-Ready Design
- No heavy JS build step — pages load fast over slow links
- CNA discovery avoids MikroTik API calls
- Bandwidth quotas protect shared satellite capacity
- Works with NAT, proxies, and intermittent connectivity
- On-premise deployment — no cloud dependency
📋 RFC & Standards Compliance
- RFC 8910 — Captive-Portal identification in DHCP/RA via captive-portal URI
- RFC 7710 — Legacy DHCP captive-portal identification support
- RFC 8908 — Captive Portal API JSON schema for device status
- RFC 2865 / 2866 — RADIUS authentication and accounting
- RFC 5176 — Dynamic Authorization Extensions (CoA / PoD)
- RFC 3580 — IEEE 802.1X RADIUS usage and VLAN attributes
Ready to Manage Your Guest Wi-Fi?
Talk to our team about deploying XaWiFi on your vessel or remote site. We handle the network integration, theme setup, and PMS connection.