Letting TVs and other devices skip the portal

How to let a room TV, a streaming stick or a games console get online without anyone signing in on the portal — on any controller brand.

The idea

A TV can't type a voucher code or tick a consent box, and guests don't want to sign in on one. So you put the device on a list of approved devices, and Kiwire lets it straight through whenever it connects. Kiwire recognises it by its MAC address, the fixed hardware address every network device has.

The list lives in Kiwire, not on your controller, so it works the same on every brand and there is nothing on the controller that can fall out of step with what you see on the page.

Two ways a device gets through

1. MAC login on the controller. This is the main way, and it works for every device, with or without a screen. When a device joins the network, the controller asks Kiwire about its MAC address before showing the portal. An approved device is let through at once; any other device sees the portal as usual. You switch this on once per controller. For MikroTik see MAC login for approved devices. On other brands the setting is usually called MAC authentication or MAC-based access on the guest network: set it to use RADIUS, and to send the device's MAC address as both the username and the password.

2. Automatic sign-in on the portal. For controllers without MAC login. When an approved device opens the portal page in its own browser — as many smart TVs do when they join a network with a login page — Kiwire signs it in by itself, without showing the login screen. Devices without a browser, which includes most streaming sticks and consoles, can only use the first way.

You don't choose between them: Kiwire uses whichever one the device arrives by. Guests can also add their own TV by scanning a QR code — see Guests connecting a TV themselves.

Who owns a device

Every approved device has an owner, which decides how long it works and how fast it is:

• A guest or room account. Type the account's username in Owner account. The device follows that account: it uses the account's profile, and it stops working when the account expires or is suspended — so a guest's streaming stick stops at check-out without anyone having to remember to remove it. Each account can own up to 2 devices.
• The property. Leave Owner account empty and choose a Profile. Use this for the TVs that belong to the room. Pick a profile without a time or data allowance; otherwise the TV is cut off when the allowance runs out, just as a guest would be.

Choosing a profile for a guest-owned device overrides the account's own profile for that device only.

Switching it on

Go to Portals › Captive Portal › Bypass Devices and open the Approved devices tab. The switch at the top, Let approved devices skip the portal, is off to begin with. While it is off, every device sees the portal, including the ones on your list, and nothing about guest logins changes. Turn it on when your list is ready.

The switch applies to your whole organisation. Each controller still needs MAC login switched on (or relies on automatic sign-in), as described above.

Approving a device

Click Approve a device and fill in:

• MAC address — on most TVs it is under Settings › Network › Network status or About. Any common format works: AA:BB:CC:DD:EE:FF, AA-BB-CC-DD-EE-FF or aabbccddeeff.
• Label — something the front desk will recognise, such as Room 1203 TV.
• Type — TV, streaming stick or box, game console, or other.
• Owner account or Profile, as described above.
• Expires — optional. After this date and time the device sees the portal again.
• Status — Disabled keeps the device on the list but stops it skipping the portal.

Picking the device from "Recently seen"

Typing MAC addresses from a TV menu is slow. Once MAC login is on, Kiwire remembers every device that asked to skip the portal and was refused, for two days. They are listed under Recently seen, not approved, with the zone and controller they connected through and when they last tried. Switch the TV on, find it in that list and click Approve: the form opens with its MAC address already filled in.

Random MAC addresses

Phones, tablets and laptops normally use a random MAC address on each network, which changes from time to time. Kiwire marks these with a random MAC label. Approving one won't last, because the device will turn up with a different address later. TVs, streaming sticks and consoles use their fixed address, so they are not affected.

Guests connecting a TV themselves (QR code)

You can let guests pair their own TV instead of calling the front desk. Switch it on under Portals › Captive Portal › Configuration › Auto Login › TV pairing (QR code). It needs Let approved devices skip the portal switched on as well.

When a smart TV, streaming box or game console opens the portal in its browser, it shows a QR code instead of the login form:

1. The guest scans the code with their phone's camera. If the phone has no camera app, the TV also shows a short address and a six-character code to type in.
2. On the phone, the guest signs in with the details they use for the WiFi — their username and password, or a voucher code in both boxes.
3. The TV is added to Approved devices, owned by the guest's account, and signs itself in a few seconds later.

What keeps it safe:

• The code only pairs the TV that is showing it. It lasts five minutes and works once; after five wrong sign-ins it stops working and the TV shows a new one.
• A paired TV follows the guest's account like any guest-owned device: it uses the account's profile, stops when the account expires or is suspended, and counts towards the limit of 2 devices per account.
• A TV that is already on the list under another account can't be taken over; the guest is asked to contact the front desk.
• Phones, tablets and computers never see the QR code — they get the normal portal. A TV can also choose Sign in on this TV instead for the normal login form.

Paired TVs appear on the Approved devices tab like any other, with the remark Paired by QR code, and you can edit or remove them there.

Changing or removing a device

Use the edit and delete buttons on the device's row. Both take effect at once: if the device is online, Kiwire disconnects it, and it reconnects under the new settings — or, if you removed it, sees the portal.

What you see in reports

An approved device's connections are recorded like any other session, under the device's MAC address. They appear in Reporting › Login › Active Session and the login reports, with the time online and data used. The Last connected column on the Approved devices tab shows when each device last got through.

Approved devices or router rules?

The Router rules (MikroTik) tab on the same page is the older way to let a device through: it writes a rule directly onto one MikroTik router. Approved devices are usually the better choice:

	Approved devices	Router rules
Controller brands	Any with MAC login, plus automatic sign-in for devices with a browser	MikroTik only
Where the list lives	In Kiwire, one list for every site	On each router
Follows a guest's account and check-out	Yes	No
Sessions and usage recorded	Yes	No

Router rules remain useful for a device that must get through even when it cannot reach Kiwire, such as equipment on a router with no connection to the internet.

Who can use it

The tab uses the same permissions as the rest of the Bypass Devices page: view-bypass-devices to see the list, create-bypass-devices to approve a device, edit-bypass-devices to change a device or the switch, and delete-bypass-devices to remove one. The page is part of the Bypass Devices licence module.