Controllers and zones

The bridge between the network hardware and the portal experience.

What a controller record is

A controller record (System › Device Controller) represents one piece of network hardware that Kiwire authenticates and accounts guests through: an access-point controller, a gateway, a router's hotspot, whatever your vendor calls it. The fields that matter are:

• Vendor — which of the 35 device types it is.
• Identity — the name the hardware presents to Kiwire. It has to equal what the controller sends when it redirects a guest to the portal, and what it sends as its NAS-Identifier in RADIUS. When those two differ, you need a record for each. It has to be unique across the whole platform, not just your tenant, because an incoming request is matched to exactly one tenant by this value. See Identity and Virtual NAS.
• Shared Secret Key — up to 64 characters, identical to what is configured on the controller.
• IP Address and COA Port (under Advanced Configuration) — where Kiwire sends disconnects and live profile changes; the port is 3799 unless you change it.

Some vendors use more: an API key and site ID for a UniFi console, a username and password for MikroTik device bypass. Monitoring Method has one working option today — Wifidog, which marks a WiFiDog gateway as running when it checks in. Ping and SNMP (with their version, MIB and community fields) are saved but do not check whether the controller is reachable.

Adding a record is gated by the tenant's licence device quota — creation is refused once you're at the licensed limit, and every record counts, including a second record created for a different Identity. Step-by-step setup for each vendor is in Connecting a controller.

Switching Wi-Fi off and opening hours

Each controller has an Availability section in its edit form (System › Device Controller, then edit the controller):

• Wi-Fi on — switch it off and everyone online on that controller is disconnected straight away, and nobody can log in through it until you switch it back on. Guests who try see "This Wi-Fi network is switched off at the moment."
• Open 24 hours — switch it off to set Opens at and Closes at. Outside those hours guests cannot log in and see when the Wi-Fi opens again. Inside them, every session ends at closing time, so nobody stays online after close. Times are in your account's time zone, and a window that runs past midnight (for example 22:00 to 06:00) works as you would expect.

Logins refused for either reason appear in the login reports with their own reason, separate from wrong passwords or expired accounts. The controller's detail panel shows its state at a glance: On · 24 hours, On · 08:00–22:00, or Off.

The CSV import on the same page takes the same settings in three optional columns: status (on or off; blank means on) and start_time / stop_time (HH:MM; leave both blank for open 24 hours). The template you download from the import window includes them.

Disconnecting needs the controller to accept disconnect requests on its COA Port (see above). If it does not, guests already online stay on until their session ends, but nobody new can log in.

What a zone is

A zone (Portals › Captive Portal › Zones Mapping) is how Kiwire groups guest traffic once it's past the controller — typically by SSID, VLAN or IP range — and it's where the guest-facing policy actually lives: a limit on connected users, a priority used to decide which zone wins when more than one could match, whether it's active at all, and the journey it runs. Each zone's rules can match on IP address, IPv6 address, VLAN, SSID, NAS ID and controller zone; every value a rule sets has to match. A guest that matches no zone gets the tenant's default page.

Force profile and zone limits

Two zone-level settings that are easy to mix up. Force Profile overrides the profile an account would otherwise use for anyone in that zone. It is linked to the profile by name: renaming a profile through Kiwire updates the zones that use it, but if the name a zone holds and an actual profile's name drift apart, the override silently stops doing anything rather than failing loudly. Force Zone Restriction can equally restrict, by name, which other zones an account is allowed to roam into.

Limit Connected User, on the other hand, is a hard capacity limit on the zone itself, unrelated to any per-account limit a profile sets — once the number of live sessions already in a zone reaches that number, the next login attempt into that zone is rejected outright, regardless of whether that particular account would otherwise be allowed on.

Sub-tenant controller assignment

Sub-tenants are a lighter grouping inside a single tenant — each with its own admins and roles, without being a separate tenant. A controller can be explicitly handed to one sub-tenant, which doesn't change how it authenticates guests at all; what it changes is reporting — traffic through that controller gets attributed to the sub-tenant it's assigned to, so a tenant that resells or sub-manages parts of its network can see usage broken out per sub-tenant without needing a separate tenant for each one. A controller can only belong to one sub-tenant at a time — assigning it elsewhere updates the existing assignment rather than creating a second one alongside it.

Testing a controller

Portals › Troubleshoot › Controller Test opens a short-lived live capture: press Start Capture, then trigger a portal redirect from a test device, and every hit on the portal entry point appears close to real time with the parameters the controller actually sent — its identity, SSID, the guest's MAC and IP, the login address — as a pass/fail checklist. It's the quickest way to confirm a controller is redirecting guests to Kiwire and sending the fields Kiwire expects.

Two things to know. The capture only shows redirects from controllers already registered in your tenant; for a controller that isn't yet (or whose Identity doesn't match), add the page's Test URL to the controller's redirect so the hit is pinned to your capture. And it shows the redirect side only — RADIUS problems (wrong secret, unregistered NAS-Identifier) don't appear there; a login that reaches the portal but never completes usually points to them.