Appearance
When a guest can't get online
A guest at the front desk says the Wi-Fi isn't working. This page takes you from what the guest describes to the cause and the fix, using the screens Kiwire already has. Find the symptom below, work through its checks in order, and stop when you find the cause. If you get to the end without one, the checklist at the bottom lists what to gather before you contact support.
First, three questions
Before you open any screen, ask:
- Is it one guest or everyone? One guest is nearly always their account, their device or their plan. Several guests in one area, or everyone, points at the network, a controller or the licence — go straight to Nobody can get online.
- What exactly is on the screen? Ask for the words, or a photo. "It doesn't work" covers six different problems; the message on screen usually names the one it is.
- What do they sign in with? A username and password, a voucher code, a phone number, a social account, a room number? It tells you where to look the guest up.
Then note the time, the guest's username or voucher code, and where they are (building, floor, network name). Every screen below asks for one of those.
The tools, and when to use each
| What you want to know | Where | Needs |
|---|---|---|
| Whether this account can log in, and if not, exactly which check stops it | Portals › Troubleshoot › Diagnostic Account | view-diagnostic-account |
| The account itself: status, plan, expiry, usage, live sessions, login history | Account › Users or Account › Vouchers, then View | view-users / view-vouchers |
| Who is online right now, and disconnecting or changing the plan of one session | Insight › Reporting › Login, Active Session tab | view-report-login-active-session (to act: manage-report-login-active-session) |
| What happened to past sessions and why they ended | Insight › Reporting › Login, Record and Session Termination tabs | view-report-login-record, view-report-login-termination |
| Every step the portal took for one device | Insight › Monitoring › Captive Portal Log and Portals › Troubleshoot › Portal Session Debugger | view-portal-log, view-portal-session |
| Whether the portal itself works, without walking to the site | Portals › Troubleshoot › Portal Simulation | view-portal-simulation |
| What the controller actually sends when a guest is redirected | Portals › Troubleshoot › Controller Test | view-controller-log |
| Whether Kiwire has already spotted a problem | Insight › Monitoring › Alerts | view-alerts |
| A plain-language answer, or a fix applied for you | KAIA | view-kaia, and KAIA switched on |
The Monitoring and troubleshooting tour describes each tool in full. The two you will use most are below.
Diagnostic Account
- Open Portals › Troubleshoot › Diagnostic Account.
- Type the guest's Username (or voucher code). Leave Password empty to use the password stored on the account, or type what the guest is typing and tick Test password match to check it.
- Optionally, under Simulate As, pick the Controller (NAS) and Zone the guest is connecting through. Pick the zone whenever the guest's account is limited to certain zones, or the zone has a user limit, so those checks are tested too.
- Click Check Account.
The result is a checklist of the same checks a real login goes through, in the same order: account exists, password, account status, profile policy, start date, expiry, third-party policy, zone allowed, zone capacity, MAC address allowed, time credit, data quota, simultaneous-login limit and voucher activation. It stops at the first failure and shows the message the guest would see. The duplicate-login guard and the licence monthly login quota always show as skipped, because a test run must not count as a login. The account summary underneath shows its status, plan, dates, usage and how many sessions are online now, with a link to open it in Users or Vouchers.
A diagnostic run never logs anyone in and never uses up anything.
Captive Portal Log and Portal Session Debugger
When the account checks out fine but the guest still can't get through, look at what the portal recorded for their device:
- Open Insight › Monitoring › Captive Portal Log, pick the Date and Hour of the attempt, and type the device's MAC address (or the username) in the filter box.
- The Captured panel lists the sessions and MAC addresses in that hour. Click the open icon next to one to jump to the Portal Session Debugger for it.
- Or go straight to Portals › Troubleshoot › Portal Session Debugger and search by MAC Address — it looks through the last 24 hours.
The debugger's User Flow shows how far the guest got: redirected from the Wi-Fi, which zone and journey they were placed in, whether the page loaded, and whether they were Authenticated — Submitted to NAS. The Log Trail below it shows the warnings and errors from that attempt. Where the flow stops is where to look.
Log lines are only written for guests Kiwire has already placed on your site. If the controller isn't registered with Kiwire, or sends the wrong identity, nothing for that guest appears in your log — use Controller Test instead.
The login page doesn't appear
The guest joins the network and nothing happens, or their browser shows "no internet", a certificate warning, or a half-drawn page.
On the guest's device first:
- Ask them to open a plain website starting with
http://(nothttps://), such ashttp://neverssl.com. Phones only pop up the login page when they can detect it; anhttps://site or an app usually can't be redirected. - Turn off any VPN or private DNS / "secure DNS" setting, and forget and rejoin the network.
- If the phone shows the login sheet and it closes when they switch apps, ask them to finish in the sheet, or open the browser and try again.
If the page never appears at all, the controller is not sending guests to Kiwire:
- Open Portals › Troubleshoot › Controller Test and click Start Capture.
- Have a device on the guest network open an
http://site. - If a request appears, the checklist says whether the controller sent everything Kiwire needs (All good, Check warnings or Problem detected). Fix any failed item on the controller.
- If nothing appears, the redirect isn't reaching Kiwire: check the redirect address on the controller and the walled garden. If the controller isn't registered yet, or its identity doesn't match, put the page's Test URL in the controller's redirect so the request shows up anyway.
If the page appears but looks broken (no logo, no styling, buttons that do nothing), the controller's walled garden is blocking some of what the page needs. See Walled garden and redirect for what must be allowed and how to spot the blocked addresses.
If an error page appears instead of the login page — a page titled Unable to Connect, Controller Not Registered, Network Not Found, Page Not Found, Session Expired, Device Blocked or Service Unavailable — Kiwire was reached but refused to show a login page. Guests see only the title and a short hint. To see the reason code, run the same visit in Portals › Troubleshoot › Portal Simulation: in simulation the error page also shows the code and the technical detail. Then look the code up in Portal error codes. The usual ones:
| Page title | Likely cause | Fix |
|---|---|---|
| Controller Not Registered / Unable to Connect | The controller's identity isn't registered in Kiwire, or the redirect doesn't carry it. | Check the Identity under Admin › System › Device Controller against what the controller sends (Controller Test shows it). See Controller identity. |
| Page Not Found / Unable to Connect | The guest's zone has no journey, or its page isn't published, and there is no published default page. | Under Portals › Captive Portal › Zones Mapping, give the zone a journey; publish the page. See The portal designer and journeys. |
| Device Blocked | The device's MAC or IP matches a block rule. | Portals › Captive Portal › Configuration, Firewall Policy card — remove the rule if the block was a mistake. |
| Session Expired | The guest left the login page open too long (about 30 minutes), or their browser lost the page's cookie. | Ask them to forget and rejoin the network. |
| Unable to Connect (licence) | The licence has expired, or the site is over its licensed device count or monthly login limit. | See Licence and add-ons and contact Synchroweb to renew. |
| Service Unavailable / System Maintenance | Your site has been switched off or the platform is in maintenance. | Nothing to fix on site — contact Synchroweb. |
Also check Insight › Monitoring › Alerts: guests being turned away before the portal (licence, device limit, no page, a controller not sending its identity or the device MAC) raise an alert there on their own.
The login page appears, but login fails
The guest fills in the form and gets a red message next to it instead of getting online. The message tells you most of the cause; Diagnostic Account tells you the rest.
- Run Diagnostic Account for the guest's username or code.
- Match the failing check to the table below.
- Fix it, then run Diagnostic Account again until every check passes, and ask the guest to try again.
| What the guest sees | Failing check | What to do |
|---|---|---|
| "Incorrect username or password." | Account exists / Password | The username doesn't exist, or the password is wrong — the guest is told the same either way. Look the guest up in Account › Users (search by username, name, email or phone). Check for spaces and capitals. To set a new password, Edit the account. |
| "Invalid voucher code." | — | The code doesn't exist as a voucher. Search Account › Vouchers by Voucher Code; check for confusable characters (0 and O, 1 and I). |
| "Too many failed sign-in attempts. Your account is locked for a while…" | — | The Password Policy locks an account after too many wrong passwords. The lock lifts by itself after the Lockout duration set on the Password Policy card under Admin › System › Settings (24 hours if left blank). Reset does not lift it. Confirm the right password with Test password match so the guest gets it right next time. |
| "Your account has been suspended." / "Your account is inactive." / "Your account is not currently active." | Account status | An admin, a schedule or the plan suspended it. If the guest should have access, select the account and use Reset (restores the status to active and clears usage), or Edit and set Status to Active. |
| "Your account is not yet active." | Start date reached | The account's start date is in the future. Edit the account if it should start now. |
| "Your account has expired." | Not expired | The Expiry Date has passed. Edit the account and move the date. Reset does not change the expiry date. |
| "Your account is not authorized to access WiFi from this location." | Zone allowed | The account's Allowed Zone doesn't include the zone the guest is in. Edit the account and add the zone, or clear the restriction. |
| "This location has reached its maximum capacity." | Zone capacity | The zone's Limit Connected User is full. Raise it under Portals › Captive Portal › Zones Mapping, or wait for sessions to end. See Force profile and zone limits. |
| "This venue has reached its maximum capacity." | Tenant concurrent-user limit | The whole site is at its concurrent-user limit. Contact Synchroweb. |
| "This venue has reached its monthly login limit." | Licence monthly login quota | The licence's monthly login allowance is used up. Contact Synchroweb. |
| "Your device is not authorized to access WiFi." | MAC address allowed | MAC Auto Register is on and the account's Allowed MAC list is full of other devices. For a user, Edit the account and remove an old address or clear the field. For a voucher, use Reset MAC. See Tying an account to its devices. |
| "You have reached your session time limit." | Time credit remaining | The plan's time is used up. See Voucher says used or expired. |
| "You have reached your data quota limit." | Data quota remaining | The plan's data is used up. Same as above. |
| "You have reached the maximum number of simultaneous connections." | Simultaneous-login limit | The account is already online on as many devices as its plan allows. See One device works, another doesn't. |
| A message you wrote yourself, or "Access denied" | Profile policy / Third-party policy | A time-of-day rule on the plan (Profile Policy card on Portals › Captive Portal › Configuration) or an outside policy check refused it. The message is the one set on that rule. |
| "This login option is not set up correctly / currently unavailable / not ready yet…", "No profile assigned" | — | A setup problem with the login method, not the guest. Check the method under Portals › Captive Portal › Login Methods — its access profile, its zones, and for a shared login the account it points to. See Login method unavailable. |
| "We could not send the verification code." | — | The SMS, WhatsApp or email provider refused the message. Insight › Monitoring › Alerts shows the provider's own error; check the connector under Grow › Connectors. |
| "We could not identify your device." | — | The controller didn't pass the device's MAC address. Ask the guest to forget and rejoin the network; if it happens to everyone, run Controller Test. |
The Error tab under Insight › Reporting › Login counts these failures by day and type, which shows whether one guest is unlucky or a whole method is failing. The full list of codes, with the order they are checked in, is in Portal error codes.
Logged in, but no internet
The guest sees the success page, or the portal says they are connected, but nothing loads.
- Are they really online? Open Insight › Reporting › Login, Active Session tab, and type their username or MAC in the table's search box.
- If they are listed, Kiwire and the controller agree they are online. Check:
- The plan. Open the account (View, Profile tab). A plan with custom RADIUS attributes such as a filter or VLAN can put guests somewhere with no internet route. See Custom RADIUS attributes.
- Data used up mid-session. If the account's quota is at its limit, the controller stops traffic. See Voucher says used or expired.
- The network beyond the controller. If every guest on that controller has the same problem, the controller's own internet link, DNS or firewall is at fault, not Kiwire.
- If they are not listed, Kiwire accepted the guest but the controller never completed the login. Open the Portal Session Debugger for their MAC. If the flow reaches Authenticated — Submitted to NAS, Kiwire did its part and handed the guest to the controller; the controller's RADIUS check against Kiwire then failed. The usual causes are a Shared Secret Key that differs from the one on the controller, or a NAS-Identifier that doesn't match a registered Identity. A newly added controller can take up to an hour to be accepted. See Before you leave site and Controller identity.
A few controllers (UniFi through its cloud console, for example) don't send accounting, so their sessions appear a little later, once Kiwire has polled the controller.
Gets disconnected, or asked to log in again
The guest was online and dropped off, or is shown the login page every time they come back.
- Open Insight › Reporting › Login, Record tab, filter by their username or MAC, and open a session. Terminate Reason says why it ended. The Session Termination tab shows the same reasons for the whole site.
- Match the reason:
| Reason | Meaning | What to do |
|---|---|---|
| Idle timeout | The device was quiet for longer than the plan's Idle Timeout. Phones go quiet when the screen is off. | Raise Idle Timeout on the plan under Account › Profiles, if that suits your site. |
| Session timeout | The session reached the plan's session time, or the controller's closing time. | Expected for timed plans. Check the plan and the controller's Availability hours. See Switching Wi-Fi off and opening hours. |
| Admin reset / admin disconnect | Someone disconnected the session from Kiwire, or the account was reset or suspended. | Check Admin › System › Audit Trail if you need to know who. |
| Lost carrier / lost service / user request | The device walked out of range, switched networks, or disconnected itself. | Usually nothing to fix. If it happens to many guests in one place, look at coverage there. |
- Kicked off when another device logs in. If Auto disconnect user connected session when same user relogin is on (Portals › Captive Portal › Configuration, Main card), a new login on the same account disconnects an existing one once the account is at its simultaneous-login limit. Raise Simultaneous Use on the plan, or ask the guest to use one device.
- Asked to log in every time. Coming back without logging in relies on auto-login (the Autologin card on Portals › Captive Portal › Configuration): a remembered browser, the device's MAC address, or a browser fingerprint. Phones use a different, private MAC address on each network and can change it, which defeats MAC auto-login. Ask the guest to switch off the private or random address for your network, or rely on cookie or fingerprint auto-login. See MAC and auto-login. The Auto Login tab under Insight › Reporting › Login, and the Access tab on the account, show which devices are registered for auto-login.
Slow speed
- Find the guest in Active Session and click the row: the panel shows the session's plan, upload, download and average speed.
- Check the plan's Max Upload Speed and Max Download Speed under Account › Profiles. That is the most a guest on that plan can get. See Profiles, bandwidth and quotas.
- To give this one guest a faster plan straight away, click Change Profile on the session panel, pick the plan, and click Apply. The account moves to that plan and the controller is told to apply it to the live session. This doesn't work on UniFi controllers using the external portal through the cloud console; disconnect the guest instead so they log in again on the new plan.
- Changes to a plan reach guests already online only when they reconnect, or when Kiwire changes their session. Use Disconnect (below) to make one guest pick up a new plan.
- If everyone is slow, it isn't the plan: the internet link, the access points, or a few heavy users. Insight › Reporting › Bandwidth, Current Top Usage, shows who is using the most right now, and an account moving far more data than usual raises an alert.
Disconnect a session: in Active Session, click the guest's row, then Disconnect and Yes, disconnect. Kiwire tells the controller to end the session; the row disappears once the controller confirms it. If the controller doesn't answer, the session stays listed — the controller isn't reachable from Kiwire on its COA Port, or the shared secret doesn't match. See Before you leave site.
A voucher says used or expired
- Search Account › Vouchers by Voucher Code, select it and click View, or run Diagnostic Account with the code.
- Read the account summary: status, Expiry Date, data and time used, and whether it is online right now.
| What you find | What to do |
|---|---|
| The time or data is used up | Reset gives the voucher its full allowance again, as if new, and disconnects any live session. Only do this if the guest is entitled to more; otherwise issue a new voucher or a top-up code. |
| The Expiry Date has passed | Edit the voucher and move the date. Reset does not change it. To move a whole batch, open the batch and use Extend expiry by. |
| Status is Suspended | Someone suspended it. Reset restores it to active. |
| "Your device is not authorized" | MAC Auto Register is on and the voucher already has its full number of devices registered. Reset MAC empties the list, so the guest's device registers on its next sign-in. |
| "Maximum number of simultaneous connections" | The voucher is already online on another device. Disconnect that session in Active Session, or let the guest use the device that's already on. |
| "Invalid voucher code" | The code isn't in Kiwire. Check the guest's typing, and that the code belongs to this site. |
Plans can renew themselves on a schedule (hourly, daily, monthly…). The account's Profile tab shows Auto Reset and Next reset, which tells the guest when their allowance comes back.
Social login fails
- Can the guest reach the provider at all? If the Google, Facebook or Microsoft sign-in page never loads, the controller's walled garden is blocking it. See Social sign-in and the walled garden.
- What does the portal say when it returns?
| Message | Cause | What to do |
|---|---|---|
| "Sign-in was cancelled or could not be completed." | The guest cancelled, or the provider refused. | Ask the guest to try again and accept the permissions asked for. |
| "Your session has expired. Please reconnect to WiFi and try again." | The sign-in finished in a different window or browser from the one that started it — common when the phone's login sheet hands off to the provider's app. | Ask the guest to open the login page in their normal browser and sign in there. |
| "The '…' login option has been disabled." / "This login option is no longer available." | The provider isn't enabled on the login method, or the method was switched off. | Check the social method under Portals › Captive Portal › Login Methods and its connector under Grow › Connectors. See Social sign-in. |
| "Could not create your account. Invalid or missing profile." | The method has no access profile. | Give the method an active profile. |
| Any other account message | The sign-in worked, but a normal login check failed. | Treat it as login fails. |
- To test without a phone, use Portal Simulation, but not the phone preview: Google, Facebook, Microsoft and other provider sign-in pages refuse to load inside it. On a Windows computer, click Open in Popup Window and pick Mobile, Tablet or Laptop for the window size. On a Mac or any other computer that button is greyed out (it works on Windows only), so click Launch Simulation instead, then the open-in-new-tab icon at the right of the preview's address bar, and sign in from that tab.
One device works, another doesn't
The guest's phone is online but their laptop isn't, or a TV can't get on at all.
- Simultaneous logins. The plan's Simultaneous Use limits how many devices one account can have online. The account's Sessions tab shows what is online now. Raise the limit on the plan, or disconnect a device the guest no longer uses.
- Allowed MAC. With MAC Auto Register on, each account registers the devices it signs in from, up to the maximum set on Portals › Captive Portal › Configuration (at most 10). Once the list is full, any other device is refused. Remove an old device from the user's Allowed MAC, or clear it; for vouchers use Reset MAC.
- Blocked device. A Device Blocked page means a Firewall Policy rule matches that device.
- Devices that can't show a login page — TVs, streaming sticks, consoles. Add them to Approved devices. See Letting TVs and devices skip the portal.
- The device skips straight past the login page and still has no internet — it may be auto-logging in with an old registration. Revoke it from the Auto Login or Browser Fingerprint tab under Insight › Reporting › Login.
- Compare the two. Run Diagnostic Account and look up both devices' MACs in the Portal Session Debugger: the working one shows how far a good login gets, the other where it stops.
Nobody can get online
Several guests, a whole floor, or the whole site.
- Check Alerts. Insight › Monitoring › Alerts, then Check now to run every check straight away. A controller that has stopped carrying sessions, guests being turned away before the portal, a licence problem, or a messaging provider failing are all raised here. See Alerts.
- Is the controller switched on? Under Admin › System › Device Controller, the controller's panel shows On · 24 hours, On with its hours, or Off. Outside opening hours, or with Wi-Fi on switched off, nobody can log in through it. See Switching Wi-Fi off and opening hours.
- Is anyone online? Active Session filtered by Zone shows whether the problem is one zone or all of them. If the list is empty where there should be guests, the controller isn't completing logins or sending accounting.
- Is the controller reaching Kiwire? Run Controller Test with a test device. Nothing captured means the controller's redirect or its internet link is down — that's on site, on the controller or the internet line.
- Is the portal itself working? Run Portal Simulation from your desk. If it works there, Kiwire is fine and the problem is between the guests and Kiwire. If it fails, note the code and see the table under The login page doesn't appear.
- The licence. An expired licence, or one over its device or monthly login limit, stops every guest login while the admin still works. See Licence and add-ons.
- Recent changes. A zone switched off or left without a journey, a deleted page, a plan made inactive, a changed shared secret — Admin › System › Audit Trail shows who changed what and when.
Asking KAIA
If KAIA is switched on for your site, you can describe the problem in the Ask KAIA box — "Room 1203 can't log in", "guests on the 3rd floor say there's no internet". KAIA can read the portal and RADIUS log lines for one device or one controller over the last day and explain in plain words where the login stopped. It can also do some of the fixes on this page when you click Apply: disconnect a guest's device, reset a guest's or voucher's password, move a voucher's expiry date, create voucher codes, switch a controller's Wi-Fi on or off, and change a plan's limits. Give it the exact username, voucher code or MAC address — it sees them masked and will ask. See KAIA.
The Kiwire Diagnostic app
When the problem is on the guest's or a staff member's own device — it won't get an address, the login page never appears, or a WPA-Enterprise certificate sign-in keeps failing — the free Kiwire Diagnostic app can work out why from the device itself. It checks the device's IP address and DNS, whether the captive-portal redirect reaches Kiwire, the security certificates involved, and certificate (WPA-Enterprise) sign-in, and keeps a report even while the device has no internet. The report is sent to Synchroweb support as soon as the device is back online, so mention it when you contact support.
It is on Google Play now; the App Store version is coming soon. The links are on the Mobile Apps page, opened from the button at the top of the admin sign-in page, and in the Get the Kiwire apps row under the sign-in form. Its companion, Kiwire WiFi, sets a device up for your WPA-Enterprise network — see WiFi Enterprise.
Before you call support, collect this
Support can solve most problems in one reply when they have these. Copy the list and fill it in:
- [ ] Who: the guest's username, voucher code, phone number or room — whatever they log in with.
- [ ] Which device: type and model (iPhone 15, Windows laptop, Samsung TV), and its MAC address from the device's Wi-Fi details for your network.
- [ ] When: the date and time of the attempt, as exactly as you can.
- [ ] Where: building, floor or area, and the network name (SSID) they joined.
- [ ] What they saw: the exact message or page title, ideally a photo or screenshot.
- [ ] How many are affected: one guest, several, one area, or everyone — and since when.
- [ ] Diagnostic Account result: a screenshot of the checklist for the guest's account.
- [ ] Portal Session Debugger: a screenshot of the User Flow and the session ID it shows.
- [ ] Active Session: whether the guest appears there.
- [ ] Controller Test: a screenshot if the login page doesn't appear, or "nothing captured".
- [ ] Alerts: any open alerts on Insight › Monitoring › Alerts.
- [ ] Kiwire Diagnostic: if the guest or a colleague ran the app on the affected device, say so and when.
- [ ] What you've already tried: reset, disconnect, plan change, the guest rejoining — and what happened.
- [ ] Recent changes: anything changed on the controller, zones, plans or login methods recently.
Who can use these tools
Each tool has its own permission, listed in the tools table. Actions need more than viewing:
| Action | Permission |
|---|---|
| Reset a user, change a user's password or details | edit-users |
| Reset or Reset MAC on a voucher | reset-vouchers |
| Edit a voucher's expiry date | edit-vouchers |
| Disconnect or Change Profile in Active Session | manage-report-login-active-session |
| Acknowledge or snooze an alert, Check now | Monitoring › Alerts → Manage |
If a colleague can't see a tool, their role doesn't include it — see Roles and Permissions by licence module.