Docs

Appearance

TP-Link Omada BE9300 WiFi 7 + Starlink ​

This guide covers connecting CaptiFi to the TP-Link Omada BE9300 Ceiling Mount Tri-Band Wi-Fi 7 Access Point range, specifically the EAP772 and EAP773, including venues running on a Starlink internet connection.

Short answer: yes, this works with CaptiFi

The EAP772 and EAP773 are standard Omada SDN access points. They support Omada's External Portal Server feature, which is exactly how CaptiFi integrates. The one thing to plan around is your Omada controller choice, because Starlink's CGNAT blocks inbound connections to an on-site controller. The Omada Cloud-Based Controller solves this cleanly.

The Hardware ​

Two Omada models carry the "BE9300 Ceiling Mount Tri-Band Wi-Fi 7" name:

ModelUplink PortPowerNotes
EAP7721× 2.5 Gbps Ethernet802.3at PoE+ (25.4 W) or 12V DCThe common BE9300 model
EAP7731× 10 Gbps Ethernet802.3bt PoE++ recommendedOn PoE+ the 6 GHz radio runs at reduced power; on 802.3af the radios switch off

Both are tri-band WiFi 7 (2.4 GHz + 5 GHz + 6 GHz), support up to 24 SSIDs and 380+ concurrent clients, and are fully compatible with Omada's captive portal and hotspot features. From CaptiFi's point of view they behave exactly like any other Omada EAP.

Check your PoE budget

The EAP772 needs a PoE+ (802.3at) switch port. If you only have an 802.3af switch, the AP will not power up correctly. The EAP773 wants PoE++ (802.3bt) for full performance.

Requirements ​

  • EAP772 or EAP773 access point(s), adopted and online in an Omada Controller
  • Omada Controller v5.15 or later (WiFi 7 EAPs are not supported by older controller versions; check the datasheet for your hardware revision)
  • Admin access to the Omada Controller
  • CaptiFi account at my.captifi.io

Standalone mode is not enough

An EAP772/EAP773 running standalone (managed only through the web page or Omada app, without a controller) cannot run an external captive portal. You must manage the APs with an Omada Controller: hardware (OC200/OC300), software, or the Omada Cloud-Based Controller.

CaptiFi authorises guests by calling your Omada Controller's hotspot API. That means CaptiFi's servers need to reach your controller from the internet.

Starlink Residential and Roam plans use CGNAT: your dish has no public IPv4 address, and the Starlink router has no port forwarding at all. An OC200 or software controller sitting inside the venue is therefore unreachable from outside, and the standard "port forward 8043" advice does not apply.

You have three working options, in order of recommendation:

TP-Link's Cloud-Based Controller (CBC) hosts the controller in TP-Link's cloud. Your APs connect outbound to it, which works perfectly behind CGNAT, and CaptiFi connects to the CBC's public URL. No port forwarding, no on-site controller hardware, no VPS to maintain.

  • Licensing is per device (a licence per AP), purchased through TP-Link
  • The APs only need outbound internet, which Starlink provides
  • This is the cleanest setup for Starlink venues

Option 2: Cloud-hosted Omada Software Controller ​

Run the free Omada Software Controller on a small VPS (any cloud provider) with a public IP and a domain name. Adopt the APs to it over the internet, and give CaptiFi the VPS URL.

  • No per-device licence fees, but you maintain the server yourself
  • The controller must be reachable on its HTTPS port (default 8043)
  • Secure it properly: HTTPS certificate, strong admin password, and firewall rules

Starlink's Priority (business) plans offer a public IPv4 address. With a third-party router doing the port forwarding, an on-site OC200/OC300 or software controller becomes reachable. This costs more per month and the IP is not guaranteed static, so we only suggest it if you need the Priority plan anyway.

Starlink router tip

If you use your own router (required for options that need port forwarding, and generally recommended for guest VLANs), put the Starlink router into Bypass mode in the Starlink app so your router handles the network.

Setup Overview ​

Once the controller question is settled, the CaptiFi integration is the standard Omada flow:

  1. Guest SSID — create a dedicated open guest network on the EAP772/EAP773
  2. External Portal — point Omada's portal at CaptiFi
  3. Walled Garden — allow pre-authentication access to CaptiFi's domains
  4. Controller Connection — link the controller to CaptiFi with an operator account

Step 1: Create a Guest SSID ​

  1. Open your Omada Controller
  2. Go to Settings → Wireless Networks and click Create New Wireless Network
  3. Configure:
    • SSID Name: your guest WiFi name (e.g. "Free WiFi")
    • Security: None (open), recommended for guest WiFi
    • Band: the EAP772/EAP773 is tri-band; enable 2.4 GHz and 5 GHz for guests. You can include 6 GHz, but note that 6 GHz does not allow open networks, so leave it off the guest SSID unless you configure Enhanced Open (OWE)
  4. Click Save

6 GHz and guest WiFi

The 6 GHz band requires WPA3 or Enhanced Open; a plain open SSID will not broadcast on it. For a guest captive portal SSID, 2.4 GHz + 5 GHz covers every guest device. Keep 6 GHz for your private staff or office SSID where WiFi 7 speeds matter most.

For network isolation, assign the guest SSID to its own VLAN under Settings → Wired Networks → LAN.

Step 2: Configure the External Portal ​

  1. Go to Settings → Authentication → Portal
  2. Click Create New Portal and configure:
SettingValue
Portal NameCaptiFi Portal
SSIDyour guest SSID
Authentication TypeExternal Portal Server
Portal URLhttps://app.captifi.io/guest/omada?site_id=YOUR_SITE_ID

Your site ID

Replace YOUR_SITE_ID with your CaptiFi site ID from your dashboard, or ask support@captifi.io. This URL accepts the redirect parameters from all Omada controller versions, including the Cloud-Based Controller, automatically.

  1. Set Portal Customisation to External Portal Server (not local web portal)
  2. Set the Authentication Timeout to your preferred session duration
  3. Set Redirect to "The Original URL" or a custom URL (e.g. your website)

Step 3: Walled Garden / Pre-Auth Domains ​

Guests must be able to reach CaptiFi before they log in. In the portal configuration, enable the Pre-Auth Policy / Walled Garden and add:

Domain / IP
app.captifi.io
*.captifi.io
46.62.168.7
fonts.googleapis.com
fonts.gstatic.com

TIP

Some Omada firmware versions only accept IP-based walled garden entries. If domains are rejected, add the IP address 46.62.168.7.

Step 4: Connect the Controller to CaptiFi ​

Create an operator account ​

CaptiFi authorises guests through Omada's hotspot operator API, so it needs a dedicated operator account (not your main admin login):

  1. In the Omada Controller, find the operators section (Settings → Cloud Access / Operators, or Hotspot Manager → Operators on some versions)
  2. Create an operator (e.g. username captifi) with a strong password

Connect in CaptiFi ​

  1. Log in to my.captifi.io
  2. Go to My Locations → Add location (or choose your hardware during onboarding) and select TP-Link Omada
  3. Enter:
    • Controller URL — depends on your controller choice:
      • Cloud-Based Controller: the CBC URL from your Omada cloud account
      • Cloud-hosted software controller: your VPS URL including the port (e.g. https://omada.yourcompany.com:8043)
      • On-site OC200/OC300 (Starlink Priority with public IP only): https://YOUR_PUBLIC_IP (port 443)
    • Controller ID — the long ID segment in your Omada controller's browser URL
    • Operator username and Operator password
  4. Click Connect — CaptiFi tests the login and confirms the link

Step 5: Test ​

  1. Connect a phone to the guest SSID
  2. The CaptiFi splash page should appear automatically (on mobile, opening http://example.com in a browser triggers it if it doesn't pop up)
  3. Complete the login form and confirm internet access
  4. Check your CaptiFi dashboard: the guest should appear in your logs
IssueCauseSolution
CaptiFi can't connect to the controllerOn-site controller behind Starlink CGNATUse the Omada Cloud-Based Controller or a cloud-hosted software controller; CGNAT blocks all inbound connections on Residential/Roam plans
Controller URL test works at the venue but not for CaptiFiTesting from inside the network bypasses CGNATAlways test the controller URL from a device on mobile data, outside the venue network
Splash page loads but login hangsController unreachable for the authorise callSame fix as above; the splash page loads from CaptiFi's servers, but the final "let the guest online" call goes to your controller
Guest WiFi slow at peak timesStarlink bandwidth contentionSet per-SSID rate limits on the guest network in Omada so guests can't saturate the Starlink link
Splash page slow to appearStarlink latency spikes (weather, obstruction)Check the obstruction map in the Starlink app; the portal tolerates normal Starlink latency fine

General Troubleshooting ​

IssueSolution
AP won't adopt to the controllerConfirm the controller is v5.15 or later; older versions do not recognise WiFi 7 EAPs
AP powers up but radios are off (EAP773)Insufficient PoE; the EAP773 needs 802.3bt for full operation
Splash page not appearingVerify the portal is enabled, the correct SSID is selected, and Authentication Type is External Portal Server
"Portal unreachable" errorCheck the Walled Garden includes app.captifi.io and 46.62.168.7
Guest SSID missing on 6 GHzExpected: open SSIDs can't broadcast on 6 GHz; use 2.4/5 GHz for guests
"Invalid credentials" in CaptiFiRe-check the operator username/password and the Controller ID copied from the Omada URL

For everything else, see the main TP-Link Omada guide and Common Issues.

Next Steps ​

Need Help? ​

Starlink plus Omada setups have a couple of extra moving parts, and we're happy to walk you through it:

CaptiFi — Guest WiFi Marketing Platform

© 2026 CaptiFi. All rights reserved.