Appearance
Network Troubleshooting
Advanced network diagnostics for when basic troubleshooting doesn't resolve the issue.
Required Network Access
The CaptiFi device needs outbound access to:
| Service | Port | Protocol | Domain |
|---|---|---|---|
| HTTPS | 443 | TCP | app.captifi.io |
| WireGuard tunnel | 51820 | UDP | app.captifi.io |
| DNS | 53 | UDP/TCP | Any DNS server |
| NTP | 123 | UDP | pool.ntp.org |
Firewall Check
If your venue has a managed firewall, ensure these ports are open for outbound traffic. This is the most common cause of a device stuck Offline in corporate or hotel environments.
Checking Connectivity
From your router
- Can you access the internet from other devices?
- Is DHCP enabled?
- Is the Ethernet port the CaptiFi device is connected to active?
Physical checks
- Are all Ethernet cables firmly connected?
- Does the device have power (LED lit)? Check the PoE injector connections (or the PoE switch port if you use one)
- Try swapping the Ethernet cable
- Try a different port on your router/switch
Common Network Issues
Double NAT
Double NAT means there are two routers between your equipment and the internet, for example an ISP modem/router combo in front of your own router. What to do depends on your hardware.
CaptiFi device (plug-and-play box): the device dials out to CaptiFi over WireGuard (UDP 51820), so double NAT is normally fine. If it stays Offline, make sure no firewall between the device and the internet blocks outbound UDP 51820 or TCP 443.
UniFi controller (UCG Ultra, UDM, Cloud Key): CaptiFi normally reaches your controller from the internet, which double NAT blocks. Tell-tale signs: the UniFi app shows an "Upstream NAT detected on WAN1" banner, your gateway's WAN address is a private IP (starts with 10., 192.168., or 172.16. through 172.31.), or port forwarding is impossible (CGNAT, or an upstream router you do not control).
Fix: CaptiFi fully supports this setup via the UniFi Remote Tunnel, a secure outbound connection from your console to CaptiFi that needs zero changes to your router or ISP equipment: no port forwarding, no bridge mode. The tunnel runs on UniFi OS gateway consoles (UDM, UCG, Dream Router, Express); Cloud Keys cannot run it, so Cloud Key sites need port forwarding instead. See Controller Behind Another Router (Double NAT / No Public IP) in the UniFi guide, or contact support and we will set it up with you.
VLAN Isolation
Some managed networks use VLANs that prevent the CaptiFi device from reaching the internet.
Fix: Ensure the port the CaptiFi device is on has internet access (not isolated to a guest VLAN without uplink).
MAC Filtering
Some networks only allow approved MAC addresses.
Fix: Add the CaptiFi device's MAC address to your allow list. The MAC address is printed on the device label.
Captive Portal Conflicts
If your network already has a captive portal (e.g., hotel network), it may interfere with CaptiFi.
Fix: Connect the CaptiFi device to a port that bypasses any existing captive portal.
iOS "Cannot Verify Server Identity" Warning
If a guest's iPhone or iPad shows a "Cannot Verify Server Identity" warning on your guest WiFi, the device is still behind the captive portal wall: it has not completed the splash page yet.
Fix: Open the WiFi sign-in page and complete it. If the sign-in page does not appear, forget the network and reconnect; the splash page will pop up when the device rejoins.
Guests See Another Venue's Page or Wrong Branding
If guests connecting to your WiFi land on a splash page for a different venue, or the branding shown is not yours, the portal is misrouted.
Fix: Contact CaptiFi support immediately with your venue name and a photo or screenshot of what guests see. This needs to be corrected on our side.
Still Stuck?
Contact support with:
- Device status in your dashboard (Online / Connecting / Offline) and whether the LED is lit
- Router brand/model
- Whether the venue has managed IT/firewall
- Any error messages in the CaptiFi dashboard
Email: hello@captifi.io