Walled garden not working as expected

Question

Hi folks, 
 I want to use my Hotspot based on vouchers where I can force a number of clients to automatically skip entering a voucher key. 
 Running v18.0.4 I see an option in 'Hotspot settins' named 'Walled Garden' where help section tells me: 
 To specify networks that can be accessed by users who do not pass authentication, click&#160;Add new item, select networks or hosts, and click&#160;Apply. 
 I tried with fixed MAC-Adress and fixed IP-Adress (while reserved this on the DHCP for a specific client), but after connecting to the hotspot the voucher still needs to be entered before accessing desired network ressources. 
 Any suggestions?

njabi · Answer

After a deeper research on this case I figured out a misunderstanding of walled garden function. 
 in 'walled garden' you are able to specify hosts or networks that can be accessed from hosts connecting to the hotspot without entering a voucher/password or accept agreement. My understanding was: You can add specific hosts by giving e.g. MAC-addresses which are still able to reach any desired network ressource (WAN) without entering the voucher/... 
 In addition to this I found out: If you have devices connected to a hotspot wifi they will be able to connect to each other, no matter if they even entering the captive portal site or not - this feels logical to me because they are connected to the same subnet. If you have the client-isolation on the wifi'ssettings enabled this won't work!

emmosophos · Answer

Hello Njabi, 
 Thank you for contacting the Sophos Community! 
 Can you try creating a firewall additional to the one the Hotspot creates automatically with source Zone as Wifi and Destination Zone (the zone where the Networks you are entering in the Walled Garden are located) and Destination Network = The Networks/IPs/URLs that should have access according to the Walled Garden 
 Regards,

Walled garden not working as expected

Top Replies