Guest access and VPN

The Network tab's Access group has three sections:

All three need ReadyView plugin 1.11 or later. See How changes work.

#Guest login pages

A guest login page shows guests on a VLAN a page before they get online. They either accept your terms and press Connect (Click-through), or type a voucher code you hand out (Vouchers). The firewall serves the page itself, and most phones and laptops open it on their own when they join the Wi-Fi.

Each VLAN shows its status (Off, Click-through, or Vouchers) and how many guests are online.

#Set up a login page

1. Open Network > Guest login pages and click Set up on the VLAN.
2. Tick Show the login page on this VLAN.
3. Under How guests get online, choose Click-through or Vouchers.
4. Fill in the page:
   • Title and Welcome message;
   • Terms of use, which guests tick "I accept the terms of use" for;
   • Brand color and Logo (PNG, JPEG, WebP, or GIF, not SVG);
   • After login, send guests to, an optional web address;
   • Log guests out after and Log out idle guests after.
5. Check the live preview, then click Turn on login page.

Saving restarts the firewall's login service, which can take a minute or two.

A VLAN can't have a login page when:

• it gets its address by DHCP, or has no fixed IPv4 address;
• it's turned off on the firewall, or it's an internet connection (WAN);
• it already has a login page set up in the firewall's own web interface. ReadyView leaves that one alone.

A firewall holds at most 20 login pages.

#Vouchers

In Vouchers mode, guests type a code to get online. To make codes:

1. Open the VLAN's Vouchers tab and click Create vouchers.
2. Set How many (1 to 500 at a time, up to 5,000 per VLAN), how long Each code lasts (counted from the guest's first login), when Unused codes stop working after, and an optional Batch name.
3. Click Create.
4. Print, copy, or download the codes before you close the sheet.

The batches table shows how many codes in each batch are unused, in use, and used up. Revoke ends a whole batch. Revoke codes ends codes you paste in, one per line.

#Guests online

The Guests online tab lists each guest's address, MAC, voucher code, when they logged in, and how much data they've used. Disconnect logs a guest out. They see the login page again the next time they open a website.

To stop using the page, click Remove login page. Guests on that VLAN then get online without logging in.

#Client VPN

The client VPN lets laptops and phones connect to this site from anywhere with the free WireGuard app. Each device gets its own configuration file, made in your browser. Its private key never leaves the page.

#Turn on the client VPN

1. Open Network > Client VPN and tick Turn on the client VPN.
2. Leave Port at 51821 unless something else uses it. The firewall opens this UDP port on its WAN.
3. Leave Tunnel network at 10.254.0.0/24 unless it overlaps one of your networks. Devices get their VPN address from it.
4. Under What devices can reach, choose:
   • Only the networks chosen (split tunnel): only traffic for the networks you tick goes through the VPN. This is the default.
   • Everything (full tunnel): all of the device's traffic goes through the firewall, including internet traffic.
5. Tick the Networks devices can reach (up to 32), and add any Other networks.
6. Keep Use the firewall for DNS ticked, so the DNS filter applies to VPN devices too.
7. Under Address devices connect to, choose The firewall's internet address, or A host name (dynamic DNS) if the address changes.
8. Click Set up client VPN.

#Add a device

1. Click Add device and enter a Device name, for example "Alex laptop".
2. Click Add device. Your browser makes the device's keys.
3. On a phone, open the WireGuard app, add a tunnel, and scan the QR code. On a computer, click Download file and import it into WireGuard.

The devices table shows each device's VPN address, when it was last seen, and its data. A device shows Connected now when it has talked to the firewall in the last three minutes. The client VPN takes up to 250 devices.

When you change the VPN's settings later, devices you already added keep the old settings in their file. Remove them and add them again to give them the new ones.

#Client VPN warnings

#Site VPN

The site VPN joins your sites' networks with encrypted WireGuard tunnels. ReadyView sets up both ends of every tunnel, so you don't type keys or addresses on each firewall. Each firewall makes its own keys, and only its public key leaves it.

There are two parts:

• Site VPN for the organization sets how the sites connect. It's the same for every site.
• Each firewall's Site VPN section says which of its networks to share.

#Plan the site VPN

Under Site VPN for the organization (open it with Show the site VPN), choose How sites connect:

• Full mesh: every site has a tunnel to every other site. Best when sites talk to each other directly.
• Hub and spoke: every site connects to one Hub site, and traffic between other sites passes through it. Best with one main office.

At least one site needs a public internet address. A site behind another router or carrier-grade NAT can still join: it connects out to a site with a public address, but it can't be the hub.

The Tunnel network (10.255.0.0/24 by default) and the WireGuard port (UDP 51821) are shared by every site. Up to 50 sites can join.

#Add a site

1. Open the firewall's Network > Site VPN section and tick Connect this site to the site VPN.
2. Tick the Networks to share with the other sites, up to 32. Every network shared must be unique across your sites, so two sites can't both share 192.168.1.0/24.
3. If the site is behind a router that forwards the WireGuard port to the firewall, enter that router's address under Address other sites use to reach this one.
4. Click Save. Saving updates every site in the site VPN, which can take a few minutes.

Tunnels to the other sites then shows each tunnel as Up, Idle, or Down, with its last contact and traffic.

Unticking Connect this site to the site VPN pauses the site: its tunnels go down, but it keeps its place and keys. Remove from the site VPN deletes its tunnels and keys, and the other sites stop reaching it.

#What each firewall did

After Save and apply, the organization card lists what each firewall did. You can leave the page while it runs. Every firewall's result also goes to the organization's Logs.

Check tunnels reads every tunnel's state again. Use Apply again after a firewall's public address changes.

Only IPv4 networks are shared. ReadyView adds the rules the tunnels need, described "ReadyView site VPN: …": WireGuard in on the WAN, the other sites into this site's shared networks, and, on a hub, between the other sites. Traffic from this site's networks toward the other sites follows those networks' own rules.